Proposed Change
As an operator
I want active ssh sessions with an app to be terminated when either ssh is disabled for the app or disallowed for the space where the app is running
So that I don't have potentially exploitative active ssh sessions when I expect none to exit
Currently allowing space ssh and disabling app ssh affects the creation of new ssh session, but any currently active ssh sessions remain unaffected and may be kept open for as long as the app instance remains live. Since this can be considered a low level security vulnerability, disabling space ssh can trigger the diego-cell to check and terminate any active ssh sessions for apps in the affected space, and do the same for any instance of an app whose ssh has just been disabled.
This is the resulting find from a security audit to our cf environments which supports a process for temporary space ssh allowance in production environments (approved following a 4-eye principle), which, after the time expires and the space ssh is again disallowed, doesn't affect any active ssh sessions, which means someone might be exploiting and using the active session without actual knowledge of the space owners (unless they proactively look)
Acceptance criteria
Scenario: Kill active app ssh session when ssh is disallowed for the space where the app is in
Given space ssh is allowed for space X and app ssh is allowed for app Y
When I cf ssh to app Y
And I disallow space ssh on space X after having established an ssh session with app Y
Then My ssh session with app Y is terminated
Scenario: Kill active app ssh session when ssh is disabled for the app
Given space ssh is allowed for space X and app ssh is allowed for app Y
When I cf ssh to app Y
And I disable ssh for app Y after having established an ssh session with app Y
Then My ssh session with app Y is terminated
Related links
No links to provide as these reports are all internal
Proposed Change
As an operator
I want active ssh sessions with an app to be terminated when either ssh is disabled for the app or disallowed for the space where the app is running
So that I don't have potentially exploitative active ssh sessions when I expect none to exit
Currently allowing space ssh and disabling app ssh affects the creation of new ssh session, but any currently active ssh sessions remain unaffected and may be kept open for as long as the app instance remains live. Since this can be considered a low level security vulnerability, disabling space ssh can trigger the diego-cell to check and terminate any active ssh sessions for apps in the affected space, and do the same for any instance of an app whose ssh has just been disabled.
This is the resulting find from a security audit to our cf environments which supports a process for temporary space ssh allowance in production environments (approved following a 4-eye principle), which, after the time expires and the space ssh is again disallowed, doesn't affect any active ssh sessions, which means someone might be exploiting and using the active session without actual knowledge of the space owners (unless they proactively look)
Acceptance criteria
Scenario: Kill active app ssh session when ssh is disallowed for the space where the app is in
Given space ssh is allowed for space X and app ssh is allowed for app Y
When I cf ssh to app Y
And I disallow space ssh on space X after having established an ssh session with app Y
Then My ssh session with app Y is terminated
Scenario: Kill active app ssh session when ssh is disabled for the app
Given space ssh is allowed for space X and app ssh is allowed for app Y
When I cf ssh to app Y
And I disable ssh for app Y after having established an ssh session with app Y
Then My ssh session with app Y is terminated
Related links
No links to provide as these reports are all internal