Feature #969

Direct Client->Foreman communication shouldn't be needed (and moved to the Proxy)

Added by Marcello de Sousa almost 2 years ago. Updated 9 months ago.

Status:New Start:06/09/2011
Priority:Normal Due date:
Assigned to:- % Done:

0%
Category:-
Target version:-
Backlog:No Difficulity:
Votes: 5 (View)

Description

When provisioning a machine, the client needs to access foreman unattended urls, such as:
http://foreman/unattended/kickstart
and
http://foreman/unattended/built

That means firewall open to foreman (and the API).
I think the architecture and security would improve if Foreman could be as isolated as possible, not depending on being open to the machines it manages... Those tasks should be left to the proxy.

The suggested solution:
Client communications directed to Foreman should me moved to proxy (in this case, the one running on the master) so you only need port 8140(puppetmaster) + 8443 (foreman-proxy) open.

Note:
The proxy doesn’t really need to simply forward the request (although this is also a valid initial solution). It could have some intelligence to validate them or serve the unattended itself (pre fetching template information or something like it)…

http://i.imgur.com/aJlN5.png

Foreman_Arch.png - Foreman architecture change (67.8 KB) Marcello de Sousa, 06/09/2011 05:23 am

Related issues

related to Foreman - Feature #1069: Unattended install behind firewall and built status Closed 07/26/2011
related to Foreman - Bug #1208: Unauthenticated IP spoofing should not be allowed Closed 10/04/2011
related to Foreman - Feature #1970: Override the foreman_url hostname New 11/22/2012

Associated revisions

Revision 81159d4bf8355ab2fac1813127fccf60baf75fbc
Added by Greg Sutcliffe 8 months ago

Use tokens for discovery of host identity during installation

- fixes #1069
- fixes #1720
- refs #969

History

Updated by Ohad Levy over 1 year ago

  • Target version deleted (0.3)

Updated by Marcello de Sousa over 1 year ago

I can't use foreman in production with this issue so a workaround I'm using at the moment is to add to the vhost something like this:


  <Location />
    Order Deny,Allow
    Deny from all
        Allow from <my allowed nets ex: 192.168.0.0/24>
        Allow from 127.0.0.1
  </Location>
  <Location ~ "^/unattended/(kickstart|built)$" >
    Order Deny,Allow
    Deny from all
        Allow from <my client nets where only unattended should be available>
      </Location>

Updated by Karl Vollmer 10 months ago

This is a barrier to my use of Foreman for provisioning due to my clients being on an internal non-routed network. As a short-term fix we've used iptables on the smart-proxy (only system with external access to the foreman) to forward requests from the internal clients, my configuration also requires https://github.com/theforeman/foreman/pull/102 as well to completely resolve the issue.

Updated by Mike Doherty 9 months ago

I've tried my hand at allowing the Smart Proxy to manage the ACL for a Squid proxy, so hosts that can't reach Foreman directly can use the Squid proxy.

Also available in: Atom PDF