<div dir="auto">The OCP bastion instance is used as part of the OCP installation process. This is where the openshift installation playbooks are run. It is not meant to be a jump box. The prod bastion instance was configured with an EIP in the public subnet for external access to the IdM CLI, but was manually deployed. </div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Dec 4, 2019, 7:37 AM Blade, Eric D [US] (MS) <<a href="mailto:Eric.Blade@ngc.com">Eric.Blade@ngc.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The Onetime can be destroyed if Colleen is done testing with it. Eric -----Original Message----- From: Feiglstok, Colleen M [US] (MS) <<a href="mailto:Colleen.Feiglstok@ngc.com" target="_blank" rel="noreferrer">Colleen.Feiglstok@ngc.com</a>> Sent: Wednesday, December 04, 2019 10:05 AM To: Miller, Timothy J. <<a href="mailto:tmiller@mitre.org" target="_blank" rel="noreferrer">tmiller@mitre.org</a>>; Dean Lystra <<a href="mailto:dlystra@redhat.com" target="_blank" rel="noreferrer">dlystra@redhat.com</a>>; Kevin O'Donnell <<a href="mailto:kodonnel@redhat.com" target="_blank" rel="noreferrer">kodonnel@redhat.com</a>> Cc: <a href="mailto:platformONE@redhat.com" target="_blank" rel="noreferrer">platformONE@redhat.com</a>; Mathew Huston <<a href="mailto:huston@diux.mil" target="_blank" rel="noreferrer">huston@diux.mil</a>>; Nunez, Carlos A [US] (MS) (Contr) <<a href="mailto:Carlos.Nunez2@ngc.com" target="_blank" rel="noreferrer">Carlos.Nunez2@ngc.com</a>>; Blade, Eric D [US] (MS) <<a href="mailto:Eric.Blade@ngc.com" target="_blank" rel="noreferrer">Eric.Blade@ngc.com</a>> Subject: RE: [EXT] Re: [Platformone] Riddle me this, Batman (odd things in up-prod) The onetime was stood up for security testing. Eric Blade is in the process of creating an AMI that we will use in the future that will have all security tools in one place. It is not part of the IAC. -----Original Message----- From: Miller, Timothy J. <<a href="mailto:tmiller@mitre.org" target="_blank" rel="noreferrer">tmiller@mitre.org</a>> Sent: Wednesday, December 4, 2019 8:54 AM To: Dean Lystra <<a href="mailto:dlystra@redhat.com" target="_blank" rel="noreferrer">dlystra@redhat.com</a>>; Kevin O'Donnell <<a href="mailto:kodonnel@redhat.com" target="_blank" rel="noreferrer">kodonnel@redhat.com</a>> Cc: <a href="mailto:platformONE@redhat.com" target="_blank" rel="noreferrer">platformONE@redhat.com</a>; Feiglstok, Colleen M [US] (MS) <<a href="mailto:Colleen.Feiglstok@ngc.com" target="_blank" rel="noreferrer">Colleen.Feiglstok@ngc.com</a>>; Mathew Huston <<a href="mailto:huston@diux.mil" target="_blank" rel="noreferrer">huston@diux.mil</a>>; Nunez, Carlos A [US] (MS) (Contr) <<a href="mailto:Carlos.Nunez2@ngc.com" target="_blank" rel="noreferrer">Carlos.Nunez2@ngc.com</a>> Subject: EXT :Re: [EXT] Re: [Platformone] Riddle me this, Batman (odd things in up-prod) Is that one up-prod-bastion? I'm putting an issue against platform-infrastructure. The bastion is broken in a couple ways: - inbound SG rule defaults to `{{ cidr }}` address space, which resolves out to the VPC addresses - it's in the private subnet (probably doesn't matter, but helps humans keep things straight) - no public IP. -- T On 12/3/19, 16:34, "Dean Lystra" <<a href="mailto:dlystra@redhat.com" target="_blank" rel="noreferrer">dlystra@redhat.com</a>> wrote: One bastion host was created for the sole purpose of allowing access to the IdM CLI. This was done as a quick fix to get the users created and for administrative purposes. Access to IdM via web console or CLI is not available from the internet. onetime is a mystery to me. On Tue, Dec 3, 2019, 2:15 PM Kevin O'Donnell <<a href="mailto:kodonnel@redhat.com" target="_blank" rel="noreferrer">kodonnel@redhat.com</a>> wrote: Bastion creation is iac, and the other ec2 that’s running in prod is for acas and was created to scan and will be shutdown after the scans are done On Tue, Dec 3, 2019 at 3:34 PM Miller, Timothy J. <<a href="mailto:tmiller@mitre.org" target="_blank" rel="noreferrer">tmiller@mitre.org</a>> wrote: - There are three bastion hosts (up-prod-bastion, up-prod-ocp-bastion, and "onetime"). Of these, I can find only up-prod-ocp-bastion in the IaC definition. Both up-prod-bastion and "onetime" look like they were built separately ("onetime" is baselined on CentOS--which is a giveaway--and up-prod-bastion is attached to the `bastion-ssh` security group--which AFAICT is also not part of the IaC). I recall someone (Dean?) telling me that there's no BH in the IaC, but that's not true (see consumers/up-node-infrastructure/environments/production/group_vars/all/ec2-instances.yml). - up-prod-openscap and up-prod-sso-server have a public IP but its inbound rules permit only traffic from the VPC subnets (<a href="http://10.40.0.0/16" rel="noreferrer noreferrer" target="_blank">10.40.0.0/16</a> <<a href="http://10.40.0.0/16" rel="noreferrer noreferrer" target="_blank">http://10.40.0.0/16</a>>) and the up-ss-vpc gitlab-ci-runner instance. - up-prod-openscap is attached to the up-prod-ocp-nodes SG, which is doesn't seem right. That opens a bunch of ports that probably don't matter to a scan host. - up-prod-sso-server has a public IP it doesn't need since traffic is handled by up-prod-sso-elb. FWIW, public IPs are assigned to up-prod-bastion, up-prod-openscap, up-prod-satellite, up-prod-sso-server, and "onetime". The bastion host and openscap kinda make sense, though you can jump to openscap from the BH. Damnfino what "onetime" is supposed to be. I'm not sure which of these or all of 'em should be turned into issues. Comments? -- T _______________________________________________ platformONE mailing list <a href="mailto:platformONE@redhat.com" target="_blank" rel="noreferrer">platformONE@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/platformone" rel="noreferrer noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/platformone</a> -- KEVIN O'DONNELL ARCHITECT MANAGER Red Hat Red Hat NA Public Sector Consulting <<a href="https://www.redhat.com/" rel="noreferrer noreferrer" target="_blank">https://www.redhat.com/</a>> <a href="mailto:kodonnell@redhat.com" target="_blank" rel="noreferrer">kodonnell@redhat.com</a> <mailto:<a href="mailto:kodonnell@redhat.com" target="_blank" rel="noreferrer">kodonnell@redhat.com</a>%20M:240-605-4654> M: 240-605-4654 <<a href="https://red.ht/sig" rel="noreferrer noreferrer" target="_blank">https://red.ht/sig</a>> _______________________________________________ platformONE mailing list <a href="mailto:platformONE@redhat.com" target="_blank" rel="noreferrer">platformONE@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/platformone" rel="noreferrer noreferrer" target="_blank">https://www.redhat.com/mailman/listinfo/platformone</a> </blockquote></div>