)]}'
{"security-notes/OSSN-0055":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"a65f13986b442f8c3ecd00440a50070c243450c5","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"OpenStack services typically use a service account to perform actions."},{"line_number":6,"context_line":"In some cases this service account has full admin privileges, may"},{"line_number":7,"context_line":"therefore perform any action on your cloud, and should be protected"},{"line_number":8,"context_line":"appropriately."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_d5b6a6f8","line":5,"updated":"2015-09-02 22:18:09.000000000","message":"Maybe give an example of what we mean by \u0027service\u0027 ?","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"OpenStack services typically use a service account to perform actions."},{"line_number":6,"context_line":"In some cases this service account has full admin privileges, may"},{"line_number":7,"context_line":"therefore perform any action on your cloud, and should be protected"},{"line_number":8,"context_line":"appropriately."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_75af9ae3","line":5,"updated":"2015-09-02 22:14:56.000000000","message":"We might want to clarify that this is an OpenStack account in Keystone (as opposed to a user on the OS or a database user).  We might also want to say that it is used for performing API actions/calls against other OpenStack services since other \"actions\" don\u0027t use this service account (like publishing on the message queue or writing to a database).","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"OpenStack services typically use a service account to perform actions."},{"line_number":6,"context_line":"In some cases this service account has full admin privileges, may"},{"line_number":7,"context_line":"therefore perform any action on your cloud, and should be protected"},{"line_number":8,"context_line":"appropriately."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_35584256","line":5,"in_reply_to":"da20952f_75af9ae3","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":8,"context_line":"appropriately."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Most OpenStack services / all versions"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_95bfcefb","line":11,"updated":"2015-09-02 22:14:56.000000000","message":"Why \"most\" and not \"all\"?  Are there known exceptions?","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":8,"context_line":"appropriately."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"### Affected Services / Software ###"},{"line_number":11,"context_line":"Most OpenStack services / all versions"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_354e02c2","line":11,"in_reply_to":"da20952f_95bfcefb","updated":"2015-09-02 22:33:27.000000000","message":"When we were working on this note we found that some services (Glance for example) already use the service role in devstack.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Most OpenStack services / all versions"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_b540d208","line":14,"updated":"2015-09-02 22:14:56.000000000","message":"(nit) Add a comma after \"cases\".","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Most OpenStack services / all versions"},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_75255ac0","line":14,"in_reply_to":"da20952f_b540d208","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_3555a2c5","line":15,"updated":"2015-09-02 22:14:56.000000000","message":"Clarify that these are API actions as mentioned in my comment above.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_b511b25f","line":15,"in_reply_to":"da20952f_3555a2c5","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_f5040ac7","line":16,"updated":"2015-09-02 22:14:56.000000000","message":"Which default deployment are we talking about here?  Devstack?  There are so many different deployment tools, which use different configurations.  I think we should be more generic and say that the default configuration may grant admin access depending on the deployment tool being used.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":13,"context_line":"### Discussion ###"},{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_384b575b","line":16,"in_reply_to":"da20952f_f5040ac7","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"},{"line_number":20,"context_line":"  - destroy/modify/access data"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_35f122ce","line":17,"updated":"2015-09-02 22:14:56.000000000","message":"This sentence reads a bit odd with the duplication of \"service accounts\".  Perhaps change the end to ...\", making these accounts very powerful.\"?","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":14,"context_line":"In many cases OpenStack services require an OpenStack account to"},{"line_number":15,"context_line":"perform actions such as validating Keystone tokens.  The default"},{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"},{"line_number":20,"context_line":"  - destroy/modify/access data"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_f8cf1fb1","line":17,"in_reply_to":"da20952f_35f122ce","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"},{"line_number":20,"context_line":"  - destroy/modify/access data"},{"line_number":21,"context_line":"  - create or destroy admin accounts"},{"line_number":22,"context_line":"  - potentially escalate to undercloud access"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_350362ba","line":19,"updated":"2015-09-02 22:14:56.000000000","message":"(nit) Add a blank line before your list to make this more readable.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":16,"context_line":"deployment configuration grants administrative level access to these"},{"line_number":17,"context_line":"service accounts, and therefore service accounts are very powerful."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"A service account with administrator access could be used to:"},{"line_number":20,"context_line":"  - destroy/modify/access data"},{"line_number":21,"context_line":"  - create or destroy admin accounts"},{"line_number":22,"context_line":"  - potentially escalate to undercloud access"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_18d3f360","line":19,"in_reply_to":"da20952f_350362ba","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":27,"context_line":"can check what role the service account has by performing the following"},{"line_number":28,"context_line":"steps:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. List roles:"},{"line_number":31,"context_line":"     openstack role list"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"2. Check the role assignment for the service user in question:"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_359fe260","line":30,"updated":"2015-09-02 22:14:56.000000000","message":"(nit) Add a blank line.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":27,"context_line":"can check what role the service account has by performing the following"},{"line_number":28,"context_line":"steps:"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"1. List roles:"},{"line_number":31,"context_line":"     openstack role list"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"2. Check the role assignment for the service user in question:"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_98bf03fc","line":30,"in_reply_to":"da20952f_359fe260","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":30,"context_line":"1. List roles:"},{"line_number":31,"context_line":"     openstack role list"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"2. Check the role assignment for the service user in question:"},{"line_number":34,"context_line":"     openstack role assignment list --user \u003cservice_user\u003e"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"3. Compare the ID listed in the \"role\" column from step 2 with the role"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_158bbe1f","line":33,"updated":"2015-09-02 22:14:56.000000000","message":"(nit) Add a blank line.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":30,"context_line":"1. List roles:"},{"line_number":31,"context_line":"     openstack role list"},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"2. Check the role assignment for the service user in question:"},{"line_number":34,"context_line":"     openstack role assignment list --user \u003cservice_user\u003e"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"3. Compare the ID listed in the \"role\" column from step 2 with the role"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_58b96b14","line":33,"in_reply_to":"da20952f_158bbe1f","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":9098,"name":"Nathan Kinder","email":"nkinder@redhat.com","username":"nkinder"},"change_message_id":"b7bf485f3090e4e9d722b4dccc77d2f75149ac2d","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"If a service account does have admin, it\u0027s advisable to closely"},{"line_number":45,"context_line":"monitor login events for that user to ensure that it is not used"},{"line_number":46,"context_line":"unexpectedly.  In particular pay attention to unusual IPs using the"},{"line_number":47,"context_line":"service account."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_95c58e3e","line":46,"updated":"2015-09-02 22:14:56.000000000","message":"(nit) Add a comma after particular.","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"bda65318ef3c330597911080d266fb9ef89d9f6d","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"If a service account does have admin, it\u0027s advisable to closely"},{"line_number":45,"context_line":"monitor login events for that user to ensure that it is not used"},{"line_number":46,"context_line":"unexpectedly.  In particular pay attention to unusual IPs using the"},{"line_number":47,"context_line":"service account."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"### Contacts / References ###"}],"source_content_type":"application/octet-stream","patch_set":1,"id":"da20952f_f8363fb3","line":46,"in_reply_to":"da20952f_95c58e3e","updated":"2015-09-02 22:33:27.000000000","message":"Done","commit_id":"52920b58139d67557ad1a039c4a265dda3b53527"}]}