What plans are there to extend the security model in Juju? We see two significant issues with the current model - no internal firewalling within an environment, and the inability to expose ports to systems outside the environment selectively.

Within an environment it appears that all machines can access any port on any other machine in that environment. For example, looking at the security groups in a Juju environment deployed on AWS, each instance launched by Juju is in a juju- security group with all UDP and TCP ports open to that security group. This means that if an attacker compromises any system in the environment they can probably go anywhere.

Also, the only way to expose ports outside of the environment is to expose them to any external system - there is no way, for example, to restrict access to a set of IP addresses.

Both EC2 and Openstack support internal firewalling and selectively opening ports, and other orchestrators such as Chef and Puppet support these features, so it would be good if Juju could as well.

1 Answer 1


So, you're right. We could be tighter on security than we are right now with respect to how we handle ports. We are aware of the issue, but unfortunately it's not on our list of things to address for the next few months. I've filed a couple bugs to keep track of these issues, so they don't fall through the cracks. It's possible they could get picked up as tasks to complete in the near term, but I can't say for sure.

If you'd like to talk more about your use cases and what you'd like to see implemented for Juju, I encourage you to post to the Juju mailing list - juju@lists.ubuntu.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.