)]}'
{"security-guide/source/compute/checklist.rst":[{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"2ef1c1e72bd2b030faf2097ffeb4b252af890702","unresolved":false,"context_lines":[{"line_number":28,"context_line":"**Fail:** If the above commands does not return any output as the user"},{"line_number":29,"context_line":"or group ownership might have set to any user other than nova."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Check-Compute-02: Are strict permissions set for Compute configuration files?"},{"line_number":34,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_acb97017","line":31,"updated":"2015-09-22 06:06:08.000000000","message":"This section seems to advocate the opposite of secure deployment. `nova.conf` and other configuration files should be readable by nova, but a running nova-compute has no business writing anything into them.\n\nA more secure approach would be either owner root:root and an ACL for read-only nova, or owner root:nova with mode 0640.","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e148bb3f651c813a3decda4cb311924815aff56c","unresolved":false,"context_lines":[{"line_number":28,"context_line":"**Fail:** If the above commands does not return any output as the user"},{"line_number":29,"context_line":"or group ownership might have set to any user other than nova."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Check-Compute-02: Are strict permissions set for Compute configuration files?"},{"line_number":34,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_884d5174","line":31,"in_reply_to":"ba15a1d1_acb97017","updated":"2015-09-22 19:33:19.000000000","message":"I have rewritten Check 01, to have configuration files owned by root:root and set ACL for nova to have read only permissions in Check 02.","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"2ef1c1e72bd2b030faf2097ffeb4b252af890702","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"**Pass:** If permissions are set to 640 or stricter."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"**Fail:** If permissions are not set to at least 640."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_0c589cf9","line":50,"updated":"2015-09-22 06:06:08.000000000","message":"\"at least\" is not a very good description. Also 640 is a magic number which may not be understandable for the new user. Maybe you could add in the description something like: \"owner writable, group readable, and with no rights given to other users, can be written as u\u003drw,g\u003dr,o\u003d\".","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e148bb3f651c813a3decda4cb311924815aff56c","unresolved":false,"context_lines":[{"line_number":47,"context_line":""},{"line_number":48,"context_line":"**Pass:** If permissions are set to 640 or stricter."},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"**Fail:** If permissions are not set to at least 640."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":53,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_283d25bb","line":50,"in_reply_to":"ba15a1d1_0c589cf9","updated":"2015-09-22 19:33:19.000000000","message":"Added this description in *Pass*.","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"2ef1c1e72bd2b030faf2097ffeb4b252af890702","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Check-Compute-03: is Keystone used for authentication?"},{"line_number":55,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Openstack supports various authentication strategies like noauth, keystone etc."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_2c12400a","line":54,"updated":"2015-09-22 06:06:08.000000000","message":"Capitalise \"Is\" ?","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"e148bb3f651c813a3decda4cb311924815aff56c","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Check-Compute-03: is Keystone used for authentication?"},{"line_number":55,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Openstack supports various authentication strategies like noauth, keystone etc."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_8874719c","line":54,"in_reply_to":"ba15a1d1_2c12400a","updated":"2015-09-22 19:33:19.000000000","message":"Done and un-capitalise K in Keystone.","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"2ef1c1e72bd2b030faf2097ffeb4b252af890702","unresolved":false,"context_lines":[{"line_number":60,"context_line":"attacker might spoof some of the requests and try to gain unauthorized access"},{"line_number":61,"context_line":"to the OpenStack components. Thus it is strongly recommended that all"},{"line_number":62,"context_line":"components must first authenticate each other before initiating the"},{"line_number":63,"context_line":"communication."},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"**Pass:** If value of parameter ``auth_strategy`` under ``[DEFAULT]`` section"},{"line_number":66,"context_line":"in :file:`/etc/nova/nova.conf` is set to ``keystone``."}],"source_content_type":"text/x-rst","patch_set":1,"id":"ba15a1d1_6ca4b8b8","line":63,"updated":"2015-09-22 06:06:08.000000000","message":"I\u0027ve got a few problems with this.\n\n- `auth_strategy` controls whether any request will be authenticated, regardless of whether it comes from another component or user - and the attacker will be an unauthorised user more often than a fake component.\n\n- \"spoof\" is a strange word here. To me it implies the request is prepared in some way to act as a different user. But here, it\u0027s simply a request with no authentication at all.\n\n- Components authenticate after they initiate communication, not before (they send authentication token with the request).","commit_id":"5881b3893e9a33a74ff36a21923fada75548fd69"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"7c75a691780d6a468c106d698c6b7152585afb95","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"root root\""},{"line_number":20,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/api-paste.ini | egrep \"root root\""},{"line_number":21,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/policy.json | egrep \"root root\""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/rootwrap.conf | egrep \"root root\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":25,"context_line":"to root. The above commands show output of root root."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba15a1d1_eb707d74","line":22,"updated":"2015-09-23 01:17:49.000000000","message":"Almost what I meant. If you do this, then nova would have to run as root to read its configuration files (or files should be readable to the world, which is also not good). The safest version is to make the files owned by user root, group nova and permissions 0640 - this allows nova to read the files, but not change them.","commit_id":"cd91afb708d336f03ddccee3e0e4fca0d3389208"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"aa9ccc1e356803b450edf41066557bd27d39ec15","unresolved":false,"context_lines":[{"line_number":19,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"root root\""},{"line_number":20,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/api-paste.ini | egrep \"root root\""},{"line_number":21,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/policy.json | egrep \"root root\""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/rootwrap.conf | egrep \"root root\""},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":25,"context_line":"to root. The above commands show output of root root."}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba15a1d1_98001136","line":22,"in_reply_to":"ba15a1d1_eb707d74","updated":"2015-09-23 17:26:46.000000000","message":"Yup, setting ownership to root/nova sounds like valid recommendation but its based on the fact that OpenStack deployments should have \"nova\" group created, which may be a feasible assumption.","commit_id":"cd91afb708d336f03ddccee3e0e4fca0d3389208"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"7c75a691780d6a468c106d698c6b7152585afb95","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":".. code:: console"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    $ getfacl --tabular -a /etc/nova/nova.conf"},{"line_number":55,"context_line":"    getfacl: Removing leading \u0027/\u0027 from absolute path names"},{"line_number":56,"context_line":"    # file: etc/nova/nova.conf"},{"line_number":57,"context_line":"    USER   root  rw-"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba15a1d1_0bda914b","line":54,"updated":"2015-09-23 01:17:49.000000000","message":"This should get a comment that it only applies to ACLs. The command may not even be available on some systems by default and may fail on filesystems which do not support ACLs. (you can find that file has some ACLs set if there\u0027s a \"+\" after access rights on \"ls -l\" output)","commit_id":"cd91afb708d336f03ddccee3e0e4fca0d3389208"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"aa9ccc1e356803b450edf41066557bd27d39ec15","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":".. code:: console"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"    $ getfacl --tabular -a /etc/nova/nova.conf"},{"line_number":55,"context_line":"    getfacl: Removing leading \u0027/\u0027 from absolute path names"},{"line_number":56,"context_line":"    # file: etc/nova/nova.conf"},{"line_number":57,"context_line":"    USER   root  rw-"}],"source_content_type":"text/x-rst","patch_set":2,"id":"ba15a1d1_186961f9","line":54,"in_reply_to":"ba15a1d1_0bda914b","updated":"2015-09-23 17:26:46.000000000","message":"This command is not needed now as we changed checklist-01 from root:root to root:nova, but have it in there with the note saying getfacl might not be available on every system.","commit_id":"cd91afb708d336f03ddccee3e0e4fca0d3389208"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"b1d4ca7922545b3cad1da9d91f980407d19cb538","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"root nova\""},{"line_number":23,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/api-paste.ini | egrep \"root nova\""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/policy.json | egrep \"root nova\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/rootwrap.conf | egrep \"root nova\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_df00a136","line":22,"updated":"2015-09-24 01:21:19.000000000","message":"In Kilo on CentOS 7, the command \"stat -L -c \"%U %G\" /etc/nova/nova.conf\" returns \"nova nova\", so this check always fails. I\u0027m not sure this is derived from packaging policy of RDO, but how about changing as below?\n\n$ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"(root|nova) nova\"\n\nOther below commands return \"root nova\".","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"07ceb4af41312d93024f23f87f2490c9cac2c332","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"root nova\""},{"line_number":23,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/api-paste.ini | egrep \"root nova\""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/policy.json | egrep \"root nova\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/rootwrap.conf | egrep \"root nova\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_ca7a2124","line":22,"in_reply_to":"ba15a1d1_aa21ed4e","updated":"2015-09-24 01:39:00.000000000","message":"Got it. I withdraw this comment.","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":1528,"name":"Stanislaw Pitucha","email":"viraptor@gmail.com","username":"stanislaw-pitucha"},"change_message_id":"b4d9d72646dfb4e95893761e12edfd821444cb4d","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/nova.conf | egrep \"root nova\""},{"line_number":23,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/api-paste.ini | egrep \"root nova\""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/policy.json | egrep \"root nova\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/nova/rootwrap.conf | egrep \"root nova\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_aa21ed4e","line":22,"in_reply_to":"ba15a1d1_df00a136","updated":"2015-09-24 01:33:13.000000000","message":"Is this the right aproach? CentOS doing something doesn\u0027t mean it\u0027s automatically the best solution. Security guide should really say what\u0027s the most secure way of doing things (configs not writable by the service), and not what\u0027s \"secure OR default\".","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"b1d4ca7922545b3cad1da9d91f980407d19cb538","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Check-Compute-03: Is keystone used for authentication?"},{"line_number":73,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Openstack supports various authentication strategies like noauth, keystone etc."},{"line_number":76,"context_line":"If the \u0027noauth\u0027 strategy is used then the users could interact with OpenStack"},{"line_number":77,"context_line":"services without any authentication. This could be a potential risk since an"},{"line_number":78,"context_line":"attacker might gain unauthorized access to the OpenStack components. Thus it is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_aa69edbf","line":75,"updated":"2015-09-24 01:21:19.000000000","message":"Openstack -\u003e OpenStack","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"5be7997c2c95d448cf727e8b36cfc1f5003e77ff","unresolved":false,"context_lines":[{"line_number":72,"context_line":"Check-Compute-03: Is keystone used for authentication?"},{"line_number":73,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"Openstack supports various authentication strategies like noauth, keystone etc."},{"line_number":76,"context_line":"If the \u0027noauth\u0027 strategy is used then the users could interact with OpenStack"},{"line_number":77,"context_line":"services without any authentication. This could be a potential risk since an"},{"line_number":78,"context_line":"attacker might gain unauthorized access to the OpenStack components. Thus it is"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_058f5124","line":75,"in_reply_to":"ba15a1d1_aa69edbf","updated":"2015-09-24 18:48:05.000000000","message":"Done","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"b1d4ca7922545b3cad1da9d91f980407d19cb538","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Check-Compute-04: Is secure protocol used for authentication?"},{"line_number":89,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Openstack components communicate with each other using various protocols and"},{"line_number":92,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":93,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":94,"context_line":"information. Thus all the components must communicate with each other using a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_ca66a1ec","line":91,"updated":"2015-09-24 01:21:19.000000000","message":"Openstack -\u003e OpenStack","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"5be7997c2c95d448cf727e8b36cfc1f5003e77ff","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Check-Compute-04: Is secure protocol used for authentication?"},{"line_number":89,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"Openstack components communicate with each other using various protocols and"},{"line_number":92,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":93,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":94,"context_line":"information. Thus all the components must communicate with each other using a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_c598796d","line":91,"in_reply_to":"ba15a1d1_ca66a1ec","updated":"2015-09-24 18:48:05.000000000","message":"Done","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10497,"name":"KATO Tomoyuki","email":"kato.tomoyuki@jp.fujitsu.com","username":"to222"},"change_message_id":"b1d4ca7922545b3cad1da9d91f980407d19cb538","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Check-Compute-05: Does Nova communicates with Glance securely?"},{"line_number":110,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Openstack components communicate with each other using various protocols and"},{"line_number":113,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":114,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":115,"context_line":"information. Thus all the components must communicate with each other using a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba15a1d1_6a5f550f","line":112,"updated":"2015-09-24 01:21:19.000000000","message":"Openstack -\u003e OpenStack","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"5be7997c2c95d448cf727e8b36cfc1f5003e77ff","unresolved":false,"context_lines":[{"line_number":109,"context_line":"Check-Compute-05: Does Nova communicates with Glance securely?"},{"line_number":110,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":111,"context_line":""},{"line_number":112,"context_line":"Openstack components communicate with each other using various protocols and"},{"line_number":113,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":114,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":115,"context_line":"information. Thus all the components must communicate with each other using a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"9a1a9d01_e59d7d5a","line":112,"in_reply_to":"ba15a1d1_6a5f550f","updated":"2015-09-24 18:48:05.000000000","message":"Done","commit_id":"2c865be473c463055f2fcb2b9c513d5eba633361"},{"author":{"_account_id":12000,"name":"Ian Cordasco","email":"sigmavirus24@gmail.com","username":"sigmavirus24"},"change_message_id":"b780b70e5437ba342e6cecd6d04b3a4bfb66dbfb","unresolved":false,"context_lines":[{"line_number":32,"context_line":"other than nova."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Check-Compute-02: Are strict permissions set for Compute configuration files?"},{"line_number":37,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_a75dda16","line":35,"updated":"2015-09-28 20:50:45.000000000","message":"Should each section have its own anchor/ref? e.g.,\n\n    .. _check_compute_02:","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":32,"context_line":"other than nova."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"Recommended in: :doc:`../compute`."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Check-Compute-02: Are strict permissions set for Compute configuration files?"},{"line_number":37,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":38,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_0a812bc3","line":35,"in_reply_to":"9a1a9d01_a75dda16","updated":"2015-09-28 21:34:03.000000000","message":"Not necessarily, but I have added refs to all of the checks.","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e00020fbc11f3eb53fdfaaf2a941846d4f688734","unresolved":false,"context_lines":[{"line_number":92,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":93,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":94,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":95,"context_line":"secured communication protocol like HTTPS."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"},{"line_number":98,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_7536f104","line":95,"updated":"2015-09-24 23:47:57.000000000","message":"If this checklist is for implementors I\u0027m not very comfortable with the \"like HTTPS\" portion of this. I would recommend removing it.","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":92,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":93,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":94,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":95,"context_line":"secured communication protocol like HTTPS."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"},{"line_number":98,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_ca6fb329","line":95,"in_reply_to":"9a1a9d01_7536f104","updated":"2015-09-28 21:34:03.000000000","message":"Done","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e00020fbc11f3eb53fdfaaf2a941846d4f688734","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"},{"line_number":98,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":99,"context_line":"``https``. OR if value of parameter ``identity_uri`` under"},{"line_number":100,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":101,"context_line":"Identity API endpoint starting with ``https://``."},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_15121563","line":99,"updated":"2015-09-24 23:47:57.000000000","message":"So there is a period here, and then a word in all caps. Is this per convention? Should the period be changed to a comma and the or be emphasized and lower-case?","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":96,"context_line":""},{"line_number":97,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"},{"line_number":98,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":99,"context_line":"``https``. OR if value of parameter ``identity_uri`` under"},{"line_number":100,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":101,"context_line":"Identity API endpoint starting with ``https://``."},{"line_number":102,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_ca56d35b","line":99,"in_reply_to":"9a1a9d01_15121563","updated":"2015-09-28 21:34:03.000000000","message":"Don\u0027t know what convention applies here, but added \"comma\" and or in lower case.","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e00020fbc11f3eb53fdfaaf2a941846d4f688734","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":104,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":105,"context_line":"``http``. OR if value of parameter ``identity_uri`` under"},{"line_number":106,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is not set to"},{"line_number":107,"context_line":"Identity API endpoint starting with ``https://``."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_9506251f","line":105,"updated":"2015-09-24 23:47:57.000000000","message":". OR here again","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":102,"context_line":""},{"line_number":103,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":104,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is set to"},{"line_number":105,"context_line":"``http``. OR if value of parameter ``identity_uri`` under"},{"line_number":106,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/nova/nova.conf` is not set to"},{"line_number":107,"context_line":"Identity API endpoint starting with ``https://``."},{"line_number":108,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_8a4c5bc9","line":105,"in_reply_to":"9a1a9d01_9506251f","updated":"2015-09-28 21:34:03.000000000","message":"Done","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e00020fbc11f3eb53fdfaaf2a941846d4f688734","unresolved":false,"context_lines":[{"line_number":113,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":114,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":115,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":116,"context_line":"secured communication protocol like HTTPS."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"**Pass:** If value of parameter ``glance_api_insecure`` under ``[DEFAULT]``"},{"line_number":119,"context_line":"section in :file:`/etc/nova/nova.conf` is set to ``False``. OR if value of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_f52201b9","line":116,"updated":"2015-09-24 23:47:57.000000000","message":"Ditto on \u0027like HTTPS\u0027.","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":113,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":114,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":115,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":116,"context_line":"secured communication protocol like HTTPS."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"**Pass:** If value of parameter ``glance_api_insecure`` under ``[DEFAULT]``"},{"line_number":119,"context_line":"section in :file:`/etc/nova/nova.conf` is set to ``False``. OR if value of"}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_aa491fb9","line":116,"in_reply_to":"9a1a9d01_f52201b9","updated":"2015-09-28 21:34:03.000000000","message":"Done","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"e00020fbc11f3eb53fdfaaf2a941846d4f688734","unresolved":false,"context_lines":[{"line_number":116,"context_line":"secured communication protocol like HTTPS."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"**Pass:** If value of parameter ``glance_api_insecure`` under ``[DEFAULT]``"},{"line_number":119,"context_line":"section in :file:`/etc/nova/nova.conf` is set to ``False``. OR if value of"},{"line_number":120,"context_line":"parameter ``api_insecure`` under ``[glance]`` section in"},{"line_number":121,"context_line":":file:`/etc/nova/nova.conf` is set to ``False``."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_48ff9401","line":119,"updated":"2015-09-24 23:47:57.000000000","message":". OR here again","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"1bdbd16f3b04bc4f11f5eaa05a455367d20d2ae5","unresolved":false,"context_lines":[{"line_number":116,"context_line":"secured communication protocol like HTTPS."},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"**Pass:** If value of parameter ``glance_api_insecure`` under ``[DEFAULT]``"},{"line_number":119,"context_line":"section in :file:`/etc/nova/nova.conf` is set to ``False``. OR if value of"},{"line_number":120,"context_line":"parameter ``api_insecure`` under ``[glance]`` section in"},{"line_number":121,"context_line":":file:`/etc/nova/nova.conf` is set to ``False``."},{"line_number":122,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"9a1a9d01_4ac96325","line":119,"in_reply_to":"9a1a9d01_48ff9401","updated":"2015-09-28 21:34:03.000000000","message":"Done","commit_id":"ea444f35cddd3b309dee9c754312d5e7486e28a2"}]}