)]}'
{"doc/source/deploy/security.rst":[{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"d8629344a2603af8785ab51e2a9a680dac511d2a","unresolved":false,"context_lines":[{"line_number":8,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"While Ironic is intended to be a secure application, it is important to note"},{"line_number":11,"context_line":"that it does not handle firmware security for a deployment."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Deployers must properly evaluate their use case and take action to secure"},{"line_number":14,"context_line":"these items appropriately."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_b975c533","line":11,"updated":"2016-04-21 17:33:50.000000000","message":"I would restate this:\n\n  it is important to understand what it does and does not cover today.\n\nand then go into detail about firmware below, as well as other things.","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"8f6e9d3d5ab5492fd14f4e70c7b7995c289ed727","unresolved":false,"context_lines":[{"line_number":13,"context_line":"Deployers must properly evaluate their use case and take action to secure"},{"line_number":14,"context_line":"these items appropriately."},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"TODO add a bunch of sources, maybe network security?"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Firmware security"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_22ca306f","line":16,"updated":"2016-04-21 13:39:37.000000000","message":"TODO should be a comment","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"b43729ca5a5fc42a4c4119167882f977b1a5114b","unresolved":false,"context_lines":[{"line_number":18,"context_line":"Firmware security"},{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"When ironic deploys a server for a user, the user has full root access to"},{"line_number":22,"context_line":"the machine. Most servers in default settings do not prevent the root user"},{"line_number":23,"context_line":"from writing firmwares or accessing hardware such as the BMC or SPI interface."},{"line_number":24,"context_line":"This means that a user could write malicious firmware before tearing down"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_02b3b40b","line":21,"range":{"start_line":21,"start_character":59,"end_line":21,"end_character":63},"updated":"2016-04-21 13:37:46.000000000","message":"s/root/administrative/","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"b43729ca5a5fc42a4c4119167882f977b1a5114b","unresolved":false,"context_lines":[{"line_number":19,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"When ironic deploys a server for a user, the user has full root access to"},{"line_number":22,"context_line":"the machine. Most servers in default settings do not prevent the root user"},{"line_number":23,"context_line":"from writing firmwares or accessing hardware such as the BMC or SPI interface."},{"line_number":24,"context_line":"This means that a user could write malicious firmware before tearing down"},{"line_number":25,"context_line":"their instance, leaving future users of the machine vulnerable to attacks."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_22919053","line":22,"range":{"start_line":22,"start_character":65,"end_line":22,"end_character":70},"updated":"2016-04-21 13:37:46.000000000","message":"nit s/root user/running operating system/","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":11655,"name":"Julia Kreger","email":"juliaashleykreger@gmail.com","username":"jkreger","status":"Flying to the moon with a Jetpack!"},"change_message_id":"b43729ca5a5fc42a4c4119167882f977b1a5114b","unresolved":false,"context_lines":[{"line_number":20,"context_line":""},{"line_number":21,"context_line":"When ironic deploys a server for a user, the user has full root access to"},{"line_number":22,"context_line":"the machine. Most servers in default settings do not prevent the root user"},{"line_number":23,"context_line":"from writing firmwares or accessing hardware such as the BMC or SPI interface."},{"line_number":24,"context_line":"This means that a user could write malicious firmware before tearing down"},{"line_number":25,"context_line":"their instance, leaving future users of the machine vulnerable to attacks."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_c28d3c2c","line":23,"range":{"start_line":23,"start_character":57,"end_line":23,"end_character":67},"updated":"2016-04-21 13:37:46.000000000","message":"I  kind of feel we need to shy away from abbreviations with this.","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"d8629344a2603af8785ab51e2a9a680dac511d2a","unresolved":false,"context_lines":[{"line_number":24,"context_line":"This means that a user could write malicious firmware before tearing down"},{"line_number":25,"context_line":"their instance, leaving future users of the machine vulnerable to attacks."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"A person deploying Ironic should work with their hardware vendor to secure"},{"line_number":28,"context_line":"firmwares via cryptographic signatures, disable OS access to interfaces"},{"line_number":29,"context_line":"that the user does not need (e.g. BMC), and choose proper BIOS settings to"},{"line_number":30,"context_line":"mitigate the risk of users writing firmware."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_99d729ed","line":27,"updated":"2016-04-21 17:33:50.000000000","message":"s/A person deploying Ironic/The cloud operator/","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"8f6e9d3d5ab5492fd14f4e70c7b7995c289ed727","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"A person deploying Ironic should work with their hardware vendor to secure"},{"line_number":28,"context_line":"firmwares via cryptographic signatures, disable OS access to interfaces"},{"line_number":29,"context_line":"that the user does not need (e.g. BMC), and choose proper BIOS settings to"},{"line_number":30,"context_line":"mitigate the risk of users writing firmware."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"ironic-python-agent supports custom hardware managers, which may have"}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_c286dc15","line":29,"range":{"start_line":29,"start_character":58,"end_line":29,"end_character":62},"updated":"2016-04-21 13:39:37.000000000","message":"nit: BIOS/UEFI","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"d8629344a2603af8785ab51e2a9a680dac511d2a","unresolved":false,"context_lines":[{"line_number":29,"context_line":"that the user does not need (e.g. BMC), and choose proper BIOS settings to"},{"line_number":30,"context_line":"mitigate the risk of users writing firmware."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"ironic-python-agent supports custom hardware managers, which may have"},{"line_number":33,"context_line":"custom clean steps that run during automatic or manual cleaning. By creating"},{"line_number":34,"context_line":"a hardware manager that can validate firmware during cleaning, one can"},{"line_number":35,"context_line":"further mitigate the risk of a malicious firmware reaching the next user."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_19395942","line":32,"updated":"2016-04-21 17:33:50.000000000","message":"s/custom/pluggable/","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"d8629344a2603af8785ab51e2a9a680dac511d2a","unresolved":false,"context_lines":[{"line_number":31,"context_line":""},{"line_number":32,"context_line":"ironic-python-agent supports custom hardware managers, which may have"},{"line_number":33,"context_line":"custom clean steps that run during automatic or manual cleaning. By creating"},{"line_number":34,"context_line":"a hardware manager that can validate firmware during cleaning, one can"},{"line_number":35,"context_line":"further mitigate the risk of a malicious firmware reaching the next user."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_d4020809","line":34,"updated":"2016-04-21 17:33:50.000000000","message":"this should not use the passive voice, and instead should clearly advise operators that *they* should create their own hardware managers. It would be great for us to provide references to where some prewritten ones can be found, too. Eg,\n\n  ironic-python-agent is designed to support pluggable \n  hardware managers which may implement custom \"clean \n  steps\". These can be run manually, and will be run \n  automatically by ironic during \"cleaning\" (ie, after \n  instance deletion).\n\n  The security-conscious cloud operator is strongly \n  encouraged to create their own hardware managers and \n  cleaning steps to perform what ever actions they feel are \n  necessary to secure machines for re-use by the next tenant.\n\n  Sample hardware managers may be found at (link)\n  which implement (description).","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"8f6e9d3d5ab5492fd14f4e70c7b7995c289ed727","unresolved":false,"context_lines":[{"line_number":32,"context_line":"ironic-python-agent supports custom hardware managers, which may have"},{"line_number":33,"context_line":"custom clean steps that run during automatic or manual cleaning. By creating"},{"line_number":34,"context_line":"a hardware manager that can validate firmware during cleaning, one can"},{"line_number":35,"context_line":"further mitigate the risk of a malicious firmware reaching the next user."}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a122d0e_824864ce","line":35,"updated":"2016-04-21 13:39:37.000000000","message":"Perhaps linking some technologies that helps mitigating such problems from our documentation? E.g trusted boot and secure boot:\n\nhttp://docs.openstack.org/developer/ironic/deploy/install-guide.html?highlight\u003dtxt#trusted-boot-with-partition-image\n\nhttp://docs.openstack.org/developer/ironic/drivers/ilo.html?highlight\u003dsecure%20boot#uefi-secure-boot-support","commit_id":"c2721dbae24abf3732ce216663695e1751361aea"},{"author":{"_account_id":7080,"name":"Mathieu Mitchell","email":"mat128@gmail.com","username":"mat128"},"change_message_id":"49f401051f1b242f9c67fa5789e72a66f78b3415","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"If the ``automated_clean`` configuration option is enabled (previously the"},{"line_number":42,"context_line":"``clean_nodes`` option), then Ironic will securely erase all local disk devices"},{"line_number":43,"context_line":"within a machine during instance deletion. Ironic will not, by default,"},{"line_number":44,"context_line":"validate the integrity of or make any modifications to system or device"},{"line_number":45,"context_line":"firmware or firmware settings."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bab6814e_2d956686","line":43,"range":{"start_line":43,"start_character":58,"end_line":43,"end_character":70},"updated":"2016-05-20 17:32:20.000000000","message":"This suggests that Ironic is capable of doing so out of the box.","commit_id":"14d18336621d3fe355b800598d22d8c050609960"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"ae99c85ce7a84c20c90f395801aadc7e2631abc6","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"If the ``automated_clean`` configuration option is enabled (previously the"},{"line_number":42,"context_line":"``clean_nodes`` option), then Ironic will securely erase all local disk devices"},{"line_number":43,"context_line":"within a machine during instance deletion. Ironic will not, by default,"},{"line_number":44,"context_line":"validate the integrity of or make any modifications to system or device"},{"line_number":45,"context_line":"firmware or firmware settings."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"bab6814e_48fa5876","line":43,"updated":"2016-05-20 18:10:18.000000000","message":"fair point. I\u0027ll clean that up","commit_id":"14d18336621d3fe355b800598d22d8c050609960"},{"author":{"_account_id":2889,"name":"Aeva Black","email":"aeva.online@gmail.com","username":"tenbrae"},"change_message_id":"ae99c85ce7a84c20c90f395801aadc7e2631abc6","unresolved":false,"context_lines":[{"line_number":50,"context_line":"hardware manager that can validate firmware during cleaning, one can further"},{"line_number":51,"context_line":"mitigate the risk of a malicious firmware reaching the next user."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"The security-conscious operator is **strongly** encouraged to write their own"},{"line_number":54,"context_line":"HardwareManager plugins and build these into their"},{"line_number":55,"context_line":"``ironic-python-agent``-based deploy ramdisk. This should include custom"},{"line_number":56,"context_line":"``clean steps`` to be run as part of the automated cleaning process, which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bab6814e_28f7148c","line":53,"updated":"2016-05-20 18:10:18.000000000","message":"I\u0027ll consolidate","commit_id":"14d18336621d3fe355b800598d22d8c050609960"},{"author":{"_account_id":7080,"name":"Mathieu Mitchell","email":"mat128@gmail.com","username":"mat128"},"change_message_id":"49f401051f1b242f9c67fa5789e72a66f78b3415","unresolved":false,"context_lines":[{"line_number":50,"context_line":"hardware manager that can validate firmware during cleaning, one can further"},{"line_number":51,"context_line":"mitigate the risk of a malicious firmware reaching the next user."},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"The security-conscious operator is **strongly** encouraged to write their own"},{"line_number":54,"context_line":"HardwareManager plugins and build these into their"},{"line_number":55,"context_line":"``ironic-python-agent``-based deploy ramdisk. This should include custom"},{"line_number":56,"context_line":"``clean steps`` to be run as part of the automated cleaning process, which"}],"source_content_type":"text/x-rst","patch_set":2,"id":"bab6814e_cd381aa3","line":53,"updated":"2016-05-20 17:32:20.000000000","message":"This paragraph sounds to me like the previous one.","commit_id":"14d18336621d3fe355b800598d22d8c050609960"},{"author":{"_account_id":6773,"name":"Lucas Alvares Gomes","email":"lucasagomes@gmail.com","username":"lucasagomes"},"change_message_id":"9e712de0cb1c17a2293090688402a617df3a2b54","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Ideally, an operator would work with their hardware vendor to ensure that"},{"line_number":55,"context_line":"proper firmware security measures are put in place ahead of time.  This could"},{"line_number":56,"context_line":"include:"},{"line_number":57,"context_line":"  - installing signed firmware for BIOS and peripheral devices"},{"line_number":58,"context_line":"  - using a TPM (Trusted Platform Module) to validate signatures at boot time"},{"line_number":59,"context_line":"  - booting machines in UEFI SecureBoot mode, rather than BIOS mode, to validate"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bab6814e_a7aae782","line":56,"updated":"2016-05-23 09:13:04.000000000","message":"doc8 is accusing that this needs a new line before the bullet points","commit_id":"12796e6cc7345191c6e800288f2e5d01593009de"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"c38f210ef6679cae51b1788369856b4c11612b0c","unresolved":false,"context_lines":[{"line_number":42,"context_line":"``clean_nodes`` option), then Ironic will securely erase all local disk devices"},{"line_number":43,"context_line":"within a machine during instance deletion. However, Ironic does not ship with"},{"line_number":44,"context_line":"any code that will validate the integrity of, or make any modifications to,"},{"line_number":45,"context_line":"system or device firmware or firmware settings."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"Operators are encouraged to write their own hardware manager plugins for the"},{"line_number":48,"context_line":"``ironic-python-agent`` ramdisk.  This should include custom ``clean steps``"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bab6814e_40c82855","line":45,"updated":"2016-05-23 16:27:00.000000000","message":"iLO drivers have ability to perform OOB firmware update of some components as a manual clean_step.\nIt also supports resetting system ROM settings to default as automated clean step.\nhttps://github.com/openstack/ironic/blob/master/doc/source/drivers/ilo.rst#supported-automated-cleaning-operations","commit_id":"384957177eb01b284762a5c8744ea66771e7d641"},{"author":{"_account_id":11076,"name":"Shivanand Tendulker","email":"stendulker@gmail.com","username":"stendulker"},"change_message_id":"c38f210ef6679cae51b1788369856b4c11612b0c","unresolved":false,"context_lines":[{"line_number":57,"context_line":""},{"line_number":58,"context_line":"  - installing signed firmware for BIOS and peripheral devices"},{"line_number":59,"context_line":"  - using a TPM (Trusted Platform Module) to validate signatures at boot time"},{"line_number":60,"context_line":"  - booting machines in UEFI SecureBoot mode, rather than BIOS mode, to validate"},{"line_number":61,"context_line":"    kernel signatures"},{"line_number":62,"context_line":"  - disabling local (in-band) access from the host OS to the management controller (BMC)"},{"line_number":63,"context_line":"  - disabling modifications to boot settings from the host OS"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bab6814e_600f2c37","line":60,"range":{"start_line":60,"start_character":29,"end_line":60,"end_character":39},"updated":"2016-05-23 16:27:00.000000000","message":"nit: s/SecureBoot/ Secure Boot/","commit_id":"384957177eb01b284762a5c8744ea66771e7d641"},{"author":{"_account_id":12356,"name":"Vladyslav Drok","email":"vdrok@mirantis.com","username":"vdrok"},"change_message_id":"a16137a6a2a5830665bdc491eec8e01b5f50c838","unresolved":false,"context_lines":[{"line_number":63,"context_line":"  - disabling modifications to boot settings from the host OS"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"Additional references:"},{"line_number":66,"context_line":"  - http://docs.openstack.org/developer/ironic/deploy/install-guide.html?highlight\u003dtxt#trusted-boot-with-partition-image"},{"line_number":67,"context_line":"  - http://docs.openstack.org/developer/ironic/drivers/ilo.html?highlight\u003dsecure%20boot#uefi-secure-boot-support"}],"source_content_type":"text/x-rst","patch_set":4,"id":"bab6814e_4aafb07c","line":66,"updated":"2016-05-23 13:59:54.000000000","message":"It would be prettier to format these as links with some substituting text.","commit_id":"384957177eb01b284762a5c8744ea66771e7d641"}]}