Red Hat Satellite engineering is moving the tracking of its product development work on Satellite to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "Satellite project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs will be migrated starting at the end of May. If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "Satellite project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/SAT-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1652450 - Capsule port 8443 reverse proxy opens up Satellite UI
Summary: Capsule port 8443 reverse proxy opens up Satellite UI
Keywords:
Status: CLOSED WONTFIX
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Security
Version: 6.4
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Roman Plevka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-22 06:55 UTC by Tsai Li Ming
Modified: 2024-10-01 16:11 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-05-26 19:32:12 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 12646 0 Normal New Isolated Reverse proxy exposes all of Katello/Foreman 2021-02-02 01:34:28 UTC
Red Hat Knowledge Base (Solution) 3712851 0 None None None 2018-11-22 16:46:27 UTC

Description Tsai Li Ming 2018-11-22 06:55:08 UTC
Description of problem:
https://capsule:8443/ reverse proxy into the Satellite UI. 

1. This opens up Satelliet UI to all clients that Capsule is deployed in, which has security implications
2. There is no mention of this in the documentation. Documentation only mention this for Client to Capsule communication:
8443 TCP HTTPS Subscription Management Services and Telemetry Services

28-katello-reverse-proxy.conf
<VirtualHost *:8443>
  ServerName sat6-capsule1.example.com

## Proxy rules
  ProxyRequests Off
  ProxyPreserveHost Off
  ProxyPass / https://sat6.example.com/
  ProxyPassReverse / /
  ProxyPassReverse / https://sat6.example.com/

Expected Result:
- Capsule should not gives users an indirect access to Satellite UI at all.

Comment 5 Eric Helms 2021-05-17 22:58:47 UTC
We have assessed this BZ and there are a few considerations. The reverse proxy on the Capsule grants both UI and API access which in our view has the same security implications. In order to lock down just to the API we would have to build an access list of *all* API paths needed in order to not break functionality. Given there is no single rooted endpoint this is difficult and has the potential to miss an endpoint and break functionality. Additionally, some users see this as a feature that they use in order to access the application from clients or the Capsule itself. Given all of this, it is our recommendation that we close this BZ as wontfix. We would then opt to address https://bugzilla.redhat.com/show_bug.cgi?id=1743839 .


Note You need to log in before you can comment on or make changes to this bug.