Project

General

Profile

Feature #20449

Add randomness to SCAP client runs to avoid DDOS of the server

Added by Ondřej Pražák over 2 years ago. Updated over 1 year ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Difficulty:
Triaged:
No
Bugzilla link:

Description

Description of problem:

As a user, I may have hundreds or potentially thousands of systems associated with a hostgroup.

As OpenSCAP policies in Foreman are associated with hostgroups, if I have a large number of clients in a hostgroup and an OpenSCAP policy is defined, ALL of the clients will attempt to upload their OpenSCAP reports at the same time.

Ideally, I'd like to see some randomness added into the cron job, which allows the clients to splay their reporting.

Today, an example cron job on a client is

  1. HEADER: This file was autogenerated at 2017-07-25 14:19:34 -0400 by puppet.
  2. HEADER: While it can still be managed manually, it is definitely not recommended.
  3. HEADER: Note particularly that the comments starting with 'Puppet Name' should
  4. HEADER: not be deleted, as doing so could cause duplicate cron jobs.
  5. Puppet Name: foreman_scap_client_1
    0 1 * * 1 /usr/bin/foreman_scap_client 1

I'd like it to be similar to the below (which adds a 30-600 second random delay)

  1. HEADER: This file was autogenerated at 2017-07-25 14:19:34 -0400 by puppet.
  2. HEADER: While it can still be managed manually, it is definitely not recommended.
  3. HEADER: Note particularly that the comments starting with 'Puppet Name' should
  4. HEADER: not be deleted, as doing so could cause duplicate cron jobs.
  5. Puppet Name: foreman_scap_client_1
    0 1 * * 1 python -c 'from random import randint; from time import sleep; sleep(randint(30,600))' ; /usr/bin/foreman_scap_client 1

lastly, I'd want the range of randomness configurable by the end-user.


Related issues

Related to OpenSCAP - Feature #22582: Send reports from spool with jitterNew

History

#1 Updated by Ondřej Pražák over 2 years ago

  • Subject changed from Add randomness to SCAP client runs to avoid DDOS of the server to Add randomness to SCAP client runs to avoid DDOS of the server
  • Target version set to 115

#2 Updated by Marek Hulán about 2 years ago

Just a comment on implementation, the splay time could be another smart class parameter for foreman_scap_client (perhaps defaulting to 600 seconds) and can be passed to foreman_scap_client as second parameter. foreman_scap_client would sleep(ARGV2). This way user can still easily manually run on demand with interval set to 0.

#3 Updated by Ondřej Pražák almost 2 years ago

  • Related to Feature #22582: Send reports from spool with jitter added

#4 Updated by Marek Hulán over 1 year ago

  • Target version set to puppet-foreman_scap_client 0.3.19
  • Status changed from New to Closed
  • Fixed in Releases puppet-foreman_scap_client 0.3.19 added
  • Pull request https://github.com/theforeman/puppet-foreman_scap_client/pull/47 added

Also available in: Atom PDF