...

IBM Cloud Security Overview

Access to an GCP IBM cloud instance can be controlled by 

• an external firewall,
• the operating system firewall of the instance,
• IBM-specific security groups, and
• GCPIBM-specific firewall settingssubnet ACLs.

In addition to allowing SSH access, the different firewall levels must be configured to permit at least TCP port 8080 to enable license server access.

GCP Firewall Rules

In addition to firewall rules created by the customer, there are other rules that can affect incoming or outgoing traffic:

• Certain IP protocols, such as GRE, are not allowed within a VPC network. For more information, see always blocked traffic.

• Communication between a VM instance and its corresponding metadata server (169.254.169.254). Is always allowed.

• Every network has two implied firewall rules that permit outgoing connections and block incoming connections. Firewall rules that you create can override these implied rules.

• The default network is pre-populated with firewall rules that can be deleted or modified.

VPC firewall rule characteristics:

...

access to any required license servers.

IBM Cloud Security Groups

Security Groups are associated with a virtual server instance. They have the following characteristics:

• Stateful: once an inbound connection is permitted, return traffic is allowed.
• Only allow rules are possible.
• All rules are considered to determine if traffic should be permitted.
• An instance can have several security groups.

IBM Cloud Subnet ACLs

Subnet ACLs are associated with subnets in a VPC. They have the following characteristics:

• Stateless: inbound and outbound connections must be explicitly allowed.
• Allow and deny rules are possible.
• Rules are processed in sequence.
• One ACL can be assigned to several subnets.
• The default ACL allows all traffic.

Connecting to the Cloud Instance

During the configuration of your instance you should have created a security group allowing at the minimum SSH access to the instance. If this has been done correctly, you can, for example, use SSH from the command-line or from a tool such as PuTTY to access the command-line of the user sshuser on (for Charon prepackaged marketplace images) or your custom user (for RPM installations) on the Charon -SSP host instance.

You will need the following:

• Access to the private key associated with the public key you uploaded during the configuration of the instance.
• The public IP address of the instance.

Please note: the

• The file permissions of the private key file must be set such that the file is only readable by the user (e.g., # chmod 400 <private-key-file>).
• PuTTY uses a different key file format. It comes with tools to convert between its own .ppk format and the format of OpenSSH used by the default Linux tools.

There are several ways to connect to your Charon -SSP cloud instance using this basic SSH protocol access. Some of them are described in the following sections below.

...