[chef] Re: network encryption between hosts

[Aaron Abramson < >]

If the desire is to ensure that communications between instances are secure, 
have you given any thoughts to leveraging Amazon's VPC?  At least for that 
portion of it?


On Nov 23, 2011, at 12:13 PM, Adam Greene wrote:

> hey folks,
> 
> we are looking to provide host-to-host encryption between every instance 
> that resides on our network.  We've been looking at a few different options 
> (OpenSwan, OpenVPN, NeoRouter, or stunnel), and I'm curious if anyone has 
> any experience that they would be willing to share.
> 
> The primary goal is to protect the data moving between systems on 
> virtualized resources (ie, ec2 and rackspace).  The primary goal is not 
> focused on being able to quickly lock out an ex-employee or provide a 
> controlled access point from work into the cloud.  And I am aware of how 
> ec2 controls network traffic (active packet switching, network acls, 
> security groups, etc).  But we want to add another layer of encryption 
> which we control and is on top of what is, even if done well, an untrusted 
> network.  
> 
> So initial focus was on focusing on host-to-host (which scratches openVPN) 
> at the sysconfig level.  But each instance will need to be connected to 
> 6-12 different hosts at any given time (each has monitoring, metric 
> gathering, and syslog, and then depending on the role, might have 
> connections to multiple datastores, etc).
> 
> We are also exploring moving it up into the application stack and for the 
> connections which cannot be encrypted (web proxy to app roles, app roles to 
> some datastores) wrapping those connections in stunnel.
> 
> what makes this interesting is the power that chef search can bring to the 
> table with configuration management and what not.  So while something like 
> stunnel sounds silly when managing hundreds of host-to-host connections, we 
> are taking a look at it because of chef.
> 
> Anyway, just throwing out a general question to see what people's 
> experiences have been and if chef changes how they approach an issue such 
> as this.
> 
> thanks!
> adam
>