Product Security

Support to Restrict Application Service Ports

Feature Summary and Revision History

Table 1. Summary Data

Applicable Product(s) or Functional Area

CPS

Applicable Platform(s)

Not Applicable

Default Setting

Enabled - Always-on

Related Changes in This Release

Not Applicable

Related Documentation

Not Applicable
Table 2. Revision History

Revision Details

Release

First introduced

21.1.0

Feature Description

Previous Behavior: In CPS 21.1.0 and earlier releases,

  • Policy Director (LB) VMs accepted Rsyslog requests on both internal and external interface (port 5544 and 6514).

  • Whisper server default port 9213 and Zookeeper port 2181 listened on all the interfaces that exposed the system to vulnerable attacks for service.

New Behavior: In CPS 21.2.0 and later releases, CPS restricts application service ports to only internal network.

  • Product Security access is restricted through external interfaces for Rsyslog requests.

  • Whisper service is bound to internal interface thus restricting external access.

  • Rsyslog, Whisper, and Zookeeper allows only one bind address. Either IPv4 or IPv6 is supported as IP address.

You can now find that the Rsyslog and Whisper are now deployed using the internal interfaces. The ports connectivity will now work only using the internal IP address and the same can be verified using the telnet command. 

telnet <internalIP> 5544    - rsyslog
telnet <internalIP> 6514    - rsyslog
telnet <internalIP> 9213    - whisper
telnet <internalIP> 2181    - zookeeper