NS8 cluster-admin access

[daz (Daniel Zeman)]

Hello,
I’ve got a question regarding access to a /cluster-admin of my newly upgraded NS8 server.
FQDN of my leader node is set to “myserver-ns8” on “mydomain.cz”. I can access https://myserver-ns8.mydomain.cz/cluster-admin without problems.
Further I have installed mail and SOGo applications (both working without problems). Mail server hostname is “myserver.mydomain.cz”, SOGo FQDN is “sogo.mydomain.cz”.
I have set “myserver.mydomain.cz” and “sogo.mydomain.cz” as a public DNS record.
“myserver-ns8.mydomain.cz” is set just in local intranet DNS, because my intention was to block access to cluster administration from outside (on NS7 I used to block respective ports on router firewall).
Neverthless, I am able to access cluster adminstration also from this (publicly available) link https://myserver.mydomain.cz/cluster-admin.
Is it possible to restrict it, so the cluster admin interface is available just from https://myserver-ns8.mydomain.cz/cluster-admin (and / or https://ip-address/cluster-admin) ?
Thank you

[mrmarkuz (Markus Neuberger)]

Here are instructions to restrict the cluster-admin access:

How do I prevent the administration page from being accessible from the Internet?

There can be many ways to achieve it. The first one I’d try is restricting the /cluster-admin HTTP path to some trusted IPs. For example, the list of loopback and private networks. Enter the environment of traefik1 runagent -m traefik1 Create a file, _custom_middlewares.yml with the following contents: http: middlewares: MwTrustedNetworks: IPAllowList: sourceRange: - "127.0.0.0/8" - "10.0.0.0/8" - "172.16.0.0/12" - "192.168.0.0/16"…

[MadPatrick]

Is this only restricting the acces from HTTP ?
From HTTPS would also be nice. Is this possible ?

[daz (Daniel Zeman)]

Thank you @mrmarkuz, i will look at that.
If I understand well, it is an expected behaviour and it is not possible to restrict it from the webgui (I have tried to redirect https://myserver.mydomain.cz/cluster-admin to something else in HTTP routes, but without success).

[Andy_Wismer (André Wismer)]

@MadPatrick

Is this only restricting the acces from HTTP ?
From HTTPS would also be nice. Is this possible ?

AFAIK, After passing Traefik, it’s ALL only http. Traefik is the daemon adding or removing the ssl encryption…

My 2 cents
Andy

[davidep (Davide Principi)]

@MadPatrick

Is this only restricting the acces from HTTP ?

On the contrary, the cluster-admin route redirects to HTTPS.

@daz

it is not possible to restrict it from the webgui

I’m implementing a backend action. It is the first step to have an UI in the future.

@Andy_Wismer

Traefik is the daemon adding or removing the ssl encryption

True, but you are free to decide if the backend/upstream connection is encrypted or not, from the UI of manual route definition.

I need to update the manual page at Proxy — NS8 documentation

[Andy_Wismer (André Wismer)]

@davidep

True, but you are free to decide if the backend/upstream connection is encrypted or not, from the UI of manual route definition.

That was already true in NS7…

My 2 cents
Andy

[MadPatrick]

@davidep

On the contrary, the cluster-admin route redirects to HTTPS.

Maybe i doing something wrong but it is still accessible from the outside.
Can i be that the domain is a reverse-proxy by Nethsecurity ?

[davidep (Davide Principi)]

Yes, I’m addressing this scenario too.