Parameter -AddFirewallRule doesn't work

[stevie-sy]

When running the the Cmdlet Start-IcingaAgentInstallWizard there is no prompt if the firewall rule should be added.

If you add to the output the paramater "-AddFirewallRule 1" this will not processed like it should:

In result of this no firewall rules will be created

Expected Behavior

1. there should be a prompt where the wizrd has ask if the firewall rules should be added
2. If the parameter is set, the firewall rules should be created

Your Environment

Tested with W2012R2, W2016 and W2019
PS: 4.6 and 4.7
Icinga-PowerShell-Framework 1.3.0

[LordHepipud]

Hello and thank you for the report. Honestly this scenario is intended, as your configuration also does not accept connections from the master/satellite. Therefor there is no reason for opening port 5665 if the Agent is not accepting connections from a parent node.

This is a simple "security" feature to ensure ports are are not opened if not required.

[stevie-sy]

Hi and thanks for the input.

I testet the wizard a little bit more with the new informations you wrote. It seems that the question „Is this Agent able to connect to its parent node(s)? (Y/n)“ from the wizard tips the scales. Depending on how you answer here, other questions appear or not. But without any deeper knowledge about everything this question maybe phrased in a somewhat ambiguous way. Because it was not evident (for us) that the answer to this question switches the parameter „—AcceptConnections“ on or off. My colleague and I are somehow missing the connection between the question and this parameter.
Maybe the wording should look like the Linux Node Wizard? e.g. „Do you want to establish a connection to the parent node from this node? [Y/n]“ and also or alternatively the (additonal) questions „Accept config from parent node? [y/N]:“ and „Accept commands from parent node? [y/N]:“ should be asked in similar way. Then it could be clearer I think if the messages would be optimized for people who haven’t a deeper knowledge or use your Wizard the first time it would be very helpful.

Ok, If the question answer with „n“, I get the missing question about the firewall rule and also the question about the path for the CA-File.

If the question is answered with "y", then only the question „Do you want to convert parent node(s) connection data to IP adresses? (Y/n)“ appears. In our opinion, this question should always appear. Think about big networks, like we have, separated by routers, proxies, hardware firewalls, diffrent VLANs and also various DMZ etc. And for security reasons, e.g. the firewall admin only allows the IP connection on port 5665 between an agent (in diffent IP subnet, DMZ etc) and the parent node. And the admin also not allow any connection to the (interal) DNS. From the point of view of the question it is correct - both can communicate with each other - but not all network services work / are possible what might be needed.

What we also noticed when answering the question „Is this Agent able to connect to its parent node(s)? (Y/n)“, following question „Please specify the network destinations this Agent will connect to separated ....“ did not appear. If you do not want to run the installation immediately and therefore answer question „Do you want to run the installer now? (Otherwise only the configuration command will be printed) (Y/n)„ with "n" and copy the output to another server or your own automation tools, this can be problematic. Ok, you usually try that out beforehand. Because it fits, I wanted to have it mentioned.

Besides the wizard, of course we could create everything manully with the help of your docs. But here also some information and hints are missing (for us). For example there is no hint - neither in the documentation nor in the execution of the installation – that the parameters „—AcceptConnection“ and „—AddFirewallRule“ are somehow mutually exclusive or make no sense depending on the selected value. A hint somewhere like „because of choosing –AcceptConnection 1, we don’t create a Firewall rule“ for the reason you wrote. But without this, it’s irritating when you set „–AcceptConnection 1 –AddFirewallRule 1“ and then CmdLet writes „–AddFirewallRule 0“ as output during execution without reason. That could then be improved.

But what I also observed, that the uninstall routine doesn’t delete the firewall rule if created.

Anyway, in times of increasingly important and stricter security guidelines, the question arises as that Windows servers are not allowed to communicate with the Internet by default and the local firewall are switched on with the minimum of some base rules installed by Windows itself. Also when I think of our firewall admins, who first forbid everything and everything has to be explicitly enabled. With this point of view, should you always create the firewall rule for icinga or at least a hint?

[LordHepipud]

Thank you very much for the detailed input. My idea would be to not move forward with this and to not change the current behavior of Start-IcingaAgentInstallWizard.

We will work on a new entry point to install Icinga for Windows and will ship a new install function with v1.4.0. This will make things a lot easier, user friendly and intuitive then it is right now.

[LordHepipud]

Just to follow up on this (forgot to update the issue)

With Icinga for Windows v1.4.0 we added the Management Console as experimental feature:

icinga -Manage

Maybe you can give it a try and check if it is more intuitive as the current wizard.

[stevie-sy]

Sadly this Cmdlet doenst work in our setup:

[stevie-sy]

Same with the master from today (here called 1.5.0 because of versioning):

[LordHepipud]

This is interesting. Have you installed the Framework with PowerShell Gallery?
It looks like the issue occurs because the "root" path is not handled properly.

This looks like #237

[LordHepipud]

I just created PR #270, which should resolve this issue. Could you please update the folder 1.5.0 with the files from the fixed branch and test if everything is working?
In case it does, it will be fixed with 1.5.0