Accessing SUSE Customer Center and SUSE registry behind a firewall and/or through a proxy
This document (000021034) is provided subject to the disclaimer at the end of this document.
Environment
Situation
These rules prevent access to SUSE Customer Center/SCC (for registration or access via browser) or SUSE registry - registry.suse.com - (to download container images).
Resolution
The page "SUSE Content Delivery Network (CDN) Change" has the newest updates and details about the SUSE Content Delivery Network.
Domain/Host Name Allowlisting
* The firewall needs to allow connections to the following domains (for both ports: 80 and 443):
system registration |
scc.suse.com:<port>, updates.suse.com:<port>, installer-updates.suse.com:<port>, dl.suse.com, dl-ipv4.suse.com, public-dl.suse.com, public-dl-ipv4.suse.com |
website access |
scc.suse.com:<port>, customer-uploads.suse.com:<port>, static.scc.suse.com:<port> |
container image downloads |
scc.suse.com:<port>, registry.suse.com:<port>, registry-storage.suse.com:<port>, registry.rancher.com:<port>, dl.suse.com, dl-ipv4.suse.com, public-dl.suse.com, public-dl-ipv4.suse.com |
* Our new host names will not provide a single static IP address any more.
IP Address Allowlisting
* The current list of IPs for scc.suse.com and registry.suse.com are:
99.83.188.102 |
75.2.43.231 |
In case you need a static IP address for updates.suse.com, you can contact our customer support team to review the case and provide help.
* Static assets and support case attachments are served via AWS CloudFront.
CloudFront IP addresses may change over time.
The current list of possible IP addresses can be obtained as follows:
- CloudFront (customer-uploads.suse.com, registry-storage.suse.com, static.scc.suse.com)
$ curl https://ip-ranges.amazonaws.com/ip-ranges.json -o ip-ranges.json $ jq -r '.prefixes[] | select(.service=="CLOUDFRONT") | .ip_prefix' < ip-ranges.json | sort
For reference, AWS (Amazon Web Services) publishes its current IP address ranges in JSON format. To view the current ranges, download the .json file at: AWS IP address ranges (https://docs.aws.amazon.com/vpc/latest/userguide/aws-ip-ranges.html)
Proxy Setup
* A Proxy needs to allow for the "Authorization" and "System-Token" headers to be passed to the SUSE Customer Center.
Whether a proxy is filtering these headers can be checked with:
$ curl -X POST -H "Authorization: Basic dXNlcjpwYXNzd29yZA==" -H "System-Token: testtoken" https://scc.suse.com/debug/reflect
The output of the command should contain the values for HTTP_AUTHORIZATION and HTTP_SYSTEM_TOKEN that were provided in the command.
* Verify the proxy doesn't break the certification or a certificate wasn't installed correctly
$ openssl s_client -connect scc.suse.com:443 -showcerts -servername scc.suse.com
This should return "CONNECTED" and a successful SSL handshake. If it doesn't, the SUSE Knowledge Base article "How to verify openssl certification chain" can be used to check and debug the certificate status.
Additional Information
The following script serves as a basis for validating that your outbound connectivity is in place.
It validates being able to access SCC and the update hosts. You can download the shell script from here ( sha256 ). Remember to inspect it before running it to validate connectivity.
Please run it on the host that you use for connectivity to SCC (e.g. your RMT/SMT/SUSE Multi-Linux Manager Proxy).
Disclaimer
This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.
- Document ID:000021034
- Creation Date: 04-Apr-2023
- Modified Date:09-Jan-2025
-
- SUSE Linux Enterprise Server
For questions or concerns with the SUSE Knowledgebase please contact: tidfeedback[at]suse.com