search

rackspace-cookbooks / elkstack

Elasticsearch, logstash, and kibana stack
Other
81 stars 54 forks source link

`elkstack::acl` doesn't seem to work on ubuntu 14.04 #165

Closed patcon closed 8 years ago

patcon commented 9 years ago

The rules get enabled, but this is the output:

patcon@elkstack-server-test:~$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport dports 5959 /* allow syslog entries inbound */
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport dports 5960 /* allow lumberjack entries inbound */
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport dports 5961 /* allow tcp entries inbound */
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport dports https /* allow nginx SSL entries inbound */
ACCEPT     tcp  --  anywhere             anywhere             tcp multiport dports http /* allow nginx entries inbound */
ACCEPT     udp  --  anywhere             anywhere             multiport dports 5962 /* allow udp entries inbound */
ACCEPT     all  --  anywhere             anywhere             /* allow services on loopback to talk to any interface */

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Presumably, the policy should be to drop, from what I gather.

Also, as noted here, it's not intuitive how to extend on those firewall rules.

Thanks!

martinb3 commented 9 years ago

@patcon Hello! The goal of the acl recipe is to open firewall rules required for elkstack, but not necessarily to enforce a default drop rule. If you don't have a default drop rule already, you don't need to run the acl recipe. Does that make sense?

Since the firewall cookbook currently applies the rules in the order they appear in the resource collection, a default-drop recipe would be something you'd declare last, so it's at the end of the runlist (and the final firewall_rule resource in the resource collection).

patcon commented 9 years ago

I do appreciate that explanation, but is it the intention that every firewall rule must be added after this recipe? It would strike me as sensible to have rules for ssh etc in a base recipe/role which tends to run first, but in my experience here, those have no effect. Or perhaps they require some odd wrangling which I haven't figure out yet :)

Adding all firewall rules after elkstack::acl is a workable solution, but I would suggest it's not obvious. I assumed I was doing something wrong!

patcon commented 9 years ago

Also, even the code of firewall provider suggests that a default drop policy should occur when enabled: https://github.com/opscode-cookbooks/firewall/blob/master/libraries/provider_firewall_iptables.rb#L40-L53

Am I misunderstanding?

martinb3 commented 9 years ago

Hi @patcon -- the firewall cookbook has been updated to allow firewall_rule resources to be declared in any order, in #83 and #84. I've confirmed that's what is happening now on elkstack as well. I'm going to do an update to be pin elkstack up to at least the latest firewall cookbook, and then I'll go ahead and close this.

patcon commented 9 years ago

As always, thanks Martin! I'll definitely revisit at some point soon

martinb3 commented 8 years ago

I think this one is resolved now :+1: