| Summary: | Firewall ports open by default that shouldn't be | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 6 | Reporter: | Mike Burns <mburns> | ||||||||
| Component: | ovirt-node | Assignee: | Mike Burns <mburns> | ||||||||
| Status: | CLOSED ERRATA | QA Contact: | Virtualization Bugs <virt-bugs> | ||||||||
| Severity: | medium | Docs Contact: | |||||||||
| Priority: | medium | ||||||||||
| Version: | 6.2 | CC: | apevec, avettath, cshao, gouyang, leiwang, mburns, moli, ovirt-maint, sgordon, ycui, yeylon | ||||||||
| Target Milestone: | rc | ||||||||||
| Target Release: | --- | ||||||||||
| Hardware: | x86_64 | ||||||||||
| OS: | Linux | ||||||||||
| Whiteboard: | |||||||||||
| Fixed In Version: | ovirt-node-2.0.1-3.el6 | Doc Type: | Bug Fix | ||||||||
| Doc Text: | Story Points: | --- | |||||||||
| Clone Of: | 715288 | Environment: | |||||||||
| Last Closed: | 2011-12-06 19:16:37 UTC | Type: | --- | ||||||||
| Regression: | --- | Mount Type: | --- | ||||||||
| Documentation: | --- | CRM: | |||||||||
| Verified Versions: | Category: | --- | |||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||
| Attachments: |
|
||||||||||
|
Description
Mike Burns
2011-06-22 13:41:45 UTC
I have noticed that port 81 (anyterm) also seems to be open. I have the following rule in my /etc/sysconfig/iptables file: # anyterm -A INPUT -p tcp --dport 81 -j ACCEPT The build I am using is Red Hat Enterprise Virtualization Hypervisor release 6.2 (0.1.hybrid1307679705). After upstream rebase, anyterm port is not open. Created attachment 515579 [details]
Patch
Testing:
Confirm that libvirt port is not open after installation
(Copied from bug 715288 comment 1) At least, I found the libvirt port is used by vm migration. Thread-40634::ERROR::2011-07-29 04:25:49,358::vm::175::vm.Vm::(_recover) vmId=`ae9b323d-fec1-4ad9-b877-54af58ab757e`::operation failed: Failed to connect to remote libvirt URI (null) Dummy-38061::DEBUG::2011-07-29 04:25:50,288::storage_mailbox::623::Storage.Misc.excCmd::(_checkForMail) 'dd if=/rhev/data-center/06f64173-815f-4d86-b403-8715ab760984/mastersd/dom_md/inbox iflag=direct,fullblock count=1 bs=1024000' (cwd None) Dummy-38061::DEBUG::2011-07-29 04:25:50,389::storage_mailbox::623::Storage.Misc.excCmd::(_checkForMail) SUCCESS: <err> = '1+0 records in\n1+0 records out\n1024000 bytes (1.0 MB) copied, 0.0428696 s, 23.9 MB/s\n'; <rc> = 0 Thread-40634::ERROR::2011-07-29 04:25:50,411::vm::230::vm.Vm::(run) vmId=`ae9b323d-fec1-4ad9-b877-54af58ab757e`::Traceback (most recent call last): File "/usr/share/vdsm/vm.py", line 222, in run File "/usr/share/vdsm/libvirtvm.py", line 305, in _startUnderlyingMigration File "/usr/share/vdsm/libvirtvm.py", line 327, in f File "/usr/share/vdsm/libvirtconnection.py", line 63, in wrapper File "/usr/lib64/python2.6/site-packages/libvirt.py", line 689, in migrateToURI libvirtError: operation failed: Failed to connect to remote libvirt URI (null) After enable libvirt port 16514 in iptables, the error "Failed to connect to remote libvirt URI (null)" disappears. Test version: rhev-hypervisor-6.2-09.el6 libvirt-0.9.2-1.el6.x86_64 Created attachment 515884 [details]
Patch
Given previous comment, this patch reverts previous change to the firewall.
Patch was nacked. Need to enable libvirt ssl/tls port, not tcp port. Created attachment 515924 [details]
Patch
Obsoletes previous patch to add libvirt port to firewall
Verified on rhev-hypervisor-6.2-0.11.el6， libvirt tls port 16514 is enabled in iptables. # iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:54321 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:16514 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:5989 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 5634:6166 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 49152:49216 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt:161 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHBA-2011-1783.html |