GNOME Bugzilla – Bug 621236
Remove firewalling of fixed.gnome.org:9070
Last modified: 2010-12-02 18:36:00 UTC
The buildbot master is running on fixed.gnome.org, port 9070; at the moment the port is firewalled so it's necessary for build slaves to have a fixed IP address, and to register those. As it would be really useful to have more build slaves, it would be really nice if that rule could be removed. Thanks.
I'd still be interested in this.
What are the implications of globally opening this port on the host firewall? Is there any application-level restrictions that can be put in place (ie; you can limit the build slaves at the application, and don't need to rely on us to update iptables)? What other security concerns might we face by globally allowing this port? Can anyone attach a build server to this port? What consequences would this have? If you could give me a better idea of how the build master/slave process works I (we) can better determine the possibility of this request.
(In reply to comment #2) > What are the implications of globally opening this port on the host firewall? > Is there any application-level restrictions that can be put in place (ie; you > can limit the build slaves at the application, and don't need to rely on us to > update iptables)? > > What other security concerns might we face by globally allowing this port? Can > anyone attach a build server to this port? What consequences would this have? No, not anyone can attach a build slave. In order to attach a new build slave you need a login and a password. The list of allowed build slaves are saved as part of the configuration of the master installed at RHEL5. The idea is that the build brigade maintainers (AFAIK: Olav, Frederic, Iago an me) would give a login and password to any allowed slave. But as the description says, due this firewall rule, it is also required to ask sysadmin to include the new IP. > If you could give me a better idea of how the build master/slave process works > I (we) can better determine the possibility of this request. CCing myself in order to try to answer any other question. More information here: http://live.gnome.org/BuildBrigade/DocsAndGuides
Based on this further information I'm comfortable opening the port globally. I'll update the firewall now (I'll include a backup of the original at /etc/sysconfig/iptables-2010-12-02). Closing ticket.