731228 - Setup Firewalling on Production

Status: RESOLVED FIXED

(Pancake Graveyard :: General, defect)

Description

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

We need to look at what is running where and then decide on a simple firewall setup to limit the access that individual machines have to eachother. Ccing security folks.

Comment 1

[Joe Stevensen [:joe]]

Stefan,

We're still waiting for pancake documentation. We've been asking for months. We need the opportunity to review pancake prior to deployment...which it sounds like has already happened.

Please get us a detailed set of documentation and diagrams for pancake.

We need to know information such as:

What components do what
What components talk to what systems
What data is transmitted between systems

Comment 2

[Joe Stevensen [:joe]]

Stefan,

Any update on this?

Comment 3

[Joe Stevensen [:joe]]

Stefan,

Can you update this bug?

Comment 4

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

So even though i filed this bug it was totally not on my radar and i have missed all updates to it. Moving it to M1 to keep it in the 'what to do before release' list.

Comment 5

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Joe, I started a Wiki page at https://wiki.mozilla.org/Pancake_Infrastructure please let me know if this is good.

Comment 6

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Attachment: Pancake architecture diagrams

Comment 7

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Added a PDF describing the current pancake architecture. both on Mozilla and Amazon infrastructure.

Comment 8

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

New wiki page to describe the Pancake Thumbnailer infrastructure at https://wiki.mozilla.org/Pancake_Thumbnailer_Infrastructure

Comment 9

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

We are now in the process of setting up a production environment. Cc'ing gozer on this bug as he has the best overview of iptables rules that were needed to get things going.

Comment 10

[Stefan Arentz | :st3fan | ⏰ EST | he/him]

Attachment: Pancake infra on mozilla vms

Comment 11

[Philippe M. Chiasson (:gozer)]

webservers (pancake-web[1-4]) have:
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT 
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT 

user-api (pancake-user-api1) has:
 -A INPUT -s 10.8.110.0/24 -p tcp -m state --state NEW -m tcp --dport 4323 -j ACCEPT

neo4j (pancake-neo4j1) has:
 -A INPUT -s 10.8.110.0/24 -p tcp -m state --state NEW -m tcp --dport 7474 -j ACCEPT

elasticsearch (pancake-elasticsearch1) has:
 -A INPUT -s 10.8.110.0/24 -p tcp -m state --state NEW -m tcp --dport 9200 -j ACCEPT

memcache1 (pancake-memcache1) [running membase] has:
 -A INPUT -s 10.8.110.0/24 -p tcp -m state --state NEW -m tcp --dport 11211 -j ACCEPT

They all also have:
 -A INPUT -i lo -j ACCEPT 
 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT