search

netsec-ethz / scionlab

SCIONLab user interface and administration
https://www.scionlab.org
Apache License 2.0
9 stars 16 forks source link

Cannot connect to host from the Coordinator: configuration not automatically deployed #156

Closed juagargi closed 3 years ago

juagargi commented 5 years ago

Some hosts cannot be managed from the Coordinator because ssh refuses to connect. Most likely the problem will be just a firewall configuration, thus an email and patience will be sufficient. This is the list:

mkowalski commented 5 years ago

For these machines I do have connectivity from the office network, but do not from the server network

- 1501-wozniak
- 1402-bhaskara
- 1401-cray
- 1307-ptolemy
- 1305-hopper
- 1204-thompson

Please note this list do not contain machines which are unavailable from both office and server networks. There is a few like this, but there problem is not the firewall.

On the ones above the issue is surely the corporate firewall in the networks where these boxes live.

The full list of ETHZ subnets is as follows

  # ETH-Hauptnetz
  - 82.130.64.0/18
  # ETH-Hauptnetz
  - 129.132.0.0/16
  # ETH-Hauptnetz
  - 195.176.96.0/19
  # ETH-Hauptnetz
  - 192.33.87.0/24
  # ETH-Hauptnetz
  - 192.33.88.0/23
  # ETH-Hauptnetz
  - 192.33.91.0/24
  # Verbindung zwischen ETH und SWITCH
  - 192.33.92.0/24
  # ETH-Hauptnetz
  - 192.33.93.0/24
  # ETH-Hauptnetz
  - 192.33.94.0/23
  # ETH-Hauptnetz
  - 192.33.96.0/21
  # ETH-Hauptnetz
  - 192.33.104.0/22
  # ETH-Hauptnetz
  - 192.33.108.0/23
  # ETH-Hauptnetz
  - 192.33.110.0/24

Office and server subnets used by us at this moment are as follows. This is an extreme minimum of subnets which have to be open so we can always access the SCION node. The list can also grow in case we run out of addresses in any of these networks.

192.33.93.0/24
129.132.230.64/26
195.176.124.176/28
129.132.55.208/28
129.132.85.112/28
129.132.105.24/29
129.132.227.224/28
cmeury commented 3 years ago

Connections to all of these hosts except scionlab-1204-thompson have have been restored. Reached out to thompson's maintainers multiple times and escalated to our group lead. The same story applies to scionlab-1203-hawking

Hopefully this should be resolved fairly soon and I'll be able to close this issue.

matzf commented 3 years ago

Configuration deployment push with SSH access has been removed in #313.