This may be of interest to people using Fedora as a cloud solution, for several reasons.
First, on _host_ systems providing virtualization services, the firewall daemon provides an interface for tracking dynamic rules. (Libvirt already has code to use it, for example.)
On cloud _guest_ systems, it's probably less desirable: the firewall is unlikely to have dynamic changes, and resources will be more constrained. Having an extra python-based daemon running all the time with literally nothing to do probably isn't what we're looking for, and it also happens that the code pulls in a large list of dependencies.
The FirewallD feature page proposes that both options should be available for at least the next few Fedora releases (just as we have the legacy network scripts). But right now, the appliance building tools and anaconda both rely on the new firewalld commands. I suggested putting that back to the old way for now, but that's going to take some work and testing.
* https://bugzilla.redhat.com/show_bug.cgi?id=885807 * https://bugzilla.redhat.com/show_bug.cgi?id=884878
Anyway, see https://fedorahosted.org/fesco/ticket/973, which is a topic of a FESCO meeting at 1 EDT today. Not asking people to storm the meeting (not productive!) but I thought you might want to be aware if you haven't been following this.
On 2012-12-12 7:27, Matthew Miller wrote:
This may be of interest to people using Fedora as a cloud solution, for several reasons.
First, on _host_ systems providing virtualization services, the firewall daemon provides an interface for tracking dynamic rules. (Libvirt already has code to use it, for example.)
On cloud _guest_ systems, it's probably less desirable: the firewall is unlikely to have dynamic changes, and resources will be more constrained. Having an extra python-based daemon running all the time with literally nothing to do probably isn't what we're looking for, and it also happens that the code pulls in a large list of dependencies.
How much memory does firewalld actually use on F18 when it has nothing to do? At what point should we become concerned about how much memory a process is using?
The FirewallD feature page proposes that both options should be available for at least the next few Fedora releases (just as we have the legacy network scripts). But right now, the appliance building tools and anaconda both rely on the new firewalld commands. I suggested putting that back to the old way for now, but that's going to take some work and testing.
Does the "no firewall" case still work, at least? EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
Should the F18 release image explicitly target clouds other than EC2? *Can* it?
-- Garrett Holmstrom
On Wed, Dec 12, 2012 at 09:58:04PM -0800, Garrett Holmstrom wrote:
How much memory does firewalld actually use on F18 when it has nothing to do?
16MB? That's not the end of the world, but it's bigger than anything else running in the cloud image. (In fact, excepting dhclient, it's bigger than *everything else put together*.)
At what point should we become concerned about how much memory a process is using?
I don't have a magic number, but I think we want to be concerned about all resource waste, because it does add up.
Does the "no firewall" case still work, at least? EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
The current situation is that it works, but only by removing stuff in kickstart post.
Should the F18 release image explicitly target clouds other than EC2? *Can* it?
Yes, but I think we'll end up with two different kickstarts. (The EC2 image won't need grub, for example.) I'm open to just leaving it off for the EC2 image in specific.
On Wed, Dec 12, 2012 at 09:58:04PM -0800, Garrett Holmstrom wrote:
EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
I'd like to get a group consensus on this. Dennis Gilmore has expressed concern about leaving the local firewall off -- having it on may be redundant, but it protects against configuration errors or security bugs in EC2 itself.
Options for the out-of-the-box config are:
A) no local firewall (Garrett, do you have a reference to an EC2 recommendation for this configuration?)
B) firewall allowing ssh in by default (normal Fedora default)
C) firewall allowing in ssh + http/https (since cloud systems are often web servers)
I'm lightly in favor of C, since I like the concept of defense-in-depth, and this seems like a decent compromise. But I really don't have a very strong opinion. What are your thoughts?
On 12/20/2012 3:49 PM, Matthew Miller wrote:
On Wed, Dec 12, 2012 at 09:58:04PM -0800, Garrett Holmstrom wrote:
EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
I'd like to get a group consensus on this. Dennis Gilmore has expressed concern about leaving the local firewall off -- having it on may be redundant, but it protects against configuration errors or security bugs in EC2 itself.
Options for the out-of-the-box config are:
A) no local firewall (Garrett, do you have a reference to an EC2 recommendation for this configuration?)
B) firewall allowing ssh in by default (normal Fedora default)
C) firewall allowing in ssh + http/https (since cloud systems are often web servers)
I'm lightly in favor of C, since I like the concept of defense-in-depth, and this seems like a decent compromise. But I really don't have a very strong opinion. What are your thoughts?
I think B is the right solution. I don't trust EC2's firewalls (especially EC2 instance to EC2 instance) and I have EC2 instances that don't run web servers.
On 2012-12-20 12:49, Matthew Miller wrote:
On Wed, Dec 12, 2012 at 09:58:04PM -0800, Garrett Holmstrom wrote:
EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
I'd like to get a group consensus on this. Dennis Gilmore has expressed concern about leaving the local firewall off -- having it on may be redundant, but it protects against configuration errors or security bugs in EC2 itself.
Options for the out-of-the-box config are:
A) no local firewall (Garrett, do you have a reference to an EC2 recommendation for this configuration?)
Not any more. The only reference to instance-specific firewalls that I can find in today's documentation [1] is, "In addition to these examples, you can maintain your own firewall on any of your instances. This can be useful if you have specific requirements not met by the Amazon EC2 distributed firewall."
B) firewall allowing ssh in by default (normal Fedora default)
C) firewall allowing in ssh + http/https (since cloud systems are often web servers)
I'm lightly in favor of C, since I like the concept of defense-in-depth, and this seems like a decent compromise. But I really don't have a very strong opinion. What are your thoughts?
There seem to be enough people here who are okay with defaulting to dual firewalls to narrow it down to B and C. To be honest, I'd choose B. It's Fedora's default, it makes fewer assumptions, and since we're already considering an exploit in EC2 itself to be in scope, we might as well block off a couple a couple more ports out of the box.
I don't feel incredibly strongly about that, though. I just think it makes more sense.
[1] http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/using-network-secu...
-- Garrett Holmstrom
Hi, On 12/20/2012 09:49 PM, Matthew Miller wrote:
I'd like to get a group consensus on this. Dennis Gilmore has expressed concern about leaving the local firewall off -- having it on may be redundant, but it protects against configuration errors or security bugs in EC2 itself.
My 2c is that cloud images should be leaving firewall config to their cloud provider, and not ship with that my default. A competent sysadmin can add additional constraints later.
Cheers, Dave.
----- Original Message -----
From: "Matthew Miller" mattdm@fedoraproject.org To: "Fedora Cloud SIG" cloud@lists.fedoraproject.org Sent: Thursday, December 20, 2012 1:49:23 PM Subject: cloud and local firewall at all (sig consensus?)
On Wed, Dec 12, 2012 at 09:58:04PM -0800, Garrett Holmstrom wrote:
EC2 recommends images with *no* default firewall since they use security groups to control traffic, and adding a second, guest-level firewall tends to confuse people.
I'd like to get a group consensus on this. Dennis Gilmore has expressed concern about leaving the local firewall off -- having it on may be redundant, but it protects against configuration errors or security bugs in EC2 itself.
Is this consensus just for EC2 or all images potentially used in cloud (public or private)?
Options for the out-of-the-box config are:
A) no local firewall (Garrett, do you have a reference to an EC2 recommendation for this configuration?)
B) firewall allowing ssh in by default (normal Fedora default)
C) firewall allowing in ssh + http/https (since cloud systems are often web servers)
I'm lightly in favor of C, since I like the concept of defense-in-depth, and this seems like a decent compromise. But I really don't have a very strong opinion. What are your thoughts?
-- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ mattdm@fedoraproject.org _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud
On Fri, Dec 21, 2012 at 09:40:38AM -0500, Robyn Bergeron wrote:
Is this consensus just for EC2 or all images potentially used in cloud (public or private)?
This is specifically just for EC2, although I guess I'd like to hear opinions on the other as well.