D4Science Infrastructure

On node51.p (pre production host) there are the following services:

• executionengineservice-search
• searchsystemservice

I'm going to analyze the logs

If there isn't an apache frontend on this host, I think is better to disable the 8009 port in the server.xml file. I think someone could abuse of 8009 port as happened in the latest days.
What do you think about it?

It surely needs to be closed.

The ajp port is always of no use on our systems, because we always use the http port even for the apache frontends.
Even if we wanted to use it, it should be configured to bind on localhost only.

I'm more worried about the udp port 4446, is it open by one of the d4science services?

I don't know this. The d4science services hosted on this VM are related to an elastic search cluster and, maybe, this port is used for this. I've added John to this ticket, maybe John can answer to this question.

Searchsystem service communicates with elasticsearch, which is on another vm and with pottal.

To my knowledge, elasticsearch does not use the port 4446. Moreover, searchsystem exploits elasticsearch through http rest api, so there is no need for other communication to elasticsearch node. Portal exploits searchsearvice throught resultset which communicates at another port (e.g. 4000-4010).

I searched logs of elasticsearch, searchsystem and portal of the development environment and didn't find 4446 port exploitation.

At least, we could limit access to the production subnet? Otherwise, if there is a change in firewall, we have to check the status of the services.

as John said, for this VM I think is better to limit access to our subnet. The services hosted on node51.p have to communicate with: DTS, index-service, portal, Information-System and Registry of preproduction environment. All these services are deployed to CNR, so, I think we could try to restrict the access to the CNR net.

Well, search services should be publicly available for REST APIs also, as such, 8080 should be public at least. We could only protect irrelevant ports with the services, such as 8009. Correct me if I am wrong.

Port 8009 is now closed. What's worrying me is udp 4446, it's opened by one of the tomcat webapps but I don't know if it's used by some services.

I suggest limiting 4446 to subnet only.

I've notice on node51.p there are the ehcache jars. I don't know how the ehcache is configured but I've seen that a kind of setting is:

<cacheManagerPeerProviderFactory
class="net.sf.ehcache.distribution.RMICacheManagerPeerProviderFactory"
properties="peerDiscovery=automatic, multicastGroupAddress=230.0.0.1,
multicastGroupPort=4446, timeToLive=32"/>

with multicastGroupPort=4446....
Maybe the 4446 port is used by ehcache ?

Yes searchsystem uses ehcache and the default port of ehcache is 4446.

John Gerbesiotis wrote:

Yes searchsystem uses ehcache and the default port of ehcache is 4446.

And that port is effectively used to talk with other instances?
In a tcpdump session I've seen only broadcast traffic from other - completely unrelated - servers that happen to live on the same network.

Andrea, do you want to add an iptables rule for this port?

Yes. I'd limit it to localhost only if it does not need to talk to anyone else.

No it is a feature of ehcache that is not being exploited. Searchsystem's ehcache does not talk with other service instances. It is enabled by default.