Ceph Storage Cluster Security Hardening

Ceph Security Hardening

Ceph Storage Cluster Security Hardening CephX Encryption Network Firewall Access Control Audit SELinux dmcrypt TLS ป้องกันแฮก

เนื้อหาเกี่ยวข้อง — แนะนำให้อ่าน Python Pydantic CQRS Event Sourcing

Layer	Threat	Mitigation	Priority
Authentication	Unauthorized Access	CephX + Least Privilege	Critical
Encryption (Transit)	Traffic Sniffing	msgr2 secure + TLS	Critical
Encryption (Rest)	Disk Theft	dmcrypt + SSE-KMS	High
Network	Network Attack	Firewall + Separate Networks	Critical
Access Control	Over-privilege	Per-pool Capabilities	High
Audit	Undetected Breach	Logging + Monitoring	High

Network & Firewall

# === Network Security & Firewall Rules ===



# Firewall Rules (firewalld)

# # Monitor nodes

# firewall-cmd --zone=ceph --add-port=3300/tcp --permanent  # msgr2

# firewall-cmd --zone=ceph --add-port=6789/tcp --permanent  # msgr1

#

# # OSD nodes

# firewall-cmd --zone=ceph --add-port=6800-7300/tcp --permanent

#

# # Dashboard

# firewall-cmd --zone=mgmt --add-port=8443/tcp --permanent

#

# # RGW

# firewall-cmd --zone=public --add-port=443/tcp --permanent

#

# # Restrict source IPs

# firewall-cmd --zone=ceph --add-source=10.0.0.0/24 --permanent

# firewall-cmd --reload

#

# ceph.conf Network Separation

# [global]

# public_network = 10.0.1.0/24

# cluster_network = 10.0.2.0/24



@dataclass

class FirewallRule:

    service: str

    port: str

    zone: str

    source: str

    note: str



rules = [

    FirewallRule("Monitor (msgr2)", "3300/tcp",

        "ceph", "10.0.0.0/24 (Ceph nodes + Clients)",

        "จำกัดเฉพาะ Ceph Network"),

    FirewallRule("Monitor (msgr1)", "6789/tcp",

        "ceph", "10.0.0.0/24",

        "Legacy protocol ปิดถ้าใช้ msgr2 อย่างเดียว"),

    FirewallRule("OSD", "6800-7300/tcp",

        "cluster", "10.0.2.0/24 (Cluster Network only)",

        "เปิดเฉพาะ Cluster Network ไม่เปิด Public"),

    FirewallRule("Dashboard", "8443/tcp",

        "mgmt", "10.0.100.0/24 (Management Network)",

        "เข้าผ่าน VPN หรือ Bastion Host เท่านั้น"),

    FirewallRule("RGW (S3 API)", "443/tcp",

        "public", "Application Subnet",

        "ผ่าน Load Balancer + WAF ถ้าเปิด Public"),

]



print("=== Firewall Rules ===")

for r in rules:

    print(f"  [{r.service}] Port: {r.port}")

    print(f"    Zone: {r.zone} | Source: {r.source}")

    print(f"    Note: {r.note}")