Bug 1289853

Summary:	[RFE] Network Port Requirements between Client, Capsule and Satellite too Excessive
Product:	Red Hat Satellite	Reporter:	Mark Meierjohann <mmj>
Component:	Foreman Proxy	Assignee:	Katello Bug Bin <katello-bugs>
Status:	CLOSED WONTFIX	QA Contact:	Katello QA List <katello-qa-list>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.1.5	CC:	bkearney, mmj, nobody, xdmoon
Target Milestone:	Unspecified	Keywords:	FutureFeature
Target Release:	Unused
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Enhancement
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-01-21 16:29:38 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	260381, 1115190

Description Mark Meierjohann 2015-12-09 07:27:43 UTC

Description of problem:
Too many ports required for communication between Capsule and Satellite as well as Satellite and Capsule.
Too many ports required for communication between Client and Capsule.

Version-Release number of selected component (if applicable): 6.1

As described in the documentation
( https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/Installation_Guide/sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Capsule_Server_Prerequisites.html#sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Capsule_Server_Prerequisites-Network_Ports_Required_for_Capsule_Communications )
we require ports 443, 5646 and 5647 ( all TCP ) between the Capsule and the Satellite, as well as 9090/TCP between the Satellite and the Capsule. These requirements make managing public-cloud workloads with a satellite/capsule architecture impossible for some enterprises, due to the amount of firewall rules required.

In addition the number of ports required Client management between the client and the capsule are causing an issue if there is a firewall between the Client and the Capsule: 443 5647 8140 8443 9090 all TCP.

A number of security conscience customers, financial and government, can not get Satellite into operations with these requirements. Communication initiated both ways between Satellite and Capsule is a show-stopper.

Ideally these customers would like to see one port (443/TCP) that can be proxied through a web-application firewall or a web-proxy based http CONNECT for both client to capsule and capsule to Satellite communication.

Comment 1 Bryan Kearney 2016-01-21 16:29:17 UTC

I do not believe we will do this in any reasonable amount of time. While I understand the value this would bring, the work would be large, and I do not expect us to do it any time soon.