Mailing List Archive: Some investigative questions

We're currently looking at wackamole for our corporate websites to ensure
uptime. I have several items I'd like to ask the user community....

1) Is there any mechanisms in spread for security. What I'm concerned about
is an attacker sending messages to the daemon to cause IP's to be switched
or downed in any way (or the usual buffer overrun exploits, etc). I could
certainly do this with ip filters so that spread/wackamole messages are only
accepted from certain ip addresses, but short of this, is there anything
built into the package to restrict who joins the cluster? Are there any
other attack/security issues that spread/wackamole opens us up to? The
platform is FreeBSD with apache and mysql by the way. I noticed there is a
"secure spread" add on, but wasn't sure if wackamole would just use that
interface if it was installed or if it would have to be modified/recompiled
to take advantage of it. Perhaps tunneling the spread/wackamole process
through ssh is possible? Ideas?

2) Has anyone used wackamole/spread in a mission critical enterprise scale
ecommerce web cluster? Ie. can anyone attest to reliability, security, etc.?
Ie. is it ready for prime time?

3) Of course I can gauge by the responses to this message, but can anyone
vouch for the level of support available, particularly with regards to
timely answers to questions on this list?

Thanks very much in advance for all replies!

Regards,

Jay West

---
[This E-mail scanned for viruses by Declude Virus]

Jay West wrote:

>We're currently looking at wackamole for our corporate websites to ensure
>uptime. I have several items I'd like to ask the user community....
>
>1) Is there any mechanisms in spread for security. What I'm concerned about
>is an attacker sending messages to the daemon to cause IP's to be switched
>or downed in any way (or the usual buffer overrun exploits, etc). I could
>certainly do this with ip filters so that spread/wackamole messages are only
>accepted from certain ip addresses, but short of this, is there anything
>built into the package to restrict who joins the cluster? Are there any
>other attack/security issues that spread/wackamole opens us up to? The
>platform is FreeBSD with apache and mysql by the way. I noticed there is a
>"secure spread" add on, but wasn't sure if wackamole would just use that
>interface if it was installed or if it would have to be modified/recompiled
>to take advantage of it. Perhaps tunneling the spread/wackamole process
>through ssh is possible? Ideas?
>
No ssh tunnels -- Spread doesn't use TCP. (IPSEC will work fine). I
use ipfw/ipchains rules on all my machines or ACLs on the switch ports
that they are connected to. Works like a charm. Other than that,
Spread is not robust at all... there is work to make it so. As of now
you, given no external precautions, one can completely hose a spread
ring with very little effort.

>2) Has anyone used wackamole/spread in a mission critical enterprise scale
>ecommerce web cluster? Ie. can anyone attest to reliability, security, etc.?
>Ie. is it ready for prime time?
>
Like anything, it has its issues. But I have run it unattended at my
colo facility for several month without a single issue. The only issues
I have had with wackamole are "missing features", but luckily those were
fixed in short order. Spread can be a bit tricky to set up and get
running in a mission-critical way.

>3) Of course I can gauge by the responses to this message, but can anyone
>vouch for the level of support available, particularly with regards to
>timely answers to questions on this list?
>
>
Replies to the list of often timely. Especially when the problems are
interesting :-)

My company offers complete commercial support for wackamole. We run it
in production for our own services and provide fully managed wackamole
instances (with 24x7 monitoring and support) for several enterprise
sites and provide (amongst other things) ecommerce.

--
Theo Schlossnagle
Principal Consultant
OmniTI Computer Consulting, Inc. -- http://www.omniti.com/
Phone: +1 301 776 6376 Fax: +1 410 880 4879
1024D/82844984/95FD 30F1 489E 4613 F22E 491A 7E88 364C 8284 4984
2047R/33131B65/71 F7 95 64 49 76 5D BA 3D 90 B9 9F BE 27 24 E7