Fuel slaves sysctl.conf security hardening

[Adam Heczko]

Detailed bug description:
Observe Linux network stack sysctl values of Fuel slave nodes.

Expected results:
generic-ip-source-routing-enabled
For Linux systems ensure the following sysctl values are set:
 * net.ipv4.conf.all.accept_source_route=0
 * net.ipv4.conf.all.forwarding=0
 * net.ipv6.conf.all.forwarding=0
 * net.ipv4.conf.all.mc_forwarding=0
 * net.ipv6.conf.all.mc_forwarding=0

sysctl -w net.ipv4.conf.all.accept_source_route=0
sysctl -w net.ipv4.conf.all.forwarding=0
sysctl -w net.ipv6.conf.all.forwarding=0
sysctl -w net.ipv4.conf.all.mc_forwarding=0
sysctl -w net.ipv6.conf.all.mc_forwarding=0

More Linux information can be found at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-Server_Security-Disable-Source-Routing.html

linux-icmp-redirect
Disable ICMP redirect support
Issue the following commands as root:
 sysctl -w net.ipv4.conf.all.accept_redirects=0
 sysctl -w net.ipv4.conf.default.accept_redirects=0
 sysctl -w net.ipv4.conf.all.secure_redirects=0
 sysctl -w net.ipv4.conf.default.secure_redirects=0
These settings can be added to /etc/sysctl.conf to make them permanent.

generic-tcp-timestamp
Disable TCP timestamp responses on Linux
Set the value of net.ipv4.tcp_timestamps to 0 by running the following command:
sysctl -w net.ipv4.tcp_timestamps=0
Additionally, put the following value in the default sysctl configuration file, generally sysctl.conf:
net.ipv4.tcp_timestamps=0

[Vitaly Sedelnik (vsedelnik)]

Won't Fix for 8.0 as MUs for 8.0 are postponed. Confirmed for 9.2 and 10.

[Ivan Suzdal (isuzdal)]

I'm afraid, disabling forward could break connectivity between a lot of cluster components and vm's.

[Bogdan Dobrelya (bogdando)]

The net.ipv4.conf.all.forwarding=0 should not be used with OpenStack, indeed. The rest of the changes should be tested. If everything works w/o regressions, let's accept them.

[Maksim Malchuk (mmalchuk)]

@Bogdan, net.ipv4.conf.all.forwarding shouldn't be 0 !!!
Because by default Fuel acts as a router prior networks configured on slaves via bridges.
The default route is configured in the fuel-menu.
Disable forwarding would break at least all deployments via VirtualBox scripts.

[Oleksiy Molchanov (omolchanov)]

It looks like a feature and needs a lot of efforts and test coverage to implement this.

Also Fuel relies on part of the suggested parameters.

Closing as Won't fix.