Bug 1380192 - [RFE] Consolidated log every nonlocal ip connection
Summary: [RFE] Consolidated log every nonlocal ip connection
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Networking
Version: 3.2.1
Hardware: Unspecified
OS: Unspecified
unspecified
low
Target Milestone: ---
: ---
Assignee: Ben Bennett
QA Contact: Meng Bo
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-09-28 21:47 UTC by Brennan Vincello
Modified: 2017-07-26 13:17 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-07-26 13:17:21 UTC
Target Upstream Version:


Attachments (Terms of Use)

Description Brennan Vincello 2016-09-28 21:47:33 UTC
As an OpenShift admin I need a historical record of all pod connections to nonlocal IPs for security audits. I'd like to configure SDN logging to reveal information regarding: {time, ip, port} <--> {pod}.

Required info: {time, ip, port} of ant pod that generates a nonlocal connection

Requested on behalf of customer.

Comment 1 Ben Bennett 2016-10-20 13:59:49 UTC
We are unlikely to add something specifically for this soon; however, you can do this yourself.

On each node you can add iptables rules to log the packets for all outgoing pod connections.  However, be very careful when working with iptables because OpenShift relies on them being set up correctly, and it is easy to break OpenShift networking by changing the chains too much.

If you add a NFLOG entry to the top of the POSTROUTING chain to log all traffic leaving the cluster.  You can restrict the source to the pod sdn if you just want to log that traffic.

Then you need to run ulogd on each node to gather the logged information, and that can send it to syslog, and then you could have your syslog configured to forward just the packet information to a remote server where you could collect all the info.

The problem is that it will be logged by pod IP, so you would need to have something that could translate that back to the pod name.  You would need to do that in real-time because the pods come and go, so determining the IP address used at a point in time can be tricky.


See also:
 - Ulogd man page: http://www2.kangran.su/~nnz/pub/nf-doc/ulogd2/
 - ULOG vs. NFLOG: http://unix.stackexchange.com/questions/138135/whats-the-difference-between-ulog-and-nflog


Note You need to log in before you can comment on or make changes to this bug.