Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1652450 - Capsule port 8443 reverse proxy opens up Satellite UI
Summary: Capsule port 8443 reverse proxy opens up Satellite UI
Alias: None
Product: Red Hat Satellite
Classification: Red Hat
Component: Security
Version: 6.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: Unspecified
Assignee: satellite6-bugs
QA Contact: Roman Plevka
Depends On:
TreeView+ depends on / blocked
Reported: 2018-11-22 06:55 UTC by Tsai Li Ming
Modified: 2021-05-26 19:32 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2021-05-26 19:32:12 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Foreman Issue Tracker 12646 0 Normal New Isolated Reverse proxy exposes all of Katello/Foreman 2021-02-02 01:34:28 UTC
Red Hat Knowledge Base (Solution) 3712851 0 None None None 2018-11-22 16:46:27 UTC

Description Tsai Li Ming 2018-11-22 06:55:08 UTC
Description of problem:
https://capsule:8443/ reverse proxy into the Satellite UI. 

1. This opens up Satelliet UI to all clients that Capsule is deployed in, which has security implications
2. There is no mention of this in the documentation. Documentation only mention this for Client to Capsule communication:
8443 TCP HTTPS Subscription Management Services and Telemetry Services

<VirtualHost *:8443>
  ServerName sat6-capsule1.example.com

## Proxy rules
  ProxyRequests Off
  ProxyPreserveHost Off
  ProxyPass / https://sat6.example.com/
  ProxyPassReverse / /
  ProxyPassReverse / https://sat6.example.com/

Expected Result:
- Capsule should not gives users an indirect access to Satellite UI at all.

Comment 5 Eric Helms 2021-05-17 22:58:47 UTC
We have assessed this BZ and there are a few considerations. The reverse proxy on the Capsule grants both UI and API access which in our view has the same security implications. In order to lock down just to the API we would have to build an access list of *all* API paths needed in order to not break functionality. Given there is no single rooted endpoint this is difficult and has the potential to miss an endpoint and break functionality. Additionally, some users see this as a feature that they use in order to access the application from clients or the Capsule itself. Given all of this, it is our recommendation that we close this BZ as wontfix. We would then opt to address https://bugzilla.redhat.com/show_bug.cgi?id=1743839 .

Note You need to log in before you can comment on or make changes to this bug.