)]}'
{"security-notes/OSSN-0068":[{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"eb7604acf0982f6a9bd7e184e7651de197ae64a1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"DoS style attack on keystone, using repeated token revocation requests, can"},{"line_number":2,"context_line":"lead to service degradation or disruption"},{"line_number":3,"context_line":"---"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9abb7d3a_65d26e36","line":2,"updated":"2016-06-02 17:58:30.000000000","message":"I think we need to shorten the title","commit_id":"075c7d8a96b203fca71e30bd07f86d64053a65a8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"eb7604acf0982f6a9bd7e184e7651de197ae64a1","unresolved":false,"context_lines":[{"line_number":5,"context_line":"### Summary ###"},{"line_number":6,"context_line":"There is currently no limit to the frequency of keystone token revocations that"},{"line_number":7,"context_line":"can be made by a single user, in any given time frame. If a user repeatedly"},{"line_number":8,"context_line":"makes token requests, and then immediately revokes the token, a performance"},{"line_number":9,"context_line":"degradation can occur and possible DoS attacks could be directed towards"},{"line_number":10,"context_line":"keystones API."},{"line_number":11,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9abb7d3a_45be4ad5","line":8,"updated":"2016-06-02 17:58:30.000000000","message":"I\u0027m wondering if we should expand this beyond just Keystone\u0027s issue","commit_id":"075c7d8a96b203fca71e30bd07f86d64053a65a8"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"1d1a68f3a003d7f66240902cfef1ecf9c0e467ca","unresolved":false,"context_lines":[{"line_number":5,"context_line":"### Summary ###"},{"line_number":6,"context_line":"There is currently no limit to the frequency of keystone token revocations that"},{"line_number":7,"context_line":"can be made by a single user, in any given time frame. If a user repeatedly"},{"line_number":8,"context_line":"makes token requests, and then immediately revokes the token, a performance"},{"line_number":9,"context_line":"degradation can occur and possible DoS attacks could be directed towards"},{"line_number":10,"context_line":"keystones API."},{"line_number":11,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9abb7d3a_6824feae","line":8,"in_reply_to":"9abb7d3a_45be4ad5","updated":"2016-06-02 19:53:00.000000000","message":"I believe the plan is to cover \u0027rate-limiting\u0027 as an overall topic in the security guide. So this will cover the launchpad issue already up, and then the guide will round up all the services. Make sense?","commit_id":"075c7d8a96b203fca71e30bd07f86d64053a65a8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"eb7604acf0982f6a9bd7e184e7651de197ae64a1","unresolved":false,"context_lines":[{"line_number":20,"context_line":"revocations are made in quick succession, response times starts to lengthen,"},{"line_number":21,"context_line":"due to the increasing entries made in the revocation_event table."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With no form of rate limiting in place, a single user can cause a the OpenStack "},{"line_number":24,"context_line":"auth service to become poor in response time, resulting in a Denial of Serice"},{"line_number":25,"context_line":"(DoS) style attack."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9abb7d3a_45d76a23","line":23,"updated":"2016-06-02 17:58:30.000000000","message":"ws","commit_id":"075c7d8a96b203fca71e30bd07f86d64053a65a8"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"eb7604acf0982f6a9bd7e184e7651de197ae64a1","unresolved":false,"context_lines":[{"line_number":30,"context_line":"thousand events during that time."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"### Recommended Actions ###"},{"line_number":33,"context_line":"For current stable OpenStack releases (Mitaka and previous), user are recommended"},{"line_number":34,"context_line":"to deploy external rate-limiting proxies or web application firewalls, to provide"},{"line_number":35,"context_line":"a front layer of protection to keystones API."},{"line_number":36,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":3,"id":"9abb7d3a_2576a63e","line":33,"updated":"2016-06-02 17:58:30.000000000","message":"users*","commit_id":"075c7d8a96b203fca71e30bd07f86d64053a65a8"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c09720d35dc3cd3eb8a12dfe919e225fdb978eb4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"DoS style attack on keystone, using repeated token revocation requests, can"},{"line_number":2,"context_line":"lead to service degradation or disruption"},{"line_number":3,"context_line":"---"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9abb7d3a_4a2492ae","line":2,"range":{"start_line":1,"start_character":0,"end_line":2,"end_character":41},"updated":"2016-06-02 19:09:17.000000000","message":"\"DoS Style attack on keystone from repeated token revocations\"\n\nExplain further in the summary. DoS implies \"service degredation or disruption\"","commit_id":"a7a0cc29ce798509959173f385a9a53ebb130330"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"15aa043763fc8eb6a7fc713c9aa3515a1d5a9972","unresolved":false,"context_lines":[{"line_number":1,"context_line":"DoS style attack on keystone, using repeated token revocation requests, can"},{"line_number":2,"context_line":"lead to service degradation or disruption"},{"line_number":3,"context_line":"---"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9abb7d3a_0a30ca9d","line":2,"range":{"start_line":1,"start_character":0,"end_line":2,"end_character":41},"in_reply_to":"9abb7d3a_4a2492ae","updated":"2016-06-02 19:09:49.000000000","message":"Erm,Explain as needed inthe summary","commit_id":"a7a0cc29ce798509959173f385a9a53ebb130330"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"c09720d35dc3cd3eb8a12dfe919e225fdb978eb4","unresolved":false,"context_lines":[{"line_number":20,"context_line":"revocations are made in quick succession, response times starts to lengthen,"},{"line_number":21,"context_line":"due to the increasing entries made in the revocation_event table."},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"With no form of rate limiting in place, a single user can cause the OpenStack "},{"line_number":24,"context_line":"auth service to become poor in response time, resulting in a Denial of Serice"},{"line_number":25,"context_line":"(DoS) style attack."},{"line_number":26,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9abb7d3a_b70be72a","line":23,"range":{"start_line":23,"start_character":77,"end_line":23,"end_character":78},"updated":"2016-06-02 19:09:17.000000000","message":"NIT: Whitespace.","commit_id":"a7a0cc29ce798509959173f385a9a53ebb130330"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Repeated token revocation requests, can lead to service degradation or disruption"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_c0805e49","line":1,"range":{"start_line":1,"start_character":0,"end_line":1,"end_character":81},"updated":"2016-06-02 21:27:56.000000000","message":"Much better!","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":5,"context_line":"There is currently no limit to the frequency of keystone token revocations that"},{"line_number":6,"context_line":"can be made by a single user, in any given time frame. If a user repeatedly"},{"line_number":7,"context_line":"makes token requests, and then immediately revokes the token, a performance"},{"line_number":8,"context_line":"degradation can occur and possible DoS attacks could be directed towards"},{"line_number":9,"context_line":"keystones API."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_bd5bc12d","line":8,"range":{"start_line":8,"start_character":35,"end_line":8,"end_character":38},"updated":"2016-06-02 21:10:40.000000000","message":"Perhaps define DoS here when it is first mentioned? Then we can use the acronym throughout this document. Or perhaps have a separate \"Definitions\" section at the top of this document to make it easier to read.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":5,"context_line":"There is currently no limit to the frequency of keystone token revocations that"},{"line_number":6,"context_line":"can be made by a single user, in any given time frame. If a user repeatedly"},{"line_number":7,"context_line":"makes token requests, and then immediately revokes the token, a performance"},{"line_number":8,"context_line":"degradation can occur and possible DoS attacks could be directed towards"},{"line_number":9,"context_line":"keystones API."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_009386a4","line":8,"range":{"start_line":8,"start_character":35,"end_line":8,"end_character":38},"in_reply_to":"9abb7d3a_bd5bc12d","updated":"2016-06-02 21:27:56.000000000","message":"I could go either way on defining DoS. but It doesn\u0027t hurt to do so.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":6,"context_line":"can be made by a single user, in any given time frame. If a user repeatedly"},{"line_number":7,"context_line":"makes token requests, and then immediately revokes the token, a performance"},{"line_number":8,"context_line":"degradation can occur and possible DoS attacks could be directed towards"},{"line_number":9,"context_line":"keystones API."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"### Affected Services / Software ###"},{"line_number":12,"context_line":"All services using keystone."}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_99d7f2be","line":9,"range":{"start_line":9,"start_character":0,"end_line":9,"end_character":14},"updated":"2016-06-02 21:10:40.000000000","message":"s/keystones API/keystone/","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"Token revocation can be self-served, with no restrictions enforced on the"},{"line_number":18,"context_line":"number of token revocations made by any user / service. If repeated token"},{"line_number":19,"context_line":"revocations are made in quick succession, response times starts to lengthen,"},{"line_number":20,"context_line":"due to the increasing entries made in the revocation_event table."},{"line_number":21,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_593f4ad6","line":18,"range":{"start_line":18,"start_character":40,"end_line":18,"end_character":54},"updated":"2016-06-02 21:10:40.000000000","message":"s/user \\/ service/user/\n\nUser can be any user, including the service users.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"Token revocation can be self-served, with no restrictions enforced on the"},{"line_number":18,"context_line":"number of token revocations made by any user / service. If repeated token"},{"line_number":19,"context_line":"revocations are made in quick succession, response times starts to lengthen,"},{"line_number":20,"context_line":"due to the increasing entries made in the revocation_event table."},{"line_number":21,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_20c4ca90","line":18,"range":{"start_line":18,"start_character":40,"end_line":18,"end_character":54},"in_reply_to":"9abb7d3a_593f4ad6","updated":"2016-06-02 21:27:56.000000000","message":"I think that is what is being implied. But rephrasing to:\n\n\"any user (including service users)\" might be warranted.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":16,"context_line":"### Discussion ###"},{"line_number":17,"context_line":"Token revocation can be self-served, with no restrictions enforced on the"},{"line_number":18,"context_line":"number of token revocations made by any user / service. If repeated token"},{"line_number":19,"context_line":"revocations are made in quick succession, response times starts to lengthen,"},{"line_number":20,"context_line":"due to the increasing entries made in the revocation_event table."},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"With no form of rate limiting in place, a single user can cause the OpenStack"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_1d13ed5d","line":19,"range":{"start_line":19,"start_character":1,"end_line":19,"end_character":40},"updated":"2016-06-02 21:10:40.000000000","message":"if token revocations are made in quick succession","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":29,"context_line":"thousand events during that time."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":"For current stable OpenStack releases (Mitaka and previous), users are recommended"},{"line_number":33,"context_line":"to deploy external rate-limiting proxies or web application firewalls, to provide"},{"line_number":34,"context_line":"a front layer of protection to keystones API."},{"line_number":35,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_7d62f9ae","line":32,"range":{"start_line":32,"start_character":61,"end_line":32,"end_character":66},"updated":"2016-06-02 21:10:40.000000000","message":"s/users/operators/","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"change_message_id":"d0fdd2928b478ff2bb014b3d7a70d7efb1daa9e1","unresolved":false,"context_lines":[{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":"For current stable OpenStack releases (Mitaka and previous), users are recommended"},{"line_number":33,"context_line":"to deploy external rate-limiting proxies or web application firewalls, to provide"},{"line_number":34,"context_line":"a front layer of protection to keystones API."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"The following solutions may be considered, however it is key that the operator"},{"line_number":37,"context_line":"carefully plans and considers the individual performance needs of users"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_7d0959dd","line":34,"range":{"start_line":34,"start_character":31,"end_line":34,"end_character":45},"updated":"2016-06-02 21:10:40.000000000","message":"s/keystones API/keystone/","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":130,"context_line":"~~~"},{"line_number":131,"context_line":"limit_req_zone $binary_remote_addr zone\u003done:10m rate\u003d10r/m;"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"server {"},{"line_number":134,"context_line":"    ..."},{"line_number":135,"context_line":"    location /\u003curi\u003e {"},{"line_number":136,"context_line":"        limit_req zone\u003done;"},{"line_number":137,"context_line":"    ..."},{"line_number":138,"context_line":"    }"},{"line_number":139,"context_line":"}"},{"line_number":140,"context_line":"~~~"},{"line_number":141,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_e00e42e4","line":138,"range":{"start_line":133,"start_character":0,"end_line":138,"end_character":5},"updated":"2016-06-02 21:27:56.000000000","message":"suggest expanding this to the same level as repose is covered.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"3db1001fd1080acf7aa864fc4e2971238ff99190","unresolved":false,"context_lines":[{"line_number":130,"context_line":"~~~"},{"line_number":131,"context_line":"limit_req_zone $binary_remote_addr zone\u003done:10m rate\u003d10r/m;"},{"line_number":132,"context_line":""},{"line_number":133,"context_line":"server {"},{"line_number":134,"context_line":"    ..."},{"line_number":135,"context_line":"    location /\u003curi\u003e {"},{"line_number":136,"context_line":"        limit_req zone\u003done;"},{"line_number":137,"context_line":"    ..."},{"line_number":138,"context_line":"    }"},{"line_number":139,"context_line":"}"},{"line_number":140,"context_line":"~~~"},{"line_number":141,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":5,"id":"7aa08908_bcdcd146","line":138,"range":{"start_line":133,"start_character":0,"end_line":138,"end_character":5},"in_reply_to":"9abb7d3a_e00e42e4","updated":"2016-06-08 12:16:00.000000000","message":"Going to research this and HAProxy now for next patch.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":148,"context_line":"HAProxy can provide inherent rate-limiting, using stick-tables, with a General"},{"line_number":149,"context_line":"Purpose Counter (gpc)"},{"line_number":150,"context_line":""},{"line_number":151,"context_line":"~~~"},{"line_number":152,"context_line":"# Monitors the number of request sent by an IP over a period of 10 seconds"},{"line_number":153,"context_line":"stick-table type ip size 1m expire 10s store gpc0,http_req_rate(10s)"},{"line_number":154,"context_line":"tcp-request connection track-sc1 src"},{"line_number":155,"context_line":"tcp-request connection reject if { src_get_gpc0 gt 0 }"},{"line_number":156,"context_line":"~~~"},{"line_number":157,"context_line":""},{"line_number":158,"context_line":"Further details can be found on the haproxy website:"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_803016a0","line":155,"range":{"start_line":151,"start_character":0,"end_line":155,"end_character":54},"updated":"2016-06-02 21:27:56.000000000","message":"Can HAProxy cover specific URIs? Suggest covering this just like the repose option.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"34b4cbda09453dc4e76159c146675193a56a44b2","unresolved":false,"context_lines":[{"line_number":159,"context_line":""},{"line_number":160,"context_line":"http://blog.haproxy.com/2012/02/27/use-a-load-balancer-as-a-first-row-of-defense-against-ddos)"},{"line_number":161,"context_line":""},{"line_number":162,"context_line":"#### Apache ####"},{"line_number":163,"context_line":"A number of solutions can be explored here."},{"line_number":164,"context_line":""},{"line_number":165,"context_line":"##### mod_ratelimit #####"},{"line_number":166,"context_line":"http://httpd.apache.org/docs/2.4/mod/mod_ratelimit.html"},{"line_number":167,"context_line":""},{"line_number":168,"context_line":"##### mod_qos #####"},{"line_number":169,"context_line":"http://opensource.adnovum.ch/mod_qos/dos.html"},{"line_number":170,"context_line":""},{"line_number":171,"context_line":"##### mod_evasive #####"},{"line_number":172,"context_line":"https://www.digitalocean.com/community/tutorials/how-to-protect-against-dos-and-ddos-with-mod_evasive-for-apache-on-centos-7)"},{"line_number":173,"context_line":""},{"line_number":174,"context_line":"##### mod_security #####"},{"line_number":175,"context_line":"https://www.modsecurity.org/"},{"line_number":176,"context_line":""},{"line_number":177,"context_line":"### Contacts / References ###"},{"line_number":178,"context_line":"This OSSN : https://bugs.launchpad.net/ossn/+bug/1553324"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9abb7d3a_601a5219","line":175,"range":{"start_line":162,"start_character":0,"end_line":175,"end_character":28},"updated":"2016-06-02 21:27:56.000000000","message":"These are pretty solidly documented and should be sufficient.","commit_id":"5d633075fd1bd67cbb76ed2e6bbbd01948dd7a75"}]}