Are you referring to /etc/sysconfig/iptables ? That's where the engine setup configures iptables, when I provision my nodes I select "Don't configure firewall" and let puppet manage my iptables rules for other reasons.. not sure if that was what you're asking On Tue, Oct 1, 2013 at 11:16 PM, Sven Kieske <S.Kieske@mittwald.de> wrote:

Hi,

we have an test environment with ovirt 3.3 installed on various hardware nodes.

The management node is installed on an centos 6.4 x64 minimal.

The issue we are running into is, that some ovirt component keeps resetting the iptables firewall configuration, denying access to ports 80 and 443, which results in the web interface being not accessible.

We do know that the engine-setup initially configures the firewall, but through which scripts does iptables get configured?

Are there some database entries for this?

If you need any logfiles for this, please let me know.

Currently we have disabled iptables, as it's just an test environment.

We read about some "vdsm bootstrap script" (e.g. BZ 893680), may this be related?

However we didn't find out where this scripts resides.

Also vvyazmin@redhat.com posted in this BZ: "not a bug".

I don't see why you shouldn't be able to ping the hypervisor in the management lan? this is useful for monitoring and network debugging.

ICMP is no danger at all.

Kind regards

Sven Kieske _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users

On Tue, 1 Oct 2013, Sven Kieske wrote:

We read about some "vdsm bootstrap script" (e.g. BZ 893680), may this be related?

SvenKieske appeared in the OFTC IRC channel #ovirt with this issue, and we discussed it some more 11:41 < SvenKieske> meaning you can't ping compute nodes, this is in the default install 11:41 < orc_orc> SvenKieske: * nod * that effect would occur with the physdev rule, I think 11:41 < SvenKieske> and I think this default iptables rule is just plain useless :) 11:42 < SvenKieske> and prevents proper network debugging, as we are having some issues with network related to newest ovirt nodes 11:42 < orc_orc> SvenKieske: assumedly you are following a guide. can you point out that URL and the step at which the problem is first noticed and he pointed to the wiki outline at: http://www.ovirt.org/Quick_Start_Guide#Install_oVirt_Node 11:43 < orc_orc> but from a policy POV, it may make sense that a node is not reachible until it has had time to become hardened .. and I also pointed out an example of an ICMP fragmantation attack and its remdiation in the Red Hat bugzilla

I don't see why you shouldn't be able to ping the hypervisor in the management lan? this is useful for monitoring and network debugging.

ICMP is no danger at all.

and in IRC he there stated 11:45 < SvenKieske> I'm not sure you can harden this node any further, as it resides on a read only file system, beside that, I can not think of any attack vector via icmp on the compute node 11:46 < orc_orc> SvenKieske: there are some ICMP attacks, particularly on ipv6 stacks, which can cause machines to fall over and die 11:46 < orc_orc> I reported one a while back 11:47 < orc_orc> the packet reassembly code had an unsuspected re-construction method with a problem in it and at that point he concluded that perhaps the ICMP block limitation had policy reasons behind it 11:49 < SvenKieske> Well then that's fine with me, but maybe the node devs should more focus on reliable network configuration and then harden it for security and not the other way around, it was just a small nuisance, if network setup in 3.3 would work ootb I'd maybe never noticed ping doesn't work ootb to which I can only respond: 11:49 < orc_orc> SvenKieske: sounds like you are saying that you need to file an RFE as to debugging tools extensions or amend the setup documentation I had a private inquiry about KVM hardening and so had been looking at the physdev iptables rules recently, and on a VM for which I am responsible an incident just last weekend 11:50 < orc_orc> SvenKieske: I had a person at my office just today, who was the victim of a TOR attack on a VM 11:50 < orc_orc> so VM's _do_ get scanned for and attacked ... in part we mitigated the attack via a temporary iptables rule on the KVM based hypervisor ... and he closed that he may file something tomorrow. 11:50 < SvenKieske> yeah, might be the way to go, but my workday is over now, so maybe tomorrow :) 11:50 < orc_orc> SvenKieske * nod * don't forget ;) 11:51 < SvenKieske> I'm all in for more computer security :) 11:51 < SvenKieske> see you! 11:51 * orc_orc waves I've been working through the setup documentation as well since the 3.3 update, and have a list of questions as to the wiki materials, as of course bit rot happens in wiki's (heck, in _any_ documentation) as new releases are issued -- Russ herrold

Kind regards

Sven Kieske _______________________________________________ Users mailing list Users@ovirt.org http://lists.ovirt.org/mailman/listinfo/users

-- -- end ================================== .-- -... ---.. ... -.- -.-- Copyright (C) 2013 R P Herrold herrold@owlriver.com My words are not deathless prose, but they are mine.