Bug #6428: Syslog accept reports from non-accepted nodes - Rudder - Issue Tracker

Custom queries

8.1 beta
Bugs triage
CS - by priority
CS - to review
My TR
Need technical review
Open bugs (all)
Open bugs (UI - UX)
Open UX defects (all)
Opened by users

Actions

Copy link

Bug #6428

closed

Syslog accept reports from non-accepted nodes

Added by François ARMAND over 9 years ago. Updated over 5 years ago.

Status:

Rejected

Priority:

N/A

Assignee:

Category:

System integration

Target version:

4.1.22

Pull Request:

Severity:

Critical - prevents main use of Rudder | no workaround | data loss | security

UX impact:

User visibility:

Operational - other Techniques | Technique editor | Rudder settings

Effort required:

Large

Priority:

Name check:

Fix check:

Regression:

Description

We don't refuse reports from non-accepted node. That may cause disponibility problem (DoD, filling of the base leading to slow query or filling of the harddrive, etc) and since 3.0, it may display erroneous "changes" for rules.

Related issues 1 (0 open — 1 closed)

Related to Rudder - Bug #6481: Create a rudder variable containing all IP of agents

Released

François ARMAND

2015-04-09

Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by François ARMAND over 9 years ago

Most likelly we need to use: http://www.rsyslog.com/doc/rsconf1_allowedsender.html and have system rules for relays and root server that configure them correctly.

Actions

Copy link

Updated by François ARMAND over 9 years ago

Parent task set to #6363

Actions

Copy link

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 2.10.12 to 2.10.13

Actions

Copy link

Updated by Benoît PECCATTE over 9 years ago

I tried with 8000 entries in rsyslog: there is no difference when starting rsyslog nor when sending a log line.
So this should not impact performances.

Actions

Copy link

Updated by Benoît PECCATTE over 9 years ago

Status changed from 8 to Discussion
Assignee set to Nicolas CHARLES

We are missing the list of IP to be authorized somewhere in a a rudder variable.

But do not have them yet since there is a problem getting those IP:
- If there is a NAT
- If there is more than one IP on the agent

Alternatives are:
- using hostname and reverse DNS : big performance hit and probably not available in rsyslog
- trying to collect real source ip from agents : we would need to find the information and to manage configuration transition
- using only the allowed network : easy but does not solve the case of removed agent

NCH, do you have an idea ?

Actions

Copy link

Updated by Benoît PECCATTE over 9 years ago

- If there is more than one IP on the agent
-> allow all IPs of each node

- If there is a NAT
-> in this case the used should have already disabled "Use reverse DNS"
-> use only ALLOWED_NETWORKS and not each IP individually

Actions

Copy link

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 2.10.13 to 2.10.14

Actions

Copy link

Updated by Benoît PECCATTE over 9 years ago

Parent task changed from #6363 to #6589

Actions

Copy link

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 2.10.14 to 2.10.15

Actions

Copy link

#10

Updated by Vincent MEMBRÉ over 9 years ago

Parent task deleted (~~#6589~~)

Actions

Copy link

#11

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 2.10.15 to 2.10.14

Actions

Copy link

#12

Updated by Vincent MEMBRÉ over 9 years ago

Status changed from Discussion to Pending technical review

Actions

Copy link

#13

Updated by Vincent MEMBRÉ over 9 years ago

Status changed from Pending technical review to Pending release

Actions

Copy link

#14

Updated by Vincent MEMBRÉ over 9 years ago

Status changed from Pending release to Released

Edit: We thought this bug was fixed in 3.0.5 but clearly this is not working, more explanantion in a following update

Actions

Copy link

#15

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 2.10.14 to 3.0.5

Actions

Copy link

#16

Updated by Vincent MEMBRÉ over 9 years ago

Status changed from Released to New
Assignee changed from Nicolas CHARLES to Benoît PECCATTE
Target version changed from 3.0.5 to 3.0.6

The fix provided in #6507, was not functionning and reverted by #6761.

We still keep the added variable in #6498 in 3.0.6 even if it is not really used

Actions

Copy link

#17

Updated by Vincent MEMBRÉ over 9 years ago

Related to Bug #6481: Create a rudder variable containing all IP of agents added

Actions

Copy link

#18

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 3.0.6 to 3.0.7

Actions

Copy link

#19

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 3.0.7 to 3.0.8

Actions

Copy link

#20

Updated by Vincent MEMBRÉ over 9 years ago

Target version changed from 3.0.8 to 3.0.9

Actions

Copy link

#21

Updated by Vincent MEMBRÉ about 9 years ago

Target version changed from 3.0.9 to 3.0.10

Actions

Copy link

#22

Updated by Vincent MEMBRÉ about 9 years ago

Target version changed from 3.0.10 to 3.0.11

Actions

Copy link

#23

Updated by Vincent MEMBRÉ about 9 years ago

Target version changed from 3.0.11 to 3.0.12

Actions

Copy link

#24

Updated by Vincent MEMBRÉ almost 9 years ago

Target version changed from 3.0.12 to 3.0.13

Actions

Copy link

#25

Updated by Vincent MEMBRÉ almost 9 years ago

Target version changed from 3.0.13 to 3.0.14

Actions

Copy link

#26

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.0.14 to 3.0.15

Actions

Copy link

#27

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.0.15 to 3.0.16

Actions

Copy link

#28

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.0.16 to 3.0.17

Actions

Copy link

#29

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.0.17 to 302

Actions

Copy link

#30

Updated by Alexis Mousset over 8 years ago

Target version changed from 302 to 3.1.12

Actions

Copy link

#31

Updated by Vincent MEMBRÉ over 8 years ago

Target version changed from 3.1.12 to 3.1.13

Actions

Copy link

#32

Updated by Vincent MEMBRÉ about 8 years ago

Target version changed from 3.1.13 to 3.1.14

Actions

Copy link

#33

Updated by Vincent MEMBRÉ about 8 years ago

Target version changed from 3.1.14 to 3.1.15

Actions

Copy link

#34

Updated by Vincent MEMBRÉ about 8 years ago

Target version changed from 3.1.15 to 3.1.16

Actions

Copy link

#35

Updated by Vincent MEMBRÉ about 8 years ago

Target version changed from 3.1.16 to 3.1.17

Actions

Copy link

#36

Updated by Vincent MEMBRÉ almost 8 years ago

Target version changed from 3.1.17 to 3.1.18

Actions

Copy link

#37

Updated by Vincent MEMBRÉ almost 8 years ago

Target version changed from 3.1.18 to 3.1.19

Actions

Copy link

#38

Updated by Jonathan CLARKE over 7 years ago

Severity set to Critical - prevents main use of Rudder | no workaround | data loss | security
User visibility set to Operational - other Techniques | Technique editor | Rudder settings
Priority set to 50

I assume this would be simple enough to do based solely on allowed networks?

Actions

Copy link

#39

Updated by Vincent MEMBRÉ over 7 years ago

Target version changed from 3.1.19 to 3.1.20

Actions

Copy link

#40

Updated by Jonathan CLARKE over 7 years ago

Assignee deleted (~~Benoît PECCATTE~~)

Actions

Copy link

#41

Updated by Benoît PECCATTE over 7 years ago

As demonstrated by the previous attempt in #6761, doing this makes rsyslog segfault.
So let's do the simple version with allowed network.

Actions

Copy link

#42

Updated by Vincent MEMBRÉ over 7 years ago

Target version changed from 3.1.20 to 3.1.21

Actions

Copy link

#43

Updated by Vincent MEMBRÉ over 7 years ago

Target version changed from 3.1.21 to 3.1.22

Actions

Copy link

#44

Updated by Benoît PECCATTE over 7 years ago

Priority changed from 50 to 63

Actions

Copy link

#45

Updated by Vincent MEMBRÉ over 7 years ago

Target version changed from 3.1.22 to 3.1.23

Actions

Copy link

#46

Updated by Vincent MEMBRÉ about 7 years ago

Target version changed from 3.1.23 to 3.1.24

Actions

Copy link

#47

Updated by Vincent MEMBRÉ about 7 years ago

Target version changed from 3.1.24 to 3.1.25

Actions

Copy link

#48

Updated by Vincent MEMBRÉ almost 7 years ago

Target version changed from 3.1.25 to 387

Actions

Copy link

#49

Updated by Vincent MEMBRÉ almost 7 years ago

Target version changed from 387 to 4.1.10

Actions

Copy link

#50

Updated by Benoît PECCATTE almost 7 years ago

Effort required set to Large
Priority changed from 63 to 38

There is no simple version based on allowed network, since the problem is rsyslog itself.
"Some versions of rsyslog segfaults when receiving logs from disallowed senders. It happens only on TCP."

As long as we support those versions, we are stuck.

Actions

Copy link

#51