497422 - a few firewall changes for try-win32-slave05

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[[e-mail] (:bhearsum)]

As part of the OPSI rollout in bug 495948 we need to get the try slaves talking to the staging-opsi/production-opsi VMs. Can you please allow the following ports (both ways) between try-win32-slave05 and staging-opsi.build.mozilla.org? Before we go to the trouble of changing it for everything I want to make sure I've got everything covered.

Here they are:
ports 137-139 tcp/udp
port 445 tcp
port 901 tcp
port 4447 tcp

Comment 1

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

How quickly can this be done? I ask because this blocks us rolling out of OPSI onto the try slaves, and hence the java update to those slaves. This means try slaves are currently different to production slaves, and different test results, which is not good. 

Sorry for the last minute rush here, we should have thought of this before, but we dropped the ball.

Comment 2

[Derek Moore [:dmoore]]

Configured as requested, please test and verify. Feel free to reopen the bug if additional changes are necessary.

Comment 3

[[e-mail] (:bhearsum)]

I missed at least one port. Can you open up 69/udp between those hosts, too?

Comment 4

[Derek Moore [:dmoore]]

69/udp added

Comment 5

[[e-mail] (:bhearsum)]

dmoore and I figured out exactly what we needed over irc. Let's go ahead and do this for the rest of the try slaves:
Specifically, between try-w32-slave01 -> 04 and 06 -> 19 we need the following allowed:
ports 137-139 tcp/udp
port 445 tcp
port 901 tcp
port 4447 tcp
icmp ping

thanks a bunch!

Comment 6

[Derek Moore [:dmoore]]

Identical access granted for slave01 -> slave19

Comment 7

[John O'Duinn [:joduinn] (please use "needinfo?" flag)]

Thanks derek, mrz. We'll plan this better next time, to avoid last-minute-rush-jobs like this.

Comment 8

[[e-mail] (:bhearsum)]

(I can't believe I have to reopen this bug again, sigh.)

I forgot to mention that the other slaves need these ports opened between them and *production*-opsi.build.mozilla.org

I'm really sorry for all the churn I'm causing with this.

Comment 9

[Derek Moore [:dmoore]]

Not a problem, identical access has been granted to production-opsi.build for all slaves.