Bug 1289853 - [RFE] Network Port Requirements between Client, Capsule and Satellite too Excessive
[RFE] Network Port Requirements between Client, Capsule and Satellite too Exc...
Product: Red Hat Satellite 6
Classification: Red Hat
Component: Capsule (Show other bugs)
x86_64 Linux
medium Severity medium (vote)
: Unspecified
: --
Assigned To: Katello Bug Bin
Katello QA List
: FutureFeature
Depends On:
Blocks: 260381 GSS_Sat6Beta_Tracker/GSS_Sat6_Tracker
  Show dependency treegraph
Reported: 2015-12-09 02:27 EST by Mark Meierjohann
Modified: 2016-09-19 21:36 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Enhancement
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-01-21 11:29:38 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Mark Meierjohann 2015-12-09 02:27:43 EST
Description of problem:
 Too many ports required for communication between Capsule and Satellite as well as Satellite and Capsule. 
 Too many ports required for communication between Client and Capsule.

Version-Release number of selected component (if applicable): 6.1

As described in the documentation 
( https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/Installation_Guide/sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Capsule_Server_Prerequisites.html#sect-Red_Hat_Satellite-Installation_Guide-Red_Hat_Satellite_Capsule_Server_Prerequisites-Network_Ports_Required_for_Capsule_Communications ) 
we require ports 443, 5646 and 5647 ( all TCP )	between the Capsule and the Satellite, as well as 9090/TCP between the Satellite and the Capsule. These requirements make managing public-cloud workloads with a satellite/capsule architecture impossible for some enterprises, due to the amount of firewall rules required. 

In addition the number of ports required Client management between the client and the capsule are causing an issue if there is a firewall between the Client and the Capsule: 443 5647 8140 8443 9090 all TCP.

A number of security conscience customers, financial and government, can not get Satellite into operations with these requirements. Communication initiated both ways between Satellite and Capsule is a show-stopper.

Ideally these customers would like to see one port (443/TCP) that can be proxied through a web-application firewall or a web-proxy based http CONNECT for both client to capsule and capsule to Satellite communication.
Comment 1 Bryan Kearney 2016-01-21 11:29:17 EST
I do not believe we will do this in any reasonable amount of time. While I understand the value this would bring, the work would be large, and I do not expect us to do it any time soon.

Note You need to log in before you can comment on or make changes to this bug.