)]}'
{"security-guide/section_secure-reference-architectures.xml":[{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"116023d200e02bd69ed7a20a544b0a2624251d93","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, password"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"},{"line_number":26,"context_line":"    man-in-the-middle attack. The attacker can then use these valid"},{"line_number":27,"context_line":"    credentials to perform malicious operations. All real deployments"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_6dc4b140","line":24,"updated":"2015-02-20 17:29:04.000000000","message":"should this be \"..., passwords and tokens ...\"?","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e16ca2e6febdbb8c7f12ed1cde54a34cfa63c00d","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, password"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"},{"line_number":26,"context_line":"    man-in-the-middle attack. The attacker can then use these valid"},{"line_number":27,"context_line":"    credentials to perform malicious operations. All real deployments"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_4be512a7","line":24,"in_reply_to":"ba7be1f8_6dc4b140","updated":"2015-02-20 19:39:09.000000000","message":"Done","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"116023d200e02bd69ed7a20a544b0a2624251d93","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    malicious. SSL/TLS isn\u0027t going to help in this situation if the"},{"line_number":34,"context_line":"    attacker is allowed to access the private key. Not everyone on the"},{"line_number":35,"context_line":"    management network would be allowed to access the private key of"},{"line_number":36,"context_line":"    course, so there is still a lot of value in using SSL/TLS to protect"},{"line_number":37,"context_line":"    yourself from internal attackers. Even if everyone that is allowed"},{"line_number":38,"context_line":"    to access your management network is 100% trusted, there is still a"},{"line_number":39,"context_line":"    threat that an unauthorized user gains access to your internal"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_ad7949fe","line":36,"updated":"2015-02-20 17:29:04.000000000","message":"i think we should avoid using \"a lot of\", the sentence still reads well without it.","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e16ca2e6febdbb8c7f12ed1cde54a34cfa63c00d","unresolved":false,"context_lines":[{"line_number":33,"context_line":"    malicious. SSL/TLS isn\u0027t going to help in this situation if the"},{"line_number":34,"context_line":"    attacker is allowed to access the private key. Not everyone on the"},{"line_number":35,"context_line":"    management network would be allowed to access the private key of"},{"line_number":36,"context_line":"    course, so there is still a lot of value in using SSL/TLS to protect"},{"line_number":37,"context_line":"    yourself from internal attackers. Even if everyone that is allowed"},{"line_number":38,"context_line":"    to access your management network is 100% trusted, there is still a"},{"line_number":39,"context_line":"    threat that an unauthorized user gains access to your internal"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_6be2d6a0","line":36,"in_reply_to":"ba7be1f8_ad7949fe","updated":"2015-02-20 19:39:09.000000000","message":"Done\n\nChecked that this is the only place we were using \"a lot of\" :)","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"116023d200e02bd69ed7a20a544b0a2624251d93","unresolved":false,"context_lines":[{"line_number":67,"context_line":"       pictured above:\u003c/para\u003e"},{"line_number":68,"context_line":"       \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":69,"context_line":"         \u003cpara\u003e"},{"line_number":70,"context_line":"           Native SSL/TLS in OpenStack services does not perform/scale"},{"line_number":71,"context_line":"           as good as SSL proxies (particularly for Python"},{"line_number":72,"context_line":"           implementations like Eventlet)."},{"line_number":73,"context_line":"         \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_2d02b93e","line":70,"updated":"2015-02-20 17:29:04.000000000","message":"is this saying that native SSL/TLS does not perform and scale as well as proxies, or that it doesn\u0027t perform at scale as well as?\n\ni also think we should \"well\" instead of \"good\"","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e16ca2e6febdbb8c7f12ed1cde54a34cfa63c00d","unresolved":false,"context_lines":[{"line_number":67,"context_line":"       pictured above:\u003c/para\u003e"},{"line_number":68,"context_line":"       \u003citemizedlist\u003e\u003clistitem\u003e"},{"line_number":69,"context_line":"         \u003cpara\u003e"},{"line_number":70,"context_line":"           Native SSL/TLS in OpenStack services does not perform/scale"},{"line_number":71,"context_line":"           as good as SSL proxies (particularly for Python"},{"line_number":72,"context_line":"           implementations like Eventlet)."},{"line_number":73,"context_line":"         \u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_ceabd087","line":70,"in_reply_to":"ba7be1f8_2d02b93e","updated":"2015-02-20 19:39:09.000000000","message":"Done.\n\nReplaced \"good\" with \"well\".\n\nIt was \"well\" originally in Nathan\u0027s blog, it sounded little confusing to me so updated the statement. But I guess it was only me :)\n\nThis is saying that \"native SSL/TLS does not perform and scale as well as proxies\"","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"116023d200e02bd69ed7a20a544b0a2624251d93","unresolved":false,"context_lines":[{"line_number":92,"context_line":"         \u003c/para\u003e"},{"line_number":93,"context_line":"       \u003c/listitem\u003e"},{"line_number":94,"context_line":"       \u003c/itemizedlist\u003e"},{"line_number":95,"context_line":"       \u003cpara\u003eAll of the above are valid concerns, but none of the"},{"line_number":96,"context_line":"       prevent SSL/TLS from being used on the management network. Let\u0027s"},{"line_number":97,"context_line":"       consider the next deployment model.\u003c/para\u003e"},{"line_number":98,"context_line":"    \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_edb6e189","line":95,"updated":"2015-02-20 17:29:04.000000000","message":"should be \"but none of them\"","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e16ca2e6febdbb8c7f12ed1cde54a34cfa63c00d","unresolved":false,"context_lines":[{"line_number":92,"context_line":"         \u003c/para\u003e"},{"line_number":93,"context_line":"       \u003c/listitem\u003e"},{"line_number":94,"context_line":"       \u003c/itemizedlist\u003e"},{"line_number":95,"context_line":"       \u003cpara\u003eAll of the above are valid concerns, but none of the"},{"line_number":96,"context_line":"       prevent SSL/TLS from being used on the management network. Let\u0027s"},{"line_number":97,"context_line":"       consider the next deployment model.\u003c/para\u003e"},{"line_number":98,"context_line":"    \u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"ba7be1f8_4e760040","line":95,"in_reply_to":"ba7be1f8_edb6e189","updated":"2015-02-20 19:39:09.000000000","message":"Done","commit_id":"aca27359d4c4f5f9f1a63b045a49cf8ebf64b624"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"660ac3697597d2cfa5d262433e50f808eccdd03a","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    operate on both the public and management networks.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003cpara\u003eFor publicly facing services, the threats are pretty"},{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, passwords"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_2c9b6673","line":22,"updated":"2015-02-23 16:07:59.000000000","message":"i\u0027m not sure if we should be using the names \"Horizon\" and \"Keystone\" in this document. i think the proper references are to the \"OpenStack dashboard\" and \"OpenStack Identity service\", although if we do end up using the project names they should not be capitalized.\n\nsee\nhttps://wiki.openstack.org/wiki/Documentation/Conventions#Service_and_project_names","commit_id":"a8ae421ba1f57fb0337f8514005ad8c3e463c478"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"4e6549bf601ab56dff937e9a27eaaa8f93f89b48","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    operate on both the public and management networks.\u003c/para\u003e"},{"line_number":20,"context_line":"    \u003cpara\u003eFor publicly facing services, the threats are pretty"},{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, passwords"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_6f038942","line":22,"in_reply_to":"ba7be1f8_2c9b6673","updated":"2015-02-23 19:36:08.000000000","message":"I think sticking to the OpenStack project names is reasonable. Fixed the capitalization.","commit_id":"a8ae421ba1f57fb0337f8514005ad8c3e463c478"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"660ac3697597d2cfa5d262433e50f808eccdd03a","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, passwords"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"},{"line_number":26,"context_line":"    man-in-the-middle attack. The attacker can then use these valid"},{"line_number":27,"context_line":"    credentials to perform malicious operations. All real deployments"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_cc7c8a23","line":24,"updated":"2015-02-23 16:07:59.000000000","message":"same question about using \"Keystone\"","commit_id":"a8ae421ba1f57fb0337f8514005ad8c3e463c478"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"4e6549bf601ab56dff937e9a27eaaa8f93f89b48","unresolved":false,"context_lines":[{"line_number":21,"context_line":"    straightforward. Users will be authenticating against Horizon and"},{"line_number":22,"context_line":"    Keystone with their username and password. Users will also be"},{"line_number":23,"context_line":"    accessing the API endpoints for other services using their"},{"line_number":24,"context_line":"    Keystone tokens. If this network traffic is unencrypted, passwords"},{"line_number":25,"context_line":"    and tokens can be intercepted by an attacker using a"},{"line_number":26,"context_line":"    man-in-the-middle attack. The attacker can then use these valid"},{"line_number":27,"context_line":"    credentials to perform malicious operations. All real deployments"}],"source_content_type":"application/xml","patch_set":4,"id":"ba7be1f8_8ffefd36","line":24,"in_reply_to":"ba7be1f8_cc7c8a23","updated":"2015-02-23 19:36:08.000000000","message":"Done","commit_id":"a8ae421ba1f57fb0337f8514005ad8c3e463c478"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"433b752a36623cee32be7119994d1e7a829120ac","unresolved":false,"context_lines":[{"line_number":5,"context_line":"  version\u003d\"5.0\""},{"line_number":6,"context_line":"  xml:id\u003d\"secure-reference-architectures\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eSecure Reference Architectures\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eWe recommend using SSL/TLS on both public networks and"},{"line_number":10,"context_line":"    management networks in"},{"line_number":11,"context_line":"    \u003clink linkend\u003d\"tls-proxies-and-http-services\"\u003eTLS proxies and HTTP services"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_7d93b64e","line":8,"updated":"2015-03-20 22:08:32.000000000","message":"Our Conventions are Sentence case for titles. https://wiki.openstack.org/wiki/Documentation/Markup_conventions#Headings","commit_id":"8ed21004cf681e4bdf8ebfca37a4c356f6552322"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"aa3cd5400099e0844b505156f7892f154a04fe83","unresolved":false,"context_lines":[{"line_number":5,"context_line":"  version\u003d\"5.0\""},{"line_number":6,"context_line":"  xml:id\u003d\"secure-reference-architectures\"\u003e"},{"line_number":7,"context_line":"  \u003c?dbhtml stop-chunking?\u003e"},{"line_number":8,"context_line":"    \u003ctitle\u003eSecure Reference Architectures\u003c/title\u003e"},{"line_number":9,"context_line":"    \u003cpara\u003eWe recommend using SSL/TLS on both public networks and"},{"line_number":10,"context_line":"    management networks in"},{"line_number":11,"context_line":"    \u003clink linkend\u003d\"tls-proxies-and-http-services\"\u003eTLS proxies and HTTP services"}],"source_content_type":"application/xml","patch_set":6,"id":"fa963961_0704dfbd","line":8,"in_reply_to":"9a80dd14_7d93b64e","updated":"2015-03-27 20:08:28.000000000","message":"Updated all the titles in this section to follow sentence case.","commit_id":"8ed21004cf681e4bdf8ebfca37a4c356f6552322"},{"author":{"_account_id":964,"name":"Anne Gentle","email":"annegentle@justwriteclick.com","username":"annegentle"},"change_message_id":"433b752a36623cee32be7119994d1e7a829120ac","unresolved":false,"context_lines":[{"line_number":54,"context_line":"      \u003cpara\u003e"},{"line_number":55,"context_line":"          \u003cinlinemediaobject\u003e"},{"line_number":56,"context_line":"              \u003cimageobject role\u003d\"html\"\u003e"},{"line_number":57,"context_line":"                  \u003cimagedata contentdepth\u003d\"450\" contentwidth\u003d\"540\""},{"line_number":58,"context_line":"                  fileref\u003d\"static/secure-arch-ref-1.png\" format\u003d\"PNG\" scalefit\u003d\"1\"/\u003e"},{"line_number":59,"context_line":"              \u003c/imageobject\u003e"},{"line_number":60,"context_line":"              \u003cimageobject role\u003d\"fo\"\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"9a80dd14_7da576b3","line":57,"updated":"2015-03-20 22:08:32.000000000","message":"I think you want a unit in the width like this contentwidth\u003d\"6in\" -- try it and see.\n\nhttps://github.com/openstack/openstack-manuals/blob/ea4f68a88cb56deb216949d781ef905d72c1ab31/doc/common/section_keystone-concepts.xml#L138","commit_id":"8ed21004cf681e4bdf8ebfca37a4c356f6552322"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"aa3cd5400099e0844b505156f7892f154a04fe83","unresolved":false,"context_lines":[{"line_number":54,"context_line":"      \u003cpara\u003e"},{"line_number":55,"context_line":"          \u003cinlinemediaobject\u003e"},{"line_number":56,"context_line":"              \u003cimageobject role\u003d\"html\"\u003e"},{"line_number":57,"context_line":"                  \u003cimagedata contentdepth\u003d\"450\" contentwidth\u003d\"540\""},{"line_number":58,"context_line":"                  fileref\u003d\"static/secure-arch-ref-1.png\" format\u003d\"PNG\" scalefit\u003d\"1\"/\u003e"},{"line_number":59,"context_line":"              \u003c/imageobject\u003e"},{"line_number":60,"context_line":"              \u003cimageobject role\u003d\"fo\"\u003e"}],"source_content_type":"application/xml","patch_set":6,"id":"fa963961_4721c74c","line":57,"in_reply_to":"9a80dd14_7da576b3","updated":"2015-03-27 20:08:28.000000000","message":"Tried setting contentwidth\u003d\"6in\" but does not format the image in HTML. Finally, reducing the size of the image to 6in.","commit_id":"8ed21004cf681e4bdf8ebfca37a4c356f6552322"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"89cf3fb8778551b65639ca8d4d78ebe85642c13a","unresolved":false,"context_lines":[{"line_number":109,"context_line":"              \u003c/imageobject\u003e"},{"line_number":110,"context_line":"          \u003c/inlinemediaobject\u003e\u003c/para\u003e"},{"line_number":111,"context_line":"      \u003cpara\u003eThis is very similar to"},{"line_number":112,"context_line":"      \u003clink linkend\u003d\"ssl-tls-proxy-in-front\"\u003eSSL/TLS in Front model"},{"line_number":113,"context_line":"      \u003c/link\u003e but the SSL/TLS proxy is on the same physical system as"},{"line_number":114,"context_line":"      the API endpoint. The API endpoint would be configured to only"},{"line_number":115,"context_line":"      listen on the local network interface. All remote communication"}],"source_content_type":"application/xml","patch_set":7,"id":"da9b358b_4defdcb0","line":112,"updated":"2015-03-28 11:11:13.000000000","message":"Better use xref\u0027s here - that way the title gets inserted automatically and you don\u0027t have to change it.","commit_id":"fe592a91805147a480da5c0926e7e1515a31989d"}]}