Project

General

Profile

Actions

Feature #969

closed

Direct Client->Foreman communication shouldn't be needed (and moved to the Proxy)

Added by Marcello de Sousa almost 13 years ago. Updated over 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Category:
TFTP
Target version:
Difficulty:
Triaged:
Fixed in Releases:
Found in Releases:

Description

When provisioning a machine, the client needs to access foreman unattended urls, such as:
http://foreman/unattended/kickstart
and
http://foreman/unattended/built

That means firewall open to foreman (and the API).
I think the architecture and security would improve if Foreman could be as isolated as possible, not depending on being open to the machines it manages... Those tasks should be left to the proxy.

The suggested solution:
Client communications directed to Foreman should me moved to proxy (in this case, the one running on the master) so you only need port 8140(puppetmaster) + 8443 (foreman-proxy) open.

Note:
The proxy doesn’t really need to simply forward the request (although this is also a valid initial solution). It could have some intelligence to validate them or serve the unattended itself (pre fetching template information or something like it)…

http://i.imgur.com/aJlN5.png


Files

Foreman_Arch.png View Foreman_Arch.png 67.8 KB Foreman architecture change Marcello de Sousa, 06/09/2011 05:23 AM

Related issues 7 (3 open4 closed)

Related to Foreman - Feature #1069: Unattended install behind firewall and built statusClosedGreg Sutcliffe07/26/2011Actions
Related to Foreman - Bug #1208: Unauthenticated IP spoofing should not be allowedClosedOhad Levy10/04/2011Actions
Related to Foreman - Feature #1970: Override the foreman_url hostnameNew11/22/2012Actions
Related to Smart Proxy - Feature #11582: Implement proxy API for "built" commandRejected08/27/2015Actions
Related to Foreman - Feature #17316: Proxy templating needs TFTP feature to be turned onClosedLukas Zapletal11/11/2016Actions
Blocks Katello - Tracker #8172: Isolate Client Communication through a CapsuleNew

Actions
Blocks Discovery - Feature #8147: Support for HTTP proxyNew10/29/2014Actions
Actions #1

Updated by Ohad Levy over 12 years ago

  • Target version deleted (0.3)
Actions #2

Updated by Marcello de Sousa over 12 years ago

I can't use foreman in production with this issue so a workaround I'm using at the moment is to add to the vhost something like this:


  <Location />
    Order Deny,Allow
    Deny from all
        Allow from <my allowed nets ex: 192.168.0.0/24>
        Allow from 127.0.0.1
  </Location>
  <Location ~ "^/unattended/(kickstart|built)$" >
    Order Deny,Allow
    Deny from all
        Allow from <my client nets where only unattended should be available>
      </Location>

Actions #3

Updated by Karl Vollmer over 11 years ago

This is a barrier to my use of Foreman for provisioning due to my clients being on an internal non-routed network. As a short-term fix we've used iptables on the smart-proxy (only system with external access to the foreman) to forward requests from the internal clients, my configuration also requires https://github.com/theforeman/foreman/pull/102 as well to completely resolve the issue.

Actions #4

Updated by Mike Doherty over 11 years ago

I've tried my hand at allowing the Smart Proxy to manage the ACL for a Squid proxy, so hosts that can't reach Foreman directly can use the Squid proxy.

Actions #5

Updated by Greg Sutcliffe over 10 years ago

  • Category set to TFTP
  • Status changed from New to Assigned
  • Assignee set to Greg Sutcliffe

Here's an approach allowing the client to request it's template from the smart-proxy by adding new routes to the smart-proxy:

https://github.com/theforeman/foreman/pull/751
https://github.com/theforeman/smart-proxy/pull/100

Caveat: Proxy needs to be running in 'http' mode, not 'https' as it cannot currently listen on two ports.

Actions #6

Updated by Ohad Levy over 9 years ago

  • translation missing: en.field_release set to 21
Actions #7

Updated by The Foreman Bot over 9 years ago

  • Status changed from Assigned to Ready For Testing
  • Target version set to 1.7.2
  • Pull request https://github.com/theforeman/smart-proxy/pull/224 added
Actions #8

Updated by Dominic Cleal over 9 years ago

  • translation missing: en.field_release deleted (21)
Actions #9

Updated by Eric Helms over 9 years ago

  • Blocks Tracker #8172: Isolate Client Communication through a Capsule added
Actions #10

Updated by Dominic Cleal over 9 years ago

  • Status changed from Ready For Testing to Closed
  • Assignee changed from Greg Sutcliffe to dustin tsang
  • % Done changed from 0 to 100
  • translation missing: en.field_release set to 21
Actions #11

Updated by dustin tsang over 9 years ago

Actions #12

Updated by Stephen Benjamin about 9 years ago

  • Bugzilla link set to 1197806
Actions #13

Updated by Lukas Zapletal over 8 years ago

For the record, it looks like clients still try to reach the Foreman server to do the "built" request. The ticket #1096 unfortunately did not solve what was in the subject text. Creating new ticket #11582 for this.

Actions #14

Updated by Lukas Zapletal over 8 years ago

  • Related to Feature #11582: Implement proxy API for "built" command added
Actions #15

Updated by Dominic Cleal over 7 years ago

  • Related to Feature #17316: Proxy templating needs TFTP feature to be turned on added
Actions

Also available in: Atom PDF