1106573 - remove ssh access from cruncher to all masters (releng.scl3)

Status: RESOLVED FIXED

(Infrastructure & Operations Graveyard :: NetOps: DC ACL Request, task)

Description

[Dustin J. Mitchell [:dustin] (he/him)]

I know we just added this in bug 1093171, but the parent bug prompted a discussion about *why* we need this access.  Cruncher is a general-use, low-security host, which has active connections to users' SSH agents and probably a few ssh private keys.  It shouldn't have access via SSH to all of the masters.

This amounts to a revert of bug 1093171, since the other changes take place in AWS.

We have this policy:

[e-mail]> show configuration security policies from-zone srv to-zone srv policy any--ssh
match {
    source-address cruncher;
    destination-address any;
    application junos-ssh;
}
then {
    permit;
}

but since srv is a single-VLAN zone, the policy is never applied.  Deleting it might be a good cleanup, but I'll leave that to you.

It's fine to defer this to a TCW, or at least after the work week.

Comment 1

[Dave Curado :dcurado]

will do this in the 12/20 TCW

Comment 2

[Dave Curado :dcurado]

setting CAB review:

Impact: should be none.  It's a significant change to the releng firewall, and releng asked us to be hands off during December, so I saved this for the 12/20 TCW.

Duration: n/a

Comment 3

[hwine]

fwiw, releng is signed off on this change. It need not be during a TCW, just announced in #releng prior to doing it. (An email to release@m.c a day ahead would be the whipped cream topping to it all.)

Comment 4

[Dave Curado :dcurado]

I will try making this change on thursday, 12/11, unless I get waved off from someone.
Will send mail to mail to release@m.c now, suggesting I do it 24 hours from now.

Comment 5

[Dave Curado :dcurado]

done!

Comment 6

[Dustin J. Mitchell [:dustin] (he/him)]

Dave, I'm not sure what you changed here, but it looks like the permit is still in place:

[e-mail]> show configuration security policies from-zone srv to-zone bb 
apply-groups global-policies;
/* Including 1027111 and 1093171 */
policy srv-bb--ssh {
    match {
        source-address [ buildbot-master-set cruncher ];
        destination-address any;
        application junos-ssh;
    }
    then {
        permit;
    }
}

Comment 7

[Dave Curado :dcurado]

The policy you're referencing (in comment 6) is a different policy than the one you referenced
in the description.  The latter has been removed.
I'll remove the former as well.
Thanks for catching that.

Comment 8

[Dave Curado :dcurado]

Dustin -- for the policy you referenced in comment 6 -- I'm assuming I should just only remove
"cruncher" as a source-address, but leave "buildbot-master-set"

sorry for the double check on this, just want to avoid any problems

Thanks

Comment 9

[Dave Curado :dcurado]

blah

Comment 10

[Dustin J. Mitchell [:dustin] (he/him)]

Yes, that's correct.  This bug is requesting a revert of bug 1093171, which *did* add the policy I'm referencing in comment 6.  The policy I pasted in the description was just a nice ride-along cleanup :)

Comment 11

[Dave Curado :dcurado]

OK, I see.  My original read of the bug was too quick/shallow.
(a nice summary of my bug reading abilities right there!)
Sorry about that.

I can make this change today if you're confident I won't break anything?
Thanks!

Comment 12

[Dustin J. Mitchell [:dustin] (he/him)]

I'm full of exuberant confidence.

Comment 13

[Dave Curado :dcurado]

OK, I delete cruncher from the policy.
Hopefully resolved now.