)]}'
{"security-guide/source/block-storage/checklist.rst":[{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"400244148427f28b3a35c2e279dcf1319dfaf308","unresolved":false,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Configuration files contain critical parameters and information required"},{"line_number":11,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":12,"context_line":"intentionally or accidentally modifies or deletes any of the parameters or"},{"line_number":13,"context_line":"the file itself then it would cause severe availability issues causing a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_08e75cad","line":12,"updated":"2015-10-01 21:44:02.000000000","message":"maybe a comma after \"accidentally\"?","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"707b63f8275042e90dcf1a607110d0c31913f0cd","unresolved":false,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Configuration files contain critical parameters and information required"},{"line_number":11,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":12,"context_line":"intentionally or accidentally modifies or deletes any of the parameters or"},{"line_number":13,"context_line":"the file itself then it would cause severe availability issues causing a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_a6f8e14a","line":12,"in_reply_to":"9a1a9d01_08e75cad","updated":"2015-10-01 22:21:11.000000000","message":"Yup, reads better !","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"400244148427f28b3a35c2e279dcf1319dfaf308","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Configuration files contain critical parameters and information required"},{"line_number":11,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":12,"context_line":"intentionally or accidentally modifies or deletes any of the parameters or"},{"line_number":13,"context_line":"the file itself then it would cause severe availability issues causing a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":16,"context_line":"cinder."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_6864d848","line":13,"updated":"2015-10-01 21:44:02.000000000","message":"using \"cause\" and \"causing\" sounds a little weird, what about something like \"... cause severe availability issues resulting in a ...\"","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"707b63f8275042e90dcf1a607110d0c31913f0cd","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Configuration files contain critical parameters and information required"},{"line_number":11,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":12,"context_line":"intentionally or accidentally modifies or deletes any of the parameters or"},{"line_number":13,"context_line":"the file itself then it would cause severe availability issues causing a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":16,"context_line":"cinder."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_066c2d07","line":13,"in_reply_to":"9a1a9d01_6864d848","updated":"2015-10-01 22:21:11.000000000","message":"Yup, changed it !","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"400244148427f28b3a35c2e279dcf1319dfaf308","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":".. _check_block_04:"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Check-Block-04: Is secure protocol used for authentication?"},{"line_number":91,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"OpenStack components communicate with each other using various protocols and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_0b1f565c","line":90,"updated":"2015-10-01 21:44:02.000000000","message":"should we specifically mention transport layer security (TLS) here and in the following checks?","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"707b63f8275042e90dcf1a607110d0c31913f0cd","unresolved":false,"context_lines":[{"line_number":87,"context_line":""},{"line_number":88,"context_line":".. _check_block_04:"},{"line_number":89,"context_line":""},{"line_number":90,"context_line":"Check-Block-04: Is secure protocol used for authentication?"},{"line_number":91,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":92,"context_line":""},{"line_number":93,"context_line":"OpenStack components communicate with each other using various protocols and"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_21803b46","line":90,"in_reply_to":"9a1a9d01_0b1f565c","updated":"2015-10-01 22:21:11.000000000","message":"Yup, agree, as TLS is only the option.","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"400244148427f28b3a35c2e279dcf1319dfaf308","unresolved":false,"context_lines":[{"line_number":149,"context_line":"Check-Block-07: Is NAS operating in secure enviornment?"},{"line_number":150,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Cinder supports NFS driver which works differently than a traditional block"},{"line_number":153,"context_line":"storage driver. The NFS driver does not actually allow an instance to access a"},{"line_number":154,"context_line":"storage device at the block level. Instead, files are created on an NFS share"},{"line_number":155,"context_line":"and mapped to instances, which emulates a block device. Cinder supports secure"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_8b9e0662","line":152,"updated":"2015-10-01 21:44:02.000000000","message":"maybe \"supports an NFS driver\"","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"707b63f8275042e90dcf1a607110d0c31913f0cd","unresolved":false,"context_lines":[{"line_number":149,"context_line":"Check-Block-07: Is NAS operating in secure enviornment?"},{"line_number":150,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":151,"context_line":""},{"line_number":152,"context_line":"Cinder supports NFS driver which works differently than a traditional block"},{"line_number":153,"context_line":"storage driver. The NFS driver does not actually allow an instance to access a"},{"line_number":154,"context_line":"storage device at the block level. Instead, files are created on an NFS share"},{"line_number":155,"context_line":"and mapped to instances, which emulates a block device. Cinder supports secure"}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_41cf6fb3","line":152,"in_reply_to":"9a1a9d01_8b9e0662","updated":"2015-10-01 22:21:11.000000000","message":"Done","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10670,"name":"Michael McCune","email":"elmiko@redhat.com","username":"mimccune"},"change_message_id":"400244148427f28b3a35c2e279dcf1319dfaf308","unresolved":false,"context_lines":[{"line_number":185,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"If the maximum body size per request is not defined, the attacker can craft an"},{"line_number":188,"context_line":"arbitary osapi request of large size causing the service to crash and finally"},{"line_number":189,"context_line":"resulting in Denial Of Service attack. Assigning the maximum value ensures that"},{"line_number":190,"context_line":"any malicious oversized request gets blocked ensuring continued availability of"},{"line_number":191,"context_line":"the service."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_ebd782bd","line":188,"updated":"2015-10-01 21:44:02.000000000","message":"s/arbitary/arbitrary/","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"707b63f8275042e90dcf1a607110d0c31913f0cd","unresolved":false,"context_lines":[{"line_number":185,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":186,"context_line":""},{"line_number":187,"context_line":"If the maximum body size per request is not defined, the attacker can craft an"},{"line_number":188,"context_line":"arbitary osapi request of large size causing the service to crash and finally"},{"line_number":189,"context_line":"resulting in Denial Of Service attack. Assigning the maximum value ensures that"},{"line_number":190,"context_line":"any malicious oversized request gets blocked ensuring continued availability of"},{"line_number":191,"context_line":"the service."}],"source_content_type":"text/x-rst","patch_set":1,"id":"9a1a9d01_21459b16","line":188,"in_reply_to":"9a1a9d01_ebd782bd","updated":"2015-10-01 22:21:11.000000000","message":"Done","commit_id":"b86a22dcf89610d66c4a948004257b1c385802e6"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"f8ebccdb8385be80baef6750c4d845e42dd527f4","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":108,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/cinder/cinder.conf` is set to"},{"line_number":109,"context_line":"``http```, or if value of parameter ``identity_uri`` under"},{"line_number":110,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/cinder/cinder.conf` is not set"},{"line_number":111,"context_line":"to Identity API endpoint starting with ``https://`` or value of parameter"},{"line_number":112,"context_line":"``insecure`` under the same ``[keystone_authtoken]`` section in the same"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a2fa921_e0e1ebff","line":109,"updated":"2015-10-05 17:11:27.000000000","message":"Use two ` instead of three after http","commit_id":"bc0546c3afda690330f537e3161e2b85dd13732b"},{"author":{"_account_id":10281,"name":"Priti Desai","email":"pdesai@us.ibm.com","username":"priti_desai"},"change_message_id":"63a6ea3fffa2d04e5ed4e5af1d42a45e197c0348","unresolved":false,"context_lines":[{"line_number":106,"context_line":""},{"line_number":107,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":108,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/cinder/cinder.conf` is set to"},{"line_number":109,"context_line":"``http```, or if value of parameter ``identity_uri`` under"},{"line_number":110,"context_line":"``[keystone_authtoken]`` section in :file:`/etc/cinder/cinder.conf` is not set"},{"line_number":111,"context_line":"to Identity API endpoint starting with ``https://`` or value of parameter"},{"line_number":112,"context_line":"``insecure`` under the same ``[keystone_authtoken]`` section in the same"}],"source_content_type":"text/x-rst","patch_set":3,"id":"7a2fa921_f3b9c7ed","line":109,"in_reply_to":"7a2fa921_e0e1ebff","updated":"2015-10-05 17:41:54.000000000","message":"oh wow, good catch, fixed it now.","commit_id":"bc0546c3afda690330f537e3161e2b85dd13732b"}]}