1173786 - Modify security groups for windows

Status: RESOLVED FIXED

(Release Engineering :: General, defect)

Description

[Amy Rich [:arr] [:arich]]

We have security group sg-18a07677 for windows hosts in use1 and sg-84beade6 usw2 (nothing in usw1) that looks like were added by hand. These need to be added to securitygroups.yaml and modified so that they have the necessary ports (like RDP) specific to windows machines.

I'm going to need some assistance form the windows folks in determining exactly what those permissions need to be.

Comment 1

[Amy Rich [:arr] [:arich]]

rail: there seems to be some additions made to securitygroups.yaml made by you to do some sort of application to instances and interfaces with specific tags. I.e. for try:

try:
    description: security group for try build slaves
    regions:
        us-west-1: vpc-7a7dd613
        us-west-2: vpc-cd63f2a4
        us-east-1: vpc-b42100df
    apply-to:
        instances:
            tags:
                - [moz-type, try-linux64]
                - [Name, try-linux64-ec2-*]
        interfaces:
            tags:
                - [moz-type, try-linux64]
    inbound:
        include: slave-vlan-inbound
    outbound:
        include: slave-vlan-outbound

What's the recommended method of extending this to include additional tags and names for try-2008?

Comment 2

[Rail Aliiev [:rail]]

Probably being explicit would be better here. I'd create a new rule for windows machines and add rdp/vnc rules.

Comment 3

[Amy Rich [:arr] [:arich]]

rail: The default and windows security groups will be applied as part of the configs/try-2008 and configs/b-2008 files. This seems to be something specific to buildslaves/tryslaves and should probably be the same as what we have for linux. I doubt we want to replicate the logic to yet another place to keep track of.

Comment 4

[Mark Cornmesser [:markco]]

I am adding this to the agenda for the Windows chat tomorrow.

Comment 5

[Amy Rich [:arr] [:arich]]

5900 for VNC
3309 for RDP

445 for SMB (we shouldn't open that unless we need to)

Comment 6

[Q]

After review RDP should be TCP/UDP port 3389

Comment 7

[Amy Rich [:arr] [:arich]]

I think we don't actually need this group for the build/try/test slaves since they include the admin-access group (which allows all from admin hosts like the vpn). See https://github.com/mozilla/build-cloud-tools/pull/86

Could someone instantiate an instance and test this out?

rthijssen: If this works, this means we won't need the secondary windows group in the b-2008 and try-2008 config files.

Comment 8

[Mark Cornmesser [:markco]]

Confirmed, I was able to RDP using the build or try security groups.

Comment 9

[Amy Rich [:arr] [:arich]]

rob: this means that sg-18a07677 and sg-84beade6 can be removed from the b-2008 and try-2008 config files.

Comment 10

[Rob Thijssen [:grenade (EET/UTC+0300)]]

Attachment: security groups sg-18a07677 and sg-84beade6 removed

https://github.com/mozilla/build-cloud-tools/pull/87