Controls/gitea-pages
0
2
Fork 0
Code Pull Requests Actions Activity

add ideas for DMZ infrastructure

Browse Source
This commit is contained in:
ebner
2022-12-14 17:35:35 +01:00
parent 87f1ed6b19
commit 2e433d700f
2 changed files with 401 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

413
proposals/draft_infrastructure_security_concept.drawio.svg
View File

File diff suppressed because one or more lines are too long
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 76 KiB

After

Width:  |  Height:  |  Size: 106 KiB

21
proposals/draft_infrastructure_security_concept.md
View File

@@ -1,3 +1,22 @@
# [DRAFT] Core Infrastructure Security Concept
![](draft_infrastructure_security_concept.drawio.svg)
![](draft_infrastructure_security_concept.drawio.svg)
## DMZ
* There is a dedicated and additionally protected (firewall) infrastructure network within the DMZ
* This network holds the provisining infrastructure and is used for staging new nodes
* After new nodes are staged and hardened the nodes are moved out into the "real" DMZ network(s)
* VLAN and IP need to be changed
* Node will be still able to connect to the repo server as well as puppet and metric server in the infrastructure network (this way it is ensured that nodes are actively managed and still get updates)
The content of the repos in the DMZ are pushed from the PSI network. The repo servers in the DMZ only hold the latest packages - we do not have snapshotting, etc. (need to be discussed).
### TODO
* we need to define a dedicated DMZ stack
* minimal os / software stack
* firewall enabled and blocking everything except the specially configured ports
* Every node in the DMZ must have a responsible person (it would be better group)!
* Maybe have one group that takes care of all DMZ servers?