GCP Security Overview

Access to an GCP cloud instance can be controlled by 

• an external firewall,
• the operating system firewall of the instance,
• GCP-specific firewall settings.

In addition to allowing SSH access, the different firewall levels must be configured to permit at least TCP port 8080 to enable license server access.

GCP Firewall Rules

In addition to firewall rules created by the customer, there are other rules that can affect incoming or outgoing traffic:

• Certain IP protocols are not allowed within a VPC network. For more information, see always blocked traffic. Other protocols are restricted to special uses (e.g., GRE), see VPC network overview.

• Communication between a VM instance and its corresponding metadata server (169.254.169.254). Is always allowed.

• Every network has two implied firewall rules that permit outgoing connections and block incoming connections. Firewall rules that you create can override these implied rules.

• The default network is pre-populated with firewall rules that can be deleted or modified.

VPC firewall rule characteristics:

• Each rule is either for incoming or outgoing traffic. It can allow or deny traffic.
• Only IPv4 traffic is supported.
• Firewall rules are stateful (return traffic for an established connection is allowed).
• If TCP traffic is fragmented, a rule is only applied to the first fragment of a packet.

Connecting to the Cloud Instance

During the configuration of your instance you should have created a security group allowing at the minimum SSH access to the instance. If this has been done correctly, you can, for example, use SSH from the command-line or from a tool such as PuTTY to access the command-line of the user sshuser (for Charon prepackaged marketplace images) or your custom user (for RPM installations) on the Charon host instance.

You will need the following:

• Access to the private key associated with the public key you uploaded during the configuration of the instance.
• The public IP address of the instance.
• If you did not create the instance from a Charon marketplace image, you will also need the username created during instance launch (based on the uploaded SSH key).

Please note:

• The file permissions of the private key file must be set such that the file is only readable by the user (e.g., # chmod 400 <private-key-file>).
• PuTTY uses a different key file format. It comes with tools to convert between its own .ppk format and the format of OpenSSH used by the default Linux tools.

There are several ways to connect to your Charon cloud instance using this basic SSH protocol access. Some of them are described in the following sections below. GCP also offers additional ways of connecting to your instance (e.g., in a browser window). Please refer to the Google cloud documentation for more information about these methods.

• SSH and SFTP Command-Line Access
• Connecting with the Charon-SSP Manager