Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • All network connections make use of HTTP
    • Connections from a user browser to the JOC Cockpit
    • Connections from the PowerShell CLI to the JOC Cockpit REST Web Service
    • Connections from the JOC Cockpit REST Web Service to the JobScheduler Master
    • Connections from the JobScheduler Master to Agents
  • Port Usage
    • The JOC Cockpit can be accessed at port 4446
    • The JOC Cockpit REST Web Service can be accessed at port 4446
    • The JobScheduler Master uses the following ports:
      • Access to the JobScheduler Master Web Service at port 40444
      • Access to the JobScheduler Master via TCP at port 44444444 
        Display feature availability
        EndingWithRelease1.12
      • Access to the JobScheduler Master via UDP at port 44444444 
        Display feature availability
        EndingWithRelease1.12
      • The TCP port 4444 and HTTP port 40444 enable access to the "classic" JOC GUI. 
        JIRA
        columnskey,summary,type,created,updated,due,assignee,reporter,priority,status,resolution
        serverSOS JIRA
        serverId6dc67751-9d67-34cd-985b-194a8cdc9602
        keyJOC-304
    • The JobScheduler Agent listens to port 4445
  • Network Interface Usage
    • By default JobScheduler components will listen to the above mentioned ports on all available network interfaces.
  • Firewall Settings
    • Open ports in your firewall exclusively for the hosts, protocols and ports as specified above. Consider allowing connections only for the directions indicated in the diagram above.

...

  • Configure network connections to use HTTPS
    • The use of HTTPS includes users providing valid certificates for the hosts that JobScheduler components are operated for. The use of self-signed certificates is a no-go.
    • As HTTPS is restricted to secure the connection, in addition authentication is added to the configuration, e.g. when using HTTPS then a JobScheduler Master is configured to authenticate with an Agent in order to guarantee that the Master is what it claims to be and is entitled to access an Agent.
    • For detailed instructions on the configuration see:
  • Drop the JobScheduler Master TCP / UDP port:
    • This port is not required for standard operation with releases starting from 1.11. 
    • This port is required for previous releases that include the "classic" JOC GUI running in the JobScheduler Master.
      • Access to this port can be restricted with the <allowed_host> setting in ./config/scheduler.xml
    • This port is required for all releases if a JobScheduler Supervisor is used.
  • Restrict use of network interfaces
  • Drop the "classic" JOC GUI
    • The "classic" JOC GUI ships without authentication and authorization. It is included with release 1.11 for users who stick to this interface. It is available from the above TCP port and HTTP port. 
      Display feature availability
      EndingWithRelease1.12
    • To drop the "classic" JOC GUI remove the SCHEDULER_HOME/operations_gui folder.

...

  • Consider the hints from the JOC Cockpit - Security article
  • The JOC Cockpit REST Web Service ships with a default configuration in ./joc/resources/joc/shiro.ini that includes
    • using local authentication with accounts and passwords stored in clear text. 
      Display feature availability
      EndingWithRelease1.11.4
    • using local authentication with accounts and passwords stored as hash values. 
      Display feature availability
      StartingFromRelease1.11.5
    • using local role assignment
    • the following default values for accounts, passwords and assigned roles (see JOC Cockpit - Authentication and Authorization for more informatio):
      • administrator=secret, administrator
        application_manager=secret, application_manager
        it_operator=secret, it_operator
        incident_manager=secret, incident_manager
        business_user=secret, business_user
        api_user=secret, api_user
        root=root, all

  • The JobScheduler Master is assumed not to be accessed by users directly but exclusively via the JOC Cockpit REST Web Service. No default authentication is provided.
  • JobScheduler Universal Agents are assumed not to be accessed by users directly but exclusively by a JobScheduler Master. No default authentication is provided.

...