Smaug, the brand new OVHcloud backbone network infrastructure • Hacker News Board

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#21

Post by justinclift » Thu, Aug 13, 2020, 4:00 PM UTC

Avamander wrote: post #15

eric4smith wrote: post #10

OVH Hardware, support and pricing is GREAT! Buuuuutttttt... Their firewall situation is not. Guess what, if you use the supplied firewall, any server from any other customer in the local NOC that your server is in, can connect to your server. They seem to be all "safely" behind the OVH firewall product. You have to protect each server individually with its own in-machine firewall. I don't want to automatically trust…

> You have to protect each server individually with its own in-machine firewall. That's the standard practice? OVH's own firewall is for DDoS/DoS protection, not for fine-grained security, did I understand OVH's information incorrectly?

Ouch. That probably means there's a metric shit tonne of VMs running Docker with open ports in their data centres.

Saying that because (by default) Docker screws with firewall rules on the VM when it starts up, to allow other hosts to communicate with the containers.

In other hosting environments, the workaround is to apply firewall rules to your VMs using the hosting infrastructure capabilities. eg separate to the iptables (etc) rules on each host

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#22

Post by jermier » Thu, Aug 13, 2020, 4:06 PM UTC

I miss OVH's old control panel. It was so nerdy and to-the-point, unlike their newer modern interface that heats up my CPU with boatloads of javascript, and adopts the 'flat' design pattern that has now permeated every site in existence.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#23

Post by dawnerd » Thu, Aug 13, 2020, 4:26 PM UTC

drchiu wrote: post #14

eric4smith wrote: post #10

OVH Hardware, support and pricing is GREAT! Buuuuutttttt... Their firewall situation is not. Guess what, if you use the supplied firewall, any server from any other customer in the local NOC that your server is in, can connect to your server. They seem to be all "safely" behind the OVH firewall product. You have to protect each server individually with its own in-machine firewall. I don't want to automatically trust…

Can this be mitigated by using something like ufw and restricting the IP access?

Unless you use docker, then it doesn't really matter. Really have to make sure your docker containers are not exposing ports they shouldnt be.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#24

Post by rubatuga » Thu, Aug 13, 2020, 4:27 PM UTC

Notice how there’s no info on IPv6. That’s because OVH has horrible support for IPv6 and requires non standard routes to be set because they don’t support router advertisements. They also rely on ND packets and not static routing for IPv6, and also block outgoing IPv6 packets if an incoming IPv6 address has not been established. I would avoid OVH.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#25

Post by stingraycharles » Thu, Aug 13, 2020, 4:36 PM UTC

rubatuga wrote: post #24

Notice how there’s no info on IPv6. That’s because OVH has horrible support for IPv6 and requires non standard routes to be set because they don’t support router advertisements. They also rely on ND packets and not static routing for IPv6, and also block outgoing IPv6 packets if an incoming IPv6 address has not been established. I would avoid OVH.

You’re being downvoted, but a hosting provider redesigning their core network infrastructure in 2020 without proper IPv6 support is really bad imho.

It’s unacceptable that all these (cloud) hosting providers collectively make ISPs look good.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#26

Post by dylz » Thu, Aug 13, 2020, 4:54 PM UTC

Avamander wrote: post #15

eric4smith wrote: post #10

OVH Hardware, support and pricing is GREAT! Buuuuutttttt... Their firewall situation is not. Guess what, if you use the supplied firewall, any server from any other customer in the local NOC that your server is in, can connect to your server. They seem to be all "safely" behind the OVH firewall product. You have to protect each server individually with its own in-machine firewall. I don't want to automatically trust…

> You have to protect each server individually with its own in-machine firewall. That's the standard practice? OVH's own firewall is for DDoS/DoS protection, not for fine-grained security, did I understand OVH's information incorrectly?

Yes. There are two different products: VAC, which is for DDoS protection, and general SDN firewall/security groups which is only OVHcloud (not dedicated servers).

In the most general case, it seems other customers can actually send DDoS/volumetric traffic toward you from within OVH and it doesn't get picked up.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#27

Post by johnklos » Thu, Aug 13, 2020, 8:34 PM UTC

OVH is an absolutely shitty company. I've seen a tremendous uptick of spam from OVH that they're happy to simply ignore. The same kind of spam using the same content, the same registration patterns and the same template have existed on their networks for many months in spite of constant abuse complaints.

I can't imagine why anyone would want to run anything on the same networks that OVH uses to host spammers and scammers.

And good luck talking to an actual human at OVH if something goes wrong.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#28

Post by tluyben2 » Thu, Aug 13, 2020, 9:13 PM UTC

cerberusgr wrote: post #9

I had the worst experience from a vps/dedicated hosting provider with OVH few years back, long story short I had a dedicated server with software raid, after a month, one of the disks failed I gave them all the details SN of the disk at fault etc, but apparently the removed the good disk and I lost the server, I asked them to put it back and they told me they had destroyed it, luckily I had backup. Lastly I asked for…

Guess you were unlucky; I host with them since 2004 and it has been good with 100s of servers.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#29

Post by jjeaff » Thu, Aug 13, 2020, 9:19 PM UTC

imperialdrive wrote: post #19

cerberusgr wrote: post #9

I had the worst experience from a vps/dedicated hosting provider with OVH few years back, long story short I had a dedicated server with software raid, after a month, one of the disks failed I gave them all the details SN of the disk at fault etc, but apparently the removed the good disk and I lost the server, I asked them to put it back and they told me they had destroyed it, luckily I had backup. Lastly I asked for…

Amazon did about the same exact thing to me a while back, so you're not alone and it's not just cheap hosts that make that mistake as we spent 10k/mo on support alone. (AWS had EBS silently fail which is awful enough but then restored data from the 'bad leg' of the system and lost all. To this day I've never trusted them again - maybe I should get over it but, would you?

I can't imagine that any of the ebs recovery isn't fully automated now, if it wasn't then.

Re: Smaug, the brand new OVHcloud backbone network infrastructure

#30

Post by tdeck » Thu, Aug 13, 2020, 9:48 PM UTC

dawnerd wrote: post #23

drchiu wrote: post #14

Earlier quoted context omitted.

Can this be mitigated by using something like ufw and restricting the IP access?

Unless you use docker, then it doesn't really matter. Really have to make sure your docker containers are not exposing ports they shouldnt be.

Is there a good tutorial you can recommend on how to audit this?