541551 - Secure Hudson and make it public

Status: RESOLVED FIXED

(mozilla.org Graveyard :: Server Operations, task)

Description

[Wil Clouser [:clouserw]]

I thought I filed this already but I don't see it.

We should add authentication for changing anything to hudson and then put it on the internet.

Authentication can be achieved by checking the "enable security" checkbox.  However, auth needs to come from somewhere and LDAP sounds like the best place so I'm leaving this for IT.  Very short docs at https://hudson.dev.java.net/security.html

Once that is done it will be read-only for anonymous users and at that point it should get a public IP.  Note that whatever network it ends up on, it needs to continue to be able to access network resources including qa-selenium, svn.mozilla.org, github.com, the pile of sites/protocols in requirements.txt, and eventually git.mo.

Comment 1

[Wil Clouser [:clouserw]]

What is the ETA on this?

Comment 2

[Shyam Mani [:fox2mike]]

Wil, I'm looking at first week of March or so, since there's a bunch of other things going on as well. Is that alright? or you have more pressing needs here?

Comment 3

[Wil Clouser [:clouserw]]

that sounds alright

Comment 4

[Aravind Gottipati [:aravind]]

Okay, LDAP logins on hudson should now be working.  Your username is your LDAP login (e-mail address).  However, it is still a clear text login.  I would put a front end https apache instance, and proxy requests back to the hudson port before opening it to the world.

With the current LDAP setup, any anonymous user can look at the builds, etc.

Only users in the mptvpn (configurable) LDAP group are allowed to login and once they login they can configure all aspects of the system.

Comment 5

[Jeff Balogh (:jbalogh)]

http://img.skitch.com/20100302-11bp4giyfkc71t61q1nty35xti.png

I logged in with LDAP, which was successful according to the top nav bar.  But it's still asking for me to log in.

Comment 6

[Aravind Gottipati [:aravind]]

It gives you the links on the left side to manage/configure hudson, so you are definitely logged in.  As to why it think you need to login again, I am not sure.  I noticed that you already had a user account within Hudson.  I am not sure if you created that, or if it automatically configured you as a user because you had checked something in.  My guess is that that has something to do with it.  Try logging off, clearing any cookies it might have set and try again?  I  just tested this again, and it does not give me that double login screen.

If you still see the problem, its probably a hudson bug.

Comment 7

[Wil Clouser [:clouserw]]

I think those auth settings are alright.  Can you setup the apache proxy with SSL?

Comment 8

[Tom Ellins [:TMZ]]

Any updates?

Comment 9

[Shyam Mani [:fox2mike]]

Tom/Wil,

POA on this - I'll migrate sm-hudson01 (from the sandbox network) to dm-hudson01 (public facing dmz) and then make sure nothing is functionally broken before I setup SSL/Apache and open it up.

I plan to move this tomorrow and once that's done and you guys can verify we have it working as it should, I'll do the rest.

Apologies for the delay.

Comment 10

[Shyam Mani [:fox2mike]]

Alright, so sm-hudson01 has moved from the sandbox (vlan 76) to the pubdmz (vlan 74). We kept the same name so as to not cause more confusion/config changes on the box and on hudson.

Can you trigger a few builds/check if things are working well? And list out what's broken and I'll get around to fixing those.

Then we'll push apache in front and open it up.

Comment 11

[Shyam Mani [:fox2mike]]

I took the opportunity to pull in system updates, which included a hudson update and a new kernel as well.

Comment 12

[Wil Clouser [:clouserw]]

I haven't found anything broken so far. I think it looks good.

Comment 13

[Shyam Mani [:fox2mike]]

Awesome.

Now, one more step is in place. Proxying has been enabled, so http://sm-hudson01.mozilla.org/ will now display hudson and /pypi/ will still show all the pypi stuff.

Verify this works as normal/expected? No failures?

Final step - assign a public IP and redirect everything to SSL, just to make sure we don't have any auth over plain-text.

Comment 14

[Shyam Mani [:fox2mike]]

Also, what's the public facing domain you'd like for this? hudson.addons.mozilla.org? or addons.hudson.mozilla.org?

I also see some sumo stuff in there, might want to remove that and ask SUMO to ask for their own hudson server :)

Comment 15

[Wil Clouser [:clouserw]]

> Now, one more step is in place. Proxying has been enabled, so
> http://sm-hudson01.mozilla.org/ will now display hudson and /pypi/ will still
> show all the pypi stuff.
> 
> Verify this works as normal/expected? No failures?

Well, hudson itself still thinks it's on port 8080, so generated URLS (eg. from the IRC bot) contain http and the port.  A redirect for both wfm though.

> Also, what's the public facing domain you'd like for this?
> hudson.addons.mozilla.org? or addons.hudson.mozilla.org?
> 
> I also see some sumo stuff in there, might want to remove that and ask SUMO to
> ask for their own hudson server :)

Just hudson.mozilla.org?  Or hudson.webdev.m.o if you want to namespace it some more.  AMO was the first project on here, but I want to get the rest of webdev on it too.

Comment 16

[Shyam Mani [:fox2mike]]

/me does a little happy dance :D

I happily present http://hudson.mozilla.org/ 

Everything but /pypi/ goes over https. If the app can handle it, I'd like that to go over https too, but I thought I'd ask you guys first. 

As always, run your checks, make sure nothing is h0rked and reopen if you need anything else?

Comment 17

[Jeff Balogh (:jbalogh)]

Thanks!  This looks good to me.

Comment 18

[Shyam Mani [:fox2mike]]

After a little chat over IRC with jbalogh and ianbicking, /pypi/ is also over https now.