[BlueOnyx:22031] base-sitestats-scripts breaking servers
Dogsbody
dan at dogsbody.org
Thu May 10 11:32:51 -05 2018
Hi,
We have had two major outages of our final BlueOnyx server in the last
month. Both happened while the server was being patched.
We have identified the issue as due to post install scripts in the
following packages...
- base-sitestats-scripts-2.1-1BX01.el6.noarch.rpm
- base-sitestats-scripts-2.1-1BX02.el6.noarch.rpm.
These packages appear to have a post install script that runs `iptables
--flush`, clearing the configs, saving the new configs and then
restarting iptables. The reason this causes us issues is that our
default INPUT policy is DROP and we then lose our whitelisted IP's and
ports. Ultimately this blocks all access to the server and we have to
use a remote KVM to access the console and reset iptables.
Please can you change these scripts in the future so that they don't
blindly remove existing firewall rules without warning. I can't see why
an upgrade to base-sitestats-scripts even needs to clear iptables but if
so can it please specify which ones to remove or set the default
policies to allow to avoid breaking existing firewalls then this would
be very appreciated :-)
Thank you
Regards, Dan
More information about the Blueonyx
mailing list