)]}'
{"security-guide/section_identity-checklist.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"      \u003ctitle\u003eChecklist\u003c/title\u003e"},{"line_number":9,"context_line":"        \u003csection xml:id\u003d\"check-keystone-01\"\u003e"},{"line_number":10,"context_line":"             \u003ctitle\u003eCheck-Keystone-01: Is user/group ownership of"},{"line_number":11,"context_line":"             Keystone configuration files set to keystone?\u003c/title\u003e"},{"line_number":12,"context_line":"             \u003cpara\u003eConfiguration files contain critical parameters and"},{"line_number":13,"context_line":"             information required for smooth functioning of the"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_363feb88","line":10,"updated":"2015-03-03 11:00:05.000000000","message":"Say \"user and group\", don\u0027t use a \"/\" - also further below in this section.","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"      \u003ctitle\u003eChecklist\u003c/title\u003e"},{"line_number":9,"context_line":"        \u003csection xml:id\u003d\"check-keystone-01\"\u003e"},{"line_number":10,"context_line":"             \u003ctitle\u003eCheck-Keystone-01: Is user/group ownership of"},{"line_number":11,"context_line":"             Keystone configuration files set to keystone?\u003c/title\u003e"},{"line_number":12,"context_line":"             \u003cpara\u003eConfiguration files contain critical parameters and"},{"line_number":13,"context_line":"             information required for smooth functioning of the"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_6f7b37be","line":10,"in_reply_to":"ba7be1f8_363feb88","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":8,"context_line":"      \u003ctitle\u003eChecklist\u003c/title\u003e"},{"line_number":9,"context_line":"        \u003csection xml:id\u003d\"check-keystone-01\"\u003e"},{"line_number":10,"context_line":"             \u003ctitle\u003eCheck-Keystone-01: Is user/group ownership of"},{"line_number":11,"context_line":"             Keystone configuration files set to keystone?\u003c/title\u003e"},{"line_number":12,"context_line":"             \u003cpara\u003eConfiguration files contain critical parameters and"},{"line_number":13,"context_line":"             information required for smooth functioning of the"},{"line_number":14,"context_line":"             component. If an unprivileged user, either intentionally or"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_16d7474c","line":11,"updated":"2015-03-03 11:00:05.000000000","message":"Please follow the conventions for project names https://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names and use \"Identity configuration files\"","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":8,"context_line":"      \u003ctitle\u003eChecklist\u003c/title\u003e"},{"line_number":9,"context_line":"        \u003csection xml:id\u003d\"check-keystone-01\"\u003e"},{"line_number":10,"context_line":"             \u003ctitle\u003eCheck-Keystone-01: Is user/group ownership of"},{"line_number":11,"context_line":"             Keystone configuration files set to keystone?\u003c/title\u003e"},{"line_number":12,"context_line":"             \u003cpara\u003eConfiguration files contain critical parameters and"},{"line_number":13,"context_line":"             information required for smooth functioning of the"},{"line_number":14,"context_line":"             component. If an unprivileged user, either intentionally or"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_6f29779a","line":11,"in_reply_to":"ba7be1f8_16d7474c","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":28,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If user/group"},{"line_number":29,"context_line":"             ownership of all these config files is set to keystone."},{"line_number":30,"context_line":"             The above commands show output keystone keystone.\u003c/para\u003e"},{"line_number":31,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":32,"context_line":"             \u003c/para\u003e"},{"line_number":33,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":34,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_166587b4","line":31,"updated":"2015-03-03 11:00:05.000000000","message":"If otherwise -\u003e Otherwise, also below in several places","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":28,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If user/group"},{"line_number":29,"context_line":"             ownership of all these config files is set to keystone."},{"line_number":30,"context_line":"             The above commands show output keystone keystone.\u003c/para\u003e"},{"line_number":31,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":32,"context_line":"             \u003c/para\u003e"},{"line_number":33,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":34,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_5a170f45","line":31,"in_reply_to":"ba7be1f8_166587b4","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":30,"context_line":"             The above commands show output keystone keystone.\u003c/para\u003e"},{"line_number":31,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":32,"context_line":"             \u003c/para\u003e"},{"line_number":33,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":34,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"},{"line_number":35,"context_line":"             Internally Implemented Authentication Methods\u003c/link\u003e\u003c/para\u003e"},{"line_number":36,"context_line":"        \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_b68d9b7e","line":33,"updated":"2015-03-03 11:00:05.000000000","message":"don\u0027t capitalize \"In\" - please change everywhere.","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":30,"context_line":"             The above commands show output keystone keystone.\u003c/para\u003e"},{"line_number":31,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":32,"context_line":"             \u003c/para\u003e"},{"line_number":33,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":34,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"},{"line_number":35,"context_line":"             Internally Implemented Authentication Methods\u003c/link\u003e\u003c/para\u003e"},{"line_number":36,"context_line":"        \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_7a2773b6","line":33,"in_reply_to":"ba7be1f8_b68d9b7e","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":40,"context_line":"             \u003cpara\u003eSimilar to previous check, it is recommended to set"},{"line_number":41,"context_line":"             strict access permissions for such configuration files."},{"line_number":42,"context_line":"             \u003c/para\u003e"},{"line_number":43,"context_line":"             \u003cpara\u003eRun the following command:\u003c/para\u003e"},{"line_number":44,"context_line":"\u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/keystone.conf\u003c/userinput\u003e"},{"line_number":45,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/keystone-paste.ini\u003c/userinput\u003e"},{"line_number":46,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/policy.json\u003c/userinput\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_56445f1a","line":43,"updated":"2015-03-03 11:00:05.000000000","message":"plural: commands","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":40,"context_line":"             \u003cpara\u003eSimilar to previous check, it is recommended to set"},{"line_number":41,"context_line":"             strict access permissions for such configuration files."},{"line_number":42,"context_line":"             \u003c/para\u003e"},{"line_number":43,"context_line":"             \u003cpara\u003eRun the following command:\u003c/para\u003e"},{"line_number":44,"context_line":"\u003cscreen\u003e\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/keystone.conf\u003c/userinput\u003e"},{"line_number":45,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/keystone-paste.ini\u003c/userinput\u003e"},{"line_number":46,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/policy.json\u003c/userinput\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_9a2c279b","line":43,"in_reply_to":"ba7be1f8_56445f1a","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":53,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":54,"context_line":"             \u003c/para\u003e"},{"line_number":55,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":56,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"},{"line_number":57,"context_line":"             Internally Implemented Authentication Methods\u003c/link\u003e\u003c/para\u003e"},{"line_number":58,"context_line":"        \u003c/section\u003e"},{"line_number":59,"context_line":"        \u003csection xml:id\u003d\"check-keystone-03\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_76dec36e","line":56,"updated":"2015-03-03 11:00:05.000000000","message":"You can use an xref here and let our scripts fill in the title themselves.","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":53,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If otherwise."},{"line_number":54,"context_line":"             \u003c/para\u003e"},{"line_number":55,"context_line":"             \u003cpara\u003eRecommended In:"},{"line_number":56,"context_line":"             \u003clink linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"\u003e"},{"line_number":57,"context_line":"             Internally Implemented Authentication Methods\u003c/link\u003e\u003c/para\u003e"},{"line_number":58,"context_line":"        \u003c/section\u003e"},{"line_number":59,"context_line":"        \u003csection xml:id\u003d\"check-keystone-03\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_ba1d6b64","line":56,"in_reply_to":"ba7be1f8_76dec36e","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":61,"context_line":"             \u003c/title\u003e"},{"line_number":62,"context_line":"             \u003cpara\u003eOpenstack components communicate with each other"},{"line_number":63,"context_line":"             using various protocols and the communication might involve"},{"line_number":64,"context_line":"             sensitive / confidential data. An attacker may try to"},{"line_number":65,"context_line":"             eavesdrop on the channel in order to get access to"},{"line_number":66,"context_line":"             sensitive information. Thus all the components must"},{"line_number":67,"context_line":"             communicate with each other using a secured communication"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_96709773","line":64,"updated":"2015-03-03 11:00:05.000000000","message":"/ -\u003e or","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":61,"context_line":"             \u003c/title\u003e"},{"line_number":62,"context_line":"             \u003cpara\u003eOpenstack components communicate with each other"},{"line_number":63,"context_line":"             using various protocols and the communication might involve"},{"line_number":64,"context_line":"             sensitive / confidential data. An attacker may try to"},{"line_number":65,"context_line":"             eavesdrop on the channel in order to get access to"},{"line_number":66,"context_line":"             sensitive information. Thus all the components must"},{"line_number":67,"context_line":"             communicate with each other using a secured communication"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_ba6babb7","line":64,"in_reply_to":"ba7be1f8_96709773","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"71ae4f0499a2e751dd27eef04018db6bc6219e70","unresolved":false,"context_lines":[{"line_number":86,"context_line":"             hashing algorithm to prevent unauthorized disclosure and"},{"line_number":87,"context_line":"             subsequent access.\u003c/para\u003e"},{"line_number":88,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"},{"line_number":89,"context_line":"             parameter \u003coption\u003ehash_algorithm\u003c/option\u003e under [token]"},{"line_number":90,"context_line":"             section in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":91,"context_line":"             is set to SHA256.\u003c/para\u003e"},{"line_number":92,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_56129f09","line":89,"updated":"2015-03-03 11:00:05.000000000","message":"\u003cliteral\u003e[token]\u003c/literal\u003e also elsewhere for sections","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"92247231b7d16327b8bdd97e7abb74df5508b381","unresolved":false,"context_lines":[{"line_number":86,"context_line":"             hashing algorithm to prevent unauthorized disclosure and"},{"line_number":87,"context_line":"             subsequent access.\u003c/para\u003e"},{"line_number":88,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"},{"line_number":89,"context_line":"             parameter \u003coption\u003ehash_algorithm\u003c/option\u003e under [token]"},{"line_number":90,"context_line":"             section in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"},{"line_number":91,"context_line":"             is set to SHA256.\u003c/para\u003e"},{"line_number":92,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_fa68c3bb","line":89,"in_reply_to":"ba7be1f8_56129f09","updated":"2015-03-03 17:26:32.000000000","message":"Done","commit_id":"224036382a6034701a496416df53a8d0688e9366"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a51492efbff6471c24c3f283d9081caa08690e4e","unresolved":false,"context_lines":[{"line_number":29,"context_line":"             group ownership of all these config files is set to"},{"line_number":30,"context_line":"             keystone. The above commands show output of keystone"},{"line_number":31,"context_line":"             keystone.\u003c/para\u003e"},{"line_number":32,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e Otherwise."},{"line_number":33,"context_line":"             \u003c/para\u003e"},{"line_number":34,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":35,"context_line":"             \u003cxref linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"/\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_c1006f68","line":32,"updated":"2015-03-03 20:49:37.000000000","message":"Personally not a fan of just \u0027otherwise\u0027 here; would prefer something like \"Output is not returned or output that is returned is not the keystone account\" (for example, running this on devstack currently returns no output as it\u0027s stack stack)","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":29,"context_line":"             group ownership of all these config files is set to"},{"line_number":30,"context_line":"             keystone. The above commands show output of keystone"},{"line_number":31,"context_line":"             keystone.\u003c/para\u003e"},{"line_number":32,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e Otherwise."},{"line_number":33,"context_line":"             \u003c/para\u003e"},{"line_number":34,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":35,"context_line":"             \u003cxref linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"/\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_21092631","line":32,"in_reply_to":"ba7be1f8_c1006f68","updated":"2015-03-16 06:32:38.000000000","message":"Replaced with:\n\nIf the above commands does not return any output as the user or group ownership might have set to any user other than keystone.","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a51492efbff6471c24c3f283d9081caa08690e4e","unresolved":false,"context_lines":[{"line_number":51,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/ssl/certs/ca.pem\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":52,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If permissions"},{"line_number":53,"context_line":"             are set to 640 or stricter.\u003c/para\u003e"},{"line_number":54,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e Otherwise."},{"line_number":55,"context_line":"             \u003c/para\u003e"},{"line_number":56,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":57,"context_line":"             \u003cxref linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"/\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_211dcbbe","line":54,"updated":"2015-03-03 20:49:37.000000000","message":"Again, I\u0027d be in favor of being a bit more specific here - will more strict permissions still allow everything to run? Or does it have to be 640 exactly?","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":51,"context_line":"\u003cprompt\u003e$\u003c/prompt\u003e \u003cuserinput\u003estat -L -c \"%a\" /etc/keystone/ssl/certs/ca.pem\u003c/userinput\u003e\u003c/screen\u003e"},{"line_number":52,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If permissions"},{"line_number":53,"context_line":"             are set to 640 or stricter.\u003c/para\u003e"},{"line_number":54,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e Otherwise."},{"line_number":55,"context_line":"             \u003c/para\u003e"},{"line_number":56,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":57,"context_line":"             \u003cxref linkend\u003d\"identity-authentication-methods-internally-implemented-authentication-methods\"/\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_e421dc9e","line":54,"in_reply_to":"ba7be1f8_211dcbbe","updated":"2015-03-16 06:32:38.000000000","message":"Replaced with:\n\nIf permissions are not set to atleast 640.","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"95d1dd34f8233b61292f06d429a4dd2f26765d5a","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        \u003csection xml:id\u003d\"check-identity-03\"\u003e"},{"line_number":61,"context_line":"             \u003ctitle\u003eCheck-Identity-03: is SSL enabled for Keystone?"},{"line_number":62,"context_line":"             \u003c/title\u003e"},{"line_number":63,"context_line":"             \u003cpara\u003eOpenstack components communicate with each other"},{"line_number":64,"context_line":"             using various protocols and the communication might involve"},{"line_number":65,"context_line":"             sensitive or confidential data. An attacker may try to"},{"line_number":66,"context_line":"             eavesdrop on the channel in order to get access to"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_bb6badb7","line":63,"updated":"2015-03-03 18:08:51.000000000","message":"Open*S*tack","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":60,"context_line":"        \u003csection xml:id\u003d\"check-identity-03\"\u003e"},{"line_number":61,"context_line":"             \u003ctitle\u003eCheck-Identity-03: is SSL enabled for Keystone?"},{"line_number":62,"context_line":"             \u003c/title\u003e"},{"line_number":63,"context_line":"             \u003cpara\u003eOpenstack components communicate with each other"},{"line_number":64,"context_line":"             using various protocols and the communication might involve"},{"line_number":65,"context_line":"             sensitive or confidential data. An attacker may try to"},{"line_number":66,"context_line":"             eavesdrop on the channel in order to get access to"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_642dec8e","line":63,"in_reply_to":"ba7be1f8_bb6badb7","updated":"2015-03-16 06:32:38.000000000","message":"Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"95d1dd34f8233b61292f06d429a4dd2f26765d5a","unresolved":false,"context_lines":[{"line_number":71,"context_line":"             parameter \u003coption\u003eenable\u003c/option\u003e under \u003cliteral\u003e[ssl]\u003c/literal\u003e"},{"line_number":72,"context_line":"             section in"},{"line_number":73,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":74,"context_line":"             True.\u003c/para\u003e"},{"line_number":75,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":76,"context_line":"             parameter \u003coption\u003eenable\u003c/option\u003e under \u003cliteral\u003e[ssl]\u003c/literal\u003e"},{"line_number":77,"context_line":"             section is not set to True.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_fb68c5bb","line":74,"updated":"2015-03-03 18:08:51.000000000","message":"\u003cliteral\u003eTrue\u003c/literal\u003e everywhere","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":71,"context_line":"             parameter \u003coption\u003eenable\u003c/option\u003e under \u003cliteral\u003e[ssl]\u003c/literal\u003e"},{"line_number":72,"context_line":"             section in"},{"line_number":73,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":74,"context_line":"             True.\u003c/para\u003e"},{"line_number":75,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":76,"context_line":"             parameter \u003coption\u003eenable\u003c/option\u003e under \u003cliteral\u003e[ssl]\u003c/literal\u003e"},{"line_number":77,"context_line":"             section is not set to True.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_849d80be","line":74,"in_reply_to":"ba7be1f8_fb68c5bb","updated":"2015-03-16 06:32:38.000000000","message":"Found it in two places, added \u003cliteral\u003eTrue\u003c/literal\u003e in both places.","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"95d1dd34f8233b61292f06d429a4dd2f26765d5a","unresolved":false,"context_lines":[{"line_number":79,"context_line":"             \u003cxref linkend\u003d\"secure_communication\"/\u003e\u003c/para\u003e"},{"line_number":80,"context_line":"        \u003c/section\u003e"},{"line_number":81,"context_line":"        \u003csection xml:id\u003d\"check-identity-04\"\u003e"},{"line_number":82,"context_line":"             \u003ctitle\u003eCheck-Identity-04: Does keystone use strong hashing"},{"line_number":83,"context_line":"             algorithms for PKI tokens?\u003c/title\u003e"},{"line_number":84,"context_line":"             \u003cpara\u003eMD5 is a weak and depreciated hashing algorithm. It"},{"line_number":85,"context_line":"             can be cracked using bruteforce attack. Keystone tokens are"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_7b75b596","line":82,"updated":"2015-03-03 18:08:51.000000000","message":"keystone -\u003e Identity in most cases","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":79,"context_line":"             \u003cxref linkend\u003d\"secure_communication\"/\u003e\u003c/para\u003e"},{"line_number":80,"context_line":"        \u003c/section\u003e"},{"line_number":81,"context_line":"        \u003csection xml:id\u003d\"check-identity-04\"\u003e"},{"line_number":82,"context_line":"             \u003ctitle\u003eCheck-Identity-04: Does keystone use strong hashing"},{"line_number":83,"context_line":"             algorithms for PKI tokens?\u003c/title\u003e"},{"line_number":84,"context_line":"             \u003cpara\u003eMD5 is a weak and depreciated hashing algorithm. It"},{"line_number":85,"context_line":"             can be cracked using bruteforce attack. Keystone tokens are"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_c43f7885","line":82,"in_reply_to":"ba7be1f8_7b75b596","updated":"2015-03-16 06:32:38.000000000","message":"Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a51492efbff6471c24c3f283d9081caa08690e4e","unresolved":false,"context_lines":[{"line_number":83,"context_line":"             algorithms for PKI tokens?\u003c/title\u003e"},{"line_number":84,"context_line":"             \u003cpara\u003eMD5 is a weak and depreciated hashing algorithm. It"},{"line_number":85,"context_line":"             can be cracked using bruteforce attack. Keystone tokens are"},{"line_number":86,"context_line":"             sensitive and need to be protected with more stronger"},{"line_number":87,"context_line":"             hashing algorithm to prevent unauthorized disclosure and"},{"line_number":88,"context_line":"             subsequent access.\u003c/para\u003e"},{"line_number":89,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_7c9be817","line":86,"updated":"2015-03-03 20:49:37.000000000","message":"Replace \u0027more\u0027 with \u0027a\u0027","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":83,"context_line":"             algorithms for PKI tokens?\u003c/title\u003e"},{"line_number":84,"context_line":"             \u003cpara\u003eMD5 is a weak and depreciated hashing algorithm. It"},{"line_number":85,"context_line":"             can be cracked using bruteforce attack. Keystone tokens are"},{"line_number":86,"context_line":"             sensitive and need to be protected with more stronger"},{"line_number":87,"context_line":"             hashing algorithm to prevent unauthorized disclosure and"},{"line_number":88,"context_line":"             subsequent access.\u003c/para\u003e"},{"line_number":89,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_445388e1","line":86,"in_reply_to":"ba7be1f8_7c9be817","updated":"2015-03-16 06:32:38.000000000","message":"Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"95d1dd34f8233b61292f06d429a4dd2f26765d5a","unresolved":false,"context_lines":[{"line_number":92,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":93,"context_line":"             SHA256.\u003c/para\u003e"},{"line_number":94,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":95,"context_line":"             parameter \u003coption\u003ehash_algorithm\u003c/option\u003e under [token]"},{"line_number":96,"context_line":"             section is set to MD5.\u003c/para\u003e"},{"line_number":97,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":98,"context_line":"             \u003cxref linkend\u003d\"identity-tokens\"/\u003e\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_bba2cdf9","line":95,"updated":"2015-03-03 18:08:51.000000000","message":"\u003cliteral\u003e[token]","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":92,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":93,"context_line":"             SHA256.\u003c/para\u003e"},{"line_number":94,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":95,"context_line":"             parameter \u003coption\u003ehash_algorithm\u003c/option\u003e under [token]"},{"line_number":96,"context_line":"             section is set to MD5.\u003c/para\u003e"},{"line_number":97,"context_line":"             \u003cpara\u003eRecommended in:"},{"line_number":98,"context_line":"             \u003cxref linkend\u003d\"identity-tokens\"/\u003e\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_c45698cd","line":95,"in_reply_to":"ba7be1f8_bba2cdf9","updated":"2015-03-16 06:32:38.000000000","message":"Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a51492efbff6471c24c3f283d9081caa08690e4e","unresolved":false,"context_lines":[{"line_number":113,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"},{"line_number":114,"context_line":"             parameter max_request_body_size in"},{"line_number":115,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":116,"context_line":"             default (114688)."},{"line_number":117,"context_line":"             \u003c/para\u003e"},{"line_number":118,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":119,"context_line":"             parameter max_request_body_size is not set.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_f7ce1159","line":116,"updated":"2015-03-03 20:49:37.000000000","message":"The Pass/Fail here seem to leave possible valid options without either status - I\u0027d like to have pass amended to say something along the lines of \u0027default (114688), or some reasonable setting\" and leaving Fail as \u0027not set\u0027. That way domain-specific sizes can be set without concerning others (such as non-technical mgmt) about not following the default exactly.","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":113,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If value of"},{"line_number":114,"context_line":"             parameter max_request_body_size in"},{"line_number":115,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e is set to"},{"line_number":116,"context_line":"             default (114688)."},{"line_number":117,"context_line":"             \u003c/para\u003e"},{"line_number":118,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":119,"context_line":"             parameter max_request_body_size is not set.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_64c16c4d","line":116,"in_reply_to":"ba7be1f8_f7ce1159","updated":"2015-03-16 06:32:38.000000000","message":"Amended Pass to say:\n\nset to default (114688) or some reasonable value based on your environment.","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"95d1dd34f8233b61292f06d429a4dd2f26765d5a","unresolved":false,"context_lines":[{"line_number":116,"context_line":"             default (114688)."},{"line_number":117,"context_line":"             \u003c/para\u003e"},{"line_number":118,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":119,"context_line":"             parameter max_request_body_size is not set.\u003c/para\u003e"},{"line_number":120,"context_line":"        \u003c/section\u003e"},{"line_number":121,"context_line":"        \u003csection xml:id\u003d\"check-identity-06\"\u003e"},{"line_number":122,"context_line":"             \u003ctitle\u003eCheck-Identity-06: is admin token disabled in"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_fb960593","line":119,"updated":"2015-03-03 18:08:51.000000000","message":"\u003coption\u003emax_request... - also line 114","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":116,"context_line":"             default (114688)."},{"line_number":117,"context_line":"             \u003c/para\u003e"},{"line_number":118,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003eFail:\u003c/emphasis\u003e If value of"},{"line_number":119,"context_line":"             parameter max_request_body_size is not set.\u003c/para\u003e"},{"line_number":120,"context_line":"        \u003c/section\u003e"},{"line_number":121,"context_line":"        \u003csection xml:id\u003d\"check-identity-06\"\u003e"},{"line_number":122,"context_line":"             \u003ctitle\u003eCheck-Identity-06: is admin token disabled in"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_6465ecad","line":119,"in_reply_to":"ba7be1f8_fb960593","updated":"2015-03-16 06:32:38.000000000","message":"Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"a51492efbff6471c24c3f283d9081caa08690e4e","unresolved":false,"context_lines":[{"line_number":123,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e?\u003c/title\u003e"},{"line_number":124,"context_line":"             \u003cpara\u003eAdmin token is generally used to bootstrap Keystone."},{"line_number":125,"context_line":"             This token is the most valuable asset using which anyone"},{"line_number":126,"context_line":"             can get cloud admin privileges.\u003c/para\u003e"},{"line_number":127,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If"},{"line_number":128,"context_line":"             \u003coption\u003eadmin_token\u003c/option\u003e under \u003cliteral\u003e[DEFAULT]\u003c/literal\u003e"},{"line_number":129,"context_line":"             section in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"ba7be1f8_57619d37","line":126,"updated":"2015-03-03 20:49:37.000000000","message":"This sentence is a little choppy, maybe change it to:\n\"This token is the most valuable keystone asset, which could be used to gain cloud admin privileges.\"?","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"6ccc9f7463162b84110b21870d5e99c92c90f4fb","unresolved":false,"context_lines":[{"line_number":123,"context_line":"             \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e?\u003c/title\u003e"},{"line_number":124,"context_line":"             \u003cpara\u003eAdmin token is generally used to bootstrap Keystone."},{"line_number":125,"context_line":"             This token is the most valuable asset using which anyone"},{"line_number":126,"context_line":"             can get cloud admin privileges.\u003c/para\u003e"},{"line_number":127,"context_line":"             \u003cpara\u003e\u003cemphasis role\u003d\"bold\"\u003ePass:\u003c/emphasis\u003e If"},{"line_number":128,"context_line":"             \u003coption\u003eadmin_token\u003c/option\u003e under \u003cliteral\u003e[DEFAULT]\u003c/literal\u003e"},{"line_number":129,"context_line":"             section in \u003cfilename\u003e/etc/keystone/keystone.conf\u003c/filename\u003e"}],"source_content_type":"application/xml","patch_set":5,"id":"9a80dd14_64fc0cb6","line":126,"in_reply_to":"ba7be1f8_57619d37","updated":"2015-03-16 06:32:38.000000000","message":":) Done","commit_id":"485bb2fcfd6824efa056155b26afac6d4528f3cc"}]}