1172173 - Open up access to triage1.dmz.scl3 internally to all Mozilla employees.

Status: RESOLVED FIXED

(Infrastructure & Operations :: Corporate VPN: ACL requests, task)

Description

[Mike Hoye [:mhoye]]

Could we open this up to all Mozillians internally connected by VPN?

I will be filing for secreview of the service momentarily, to expose it to the world a bit later.

Comment 1

[Dan Parsons [:lerxst]]

:jeff, can you ack this?

Comment 2

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

Mike can you tell me a little about this system? Who owns it and what type of data is in it? 
https://mana.mozilla.org/wiki/display/SECURITY/Mozilla+Data+Handling+for+Services+Standard

Comment 3

[Mike Hoye [:mhoye]]

Sure! Take a look at http://triage1.dmz.scl3.mozilla.com/  to get a sense of it.

It hosts a web service that lets contributors sign up to receive X number of bugs per Y time period, and emails them a brief description of up-to-X bugs along with a request to triage them. 

I own it.

The software running the service is here - https://github.com/mhoye/Canutist/ - and is currently being reviewed by Yvan Boily. It doesn't use a DB, so the only network services running on that machine should be ssh and my app on 80 via lighttpd.

Comment 4

[Mike Hoye [:mhoye]]

(Having said that, if you've got a data-handling guidelines doc that's just a tiny bit less completely incomprehensible than that one, I'd be very happy to read it and follow its advice.)

Comment 5

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

OK, thanks for the info. I signed up ;-]

Can you tell me what level of bugs are emailed out? (that would set the data classification level). I'm assuming it does not have access to email out security sensitive, confidential, etc.

Comment 6

[Mike Hoye [:mhoye]]

It doesn't currently make any distinction wrt bug security level in the code, but the service account it uses to access the API is that of a registered but otherwise unprivileged user.

Using that account, it asks for UNCONFIRMED bugs from Firefox, Core and Toolkit products, and any bugs in the Firefox::Untriaged, Core::Untriaged and Toolkit::Untriaged components.

Comment 7

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

OK. Dan: does this sound ok to open to any mozilla folk with VPN access?

Comment 8

[Daniel Veditz [:dveditz] out until Nov 10]

Sounds like it's only handing out bugs that a random user (without even a log in) could find with a query, in which case even the VPN requirement seems unnecessary. At least in terms of the bug data. Maybe there's worries about the software running the system getting hacked or overwhelmed?

The page talks about the need to have the CanConfirm privs. That's of course necessary to do the triage, but does the service have the bugzilla access to be able to confirm that? If so I'd want to look deeper into the security of the app, but if having that privilege is just on the honor system then it looks good.

Comment 9

[Daniel Veditz [:dveditz] out until Nov 10]

Just signed up and there's no confirmation mail or rate limiting on the signups so it'd be pretty easy to create a massive spam problem (and transfer the blame to Mozilla). And no unsubscribe so that transfers the spam problem to mhoye since he's advertised as the manual process in the mail :-)

Yes, let's restrict this to the VPN so at least internet jerks can't do it anonymously.

Comment 10

[Mike Hoye [:mhoye]]

Thanks. 

It won't send anyone more than one email/day, but I'm going to implement those features before I want to roll it out to the the larger internet.

Comment 11

[Mike Hoye [:mhoye]]

Any chance I can get an ETA on this?

Comment 12

[Jeff Bryner [:jeff] (use NEEDINFO 😉)]

Dan, consider this an ack from Opsec for an all clear to open to VPN access.

Comment 13

[Dan Parsons [:lerxst]]

This is done, but people will have to disconnect/reconnect their VPN connection to access it.

Comment 14

[Mike Hoye [:mhoye]]

Thank you!