Open ports cannot be restricted to an IP or domain

Bug #1321407 reported by Nate Finch on 2014-05-20
28
This bug affects 5 people
Affects Status Importance Assigned to Milestone
juju
Wishlist
Unassigned
juju-core
Medium
Unassigned

Bug Description

Right now, if you open a port on a node to the outside network, it's open to the entire network - there's no way to just expose it to a limited audience.

Reported here: http://askubuntu.com/questions/448444/juju-security-model-issues

Nate Finch (natefinch) on 2014-05-20
tags: added: security
Joey Stanford (joey) on 2014-05-20
tags: added: production
Curtis Hovey (sinzui) on 2014-05-20
Changed in juju-core:
status: New → Triaged
importance: Undecided → Medium
William Grant (wgrant) wrote :

This is pretty inconvenient when combined with the lack of intra-environment isolation. If you have some slightly untrustworthy services, the free-for-all security groups within an environment mean you need to have them in a separate one. But that requires that you expose some services from the trusted environment, and this bug means you then need to firewall them manually.

Something like "juju expose --to NETWORK/MASK" might work, though in my specific case I need a private API port to be restricted while a webapp port on the same service should be public.

Anastasia (anastasia-macmood) wrote :

Re-targeting for Juju 2.

Changed in juju:
status: New → Triaged
importance: Undecided → Wishlist
Changed in juju-core:
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers