874637 - security review of servo networks

Status: RESOLVED FIXED

(mozilla.org :: Security Assurance: Review Request, task)

Description

[[e-mail] (:bhearsum)]

These networks are up and I _think_ that all the ACLs are in place, but they're not locked down like they need to be yet AFAIK:
➜  output  ssh mpt-vpn.mozilla.com
Last login: Mon May  6 12:36:38 2013 from 24.52.200.235
[bhearsum@cm-vpn01 ~]$ telnet buildbot-master-servo-01.srv.servo.releng.use1.mozilla.com 22
Trying 10.134.82.21...
Connected to buildbot-master-servo-01.srv.servo.releng.use1.mozilla.com.
Escape character is '^]'.
SSH-1.99-OpenSSH_5.3
Connection closed by foreign host.

This might block bug 874089.

Comment 1

[Michal Purzynski [:michal`] (use NEEDINFO)]

The cm-vpn01 by definition has access to everything and will be decommissioned once everyone switches to the new VPN. I'm going to take a look at the servo networks ACLs anyway.

Comment 2

[[e-mail] (:bhearsum)]

I think everyone accessing Servo machines switched to the Mozilla VPN, fwiw.

Comment 3

[Michal Purzynski [:michal`] (use NEEDINFO)]

Attachment: RelEng_to_VPC_flows.pdf

Comment 4

[Michal Purzynski [:michal`] (use NEEDINFO)]

I don't see anything suspicious that would be totally different from the usual RelEng standards. Flows audit report in PDF attached. Feel free to reopen if you think otherwise, for now closing.