[CVE-2018-1000115] memcached: restrict to TCP & internal_api network
https://access.redhat.com/security/cve/cve-2018-1000115
Restrict Memcached to only work on TCP and internal_api network.
The restriction is made at the application and firewall levels.
It will prevent DDoS amplification attacks using memcached.
Change-Id: I8fb81d7f3938b04ff7652e30de35a1ec23ae723d
Related-Bug: #1754607
(cherry picked from commit 2b37b726aa
)
This commit is contained in:
parent
9ac2d8b500
commit
d373df5ff8
|
@ -27,6 +27,16 @@ parameters:
|
|||
MonitoringSubscriptionMemcached:
|
||||
default: 'overcloud-memcached'
|
||||
type: string
|
||||
MemcachedIpSubnet:
|
||||
default: ''
|
||||
description: IP address/subnet on the memcached network. If empty (default), MemcachedNetwork
|
||||
will be taken. Useful in the case where an operator wants to open Memcached outside
|
||||
of the internal network. Use this parameter with caution and be aware of
|
||||
opening memcached to external network can be dangerous.
|
||||
type: string
|
||||
|
||||
conditions:
|
||||
memcached_network_unset: {equals : [{get_param: MemcachedIpSubnet}, '']}
|
||||
|
||||
outputs:
|
||||
role_data:
|
||||
|
@ -35,6 +45,11 @@ outputs:
|
|||
service_name: memcached
|
||||
monitoring_subscription: {get_param: MonitoringSubscriptionMemcached}
|
||||
config_settings:
|
||||
memcached_network:
|
||||
str_replace:
|
||||
template: "NETWORK_subnet"
|
||||
params:
|
||||
NETWORK: {get_param: [ServiceNetMap, MemcachedNetwork]}
|
||||
# NOTE: bind IP is found in Heat replacing the network name with the local node IP
|
||||
# for the given network; replacement examples (eg. for internal_api):
|
||||
# internal_api -> IP
|
||||
|
@ -42,9 +57,23 @@ outputs:
|
|||
# internal_api_subnet - > IP/CIDR
|
||||
memcached::listen_ip: {get_param: [ServiceNetMap, MemcachedNetwork]}
|
||||
memcached::max_memory: {get_param: MemcachedMaxMemory}
|
||||
# https://access.redhat.com/security/cve/cve-2018-1000115
|
||||
# Only accept TCP to avoid spoofed traffic amplification DoS on UDP.
|
||||
memcached::udp_port: 0
|
||||
tripleo.memcached.firewall_rules:
|
||||
'121 memcached':
|
||||
dport: 11211
|
||||
# https://access.redhat.com/security/cve/cve-2018-1000115
|
||||
# Only accept TCP to avoid spoofed traffic amplification DoS on UDP.
|
||||
proto: 'tcp'
|
||||
# Memcached traffic shouldn't be open on the internet.
|
||||
# Even if binding is configured on internal_api network, enforce it
|
||||
# via firewall as well.
|
||||
source:
|
||||
if:
|
||||
- memcached_network_unset
|
||||
- "%{hiera('memcached_network')}"
|
||||
- {get_param: MemcachedIpSubnet}
|
||||
step_config: |
|
||||
include ::tripleo::profile::base::memcached
|
||||
service_config_settings:
|
||||
|
|
|
@ -0,0 +1,4 @@
|
|||
---
|
||||
security:
|
||||
- |
|
||||
Restrict memcached service to TCP and internal_api network (CVE-2018-1000115).
|
Loading…
Reference in New Issue