Added upstream pull request to make ui/werbserivce workers (ports 3000+/4000+) not listen on 0.0.0.0 and instead only loopback. https://github.com/ManageIQ/manageiq/pull/1832
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/f315d4dc411d501d200d2fe5c7be7ee284873e1c commit f315d4dc411d501d200d2fe5c7be7ee284873e1c Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 12:30:46 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Mon Feb 23 12:42:10 2015 -0500 Bind to loopback address in production mode. The appliances are already blocking ports 3000+, 4000+ as only local apache workers communicate with the Rails "thin" server on those ports. Let's not bind to 0.0.0.0 in production since we can't access them anyway. https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/app/models/mixins/web_server_worker_mixin.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/c1aec8d111dbd3205dc0fea402e7965d83127493 commit c1aec8d111dbd3205dc0fea402e7965d83127493 Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 12:31:08 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Mon Feb 23 12:42:16 2015 -0500 Use Rails.env only. It must be known here or things will blow up. Commit 051c582d9 changed from using the old RAILS_ENV environment variable to the new Rails.env. - :environment => (RAILS_ENV || "development").dup, + :environment => (Rails.env || "development").to_s.dup, This defaulting of development shouldn't be needed anymore as we're using Rails.root in this same method. https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/app/models/mixins/web_server_worker_mixin.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Add upstream pull request to change memcached to also only listen on localhost/127.0.0.1, not 0.0.0.0: https://github.com/ManageIQ/manageiq/pull/1834
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/3dc1f408330995647f20f409787321fffe1c1d18 commit 3dc1f408330995647f20f409787321fffe1c1d18 Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 13:08:39 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Mon Feb 23 13:33:25 2015 -0500 Make memcached listen on loopback address, not all addresses. In other words, listen on 127.0.0.1, not 0.0.0.0. We don't actually share memcached between appliances so our default iptables blocks incoming requests on port 11211 already so let's only listen on the loopback address used by the UI/Web Service workers. Note, since existing appliance configurations contain memcache_server_opts in the session section, users will have to update their current configuration if they want to limit memcached to 127.0.0.1. In other words, change the configuration in the user interface as below: Configure, Configuration, Select the correct server, Advanced tab. From: ``` session: interval: 60 memcache_server: 127.0.0.1:11211 memcache_server_opts: ``` To: ``` session: interval: 60 memcache_server: 127.0.0.1:11211 memcache_server_opts: "-l 127.0.0.1" ``` https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/config/vmdb.tmpl.yml | 2 +- vmdb/lib/miq_memcached.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
Added upstream PR to migrate memcache_server_opts from "" to "-l 127.0.0.1" so we bind to 127.0.0.1 (not 0.0.0.0) unless the user configured their own memcache_server_opts settings. https://github.com/ManageIQ/manageiq/pull/1865
Added upstream PR to default on 127.0.0.1 for all environments included development and properly set the UI/WS worker uri fields: https://github.com/ManageIQ/manageiq/pull/1853
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/e146f01fa9f1c69777482a3a3271c2115570166a commit e146f01fa9f1c69777482a3a3271c2115570166a Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 22:03:10 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Mon Feb 23 22:41:55 2015 -0500 Apparently, developers don't need thin to bind to 0.0.0.0 Bind on localhost. https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/app/models/mixins/web_server_worker_mixin.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/189a73b2d8da88fe6a2d30198ade60ed287ff77e commit 189a73b2d8da88fe6a2d30198ade60ed287ff77e Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 22:32:58 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Mon Feb 23 22:42:03 2015 -0500 Make 127.0.0.1 a constant with a getter method. https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/app/models/mixins/web_server_worker_mixin.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-)
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/01cb19a7f2d4f97ee2a275798692f9d517913d64 commit 01cb19a7f2d4f97ee2a275798692f9d517913d64 Author: Joe Rafaniello <jrafanie> AuthorDate: Mon Feb 23 22:34:24 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Tue Feb 24 16:59:40 2015 -0500 Build the UI/WS worker uri using binding_address. If this value ever is an IPv6 address, build the URI using URI#hostname. https://bugzilla.redhat.com/show_bug.cgi?id=1182330 vmdb/app/models/mixins/web_server_worker_mixin.rb | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-)
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/3b60ed3b749b3eb90d47025328b1bca412769c91 commit 3b60ed3b749b3eb90d47025328b1bca412769c91 Author: Joe Rafaniello <jrafanie> AuthorDate: Tue Feb 24 15:49:31 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Tue Feb 24 15:49:31 2015 -0500 Migrate empty memcache_server_opts to bind on localhost by default. Instead of having memcached bind on 0.0.0.0, we want 127.0.0.1 by default. If a user configured their own options, it is left intact. Followup to #1834 https://bugzilla.redhat.com/show_bug.cgi?id=1182330 ...ack_to_memcache_server_opts_in_configuration.rb | 27 ++++++++++++ ...o_memcache_server_opts_in_configuration_spec.rb | 51 ++++++++++++++++++++++ 2 files changed, 78 insertions(+) create mode 100644 vmdb/db/migrate/20150224164512_add_loopback_to_memcache_server_opts_in_configuration.rb create mode 100644 vmdb/spec/migrations/20150224164512_add_loopback_to_memcache_server_opts_in_configuration_spec.rb
New commit detected on manageiq/master: https://github.com/ManageIQ/manageiq/commit/1e6e7c98e9353d58453137706e463b7582bac8cf commit 1e6e7c98e9353d58453137706e463b7582bac8cf Author: Joe Rafaniello <jrafanie> AuthorDate: Thu Feb 26 11:50:04 2015 -0500 Commit: Joe Rafaniello <jrafanie> CommitDate: Thu Feb 26 12:01:44 2015 -0500 Thin server should bind on 0.0.0.0 in dev mode. Followup to #1853 We should be able to make rails development environments easier to setup while also making production abide by the STIG requirement: "The web server must be configured to listen on a specific IP address and port" http://www.stigviewer.com/stig/apache_server_2.2unix/2014-04-03/finding/V-26326 https://bugzilla.redhat.com/show_bug.cgi?id=1182330 [skip ci] vmdb/app/models/mixins/web_server_worker_mixin.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Verified that 3000,4000 are bound to localhost, noticed rpcbind is running on 0.0.0.0:111 known?
Sorry Pete, Yes, I only changed the behavior of our services: memcached (11211), the ui workers (3000, 3001, etc.) and the web service workers (4000, 4001, etc.). The other services listening on 0.0.0.0 will have to be evaluated on a case by case basis since they're system services that have unknown effects on CFME if we try to change them.
Sorry Joe, So in the context of the bug, how should we proceed? The initial request seemed like it wanted all services disabled that listen on 0.0.0.0, we should probably somewhere, docs?, list the services which _are_ allowed to listen on 0.0.0.0?
Hi Pete, Sorry for the delay. The request was to disable the services that don't need to listen on 0.0.0.0. Without specifics on which services are questionable, I disabled our services that I knew could be disabled on 0.0.0.0 without breaking other features of the product. I would prefer we link to RHEL documentation regarding the default system services that are running on a box as 1) they will change with each new version of RHEL and 2) RHEL documentation will better describe these services. Thoughts?
Verified in 5.4.0.1: # lsof -i -P -n | grep -E ":[34]00[0-9]+|:11211" memcached 2244 memcached 26u IPv4 16832 0t0 TCP 127.0.0.1:11211 (LISTEN) memcached 2244 memcached 27u IPv4 16835 0t0 UDP 127.0.0.1:11211 memcached 2244 memcached 28u IPv4 17759 0t0 TCP 127.0.0.1:11211->127.0.0.1:39403 (ESTABLISHED) memcached 2244 memcached 29u IPv4 618559 0t0 TCP 127.0.0.1:11211->127.0.0.1:54952 (ESTABLISHED) ruby 2315 root 24u IPv4 17369 0t0 TCP 127.0.0.1:3000 (LISTEN) ruby 2315 root 27u IPv4 17758 0t0 TCP 127.0.0.1:39403->127.0.0.1:11211 (ESTABLISHED) ruby 2332 root 24u IPv4 17372 0t0 TCP 127.0.0.1:4000 (LISTEN) ruby 2332 root 26u IPv4 618558 0t0 TCP 127.0.0.1:54952->127.0.0.1:11211 (ESTABLISHED) httpd 6204 apache 17u IPv4 847717 0t0 TCP 127.0.0.1:34609->127.0.0.1:3000 (CLOSE_WAIT) httpd 6205 apache 17u IPv4 847720 0t0 TCP 127.0.0.1:34610->127.0.0.1:3000 (CLOSE_WAIT) httpd 6206 apache 17u IPv4 847714 0t0 TCP 127.0.0.1:34608->127.0.0.1:3000 (CLOSE_WAIT) httpd 6207 apache 17u IPv4 847701 0t0 TCP 127.0.0.1:34607->127.0.0.1:3000 (CLOSE_WAIT) httpd 6208 apache 17u IPv4 847739 0t0 TCP 127.0.0.1:34612->127.0.0.1:3000 (CLOSE_WAIT) httpd 6209 apache 17u IPv4 832482 0t0 TCP 127.0.0.1:33891->127.0.0.1:3000 (CLOSE_WAIT) httpd 6210 apache 17u IPv4 847721 0t0 TCP 127.0.0.1:34611->127.0.0.1:3000 (CLOSE_WAIT) httpd 6211 apache 17u IPv4 830173 0t0 TCP 127.0.0.1:33756->127.0.0.1:3000 (CLOSE_WAIT) httpd 10641 apache 17u IPv4 830477 0t0 TCP 127.0.0.1:33778->127.0.0.1:3000 (CLOSE_WAIT)
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1100.html