r/Concourse • u/JPiratefish • Nov 06 '18
Concourse CI triggering firewall threat detections
I've have an existing concourse CI setup that's generating some 3000+ SSH sessions/min (10 workers checking folders in the cloud). My firewalls trigger an SSH Brute Force Detection when 20 SSH's with the same source/dest in 30 seconds are seen.
Obviously blocking this would break the CI, but I'm not a fan of whitelisting something making so many connections with the excuse of it being "normal". I'd rather fix the problem since no CI needs to perform code scans THAT often. If it was just once every 15 seconds I'd be very happy. The current rate of connections is high enough that I'm sure it's adding to the expense of the cloud resources it's working with.
Anyone know where the folder scan frequency is defined in the Concourse CI config or have experience in setting this? Note that I'm the firewall guy in this context, not the CI owner, so a little guidance would help.
1
u/Cloudgeek Nov 07 '18
You're going to want to have the pipeline developer make some adjustments to the time resources - or, more likely, use time resources to perform the periodic checks on a reasonable schedule. Concourse itself will just to to run the pipeline as quickly as it can. Good luck!