Greetings,
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
-Sam
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/10/2013 11:36 PM, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Tuesday, September 10, 2013 11:45:51 PM Subject: Re: Disabling firewalld on AWS?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/10/2013 11:36 PM, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJSL+dvAAoJEJICkBIKCqxc/esP/1/xqnHrxYLhlvS5ecgmx3zb 3SSHFeeD2MKQvVkkOlsjoj0oYX17bmWeKxFzpjI7fUBCLb1vsVl1L19QbluGHElA QcKMzyCwfoZuAMZ804SRpty2hx0RSsbVpw0gDMVfBCWDjPFXzxt+PVK/tkIRHGDe k0DMbQd9WtM2BPPPjEeBu72YGnsWNBBHRb+4E9thg1FunX4RkeZ3qw7wgVlg3dCK TH0PkJrJKedWKHUVzcR+dZqxk1thGtWYSw1fJM3Vbk9UPuZxFcxOOjTXYtNkQaO3 LL4x35UMi1pOIC20Ga9nXoMiRex1fLoO2autbJQfwLWnyCBTO/FvDxj9WUDtklFE yt/9t7Y7FH63sBvc6MOi+L7i4ZNZCMlHnZAKpF5jQ7OcOG+a/tftE2E8DUgAJwEG VnMIQPCMCGnYTkrqcsG6pcAz8RxoHMGXaGE3VYRLA0rtc6KeCEB8JuddXJ24Yst7 DNwprVK/O/sf9akniyFHHeimXhvBdhnRCS+uak0/JuRTGRvwEHJ37EeyuwHeCViL F8rq9OLG6uN/CPwT0n5fRnZp30XKQc0wODUOCH9vcp6EVoozvFJF3MRWSjM3nBcO /UKGvPFb2ZNgbGqZxkBsYBVrY12kcQX0Vo6B5IktEV5S1PmwBPOklGJnCCrpEiYq M2TLP9xhvLIHasY2Dl3G =S1Yb -----END PGP SIGNATURE-----
cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/10/2013 11:52 PM, Sam Kottler wrote:
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Oh yes, it's confusing and non-standard. But let's remember that it's the security group, or any equivalent firewall outside the virtual machine, that is non-standard. Personally I expect the host to have its own firewall, even in cloud environments; especially since we can't be sure that one will exist for anything but AWS. I might just be paranoid though. :)
On 09/10/2013 11:52 PM, Sam Kottler wrote:
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Tuesday, September 10, 2013 11:45:51 PM Subject: Re: Disabling firewalld on AWS?
On 09/10/2013 11:36 PM, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
Eric.
----- Original Message -----
From: "Eric V. Smith" eric@trueblade.com To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 7:37:21 AM Subject: Re: Disabling firewalld on AWS?
On 09/10/2013 11:52 PM, Sam Kottler wrote:
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Tuesday, September 10, 2013 11:45:51 PM Subject: Re: Disabling firewalld on AWS?
On 09/10/2013 11:36 PM, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
Eric. _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:13 AM, Sam Kottler wrote:
On 09/10/2013 11:36 PM, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
And I'm saying that the way other AMIs do it is wrong. We should not also be wrong merely because everyone else is jumping off the cliff. Rather we should continue to be secure by default and require explicit action from the user to disable security, not explicit action to enable security.
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 8:47:23 AM Subject: Re: Disabling firewalld on AWS?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:13 AM, Sam Kottler wrote:
On 09/10/2013 11:36 PM, Sam Kottler wrote:
> Given the deny-by-default nature of security groups I think > it makes sense to disable firewalld in the AMI's. I haven't > seen any other AMI's that have a firewall enabled by default > and we probably shouldn't break that pattern IMO. > > Thoughts? >
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
And I'm saying that the way other AMIs do it is wrong. We should not also be wrong merely because everyone else is jumping off the cliff. Rather we should continue to be secure by default and require explicit action from the user to disable security, not explicit action to enable security.
It's not "disabl[ing] security", security groups already do that for you. You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJSMGZbAAoJEJICkBIKCqxcZU8P/2l2+3RP57++Emwl3sfcg0TN 7a1pFT58OxQXUYeUuB/rNtIMOsr2hKsk9RzbJkB4Hlq4IE3d1X87IZ6IGU5IdAKL 0h4gxkV9yCSg0D9v7QIJbHjSPtyQS/A4xX2LGwoO5uJRkIok8c3SZnwVUni/50+l CYnIHVo7jHax6nFtoeRKlbEFajq4BLkjepDKd9O+U8cilWIUiE7/U7x7SXz+gM7m fOfgR1HJ/vvWwyt40BwVKCi94Nn3MRNooevfP2Shh9QQuaMWXe94FnqMAb4aQ0qZ bCdIzDzIzZxX5kVGj01RlFHJps35Y091aGehnyFMvecf6zglks7KBLKFnEE5au3Z a9MAzvf7Ey6pli8X8F16ghPKYyLgggBu8Df/F9fY17rY0eFLe3f2Uhmr9y/J6sSf LVkBuYKvYBprMntMs50WdOOv/T3Xgnf0NjfCqzeOb+8F7IiXiOh50nGupMhjMY2H hcGA3b1YUESuzXHWV0LR7N4Z1owfF5PpNXZZrs7V6O/vCHDh2trmL0Pd/GOh0Co4 LbukaX3kFW4IS7EtTrdZC6zLH7QNpWNvLAsVCGeMP45F/jTugv+nigM83wCr3kJo wjitcI+7I0h3OWQTiA+yJXLYiVz/yneZcUKR9ikzPdGfWVsilAEWzsnNFYp+BgWK OgO8367gE4NY68rvSw5E =oAh5 -----END PGP SIGNATURE-----
cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
----- Original Message -----
From: "Sam Kottler" skottler@redhat.com To: "Fedora Cloud SIG" cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 8:53:59 AM Subject: Re: Disabling firewalld on AWS?
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 8:47:23 AM Subject: Re: Disabling firewalld on AWS?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:13 AM, Sam Kottler wrote:
On 09/10/2013 11:36 PM, Sam Kottler wrote:
>> Given the deny-by-default nature of security groups I think >> it makes sense to disable firewalld in the AMI's. I haven't >> seen any other AMI's that have a firewall enabled by default >> and we probably shouldn't break that pattern IMO. >> >> Thoughts? >>
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
If people disable their firewall then that's their prerogative, but it's confusing and non-standard to have a firewall running on the instance and one running via the security group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
And I'm saying that the way other AMIs do it is wrong. We should not also be wrong merely because everyone else is jumping off the cliff. Rather we should continue to be secure by default and require explicit action from the user to disable security, not explicit action to enable security.
It's not "disabl[ing] security", security groups already do that for you.
Sorry, this was a weird sentence. My point is that having rules in place on the instance isn't enabling security, but rather adding another layer of it.
You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIcBAEBAgAGBQJSMGZbAAoJEJICkBIKCqxcZU8P/2l2+3RP57++Emwl3sfcg0TN 7a1pFT58OxQXUYeUuB/rNtIMOsr2hKsk9RzbJkB4Hlq4IE3d1X87IZ6IGU5IdAKL 0h4gxkV9yCSg0D9v7QIJbHjSPtyQS/A4xX2LGwoO5uJRkIok8c3SZnwVUni/50+l CYnIHVo7jHax6nFtoeRKlbEFajq4BLkjepDKd9O+U8cilWIUiE7/U7x7SXz+gM7m fOfgR1HJ/vvWwyt40BwVKCi94Nn3MRNooevfP2Shh9QQuaMWXe94FnqMAb4aQ0qZ bCdIzDzIzZxX5kVGj01RlFHJps35Y091aGehnyFMvecf6zglks7KBLKFnEE5au3Z a9MAzvf7Ey6pli8X8F16ghPKYyLgggBu8Df/F9fY17rY0eFLe3f2Uhmr9y/J6sSf LVkBuYKvYBprMntMs50WdOOv/T3Xgnf0NjfCqzeOb+8F7IiXiOh50nGupMhjMY2H hcGA3b1YUESuzXHWV0LR7N4Z1owfF5PpNXZZrs7V6O/vCHDh2trmL0Pd/GOh0Co4 LbukaX3kFW4IS7EtTrdZC6zLH7QNpWNvLAsVCGeMP45F/jTugv+nigM83wCr3kJo wjitcI+7I0h3OWQTiA+yJXLYiVz/yneZcUKR9ikzPdGfWVsilAEWzsnNFYp+BgWK OgO8367gE4NY68rvSw5E =oAh5 -----END PGP SIGNATURE-----
cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:53 AM, Sam Kottler wrote:
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 8:47:23 AM Subject: Re: Disabling firewalld on AWS?
On 09/11/2013 08:13 AM, Sam Kottler wrote:
On 09/10/2013 11:36 PM, Sam Kottler wrote:
>>> Given the deny-by-default nature of security groups I think >>> it makes sense to disable firewalld in the AMI's. I >>> haven't seen any other AMI's that have a firewall enabled >>> by default and we probably shouldn't break that pattern >>> IMO. >>> >>> Thoughts? >>>
This is easily one of my least-favorite "features" of certain Linux distributions.
Debian/Ubuntu images don't have a firewall enabled by default in their cloud images because they don't have a firewall enabled at all in a default installation. At least the last time I looked at them; maybe they've gotten smarter in the last couple of years.
I'm not really sure I see a benefit here. There may not even be a second firewall in front of the virtual machine; a user might turn it off because it's getting in the way, or a cloud provider might not provide this feature at all. I know of at least one public cloud provider which has an external firewall feature similar to AWS security groups, but it's off by default. In this case I see plenty of downside.
> If people disable their firewall then that's their prerogative, > but it's confusing and non-standard to have a firewall > running on the instance and one running via the security > group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
And I'm saying that the way other AMIs do it is wrong. We should not also be wrong merely because everyone else is jumping off the cliff. Rather we should continue to be secure by default and require explicit action from the user to disable security, not explicit action to enable security.
It's not "disabl[ing] security", security groups already do that for you. You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
I would figure Amazon would do everything in its power to prevent leakage of information about vulnerabilities to the public. Their stock price would take a large hit...
----- Original Message -----
From: "Daniel J Walsh" dwalsh@redhat.com To: "Fedora Cloud SIG" cloud@lists.fedoraproject.org Cc: "Sam Kottler" skottler@redhat.com Sent: Wednesday, September 11, 2013 8:57:50 AM Subject: Re: Disabling firewalld on AWS?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:53 AM, Sam Kottler wrote:
----- Original Message -----
From: "Michael Hampton" error@ioerror.us To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 8:47:23 AM Subject: Re: Disabling firewalld on AWS?
On 09/11/2013 08:13 AM, Sam Kottler wrote:
On 09/10/2013 11:36 PM, Sam Kottler wrote:
>>>> Given the deny-by-default nature of security groups I think >>>> it makes sense to disable firewalld in the AMI's. I >>>> haven't seen any other AMI's that have a firewall enabled >>>> by default and we probably shouldn't break that pattern >>>> IMO. >>>> >>>> Thoughts? >>>> > > This is easily one of my least-favorite "features" of certain > Linux distributions. > > Debian/Ubuntu images don't have a firewall enabled by default in > their cloud images because they don't have a firewall enabled at > all in a default installation. At least the last time I looked > at them; maybe they've gotten smarter in the last couple of > years. > > I'm not really sure I see a benefit here. There may not even be a > second firewall in front of the virtual machine; a user might > turn it off because it's getting in the way, or a cloud provider > might not provide this feature at all. I know of at least one > public cloud provider which has an external firewall feature > similar to AWS security groups, but it's off by default. In this > case I see plenty of downside. > >> If people disable their firewall then that's their prerogative, >> but it's confusing and non-standard to have a firewall >> running on the instance and one running via the security >> group(s) that the host is in.
Also, I don't trust the public cloud providers to configure their firewall correctly.
So in your case you just `chkconfig firewalld on` and configure it. I'm sure that people who share your opinion (myself among them) will do that for the extra layer of security, but I'm just advocating for the Fedora images to follow the way other AMI's are handling firewalls.
And I'm saying that the way other AMIs do it is wrong. We should not also be wrong merely because everyone else is jumping off the cliff. Rather we should continue to be secure by default and require explicit action from the user to disable security, not explicit action to enable security.
It's not "disabl[ing] security", security groups already do that for you. You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
I would figure Amazon would do everything in its power to prevent leakage of information about vulnerabilities to the public. Their stock price would take a large hit...
Right, but I'm sure there are outside security researchers who are looking at security groups who would publicly disclose vulnerabilities. There have been vulnerabilities in iptables in the past and I'm sure there will be in the future, too.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iEYEARECAAYFAlIwaM4ACgkQrlYvE4MpobN15gCgiDdJpXpg56jlhb+08JbgtiaN fGQAoOEsGcfzXLiLinHBA3/x1nYI3LdF =l2dv -----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:57 AM, Daniel J Walsh wrote:
On 09/11/2013 08:53 AM, Sam Kottler wrote:
It's not "disabl[ing] security", security groups already do that for you. You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
I would figure Amazon would do everything in its power to prevent leakage of information about vulnerabilities to the public. Their stock price would take a large hit...
[I hope the quoting is correct there, but it looks odd to me. Apologies if it's wrong.]
And, they may be under court order to not discuss their vulnerabilities!
But seriously: I'd rather this work the same way other Fedora installations work. I don't have to enable the firewall when I install from DVDs, and I'd like the same thing to apply to cloud images. Otherwise I need to modify my post-install scripts to always enable the firewall (or maybe conditionally do it, which is worse).
Eric.
----- Original Message -----
From: "Eric V. Smith" eric@trueblade.com To: cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 10:17:03 AM Subject: Re: Disabling firewalld on AWS?
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
On 09/11/2013 08:57 AM, Daniel J Walsh wrote:
On 09/11/2013 08:53 AM, Sam Kottler wrote:
It's not "disabl[ing] security", security groups already do that for you. You're adding an extra convoluted layer, and the vast majority of users will just disable it and rely on security groups (that's conjecture on my part). Have you ever heard about vulnerabilities in the AWS security group implementation? I haven't.
I would figure Amazon would do everything in its power to prevent leakage of information about vulnerabilities to the public. Their stock price would take a large hit...
[I hope the quoting is correct there, but it looks odd to me. Apologies if it's wrong.]
And, they may be under court order to not discuss their vulnerabilities!
But seriously: I'd rather this work the same way other Fedora installations work. I don't have to enable the firewall when I install from DVDs, and I'd like the same thing to apply to cloud images. Otherwise I need to modify my post-install scripts to always enable the firewall (or maybe conditionally do it, which is worse).
The way that services run on public clouds is fundamentally different from the way they run on physical hardware & most private clouds. We shouldn't be treating the AMI's the same as the iso's because they are meant to serve a different purpose.
As for your provisioning script, you don't need a conditional, just chkconfig it to on since it will exit 0 whether it successfully enabled the service or it was already enabled.
Eric. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/
iQEcBAEBAgAGBQJSMHtTAAoJENxauZFcKtNxkUcIAJV5glS4VNT9qhWWgG3UoVou uXxO4TSde8/sVnUNQY3vjmHE6XcPoiLkLjCq9nk8RWvJbmrErOiclsKLRo6E7UZL Fs9CE/aX+6JhzgTZzxoAvayhUSKtwZIDFfvXjUldH1YWMB9gj/ZPms1sDqoiH3Xb /qEt9sXmKDNFJgYGAYCvevk53c75pd4upt1UJ2fLxTezBUf7vi3o6129Fw6KNx7Z zhnyYtmfcesrmZog7lFHAZto1/qSkWIHZaY8XuO5lauEcxdiBMJUYgCWjrWu1y3a GemzbwniBKawfX/t7OIRqyWYoRKJjaHEPZswbHP33jdieCllsMwpujeRJl8q+jA= =yJ/E -----END PGP SIGNATURE----- _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
On Wed, Sep 11, 2013 at 10:30:26AM -0400, Sam Kottler wrote:
The way that services run on public clouds is fundamentally different from the way they run on physical hardware & most private clouds. We shouldn't be treating the AMI's the same as the iso's because they are meant to serve a different purpose.
So, this hits on one of the big concerns: we've previously agreed that it's important to make the image as identical as possible across all clouds public and private. If we drop a default packet filter from the EC2 AMI, this means dropping it from the downloadable qcow2 as well. Or, if we change that, it's a bigger change in strategy.
----- Original Message -----
From: "Matthew Miller" mattdm@fedoraproject.org To: "Fedora Cloud SIG" cloud@lists.fedoraproject.org Sent: Wednesday, September 11, 2013 11:24:28 AM Subject: Re: Disabling firewalld on AWS?
On Wed, Sep 11, 2013 at 10:30:26AM -0400, Sam Kottler wrote:
The way that services run on public clouds is fundamentally different from the way they run on physical hardware & most private clouds. We shouldn't be treating the AMI's the same as the iso's because they are meant to serve a different purpose.
So, this hits on one of the big concerns: we've previously agreed that it's important to make the image as identical as possible across all clouds public and private. If we drop a default packet filter from the EC2 AMI, this means dropping it from the downloadable qcow2 as well. Or, if we change that, it's a bigger change in strategy.
I see far more of a need for a firewall to be enabled by default on the private cloud images.
The public cloud and private cloud images should probably diverge IMO. This actually connects back to the other thread I started yesterday about the update_hostname cloud-init module; that should be enabled on private clouds, but not public ones, too.
-- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ mattdm@fedoraproject.org _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
On Tue, Sep 10, 2013 at 11:36:01PM -0400, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO. Thoughts?
We do disable firewalld by default, but based on an earlier discussion, we leave a basic iptables firewall in place. As always, I'm willing to revisit these things.
Note that since Anaconda _requires_ firewalld to configure the firewall, we have to remove it in %post.
https://bugzilla.redhat.com/show_bug.cgi?id=1004976
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
El Tue, 10 Sep 2013 23:36:01 -0400 (EDT) Sam Kottler skottler@redhat.com escribió:
Greetings,
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
Lets not, for one the image in EC2 is exactly the same image we make available for download in any and every cloud provider or for use on your local machine with a suitable local metadata service provider.
use in EC2 is only a portion of the use of the image.
Dennis
Hello Folks, I support keeping any additional security on my default. I would alctually support having more security enabled by default in any cloud image since it is most likely sitting on top of an environment you don't directly manage (Amazon EC2).
Would it make more since to trigger an additional configuration dialog that would help with fine-grained configuration of the images security features. This could be a script based config triggered after Anaconda finished.
I know this would be yet another feature to develop and implement, but I would prefer to have a cloud image "locked down" as much as possible by default, but make it as simple as possible for a novice to disable features they may not need.
This is a good debate though.
Wilbur
On Wednesday, September 11, 2013, Dennis Gilmore wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
El Tue, 10 Sep 2013 23:36:01 -0400 (EDT) Sam Kottler <skottler@redhat.com javascript:;> escribió:
Greetings,
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
Thoughts?
Lets not, for one the image in EC2 is exactly the same image we make available for download in any and every cloud provider or for use on your local machine with a suitable local metadata service provider.
use in EC2 is only a portion of the use of the image.
Dennis -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.21 (GNU/Linux)
iEYEARECAAYFAlIwre4ACgkQkSxm47BaWfd//wCfbqOfJn2M8CKjcHCiLRd+9TsR YvoAnRDY4/1A5bCONiR+QlVyHIVNyFs0 =3Pzs -----END PGP SIGNATURE----- _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org javascript:; https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
On Wed, Sep 11, 2013 at 10:09:20PM -0600, Wilbur K Smith wrote:
Would it make more since to trigger an additional configuration dialog that would help with fine-grained configuration of the images security features. This could be a script based config triggered after Anaconda finished.
I don't think that would work, since the user never sees anaconda, just the resulting image. And in that image, we don't really want anything to be interactive since it must be usable "out-of-the-box" as a non-interactive deployment target.
Good point, What about a terminal based security configuration wizard that could be launched by the user after the install finishes? I don't know if any current solutions exist that would allow a novice to easily configure security-groups and firewall/iptables after an install completes. I think if you combine some of the most common hardening tasks into an easy to use script with some default templates, it could make things a bit simpler. Hopefully this would eliminating some of the reasons folks just disable the security features. I think the SELinux troubleshooter has helped accomplish the same thing for desktop installs.
Wilbur
On Thu, Sep 12, 2013 at 7:08 AM, Matthew Miller mattdm@fedoraproject.orgwrote:
On Wed, Sep 11, 2013 at 10:09:20PM -0600, Wilbur K Smith wrote:
Would it make more since to trigger an additional configuration dialog
that
would help with fine-grained configuration of the images security
features.
This could be a script based config triggered after Anaconda finished.
I don't think that would work, since the user never sees anaconda, just the resulting image. And in that image, we don't really want anything to be interactive since it must be usable "out-of-the-box" as a non-interactive deployment target.
-- Matthew Miller ☁☁☁ Fedora Cloud Architect ☁☁☁ < mattdm@fedoraproject.org> _______________________________________________ cloud mailing list cloud@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/cloud Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
On Tue, Sep 10, 2013 at 11:36:01PM -0400, Sam Kottler wrote:
Given the deny-by-default nature of security groups I think it makes sense to disable firewalld in the AMI's. I haven't seen any other AMI's that have a firewall enabled by default and we probably shouldn't break that pattern IMO.
I'm +1 to this, as I noted in the other thread. It's non-intuitive to have security groups and a local firewall. Odds are if I'm using Fedora on AWS, I want to use the AWS tools to handle this. Same with OpenStack, CloudStack, etc.
Best,
jzb