Applicable scenario

• Product: ZCF
• Component: Cloud
• Versions: 4.8.x, 4.5.x
• Deployment topology: dual management nodes
• Trigger: Multiple sensitive ports require access restrictions to meet vulnerability-scan remediation requirements.

Symptoms

• Multiple common service ports are externally exposed.
• These ports must be limited to cluster-internal access.
• Ports 22 and 5000 must also allow specified PC access.

Determination method

1. Before the change, confirm platform health and resource connection state.
2. After the change, check rules and whitelists in iptables -nvL -t mangle and ipset list.
3. Check that platform services have no exception.

Cause

This is a vulnerability-scan security-hardening scenario. Firewall policies are required to restrict multiple sensitive ports while retaining whitelist access for certain ports.

Resolution

1. Preparation

• Risk level: low.
• Log in to ZStack Cloud and confirm the environment is normal.
• Disable HA and back up databases on both management nodes.
• Prepare safe_script_4.5.x.tar.gz.

2. Ports to restrict

• 3306
• 9090
• 9091
• 9100
• 10010
• 8888
• 8081
• 8080
• 7070
• 5000
• 5900-5909
• 111
• 25
• 123
• 22

3. Procedure
4. Back up databases on both management nodes:

   zstack-ctl dump_mysql --file-name zstack-db-backup-master
   zstack-ctl dump_mysql --file-name zstack-db-backup-slave

• Expected result: Database backup is complete.

2. Extract and run the script:

   tar zxvf safe_script_v4.5.tar.gz
   cd safe_script/
   bash safe.sh

• Expected result: The scripted port-hardening workflow opens.

3. Enter the management-node admin password.

• Expected result: You have permission to apply rules.

4. In the script, select:

• 3: Restrict physical-host ports
• 1: Configure rules
• Expected result: Port-restriction configuration opens.

5. Enter the ports to restrict:

   3306,9090,9091,9100,10010,8888,8081,8080,7070,5000,5900-5909,111,25,123,22

• Configure specified PC whitelist access for 22 and 5000.
• Expected result: Port restriction rules are applied.

6. Enter allowed IP addresses.

• The script automatically identifies cluster-host IPs.
• Multiple allowed IPs can also be specified manually.
• Expected result: Cluster access and whitelisted PC access are allowed correctly.

7. Check that the rules take effect:

   iptables -nvL -t mangle
   ipset list ZS-XXXX

• Expected result: Rules and allowed-IP sets take effect.

8. After confirming the environment is normal, re-enable global HA.

• Expected result: The platform resumes normal operation.

Verification

• iptables rules are applied.
• The ipset whitelist contains correct cluster IPs and specified PC IPs.
• Cloud-platform resource state and service connections are normal.

Risks and rollback

• Risk: Incorrect whitelist IPs can affect SSH, management access, or other critical services.
• Risk level: low.
• Rollback:

  bash safe.sh

Then select:

• 3 Restrict physical ports
• 2 Restore rule configuration