diff --git a/proposals/draft_infrastructure_security_concept.drawio.svg b/proposals/draft_infrastructure_security_concept.drawio.svg index 11b00ea7..77119e06 100644 --- a/proposals/draft_infrastructure_security_concept.drawio.svg +++ b/proposals/draft_infrastructure_security_concept.drawio.svg @@ -1,7 +1,7 @@ - + - + @@ -10,7 +10,7 @@ -
+
https/443 @@ -20,7 +20,7 @@
- + https/443... @@ -40,7 +40,7 @@
- + 443...
@@ -50,7 +50,7 @@ -
+
443 @@ -58,7 +58,7 @@
- + 443 @@ -87,16 +87,18 @@ -
+
+ http/80 +
https/443
- - https/443 + + http/80... @@ -136,7 +138,7 @@
- + tftp... @@ -146,7 +148,7 @@ -
+
443 @@ -222,7 +224,7 @@ - + @@ -266,7 +268,7 @@ -
+
5665 @@ -274,7 +276,7 @@
- + 5665 @@ -301,7 +303,7 @@ -
+
???? @@ -309,7 +311,7 @@
- + ???? @@ -336,7 +338,7 @@ -
+
@@ -358,7 +360,7 @@
- + nrpe... @@ -404,7 +406,7 @@ -
+
https @@ -412,7 +414,7 @@
- + https @@ -614,7 +616,7 @@ -
+
???? @@ -622,7 +624,7 @@
- + ???? @@ -632,7 +634,7 @@ -
+
@@ -654,7 +656,7 @@
- + nrpe... @@ -664,7 +666,7 @@ -
+
@@ -808,7 +810,7 @@ -
+
???? @@ -816,7 +818,7 @@
- + ???? @@ -826,7 +828,7 @@ -
+
5665 @@ -834,7 +836,7 @@
- + 5665 @@ -868,7 +870,7 @@ -
+
5665 @@ -876,11 +878,358 @@
- + 5665 + + + + + +
+
+
+ Staging / Infrastructure Network +
+
+
+
+ + Staging / Infrastructure Network + +
+
+ + + + +
+
+
+ YUM Repos DMZ +
+
+
+
+ + YUM Repos DMZ + +
+
+ + + + +
+
+
+ puppet DMZ +
+
+
+
+ + puppet DMZ + +
+
+ + + + +
+
+
+ Metrics DMZ +
+
+
+
+ + Metrics DMZ + +
+
+ + + + + +
+
+
+ https/443 +
+
+
+
+ + https/443 + +
+
+ + + + + +
+
+
+ 8140 +
+
+
+
+ + 8140 + +
+
+ + + + +
+
+
+ node +
+ (staging) +
+
+
+
+ + node... + +
+
+ + + + +
+
+
+ node +
+ (production) +
+
+
+
+ + node... + +
+
+ + + + +
+
+
+ PXE +
+ sysdb +
+
+
+
+ + PXE... + +
+
+ + + + + +
+
+
+ tftp +
+ http/80 +
+ https/443 +
+
+
+
+ + tftp... + +
+
+ + + + + +
+
+
+ https/443 +
+
+
+
+ + https/443 + +
+
+ + + + + +
+
+
+ https/443 +
+
+
+
+ + https/443 + +
+
+ + + + + +
+
+
+ 8140 +
+
+
+
+ + 8140 + +
+
+ + + + + +
+
+
+ https/443 +
+
+
+
+ + https/443 + +
+
+ + + + + + +
+
+
+ once systems are staged and hardned, they are moved out into production-dmz network +
+
+
+
+ + once syste... + +
+
+ + + + + +
+
+
+ https/443 +
+
+
+
+ + https/443 + +
+
+ + + + +
+
+
+ Firewall +
+
+
+
+ + Firewall + +
+
+ + + + + + +
+
+
+ we push the content of the repo to the repo server from the internal infrastructure +
+
+
+
+ + we push the content of the repo... + +
+
+ + + + + +
+
+
+ ssh/22 +
+
+
+
+ + ssh/22 + +
+
diff --git a/proposals/draft_infrastructure_security_concept.md b/proposals/draft_infrastructure_security_concept.md index 047fcd81..c7c1b7e3 100644 --- a/proposals/draft_infrastructure_security_concept.md +++ b/proposals/draft_infrastructure_security_concept.md @@ -1,3 +1,22 @@ # [DRAFT] Core Infrastructure Security Concept -![](draft_infrastructure_security_concept.drawio.svg) \ No newline at end of file +![](draft_infrastructure_security_concept.drawio.svg) + + +## DMZ +* There is a dedicated and additionally protected (firewall) infrastructure network within the DMZ +* This network holds the provisining infrastructure and is used for staging new nodes +* After new nodes are staged and hardened the nodes are moved out into the "real" DMZ network(s) + * VLAN and IP need to be changed + * Node will be still able to connect to the repo server as well as puppet and metric server in the infrastructure network (this way it is ensured that nodes are actively managed and still get updates) + +The content of the repos in the DMZ are pushed from the PSI network. The repo servers in the DMZ only hold the latest packages - we do not have snapshotting, etc. (need to be discussed). + +### TODO +* we need to define a dedicated DMZ stack + * minimal os / software stack + * firewall enabled and blocking everything except the specially configured ports + + +* Every node in the DMZ must have a responsible person (it would be better group)! + * Maybe have one group that takes care of all DMZ servers?