[Music]
Welcome to IBM Smart Business Development & Test on the IBM Cloud. As a member of the
team, I would like to show you how to configure the firewall settings on the IBM Smart Business
Development & Test on the IBM Cloud.
By the way, I will use the word instance interchangeably with the words virtual machines and
VMs. There are two levels of firewalls available within the IBM Development and Test Cloud.
The OS level settings, for example the IP tables for Linux and the hypervisors parameters .xml
settings for each virtual machine.
First let’s talk about the OS Level Firewall. Please note, the following simple examples do not
reflect recommended settings. These simples examples are for instructional purposes. In this
example, I will choose Linux as my virtual machine’s operating system. The IP tables file controls
the ports and IP traffic for Linux. Typically we work with the IP tables first and when the
environment is fine tuned and fully tested we then adjust the hypervisor firewalls.
For this reason, all inbound ports are open by default in the hypervisor firewalls for every IBM
based image. Let’s start with the IP tables file. To access it, we will SSH into the running VM.
In Video #@, I demonstrated how to configure SSH and connect to a running instance in the
Cloud. Briefly, I pasted the instance’s IP address into putty and clicked open. And then a
command prompt for IDCUser opened allowing me to access the instance.
I type sudo dash to become root. Then type CD / etc/sysconfig to access the necessary
subdirectory. Next type VI IPTables to see what ports are configured by default. The editor
shows me that only Port 22 is open. This is the default.
In an alternate example shown here, Rational Quality Manager was provisioned in the instance
so we can see that the following ports have already been opened in the installation time. 22, 80,
43, 5555, 5802 and 5902. But let’s return to our example where only Port 22 is opened.
Now that I have confirmed that only Port 22 is opened, I will quit the VI editor. To do this I will
press the escape key on my keyboard and then type :q. We are now back at the command
prompt.
To open Port 80, I type the following command /sbin/iptables-A INPUT–p tcp--dport 80 –j
ACCEPT.
To save the changes to the IP tables I type /sbin/service iptables save.
Restart the IP Tables service with the command /sbin/service iptables restart.
Just to check that we have the proper changes in IP tables, I will type VI iptables. Port 80 has
been added to IP tables. I press the escape key on my keyboard and then type :q to leave the
editor and now we are back to the command prompt.
I click on the X in the upper right to close this window.
To help determine which ports to modify, these URLs provide examples for configuring IP tables
for Linux. It is important to remember that each instance or using different terms, each VM
contains its own IP tables. Typically the administrator will open only the OS ports required for
their specific applications to communicate with the outside world. As the environment is fine
tuned, the administrator adjusts the OS level ports and then finally to help ensure extra security,
the administrator will close all but the necessary ports within hypervisor.
If for some reason, such as user level, the OS level ports are opened, then the hypervisor port
will block improper traffic.
Okay, we’ve discussed the OS level firewall adjustments. Now let’s turn to the hypervisor
configuration. The hypervisor’s ports and IP traffic are controlled by the parameters.xml file. By
default they are open in the IBM supplied base images.
Let’s assume that I have installed the applications in my Cloud environment, tested the system
and fine tuned the IP tables. Now I’m ready to reflect the port settings in the hypervisor. For
Cloud work, the parameters.xml file is only accessible within the stored image. The running
instance does not provide access to this file.
We will first create a private image and then modify the parameter.xml file and then provision
instances from that modified and saved image.
First, let’s create a private image from the currently running instance. I have selected the
instance QA Testing 6 and so I am ready to click on the create private image link. We need a
name for this image. In this example, will call it Eagle Private Image. The progress indicator
spins for a few second. We see that the request has been submitted.
I click the image’s sub-tab to track the progress of the new image as it is being created and after
an hour or so of copying we can see the status of the private image change to available.
Now I will click on the view asset catalog link so we can work with the parameters.xml file of the
image titled Eagle Private Image. This service is called the Rational Asset Catalog. We will cover
this service more completely in demos 8 and 9.
My Eagle Private Image is easily found here in the list. However, this list contains both the IBM
public assets as well as all of my company’s private assets so there could be hundreds of images
here. If I could not easily find my image, I could use the search for assets function. But the
easiest way to find my asset is to click the My Dashboard tab to see all of the images that I own.
Here on the My Dashboard tab is a complete list of my images.
Let’s click the Eagle Private image link. Then click the content tab. To download the
parameters.xml file, I right click on the file name and select save link as to save it to my local disk.
Using an editor, I open the parameters.xml file and see these lines. Please note, typically all
inbound ports are by default open in the hypervisor firewalls for the IBM supplied base images.
A firewall rule is defined by the xml in between the opening rule and closing rule. Source,
specifies the IP address and net mask from which traffic is to be allowed. In this example
0.0.0.0/0 allows traffic from any IP address.
Min port and max port specify a range of ports for which traffic is opened. In this example the
range specifies all ports from Port 1 to Port 65535. All of these ports are open to traffic.
Schema definition for the parameters.xml file can be found in the appendix of the creating and
customizing images document in the Rational Asset Catalog in the documentation library. First, I
will delete the rule that opens all ports from 1-65535.
Next I will create three new port openings. The specific configuration of the xml displayed here
on the screen will open traffic from all IP addresses to Port 22 which is the SSH function. Port 80
which is the http function and Port 443 which is the https function. Additional ports may appear
in my parameters.xml file based upon the needs of other applications that are included within
the image.
Once I have completed modifications of the parameters.xml file, I save the file and now I am
ready to upload the modified parameters.xml file. As my mouse hovers over the pencil icon in
the upper right, I see the text, modify. I click on the pencil icon and now I can see the details for
the content of this private image.
I click browse. The file upload dialog box appears. I select the newly modified parameters.xml
file and click open. I can see the correct file in the entry field so I click the upload button. I
enter a statement about what changes I am making to this file and click upload. A message in
blue appears at the top indicating success.
I click the content link and here is a listing of files for the asset. The parameters.xml file has
today’s date indicating the file was changed today. But just to make sure, I click on the
parameters.xml file and I see that the file contains the updates that I just added.
I close this and now I’m ready to deploy my asset entitled Eagle Private Image. The port rules
and parameters.xml are applied when I deploy the modified instance of this image. If there are
any instances still running from the time before I modified the parameters.xml file those
instances will not be affected by these changes.
I leave the Rational Asset Catalog by clicking on the exit catalog button. We are back to the
images tab. I can select my Eagle Private Image and then click the create instance link to deploy
as many instances that I need from this private image. The hypervisor’s firewall will now reflect
the modifications made to the ports. This completes our demo.
To learn more about IBM and its Cloud initiatives, please visit IBM.com/Cloud. Thank you.
[Music]