https://bugzilla.redhat.com/show_bug.cgi?id=1518093
--- Comment #4 from M. Scherer <msche...@redhat.com> --- Ok so trying to figure a bit more how I would attack that if i was given a server with root access. That's purely theorical, cause I think no one will pull this off. Assuming someone is root on the builder, even with the lan locked down, someone malicious could wreck havoc with IP/MAC on the internal lan, resulting into potential MITM (if someone steal the ip of the internal squid/unbound). Itself, it shouldn't cause much trouble, but someone doing mitm on git.gluster.org could inject code in the build, thus resulting into compromission of more internal builders. This wouldn't result into much however. We have the issue of keepalived not encrypting the VRRP password (https://louwrentius.com/configuring-attacking-and-securing-vrrp-on-linux.html ), which could result into more way to do MITM (this time on the firewall level), which isn't great either. So that would result into MITM either on squid/unbound side, on the proxy side, or on the firewall. We have the issue of using gluster for proxy internally, which may need some care since we just found a ton of issue last month: https://access.redhat.com/errata/RHSA-2018:2608 and so I would like to do more hardening on this side. I am also unsure on the auth we are using, cause if a user can use a MITM to be part of the gluster cluster, that would permit to steal the lets encrypt certs, then the same attacker can decode the traffic on the proxy side. But that's a bit far fetched, and there isn't any auth or anything worth anyway. So, nothing urgent come to mind (even if the MITM is kinda bad, but I think nothing critical would happen, just dos/disruption), and maybe I am just too cautious, but I am a bit uneasy for now. I wonder if this couldn't be used for that: https://github.com/gravitational/teleport Since I guess adding logging/audit would likely help a lot to deter a attacker -- You are receiving this mail because: You are on the CC list for the bug. Unsubscribe from this bug https://bugzilla.redhat.com/token.cgi?t=5HtWqOEH44&a=cc_unsubscribe _______________________________________________ Gluster-infra mailing list Gluster-infra@gluster.org https://lists.gluster.org/mailman/listinfo/gluster-infra