8 Feb
2023
8 Feb
'23
7:07 a.m.
Hi there,
We noticed after creating a signurl that the bucket resources were accessible from IPs
that were originally restricted from accessing them (using a bucket policy).
Using the s3cmd utility we confirmed that the Policy is correctly applied and you can
access it only for the allowed IPs.
Is this an expected behavior or do we miss something?
Thanks!
9 Feb
9 Feb
9:57 p.m.
On Wed, Feb 08, 2023 at 03:07:20PM -0000, Aggelos Toumasis wrote:
Hi there,
We noticed after creating a signurl that the bucket resources were
accessible from IPs that were originally restricted from accessing
them (using a bucket policy). Using the s3cmd utility we confirmed
that the Policy is correctly applied and you can access it only for
the allowed IPs.
Is this an expected behavior or do we miss something?
Can you share the bucket
policy?
Also, are you using some reverse proxy in front of RGW, and if so:
are both the proxy & RGW configured for the correct headers to agree on
the actual source IP.
IIRC depending how the policy is written, you have have either of:
- presigned URL || IP-check
- presigned URL && IP-check
--
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail : robbat2(a)gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
24 Mar
24 Mar
9:54 a.m.
Hello Robin,
Thanks a lot for the response! This is my first time posting, I did not get a notification
that it was accepted to be posted and missed your email.
Coming back to your question, the solution was to set up the policies of the buckets as
described
here<https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presign…ml>.
From: Robin H. Johnson <robbat2(a)gentoo.org>
Date: Friday, 10 February 2023 at 06:57
To: ceph-users(a)ceph.io <ceph-users(a)ceph.io>
Subject: [ceph-users] Re: Generated signurl is accessible from restricted IPs in bucket
policy
On Wed, Feb 08, 2023 at 03:07:20PM -0000, Aggelos Toumasis wrote:
Hi there,
We noticed after creating a signurl that the bucket resources were
accessible from IPs that were originally restricted from accessing
them (using a bucket policy). Using the s3cmd utility we confirmed
that the Policy is correctly applied and you can access it only for
the allowed IPs.
Is this an expected behavior or do we miss something?
Can you share the bucket
policy?
Also, are you using some reverse proxy in front of RGW, and if so:
are both the proxy & RGW configured for the correct headers to agree on
the actual source IP.
IIRC depending how the policy is written, you have have either of:
- presigned URL || IP-check
- presigned URL && IP-check
--
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail : robbat2(a)gentoo.org
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136
412
days inactive
456
days old
2 comments
3 participants
participants (3)
-
Aggelos Toumasis -
Aggelos.Toumasis＠swisscom.com
-
Robin H. Johnson