SSH is accessible from external network

[Daniil Lapshin]

In fuel 7.0, after deployment with defaults some ports are accessible from external network:

PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
4369/tcp open epmd
8775/tcp open unknown
41055/tcp open unknown
49000/tcp open unknown
49001/tcp open unknown
55572/tcp open unknown

For administrative services like SSH it *may* be undesirable to be accessible from the external network (which is typically - the Internet).

[Roman Podoliaka (rpodolyaka)]

Daniil, are you talking about the master node or slaves nodes?

[Daniil Lapshin (dlapshin)]

Hi, Roman,

I'm talking about all controller nodes.

[Roman Podoliaka (rpodolyaka)]

Daniil, I tweaked the description a bit:

1) it only makes sense for SSH, as other ports are expected to be exposed to the external network (e.g 80 - Horizon, 8775 - Nova, etc)

2) even for SSH I'd *not* call it a "security vulnerability" - it's perfectly fine for SSH to be exposed to the external network (it's the way you access your instances in public clouds, FWIW), though, I agree that *may* be unexpected and/or undesirable.

Still, as far as we have public key authentication set in place, I'm not sure this should be private and get importance more than Wishlist.

[Daniil Lapshin (dlapshin)]

Hi, Roman,

Horizon and other ports, that are expected to be exposed to external network, should be exposed via VIP address, not via controllers IPs (haproxy is used to balance requests to those services).

[Alexey Deryugin (velovec)]

Unable to reproduce on 9.0 #101 ISO

NMap result for controller:

PORT STATE SERVICE
80/tcp closed http
443/tcp closed https
6000/tcp closed X11
6001/tcp closed X11:1
6002/tcp closed X11:2
8000/tcp closed http-alt
8042/tcp closed fs-agent
8080/tcp closed http-proxy

[Daniil Lapshin (dlapshin)]

Hi, Roman, Alexey,

It's great that this issue couldn't be reproduced on 9.0, is there anything else that should be done from my side or we could somehow close it?