[BlueOnyx:22031] base-sitestats-scripts breaking servers

Dogsbody dan at dogsbody.org
Thu May 10 11:32:51 -05 2018


Hi,

We have had two major outages of our final BlueOnyx server in the last 
month.  Both happened while the server was being patched.

We have identified the issue as due to post install scripts in the 
following packages...
- base-sitestats-scripts-2.1-1BX01.el6.noarch.rpm
- base-sitestats-scripts-2.1-1BX02.el6.noarch.rpm.

These packages appear to have a post install script that runs `iptables 
--flush`, clearing the configs, saving the new configs and then 
restarting iptables. The reason this causes us issues is that our 
default INPUT policy is DROP and we then lose our whitelisted IP's and 
ports.  Ultimately this blocks all access to the server and we have to 
use a remote KVM to access the console and reset iptables.

Please can you change these scripts in the future so that they don't 
blindly remove existing firewall rules without warning. I can't see why 
an upgrade to base-sitestats-scripts even needs to clear iptables but if 
so can it please specify which ones to remove or set the default 
policies to allow to avoid breaking existing firewalls then this would 
be very appreciated :-)

Thank you

Regards, Dan



More information about the Blueonyx mailing list