)]}'
{"security-guide/ch_security-services-for-instances.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"90159e9ab1ffce60315f7b3e97ab4e978d1bb8ac","unresolved":false,"context_lines":[{"line_number":107,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003ewget http://mirror.anl.gov/pub/ubuntu-iso/CDs/precise/SHA256SUMS\u003c/userinput\u003e"},{"line_number":108,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003ewget http://mirror.anl.gov/pub/ubuntu-iso/CDs/precise/SHA256SUMS.gpg\u003c/userinput\u003e"},{"line_number":109,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003egpg --keyserver hkp://keyserver.ubuntu.com --recv-keys 0xFBB75451\u003c/userinput\u003e"},{"line_number":110,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003egpg --verify SHA256SUMS.gpg SHA256SUMSsha256sum -c SHA256SUMS 2\u0026gt;\u0026amp;1 | grep OK\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":111,"context_line":"        \u003cpara\u003eThe second option is to use the \u003clink xlink:href\u003d\"http://docs.openstack.org/trunk/image-guide/content/\"\u003e\u003ccitetitle\u003eOpenStack Virtual Machine Image Guide\u003c/citetitle\u003e\u003c/link\u003e. In this case, you will want to follow your organizations OS hardening guidelines or those provided by a trusted third-party such as the \u003clink xlink:href\u003d\"http://iase.disa.mil/stigs/os/unix/red_hat.html\"\u003eRHEL6 STIG\u003c/link\u003e.\u003c/para\u003e"},{"line_number":112,"context_line":"        \u003cpara\u003eThe final option is to use an automated image builder. The following example uses the Oz image builder. The OpenStack community has recently created a newer tool worth investigating: disk-image-builder. We have not evaluated this tool from a security perspective.\u003c/para\u003e"},{"line_number":113,"context_line":"        \u003cpara\u003eExample of RHEL 6 CCE-26976-1 which will help implement NIST 800-53 Section\u003cemphasis\u003eAC-19(d) in\u003c/emphasis\u003e Oz.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"baada198_990ff3df","line":110,"updated":"2014-07-25 11:46:28.000000000","message":"Christian, check this paragraph, I think it addresses your suggestion.","commit_id":"0cf920ade1c39bcfeb39ff379563294139ed018b"},{"author":{"_account_id":167,"name":"Christian Berendt","email":"berendt@osism.tech","username":"berendt"},"change_message_id":"71508a616c3a13373c88e99ac4d8f1a5dc8d854d","unresolved":false,"context_lines":[{"line_number":146,"context_line":"  \u0026lt;/command\u0026gt;"},{"line_number":147,"context_line":"\u0026lt;/commands\u0026gt;"},{"line_number":148,"context_line":"\u0026lt;/template\u0026gt;\u003c/programlisting\u003e"},{"line_number":149,"context_line":"        \u003cpara\u003eIt is recommended to avoid the manual image building process as it is complex and prone to error. Additionally, using an automated system like Oz for image building or a configuration management utility like Chef or Puppet for post-boot image hardening gives you the ability to produce a consistent image as well as track compliance of your base image to its respective hardening guidelines over time.\u003c/para\u003e"},{"line_number":150,"context_line":"        \u003cpara\u003eIf subscribing to a public cloud service, you should check with the cloud provider for an outline of the process used to produce their default images. If the provider allows you to upload your own images, you will want to ensure that you are able to verify that your image was not modified before using it to create an instance. To do this, refer to the following section on Image Provenance.\u003c/para\u003e"},{"line_number":151,"context_line":"      \u003c/section\u003e"},{"line_number":152,"context_line":"      \u003csection xml:id\u003d\"security-services-for-instances-idp166272\"\u003e"}],"source_content_type":"application/xml","patch_set":1,"id":"baada198_b93f57b4","line":149,"updated":"2014-07-25 11:40:58.000000000","message":"We should note the OpenStack Virtual Machine Image Guide (http://docs.openstack.org/image-guide/content/) here.","commit_id":"0cf920ade1c39bcfeb39ff379563294139ed018b"}]}