)]}'
{"security-notes/OSSN-0066":[{"author":{"_account_id":15321,"name":"Matthew Van Dijk","email":"mvandijk@tesora.com","username":"mvandijk"},"change_message_id":"644e03b40c792a9b8de8ad06ba181743e81fe648","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"A fix was implemented within Mitaka and back ported to Liberty that addresses"},{"line_number":28,"context_line":"the problem by setting the authorization parameter to `enabled` when the"},{"line_number":29,"context_line":"configuration value `cluser_secure` is set to `True`."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9a89bdaa_a1d70c22","line":29,"updated":"2016-09-09 15:44:58.000000000","message":"How about: A fix was implemented within Mitaka and back ported to Liberty that addresses the problem by enabling authorization by default on single instances. This can be toggled via configuration groups. Cluster security is determined by the Trove config variable mongodb.cluster_secure. This cannot be toggled once the cluster is created.","commit_id":"df080dc93322fdcac9a1feba26d9c4083c4c00b4"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"f365b90dd9ae570e8291f214605dc6064db32205","unresolved":false,"context_lines":[{"line_number":26,"context_line":""},{"line_number":27,"context_line":"A fix was implemented within Mitaka and back ported to Liberty that addresses"},{"line_number":28,"context_line":"the problem by setting the authorization parameter to `enabled` when the"},{"line_number":29,"context_line":"configuration value `cluser_secure` is set to `True`."},{"line_number":30,"context_line":""},{"line_number":31,"context_line":"### Recommended Actions ###"},{"line_number":32,"context_line":""}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9a89bdaa_22377ae4","line":29,"in_reply_to":"9a89bdaa_a1d70c22","updated":"2016-09-09 16:16:38.000000000","message":"That\u0027s great! Making the change!","commit_id":"df080dc93322fdcac9a1feba26d9c4083c4c00b4"},{"author":{"_account_id":15321,"name":"Matthew Van Dijk","email":"mvandijk@tesora.com","username":"mvandijk"},"change_message_id":"644e03b40c792a9b8de8ad06ba181743e81fe648","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operators that require new instances of mongodb to have security authorization,"},{"line_number":34,"context_line":"are required to set the configuration value `cluser_secure` to `True`. If set"},{"line_number":35,"context_line":"to `False` Role-Based Access Control will be disabled."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Contacts / References ###"},{"line_number":38,"context_line":"Author: Luke Hinds, Red Hat"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9a89bdaa_e1b834e8","line":35,"updated":"2016-09-09 15:44:58.000000000","message":"How about: Single instances are now use role based access control (RBAC) by default. To disable RBAC, the Trove user can attach a security group with \"security.authorization\" set to \"disabled\". It can be re-enabled by detaching the security group or changing the value to \"enabled\". The Trove config variable mongodb.cluster_secure (boolean type, in trove.conf) determines the RBAC state of MongoDB clusters that are created. Setting this to true enables RBAC while false disables it. This applies to all MongoDB clusters, requires a restart of the trove-api service to change, and cannot be toggled on running clusters.","commit_id":"df080dc93322fdcac9a1feba26d9c4083c4c00b4"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"f365b90dd9ae570e8291f214605dc6064db32205","unresolved":false,"context_lines":[{"line_number":32,"context_line":""},{"line_number":33,"context_line":"Operators that require new instances of mongodb to have security authorization,"},{"line_number":34,"context_line":"are required to set the configuration value `cluser_secure` to `True`. If set"},{"line_number":35,"context_line":"to `False` Role-Based Access Control will be disabled."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"### Contacts / References ###"},{"line_number":38,"context_line":"Author: Luke Hinds, Red Hat"}],"source_content_type":"application/octet-stream","patch_set":4,"id":"9a89bdaa_42347edd","line":35,"in_reply_to":"9a89bdaa_e1b834e8","updated":"2016-09-09 16:16:38.000000000","message":"Sounds great.","commit_id":"df080dc93322fdcac9a1feba26d9c4083c4c00b4"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"872fb694fea8f3b18a3fed34aabfc54275836725","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":""},{"line_number":6,"context_line":"when creating a new mongodb single instance or cluster the default setting in"},{"line_number":7,"context_line":"mongodb security.authorization was set as disabled. This resulted in no need to"},{"line_number":8,"context_line":"provide user credentials to connect to the mongo instance and perform read /"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9a89bdaa_b9981c6c","line":5,"updated":"2016-09-09 17:04:55.000000000","message":"We don\u0027t typically include a newline after a heading?","commit_id":"6d11b9b4e4a90dc32d686df631c7b70e04edfdbc"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"872fb694fea8f3b18a3fed34aabfc54275836725","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Trove, Liberty"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"### Discussion ###"},{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Mongodb contains a security config set within `mongo.conf` as follows:"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"    security:"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9a89bdaa_19a02890","line":15,"updated":"2016-09-09 17:04:55.000000000","message":"We don\u0027t typically include a newline after a heading?","commit_id":"6d11b9b4e4a90dc32d686df631c7b70e04edfdbc"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"872fb694fea8f3b18a3fed34aabfc54275836725","unresolved":false,"context_lines":[{"line_number":32,"context_line":"`mongodb.cluster_secure`. This cannot be toggled once the cluster is created."},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"### Recommended Actions ###"},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Single instances are now use role based access control (RBAC) by default. To"},{"line_number":37,"context_line":"disable RBAC, the Trove user can attach a security group with"},{"line_number":38,"context_line":"`security.authorization` set to `disabled`. It can be re-enabled by detaching"}],"source_content_type":"application/octet-stream","patch_set":5,"id":"9a89bdaa_99ba78bf","line":35,"updated":"2016-09-09 17:04:55.000000000","message":"We don\u0027t typically include a newline after a heading?","commit_id":"6d11b9b4e4a90dc32d686df631c7b70e04edfdbc"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7d26fefa7c54f71ed8574ba8610b6195763faad4","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Mongodb guest instance allows any user to connect"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_b6a6de0c","line":1,"updated":"2016-09-13 14:31:43.000000000","message":"*MongoDB ?","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"6a06c407a25a8a4c65ee06e949b0411f88941789","unresolved":false,"context_lines":[{"line_number":1,"context_line":"Mongodb guest instance allows any user to connect"},{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_b6133e64","line":1,"in_reply_to":"9a89bdaa_b6a6de0c","updated":"2016-09-13 14:39:56.000000000","message":"Done","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7d26fefa7c54f71ed8574ba8610b6195763faad4","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"when creating a new mongodb single instance or cluster the default setting in"},{"line_number":6,"context_line":"mongodb `security.authorization` was set as disabled. This resulted in no need"},{"line_number":7,"context_line":"to provide user credentials to connect to the mongo instance and perform read /"},{"line_number":8,"context_line":"write operations from any network that is attached on instance create."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_16b86a29","line":5,"updated":"2016-09-13 14:31:43.000000000","message":"*Caps - \"When\", \"MongoDB\"","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"6a06c407a25a8a4c65ee06e949b0411f88941789","unresolved":false,"context_lines":[{"line_number":2,"context_line":"---"},{"line_number":3,"context_line":""},{"line_number":4,"context_line":"### Summary ###"},{"line_number":5,"context_line":"when creating a new mongodb single instance or cluster the default setting in"},{"line_number":6,"context_line":"mongodb `security.authorization` was set as disabled. This resulted in no need"},{"line_number":7,"context_line":"to provide user credentials to connect to the mongo instance and perform read /"},{"line_number":8,"context_line":"write operations from any network that is attached on instance create."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_36000e02","line":5,"in_reply_to":"9a89bdaa_16b86a29","updated":"2016-09-13 14:39:56.000000000","message":"Done","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"},{"author":{"_account_id":11861,"name":"Travis McPeak","email":"tmcpeak@us.ibm.com","username":"travis-mcpeak"},"change_message_id":"7d26fefa7c54f71ed8574ba8610b6195763faad4","unresolved":false,"context_lines":[{"line_number":35,"context_line":"`security.authorization` set to `disabled`. It can be re-enabled by detaching"},{"line_number":36,"context_line":"the security group or changing the value to `enabled`. The Trove config"},{"line_number":37,"context_line":"variable `mongodb.cluster_secure` (boolean type, in `trove.conf`) determines"},{"line_number":38,"context_line":"the RBAC state of MongoDB clusters that are created. Setting this to true"},{"line_number":39,"context_line":"enables RBAC while false disables it. This applies to all MongoDB clusters, and"},{"line_number":40,"context_line":"requires a restart of the trove-api service to change, and cannot be toggled on"},{"line_number":41,"context_line":"running clusters."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_b627be61","line":38,"updated":"2016-09-13 14:31:43.000000000","message":"could use a paragraph break somewhere in here","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"6a06c407a25a8a4c65ee06e949b0411f88941789","unresolved":false,"context_lines":[{"line_number":35,"context_line":"`security.authorization` set to `disabled`. It can be re-enabled by detaching"},{"line_number":36,"context_line":"the security group or changing the value to `enabled`. The Trove config"},{"line_number":37,"context_line":"variable `mongodb.cluster_secure` (boolean type, in `trove.conf`) determines"},{"line_number":38,"context_line":"the RBAC state of MongoDB clusters that are created. Setting this to true"},{"line_number":39,"context_line":"enables RBAC while false disables it. This applies to all MongoDB clusters, and"},{"line_number":40,"context_line":"requires a restart of the trove-api service to change, and cannot be toggled on"},{"line_number":41,"context_line":"running clusters."}],"source_content_type":"application/octet-stream","patch_set":8,"id":"9a89bdaa_6101f204","line":38,"in_reply_to":"9a89bdaa_b627be61","updated":"2016-09-13 14:39:56.000000000","message":"Done","commit_id":"acb42785c42a4262bf7b371ea0e84f97ec59e597"}]}