)]}'
{"security-notes/OSSN-0064":[{"author":{"_account_id":11716,"name":"Tim Kelsey","email":"timothy.kelsey@uk.ibm.com","username":"tkelsey"},"change_message_id":"d33869f46094127b08d02612a0606b2ae5d3bcc2","unresolved":false,"context_lines":[{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Some deployments copy these files from the example versions and use them"},{"line_number":26,"context_line":"unchanged. This means that some production OpenStack clouds may have"},{"line_number":27,"context_line":"\"admin_token_auth\" is enabled and \"ADMIN_TOKEN\" set to the default value"},{"line_number":28,"context_line":"of \"ADMIN\"."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"It is likely that OpenStack deployments using the default keystone"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_bd05dc14","line":27,"updated":"2016-04-01 13:27:37.000000000","message":"grammar \"OpenStack clouds may have \"admin_token_auth\" is enabled\"","commit_id":"89162a56afb7ad4952a05ef89242c6f353470c01"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"5fbb57c87e45f1b066df87c9923d50258b10c4f8","unresolved":false,"context_lines":[{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \u0027ADMIN_TOKEN\u0027 value to \u0027None\u0027 will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the admin_token_auth"},{"line_number":45,"context_line":"middleware from the api pipelines in keystone-paste.ini"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_6d7b8fbe","line":44,"range":{"start_line":44,"start_character":54,"end_line":44,"end_character":70},"updated":"2016-04-01 15:17:02.000000000","message":"Elsewhere in the doc this has quotes around it.","commit_id":"89162a56afb7ad4952a05ef89242c6f353470c01"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"5fbb57c87e45f1b066df87c9923d50258b10c4f8","unresolved":false,"context_lines":[{"line_number":42,"context_line":"For existing deployments setting the \u0027ADMIN_TOKEN\u0027 value to \u0027None\u0027 will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the admin_token_auth"},{"line_number":45,"context_line":"middleware from the api pipelines in keystone-paste.ini"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"},{"line_number":48,"context_line":"    [pipeline:public_api]"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_ad4f6790","line":45,"range":{"start_line":45,"start_character":20,"end_line":45,"end_character":23},"updated":"2016-04-01 15:17:02.000000000","message":"API","commit_id":"89162a56afb7ad4952a05ef89242c6f353470c01"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"5fbb57c87e45f1b066df87c9923d50258b10c4f8","unresolved":false,"context_lines":[{"line_number":42,"context_line":"For existing deployments setting the \u0027ADMIN_TOKEN\u0027 value to \u0027None\u0027 will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the admin_token_auth"},{"line_number":45,"context_line":"middleware from the api pipelines in keystone-paste.ini"},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"},{"line_number":48,"context_line":"    [pipeline:public_api]"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"ba0121b8_2d5cf749","line":45,"range":{"start_line":45,"start_character":52,"end_line":45,"end_character":55},"updated":"2016-04-01 15:17:02.000000000","message":"Period at the end.","commit_id":"89162a56afb7ad4952a05ef89242c6f353470c01"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"10d40d9964ca497ccd60942bebc421f5276a7a3e","unresolved":false,"context_lines":[{"line_number":6,"context_line":"often left configured in its default value by OpenStack deployers."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"An attacker could gain administrative access to the Keystone API by"},{"line_number":9,"context_line":"providing \"ADMIN\" as a passphrase."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, \u003cOpenStack Releases\u003e"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_fae4453c","line":9,"updated":"2016-04-11 14:51:03.000000000","message":"s/passphrase/token/ in several places in this doc","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b7f0823a4468f78bb3fc8c2e69f7ed809b044320","unresolved":false,"context_lines":[{"line_number":6,"context_line":"often left configured in its default value by OpenStack deployers."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"An attacker could gain administrative access to the Keystone API by"},{"line_number":9,"context_line":"providing \"ADMIN\" as a passphrase."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, \u003cOpenStack Releases\u003e"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_d1883cea","line":9,"in_reply_to":"7a1b2928_fae4453c","updated":"2016-04-11 18:59:01.000000000","message":"Done","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"10d40d9964ca497ccd60942bebc421f5276a7a3e","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone supports an authentication middleware called \"admin_token_auth\""},{"line_number":16,"context_line":". This provides a simple passphrase for accessing the Keystone API and"},{"line_number":17,"context_line":"is intended to be used only for the initial setup of Keystone, allowing"},{"line_number":18,"context_line":"the deployer access to the Keystone API which can be used to setup"},{"line_number":19,"context_line":"appropriate Keystone administrator accounts."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_1abf81fc","line":16,"updated":"2016-04-11 14:51:03.000000000","message":"(nit) beginning a line with a period?","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b7f0823a4468f78bb3fc8c2e69f7ed809b044320","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone supports an authentication middleware called \"admin_token_auth\""},{"line_number":16,"context_line":". This provides a simple passphrase for accessing the Keystone API and"},{"line_number":17,"context_line":"is intended to be used only for the initial setup of Keystone, allowing"},{"line_number":18,"context_line":"the deployer access to the Keystone API which can be used to setup"},{"line_number":19,"context_line":"appropriate Keystone administrator accounts."}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_51e38ca3","line":16,"in_reply_to":"7a1b2928_1abf81fc","updated":"2016-04-11 18:59:01.000000000","message":"Fiddly because of line length restrictions.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"10d40d9964ca497ccd60942bebc421f5276a7a3e","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\"admin_token_auth\" enabled and \"ADMIN_TOKEN\" set to the default value"},{"line_number":28,"context_line":"of \"ADMIN\"."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"It is likely that OpenStack deployments using the default keystone"},{"line_number":31,"context_line":"configuration files are vulnerable to exploitation by an attacker who"},{"line_number":32,"context_line":"can accesses the API using a passphrase of \"ADMIN\"."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_fa00c5ac","line":30,"updated":"2016-04-11 14:51:03.000000000","message":"(nit) the docs switches between upper and lower case for keystone.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b7f0823a4468f78bb3fc8c2e69f7ed809b044320","unresolved":false,"context_lines":[{"line_number":27,"context_line":"\"admin_token_auth\" enabled and \"ADMIN_TOKEN\" set to the default value"},{"line_number":28,"context_line":"of \"ADMIN\"."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"It is likely that OpenStack deployments using the default keystone"},{"line_number":31,"context_line":"configuration files are vulnerable to exploitation by an attacker who"},{"line_number":32,"context_line":"can accesses the API using a passphrase of \"ADMIN\"."},{"line_number":33,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_318a50c0","line":30,"in_reply_to":"7a1b2928_fa00c5ac","updated":"2016-04-11 18:59:01.000000000","message":"Done","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"e4c9036748393adb7cbdd829b5858f571feee6d5","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_c3924057","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"updated":"2016-04-11 14:27:55.000000000","message":"This is only true in \"Mitaka\" and later. The fix required for this is not available in liberty and before.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"d06af41ed41016567cf6ec22341521d9d7f7598b","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_97487f2f","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_04aefb84","updated":"2016-04-11 15:58:41.000000000","message":"@Travis, removing the middleware from the pipeline would be enough to close any security hole. Changing the admin_token is good practice just in case the middleware gets enabled accidentally, but the middleware really should be removed.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"92d04f1d8d6a3a7b460a52bccfd13ba59b62f0fb","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_f17c5874","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_55a1bfa8","updated":"2016-04-11 18:45:10.000000000","message":"++ to what david said.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"9ac714417207571439cae1b377b373ea29e6cf1d","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_55a1bfa8","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_97487f2f","updated":"2016-04-11 16:30:43.000000000","message":"Thanks David.  @Rob, maybe we should just propose that?","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"92d04f1d8d6a3a7b460a52bccfd13ba59b62f0fb","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_913c0495","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_b46dbc06","updated":"2016-04-11 18:45:10.000000000","message":"Correct setting to \"None\" would use the string \"None\", setting to \u0027admin_token \u003d\u0027 or using the default value (commenting out) would be most correct.\n\nWe may have a doc bug-fix needed based on this.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"a1db689d4a2e2cfe6b85d8d0f11e7d7844509900","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_04aefb84","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_c3924057","updated":"2016-04-11 15:48:08.000000000","message":"@Morgan - do you have any sense for what if any recommendations we should make for users prior to Mitaka?","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"2d70581fb00a47ce89bd42bee60b8c55ea536fa2","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_b46dbc06","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_c3924057","updated":"2016-04-11 15:09:31.000000000","message":"Actually this may be misleading. If you literally set it to None as in \u0027admin_token \u003d None\u0027, then I think you can use None as the token. To avoid this you would have to set \u0027admin_token \u003d\u0027 and not provide a value.","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"b7f0823a4468f78bb3fc8c2e69f7ed809b044320","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"For existing deployments setting the \"ADMIN_TOKEN\" value to \"None\" will"},{"line_number":43,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":44,"context_line":"provided. Existing deployments should also remove the \"admin_token_auth\""},{"line_number":45,"context_line":"middleware from the API pipelines in keystone-paste.ini."},{"line_number":46,"context_line":""},{"line_number":47,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"7a1b2928_3126d0ce","line":44,"range":{"start_line":42,"start_character":0,"end_line":44,"end_character":9},"in_reply_to":"7a1b2928_f17c5874","updated":"2016-04-11 18:59:01.000000000","message":"Done","commit_id":"ab21cdb875a5bc9de1653d3a79798ddebbef9ac3"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"015265bb7e836303882ca93d99708c21464edee5","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Use of \"ADMIN_TOKEN\" for bootstrapping Keystone deployments is"},{"line_number":36,"context_line":"deprecated and will be removed in a future release. Deployers are"},{"line_number":37,"context_line":"encouraged to bootstrap Keystone using the \u0027bootstrap\u0027 feature of the"},{"line_number":38,"context_line":"keystone-manage CLI tool:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_7d55af4e","line":38,"range":{"start_line":36,"start_character":52,"end_line":38,"end_character":25},"updated":"2016-04-13 01:17:03.000000000","message":"may want to mention that this is only available as of Mitaka","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c1a7bde5291611ac3260b1933d1ed44b340cd5ba","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Use of \"ADMIN_TOKEN\" for bootstrapping Keystone deployments is"},{"line_number":36,"context_line":"deprecated and will be removed in a future release. Deployers are"},{"line_number":37,"context_line":"encouraged to bootstrap Keystone using the \u0027bootstrap\u0027 feature of the"},{"line_number":38,"context_line":"keystone-manage CLI tool:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_b498f01c","line":38,"range":{"start_line":36,"start_character":52,"end_line":38,"end_character":25},"in_reply_to":"5a18252c_7d55af4e","updated":"2016-04-13 10:37:12.000000000","message":"No problem making this change.  What\u0027s best practice pre-Mitaka? Simply to follow the \"existing deployment\" advice below?","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7955797df3130ed7a9be7e7610578206078c47f0","unresolved":false,"context_lines":[{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Use of \"ADMIN_TOKEN\" for bootstrapping Keystone deployments is"},{"line_number":36,"context_line":"deprecated and will be removed in a future release. Deployers are"},{"line_number":37,"context_line":"encouraged to bootstrap Keystone using the \u0027bootstrap\u0027 feature of the"},{"line_number":38,"context_line":"keystone-manage CLI tool:"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_5e26cece","line":38,"range":{"start_line":36,"start_character":52,"end_line":38,"end_character":25},"in_reply_to":"5a18252c_b498f01c","updated":"2016-04-13 13:53:29.000000000","message":"Pre-mitaka they would use the admin token and then should have removed the middleware from the pipeline.","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":7725,"name":"David Stanek","email":"dstanek@dstanek.com","username":"dstanek"},"change_message_id":"7955797df3130ed7a9be7e7610578206078c47f0","unresolved":false,"context_lines":[{"line_number":39,"context_line":""},{"line_number":40,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":41,"context_line":""},{"line_number":42,"context_line":"Existing deployments should remove the \"admin_token_auth\" middleware"},{"line_number":43,"context_line":"from the API pipelines in keystone-paste.ini."},{"line_number":44,"context_line":""},{"line_number":45,"context_line":"---- begin bad keystone-paste.ini snippet ----"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_817da6e9","line":42,"updated":"2016-04-13 13:53:29.000000000","message":"It looks like this still applies to deployments from master. Our default config still has the middleware configured. I proposed a patch to Keystone to get the conversation going: https://review.openstack.org/#/c/305287/","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":6482,"name":"Steve Martinelli","email":"s.martinelli@gmail.com","username":"stevemar"},"change_message_id":"015265bb7e836303882ca93d99708c21464edee5","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"---- begin bad keystone-paste.ini snippet ----"},{"line_number":46,"context_line":"    [pipeline:public_api]"},{"line_number":47,"context_line":"    pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension public_service"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    [pipeline:admin_api]"},{"line_number":50,"context_line":"    pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension s3_extension admin_service"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_ddca031a","line":47,"range":{"start_line":47,"start_character":0,"end_line":47,"end_character":140},"updated":"2016-04-13 01:17:03.000000000","message":"this line and all others like it are too long, maybe use ... between some of the good values\n\n  pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth dmin_token_auth ... public_service","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c1a7bde5291611ac3260b1933d1ed44b340cd5ba","unresolved":false,"context_lines":[{"line_number":44,"context_line":""},{"line_number":45,"context_line":"---- begin bad keystone-paste.ini snippet ----"},{"line_number":46,"context_line":"    [pipeline:public_api]"},{"line_number":47,"context_line":"    pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension public_service"},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"    [pipeline:admin_api]"},{"line_number":50,"context_line":"    pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension s3_extension admin_service"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"5a18252c_74549820","line":47,"range":{"start_line":47,"start_character":0,"end_line":47,"end_character":140},"in_reply_to":"5a18252c_ddca031a","updated":"2016-04-13 10:37:12.000000000","message":"According to our requirements, it\u0027s ok to have code snippets break the line length rules: https://wiki.openstack.org/wiki/Security/Security_Note_Process","commit_id":"f045d20656bf3d2dc2f891de86a92c6927e7d072"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"e3e60d23096b1147dd65f1020e4c2a046de85c21","unresolved":false,"context_lines":[{"line_number":28,"context_line":"of \"ADMIN\"."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"It is likely that OpenStack deployments using the default Keystone"},{"line_number":31,"context_line":"configuration files are vulnerable to exploitation by an attacker who"},{"line_number":32,"context_line":"can accesses the API using a token of \"ADMIN\"."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Use of \"ADMIN_TOKEN\" for bootstrapping Keystone deployments is"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a122d0e_9e594f38","line":32,"range":{"start_line":31,"start_character":66,"end_line":32,"end_character":12},"updated":"2016-04-26 15:17:38.000000000","message":"\u0027who can access\u0027, or \u0027who accesses\u0027?","commit_id":"ebbbc2e03667906ef3686c4ab4c8843206cec803"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"256b4c6ed88ee7372843d6961c64ef148527450e","unresolved":false,"context_lines":[{"line_number":28,"context_line":"of \"ADMIN\"."},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"It is likely that OpenStack deployments using the default Keystone"},{"line_number":31,"context_line":"configuration files are vulnerable to exploitation by an attacker who"},{"line_number":32,"context_line":"can accesses the API using a token of \"ADMIN\"."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":"Use of \"ADMIN_TOKEN\" for bootstrapping Keystone deployments is"}],"source_content_type":"application/octet-stream","patch_set":6,"id":"1a122d0e_9ed4aa20","line":32,"range":{"start_line":31,"start_character":66,"end_line":32,"end_character":12},"in_reply_to":"1a122d0e_9e594f38","updated":"2016-04-26 18:30:55.000000000","message":"Done","commit_id":"ebbbc2e03667906ef3686c4ab4c8843206cec803"}],"security-notes/OSSN-0064.txt":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"25341760c4a9934b37cdd9ba648de300f7fc705d","unresolved":false,"context_lines":[{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"A Keystone setting intended for use only during initial installation is"},{"line_number":6,"context_line":"often left configured in it\u0027s default value by OpenStack deployers."},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"An attacker could gain administrative access to the Keystone API by"},{"line_number":9,"context_line":"providing \"ADMIN\" as a passphrase."}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_764d5099","line":6,"updated":"2016-03-31 17:03:50.000000000","message":"*its","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"25341760c4a9934b37cdd9ba648de300f7fc705d","unresolved":false,"context_lines":[{"line_number":9,"context_line":"providing \"ADMIN\" as a passphrase."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"Keystone, \u003cOpenStack Releases\u003e"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":"Keystone supports an authentication method known as \u0027ADMIN_TOKEN\u0027. This"}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_1653343a","line":12,"updated":"2016-03-31 17:03:50.000000000","message":"put releases :P","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"fd9399793d8601f44defa96c6baaed61966ade9f","unresolved":false,"context_lines":[{"line_number":35,"context_line":""},{"line_number":36,"context_line":"  $ keystone-manage bootstrap --bootstrap-password s3cr3t"},{"line_number":37,"context_line":""},{"line_number":38,"context_line":"For existing deployments setting the \u0027ADMIN_TOKEN\u0027 value to \u0027None\u0027 will"},{"line_number":39,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":40,"context_line":"provided. Existing deployments should also remove the admin_auth_token"},{"line_number":41,"context_line":"middleware from the api pipelines in keystone-paste.ini"}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_d9c8cf57","line":38,"range":{"start_line":38,"start_character":37,"end_line":38,"end_character":66},"updated":"2016-03-31 17:11:52.000000000","message":"Should we add detail about where this ADMIN_TOKEN value should be configured?","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"},{"author":{"_account_id":11029,"name":"Jamie Finnigan","email":"jamiefinnigan@gmail.com","username":"jamiefinnigan"},"change_message_id":"fd9399793d8601f44defa96c6baaed61966ade9f","unresolved":false,"context_lines":[{"line_number":37,"context_line":""},{"line_number":38,"context_line":"For existing deployments setting the \u0027ADMIN_TOKEN\u0027 value to \u0027None\u0027 will"},{"line_number":39,"context_line":"cause the AdminTokenAuth middleware to pass over the token even if it is"},{"line_number":40,"context_line":"provided. Existing deployments should also remove the admin_auth_token"},{"line_number":41,"context_line":"middleware from the api pipelines in keystone-paste.ini"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Bad keystone-paste.ini:"}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_9984970b","line":40,"range":{"start_line":40,"start_character":54,"end_line":40,"end_character":70},"updated":"2016-03-31 17:11:52.000000000","message":"Should be \u0027admin_token_auth\u0027?","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"},{"author":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"change_message_id":"152cc12213e7ee22aa76e5201ba6aa413a7f9478","unresolved":false,"context_lines":[{"line_number":41,"context_line":"middleware from the api pipelines in keystone-paste.ini"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"Bad keystone-paste.ini:"},{"line_number":44,"context_line":"    \u003c..snip..\u003e"},{"line_number":45,"context_line":"    [pipeline:public_api]"},{"line_number":46,"context_line":"    pipeline \u003d cors sizelimit url_normalize request_id build_auth_context token_auth admin_token_auth json_body ec2_extension public_service"},{"line_number":47,"context_line":""}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_59bcbfba","line":44,"updated":"2016-03-31 17:10:12.000000000","message":"Should this be rendered as a code snippet?","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"},{"author":{"_account_id":7473,"name":"Grant Murphy","email":"grantcmurphy@gmail.com","username":"gm"},"change_message_id":"152cc12213e7ee22aa76e5201ba6aa413a7f9478","unresolved":false,"context_lines":[{"line_number":71,"context_line":"Mailing list [Security] tag on : openstack-dev@lists.openstack.org"},{"line_number":72,"context_line":"OpenStack Security Group : https://launchpad.net/~openstack-ossg"},{"line_number":73,"context_line":"Keystone Change : https://review.openstack.org/#/c/282104/1/releasenotes/notes/admin_token-c634ec12fc714255.yaml"},{"line_number":74,"context_line":"CVE: \u003cCVE number if one was filed\u003e"}],"source_content_type":"text/plain","patch_set":1,"id":"ba0121b8_99b657f7","line":74,"updated":"2016-03-31 17:10:12.000000000","message":"Probably can remove this line?","commit_id":"c847a3e349cbb2f0451db6b92a7be9fb7e5a94fb"}]}