1077284 - need AWS secgroups altered for nagios-{usw1,use1,use2}

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[:Atoll]

Attachment: Screen Shot 2014-10-02 at 11.02.30 PM.png

Hi, we need an alteration to the AWS EC2 security groups for nagios-usw1, nagios-use1, nagios-use2. We don't seem to have access to these that we're aware of, so I'm filing this to try and get help from releng.

The specific change to be made is to add 3 new outbound rules to whatever security group(s) are associated with:

nagios1.private.usw1.mozilla.com
nagios1.private.use1.mozilla.com
nagios1.private.use2.mozilla.com

The new rules to add are:

Custom TCP Rule, TCP, 6697, Custom IP, 54.72.42.192/32
Custom TCP Rule, TCP, 6697, Custom IP, 54.219.165.167/32
Custom TCP Rule, TCP, 6697, Custom IP, 54.85.60.193/32

That same security group should already contain this rule (among others):

Custom TCP Rule, TCP, 6697, Custom IP, 63.245.216.214/32

And these new IPs should match the AWS admin console screenshot attached, but please double-check in case I typed something wrong.

Comment 1

[:Atoll]

Also, I would like to add this host:

63.245.214.141/32

(which is the SCL3 IRC server)

Comment 2

[Rail Aliiev [:rail]]

BTW, it'd be great to add the "nagios" security group to http://hg.mozilla.org/build/cloud-tools/file/958d14baf6b3/configs/securitygroups.yml

Comment 3

[Dustin J. Mitchell [:dustin] (he/him)]

This flow is in fact restricted on fw1.releng.scl3, which is the egress for internet traffic from the releng VPCs.

[e-mail]> show security policies from-zone vpc to-zone untrust
...
  Policy: nagios--irc, State: enabled, Index: 1679, Scope Policy: 0, Sequence number: 6
    Source addresses: nagios1.private.releng.use1, nagios1.private.releng.usw1, nagios1.private.releng.usw2
    Destination addresses: concrete
    Applications: ircd-ssl
    Action: permit, log

So, it looks like the destination addresses there need to change to correspond to the new servers described in comment 0 and comment 1.

Comment 4

[Arzhel Younsi [:XioNoX]]

Added to the global-policies so everything should have access to those IPs