Skip to content

Commit 5d27b2a

Browse files
roberto-sanchez-herreraroberto-sanchez-herrera
authored
JCS-13632 Empty NSG for admin server and all ports open from bastion … (#158)
…in managed server NSG - Changes to script to create nsgs in existing subnets - Add rule to admin server NSG to accept connections in port 7002 from bastion subnet or existing bastion, to access WebLogic admin console - Change managed server nsg to accept connections from bastion (new and existing) in port 22 only - Fix some comments
2 parents 3edb417 + 9d560a7 commit 5d27b2a

File tree

1 file changed

+77
-21
lines changed

1 file changed

+77
-21
lines changed

‎utils/create_nsg.sh‎

Lines changed: 77 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/usr/bin/env bash
22
#
3-
# Copyright (c) 2022, Oracle and/or its affiliates.
3+
# Copyright (c) 2022, 2023, Oracle and/or its affiliates.
44
# Licensed under the Universal Permissive License v1.0 as shown at https://oss.oracle.com/licenses/upl.
55
#
66
# ############################################################################
@@ -16,6 +16,7 @@
1616
DB_PORT=1521
1717
MS_HTTP_PORT=7003
1818
MS_HTTPS_PORT=7004
19+
WLS_ADMIN_CONSOLE_HTTPS_PORT=7002
1920
LB_PORT=443
2021
CLOUDGATE_PORT=""
2122
WLS_SUBNET_OCID=""
@@ -167,17 +168,17 @@ then
167168
exit
168169
fi
169170

170-
# The NSGs will be created in the VCN of the weblogic subnet & in the same compartment as the VCN
171+
# The NSGs will be created in the VCN of the WebLogic subnet & in the same compartment as the VCN
171172
vcn_ocid=$(oci network subnet get --subnet-id "${WLS_SUBNET_OCID}" | jq -r '.data["vcn-id"]')
172173
vcn_cidr=$(oci network vcn get --vcn-id "${vcn_ocid}" | jq -r '.data["cidr-block"]')
173174
wls_subnet_cidr_block=$(oci network subnet get --subnet-id ${WLS_SUBNET_OCID} | jq -r '.data["cidr-block"]')
174175

175-
# Create admin & managed server NSGs when weblogic subnet is provided
176+
# Create admin & managed server NSGs when WebLogic subnet is provided
176177
admin_server_nsg_ocid=""
177178
managed_server_nsg_ocid=""
178179
if [[ -n ${WLS_SUBNET_OCID} ]]
179180
then
180-
# Create security rules for WLS VM-VM access
181+
# Create security rules for WebLogic VM-VM access
181182
INTERNAL_RULES_FILE=$(mktemp)
182183
cat > ${INTERNAL_RULES_FILE} << EOF
183184
[{
@@ -247,18 +248,43 @@ then
247248
"destination": "0.0.0.0/0"
248249
}]
249250
EOF
250-
# Create security rules for WLS private subnet
251+
# Create security rules for WebLogic private subnet
251252
WLS_BASTION_RULES_FILE=$(mktemp)
252253
cat > ${WLS_BASTION_RULES_FILE} << EOF
253254
[{
254-
"description": "All traffic for all ports",
255+
"description": "TCP traffic for ports: 22 SSH Remote Login Protocol",
255256
"direction": "INGRESS",
256257
"isStateless": "false",
257-
"protocol": "all",
258+
"protocol": "6",
258259
"sourceType": "CIDR_BLOCK",
259-
"source": "$bastion_cidr_block"
260+
"source": "$bastion_cidr_block",
261+
"tcpOptions": {
262+
"destinationPortRange": {
263+
"min": "22",
264+
"max": "22"
265+
}
266+
}
260267
}]
261268
EOF
269+
# Create security rules for WebLogic administration console
270+
WLS_ADMIN_CONSOLE_RULES_FILE=$(mktemp)
271+
cat > ${WLS_ADMIN_CONSOLE_RULES_FILE} << EOF
272+
[{
273+
"description": "TCP traffic for HTTPS port for WebLogic administration console",
274+
"direction": "INGRESS",
275+
"isStateless": "false",
276+
"protocol": "6",
277+
"sourceType": "CIDR_BLOCK",
278+
"source": "$bastion_cidr_block",
279+
"tcpOptions": {
280+
"destinationPortRange": {
281+
"min": "$WLS_ADMIN_CONSOLE_HTTPS_PORT",
282+
"max": "$WLS_ADMIN_CONSOLE_HTTPS_PORT"
283+
}
284+
}
285+
}]
286+
EOF
287+
262288

263289
# Bastion instance NSG
264290
network_security_group_name="bastion_nsg"
@@ -273,29 +299,65 @@ EOF
273299
echo -e "Adding Bastion Security Rules in Managed Server Network Security Group $managed_server_nsg_ocid..."
274300
oci network nsg rules add --nsg-id $managed_server_nsg_ocid --security-rules file://$WLS_BASTION_RULES_FILE
275301
fi
302+
if [[ -n $admin_server_nsg_ocid ]]
303+
then
304+
echo -e "Adding WebLogic Administration Console Security Rules in Administration Server Network Security Group $admin_server_nsg_ocid..."
305+
oci network nsg rules add --nsg-id $admin_server_nsg_ocid --security-rules file://$WLS_ADMIN_CONSOLE_RULES_FILE
306+
fi
276307
fi
277308
fi
278309

279310
if [[ -n ${BASTION_HOST_IP} ]]
280311
then
281312
BASTION_HOST_IP_CIDR="$BASTION_HOST_IP/32"
282-
# Create security rules for WLS private subnet with existing bastion instance
313+
# Create security rules for WebLogic private subnet with existing bastion instance
283314
WLS_EXT_BASTION_RULES_FILE=$(mktemp)
284315
cat > ${WLS_EXT_BASTION_RULES_FILE} << EOF
285316
[{
286-
"description": "All traffic for all ports",
317+
"description": "TCP traffic for ports: 22 SSH Remote Login Protocol",
287318
"direction": "INGRESS",
288319
"isStateless": "false",
289-
"protocol": "all",
320+
"protocol": "6",
290321
"sourceType": "CIDR_BLOCK",
291-
"source": "$BASTION_HOST_IP_CIDR"
322+
"source": "$BASTION_HOST_IP_CIDR",
323+
"tcpOptions": {
324+
"destinationPortRange": {
325+
"min": "22",
326+
"max": "22"
327+
}
328+
}
329+
}]
330+
EOF
331+
332+
# Create security rules for WebLogic administration console with existing bastion instance
333+
WLS_ADMIN_CONSOLE_EXT_BASTION_RULES_FILE=$(mktemp)
334+
cat > ${WLS_ADMIN_CONSOLE_EXT_BASTION_RULES_FILE} << EOF
335+
[{
336+
"description": "TCP traffic for HTTPS port for WebLogic administration console",
337+
"direction": "INGRESS",
338+
"isStateless": "false",
339+
"protocol": "6",
340+
"sourceType": "CIDR_BLOCK",
341+
"source": "$BASTION_HOST_IP_CIDR",
342+
"tcpOptions": {
343+
"destinationPortRange": {
344+
"min": "$WLS_ADMIN_CONSOLE_HTTPS_PORT",
345+
"max": "$WLS_ADMIN_CONSOLE_HTTPS_PORT"
346+
}
347+
}
292348
}]
293349
EOF
350+
294351
if [[ -n $managed_server_nsg_ocid ]]
295352
then
296353
echo -e "Adding Existing Bastion Security Rule in Managed Server Network Security Group $managed_server_nsg_ocid..."
297354
oci network nsg rules add --nsg-id $managed_server_nsg_ocid --security-rules file://$WLS_EXT_BASTION_RULES_FILE
298355
fi
356+
if [[ -n $admin_server_nsg_ocid ]]
357+
then
358+
echo -e "Adding WebLogic Administration Console Security Rules for Existing Bastion in Administration Server Network Security Group $admin_server_nsg_ocid..."
359+
oci network nsg rules add --nsg-id $admin_server_nsg_ocid --security-rules file://$WLS_ADMIN_CONSOLE_EXT_BASTION_RULES_FILE
360+
fi
299361
fi
300362

301363
# Create load balancer NSG when load balancer subnet is provided
@@ -338,7 +400,7 @@ then
338400
"destination": "0.0.0.0/0"
339401
}]
340402
EOF
341-
# Create security rules for WLS Managed servers
403+
# Create security rules for WebLogic Managed servers
342404
WLS_MS_RULES_FILE=$(mktemp)
343405
cat > ${WLS_MS_RULES_FILE} << EOF
344406
[{
@@ -480,7 +542,7 @@ EOF
480542
}
481543
}]
482544
EOF
483-
echo -e "Adding LB Security Rules to access MS HTTP port for AD subnet in Admin Server Network Security Group $admin_server_nsg_ocid..."
545+
echo -e "Adding LB Security Rules to access MS HTTP port for AD subnet in Admin Server Network Security Group $managed_server_nsg_ocid..."
484546
oci network nsg rules add --nsg-id $managed_server_nsg_ocid --security-rules file://$WLS_MS_RULES_FILE2
485547
fi
486548
fi
@@ -655,10 +717,4 @@ fi
655717
if [[ -n $mount_target_nsg_ocid ]]
656718
then
657719
echo -e "Mount Target Network Security Group : $mount_target_nsg_ocid"
658-
fi
659-
660-
661-
662-
663-
664-
720+
fi

0 commit comments

Comments
 (0)