2

I would like to use Azure Chef server (or Puppet, or any other solution) from Azure to manage my infrastructure (around 25 servers and 20 desktops) wich is on-premise behind a corporate firewall.

Is that possible? I tried searching for a similar solution but all I can find are articles how to manage Azure infrastructures.

Improve this question
2
  • 1
    My assumption is definitely yes if there are no firewall related issues.
    – Ta Mu
    Commented Jun 30, 2017 at 2:55
  • I tought so, but was looking for some kind of article about setting this up and what are common problems having this setup. Thank you for your comment.
    – Philippe
    Commented Jun 30, 2017 at 4:00

1 Answer 1

Reset to default
3

The prerequisites for a chef server are here and common to any installation.

You only need to allow https to port 443 from your inner infrastructure to the cloud server.

If you have a proxy with SSL interception I'd recommend adding this proxy certificate to each client cacert.pem and set an environment variable SSL_CERT_FILE=<chef_install_path>embedded/ssl/certs/cacert.pem so other call from different ruby tools using openssl will also work.

Improve this answer
8
  • 1
    It's also a good idea to either a) IP restrict public internet access to your Chef server to your on-prem IP(s), or b) use a VPN connection to Azure to join on-prem to cloud and access it using private IPs.
    – Adrian
    Commented Jun 30, 2017 at 13:07
  • @Adrian every communication with the chef server have to be signed with a private key (client or user) and happens within a SSL tunnel, doing a SSL tunnel withing a VPN tunnel doesn't make much sense. IP restriction prevent DoS attacks, but that's usually not a real problem if the chef server is not accessible for a while due to the model of periodic configuration enforcing.
    – Tensibai
    Commented Jun 30, 2017 at 13:13
  • SSL prevents eavesdropping/MITM attacks but does not provide any security against DDoS, brute force attack of the password-based web login, etc. And generally speaking, if you don't need to expose your central infrastructure management system to the entire world, you shouldn't. It certainly doesn't hurt to maintain simple best practices of least privilege and minimal attack surface.
    – Adrian
    Commented Jun 30, 2017 at 13:16
  • @Adrian that's a position, the web interface being a paid option, it is not in scope for the actual question, there's no login/password access. The only risk is a DoS and I gave my toughs above about it :) You're point is valid, I just don't deem it necessary here.
    – Tensibai
    Commented Jun 30, 2017 at 13:19
  • Did they remove the basic web UI from Chef OSS? It's there in v11, just not as full-featured as the one in enterprise. I'm not saying it's necessary, I'm saying the LoE for the additional security is next to nothing, there's no reason not to be more secure. I don't see why anyone would advise against free extra security.
    – Adrian
    Commented Jun 30, 2017 at 13:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.