SSH is accessible from external network

Daniil, are you talking about the master node or slaves nodes?

Hi, Roman,

I'm talking about all controller nodes.

Daniil, I tweaked the description a bit:

1) it only makes sense for SSH, as other ports are expected to be exposed to the external network (e.g 80 - Horizon, 8775 - Nova, etc)

2) even for SSH I'd *not* call it a "security vulnerability" - it's perfectly fine for SSH to be exposed to the external network (it's the way you access your instances in public clouds, FWIW), though, I agree that *may* be unexpected and/or undesirable.

Still, as far as we have public key authentication set in place, I'm not sure this should be private and get importance more than Wishlist.

Hi, Roman,

Horizon and other ports, that are expected to be exposed to external network, should be exposed via VIP address, not via controllers IPs (haproxy is used to balance requests to those services).

Unable to reproduce on 9.0 #101 ISO

NMap result for controller:

PORT STATE SERVICE
80/tcp closed http
443/tcp closed https
6000/tcp closed X11
6001/tcp closed X11:1
6002/tcp closed X11:2
8000/tcp closed http-alt
8042/tcp closed fs-agent
8080/tcp closed http-proxy

Hi, Roman, Alexey,

It's great that this issue couldn't be reproduced on 9.0, is there anything else that should be done from my side or we could somehow close it?