)]}'
{"security-guide-rst/source/instance-management.rst":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":78,"context_line":"and volume requests."},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The ``FilterScheduler`` is the default scheduler for OpenStack"},{"line_number":81,"context_line":"Compute, although other schedulers exist (see the section "},{"line_number":82,"context_line":"`Scheduling \u003chttp://docs.openstack.org/kilo/config-reference/content/section_compute-scheduler.html\u003e`_"},{"line_number":83,"context_line":"in the"},{"line_number":84,"context_line":"`OpenStack Configuration Reference \u003chttp://docs.openstack.org/kilo/config-reference/content/config_overview.html\u003e`_"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_2af42af0","line":81,"updated":"2015-07-21 19:36:52.000000000","message":"Extra whitespace at EOL","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":134,"context_line":""},{"line_number":135,"context_line":"Trusted images"},{"line_number":136,"context_line":"--------------"},{"line_number":137,"context_line":"      "},{"line_number":138,"context_line":"In a cloud environment, users work with either pre-installed images or"},{"line_number":139,"context_line":"images they upload themselves. In both cases, users should be able to"},{"line_number":140,"context_line":"ensure the image they are utilizing has not been tampered with. This"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_aae83a11","line":137,"updated":"2015-07-21 19:36:52.000000000","message":"Extra whitespace","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":152,"context_line":"ensure your images are transferred securely into OpenStack. There are"},{"line_number":153,"context_line":"a variety of options for obtaining images. Each has specific steps that"},{"line_number":154,"context_line":"help validate the image\u0027s provenance."},{"line_number":155,"context_line":"        "},{"line_number":156,"context_line":"The first option is to obtain boot media from a trusted source."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":".. code:: shell"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_2acbcaa6","line":155,"updated":"2015-07-21 19:36:52.000000000","message":"extra whitespace","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":155,"context_line":"        "},{"line_number":156,"context_line":"The first option is to obtain boot media from a trusted source."},{"line_number":157,"context_line":""},{"line_number":158,"context_line":".. code:: shell"},{"line_number":159,"context_line":""},{"line_number":160,"context_line":"    $ mkdir -p /tmp/download_directorycd /tmp/download_directory"},{"line_number":161,"context_line":"    $ wget http://mirror.anl.gov/pub/ubuntu-iso/CDs/precise/ubuntu-12.04.2-server-amd64.iso"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_0ac12e80","line":158,"updated":"2015-07-21 19:36:52.000000000","message":"Use \"console\" isntead of shell","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":175,"context_line":"example uses the Oz image builder. The OpenStack community has recently"},{"line_number":176,"context_line":"created a newer tool worth investigating: disk-image-builder. We have"},{"line_number":177,"context_line":"not evaluated this tool from a security perspective."},{"line_number":178,"context_line":"        "},{"line_number":179,"context_line":"Example of RHEL 6 CCE-26976-1 which will help implement NIST 800-53"},{"line_number":180,"context_line":"Section *AC-19(d)* in Oz."},{"line_number":181,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_aabfdaf9","line":178,"updated":"2015-07-21 19:36:52.000000000","message":"extra whitespace","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":237,"context_line":"validate an image hash immediately prior to starting an instance."},{"line_number":238,"context_line":"To understand the situation, we begin with a brief overview of how"},{"line_number":239,"context_line":"images are handled around the time of image launch."},{"line_number":240,"context_line":"        "},{"line_number":241,"context_line":"Images come from the glance service to the nova service on a node."},{"line_number":242,"context_line":"This transfer should be protected by running over TLS. Once the image"},{"line_number":243,"context_line":"is on the node, it is verified with a basic checksum and then it\u0027s"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_6a38f2a0","line":240,"updated":"2015-07-21 19:36:52.000000000","message":"extra whitespace","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":256,"context_line":""},{"line_number":257,"context_line":"Instance migrations"},{"line_number":258,"context_line":"-------------------"},{"line_number":259,"context_line":"      "},{"line_number":260,"context_line":"OpenStack and the underlying virtualization layers provide for"},{"line_number":261,"context_line":"the live migration of images between OpenStack nodes, allowing"},{"line_number":262,"context_line":"you to seamlessly perform rolling upgrades of your OpenStack"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_aa56facf","line":259,"updated":"2015-07-21 19:36:52.000000000","message":"Extra whitespace - please review the complete file, there\u0027s more in it","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"002332c3a7976a7700559dadec0a300a2bda3176","unresolved":false,"context_lines":[{"line_number":289,"context_line":"  securely, then an attacker could manipulate executables, either on"},{"line_number":290,"context_line":"  disk or in memory, during the migration."},{"line_number":291,"context_line":""},{"line_number":292,"context_line":"**Live migration mitigations**"},{"line_number":293,"context_line":""},{"line_number":294,"context_line":"There are several methods to mitigate some of the risk associated"},{"line_number":295,"context_line":"with live migrations, the following list details some of these:"}],"source_content_type":"text/x-rst","patch_set":1,"id":"3a50d1a3_0a6fee92","line":292,"updated":"2015-07-21 19:36:52.000000000","message":"Don\u0027t use bold, use real titles and underline - also in the rest","commit_id":"e1dd8a0c2a01f1288a850d8a20aeb7a5a2e6c3d5"}]}