DCO ports issue

[DCIM_Support]

Dear All,

Good day.

Recently I facing some problem on DCE and DCO ports issue. When I do a ports scanning. Found out there are 2 ports open for each DCE and DCO

10.182.12.12 - DCE ports 80 and 1080 was open

10.182.12.13 - DCO ports 22 and 80 was open

Is it advisable to close the ports?

For DCE ports, I manage to do it from the System Administration Setting - Server Access

For DCO ports, do we have any configuration or setting to close the ports?

(CID:93913142)

[DCIM_Support]

Hi, Daniel!

This customer use 443 port to work with Operation server via client, I guess...

In other way it will be unresponsible, because Operaitons's client use 80 port for server connections.

If you want to close 22 port, you need to stop ssh service. Login to server via console and run sudo service ssh stop command. 22 port will be closed.

I'm not sure, but 80 port you can close from webmin: System -> Apache Webserver -> Global Configuration -> Networking and Addresses and set radiobutton to none or change port number.

(CID:93913194)

[DCIM_Support]

Hi Daniel,

For DCO it is not supported to stop the SSH service or changing the Apache configuration. Even though it might be possible it is not supported.

We are testing our application using various Network/Software scanning tools to make sure it is safe and without security vulnerabilities. StruxureWare Data Center Operation security

Please let us know if this answers your question.

(CID:93913317)

[DCIM_Support]

Hi Valentin Kozlov & Soren Bruncke Mikkelsen,

Thank you for your advice and reply.

We did show the test and vulnerabilities from the StruxureWare Data Center Operation security to the customer. Yet they still insist that what is the data sent through the open port. Want us to capture the package from the port to show them.

According to customer, their entire Data Center, they will not use port 80. That's is why they want us to show it is save to be use if we cannot close it.

Will there be any effect is we close the ports 22 and 80 for DCO?

(CID:93913346)

[DCIM_Support]

Hi Daniel,

The ports cannot be closed. That will impact the server functionality and performance.

If there are no "clients" connecting to the ports no activity will happen on the ports. And the security scans should indicate that they are safe StruxureWare Data Center Operation Software Vulnerability Scans 

(CID:93913377)

[DCIM_Support · Accepted solution]

Hi Daniel,
I am one of the engineers responsible for this part of DCO.

In all DCO servers, we have a health checking monitor running on server. One of its responsibilities is to make certain that apache is functioning correctly. Currently, this is done by asserting that we can connect to port 80 and get a successful response.

This is the reason why port 80 needs to be open.

If the customer wants to investigate the communication that goes on on port 80, he can inspect apache's access logs on the server (/var/log/apache2/access.log on debian).

You could experiment with configuring the firewall to block requests that are not local to the node (or cluster). This could work, but it is not something that we have tested thoroughly and as such is not recommended use of the system.

Closing port 22 is another matter. In a cluster, the nodes use ssh to exchange information. This is a requirement for running a cluster. The communication is secured by a certificate that is exchanged between the servers at setup time.

(CID:93913477)

[DCIM_Support]

Hi All,

Thank your for your reply and advice. Very much appreciated. I will feedback to my teammate on this issue.

(CID:93913517)

[DCIM_Support]

This question is closed for comments. You're welcome to start a new topic if you have further comments on this issue.