)]}'
{"security-guide/source/image-storage.rst":[{"author":{"_account_id":9382,"name":"Shilla Saebi","email":"shilla.saebi@gmail.com","username":"shillasaebi"},"change_message_id":"3c8f8e40908424ab2ade0c7168ec541d69020902","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Image Storage"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"OpenStack Image Storage (glance) is a service where users can upload and discover data assets that are meant to be used with other services. This currently includes images and metadata definitions."},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"Image services include discovering, registering, and retrieving virtual machine images. Glance has a RESTful API that allows querying of VM image metadata as well as retrieval of the actual image."},{"line_number":8,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"1a430d35_cb9d350c","line":5,"updated":"2017-02-09 14:33:29.000000000","message":"Does this line go over 79 characters?","commit_id":"7b3ebee7c5acf980c468f1f3f595dbf8bc09c0c6"}],"security-guide/source/image-storage/checklist.rst":[{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":12,"context_line":"intentionally or accidentally, modifies or deletes any of the parameters or"},{"line_number":13,"context_line":"the file itself then it would cause severe availability issues resulting in a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":16,"context_line":"cinder."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run the following commands:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_9c7dd5e9","line":15,"range":{"start_line":15,"start_character":35,"end_line":15,"end_character":39},"updated":"2017-02-22 05:23:46.000000000","message":"mark up","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":13,"context_line":"the file itself then it would cause severe availability issues resulting in a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":16,"context_line":"cinder."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run the following commands:"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_bc8459d4","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":6},"updated":"2017-02-22 05:23:46.000000000","message":"mark up","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":15,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":16,"context_line":"cinder."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run the following commands:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_dc874dd5","line":18,"range":{"start_line":18,"start_character":4,"end_line":18,"end_character":17},"updated":"2017-02-22 05:23:46.000000000","message":"these","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":31,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/schema-image.json | egrep \"root glance\""},{"line_number":32,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/schema.json | egrep \"root glance\""},{"line_number":33,"context_line":""},{"line_number":34,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":35,"context_line":"to root and glance respectively. The above commands show output of root glance."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"**Fail:** If the above commands does not return any output as the user"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_fc6ed12d","line":34,"range":{"start_line":34,"start_character":51,"end_line":34,"end_character":57},"updated":"2017-02-22 05:23:46.000000000","message":"configuration","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":34,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":35,"context_line":"to root and glance respectively. The above commands show output of root glance."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"**Fail:** If the above commands does not return any output as the user"},{"line_number":38,"context_line":"and group ownership might have set to any user other than root or any group"},{"line_number":39,"context_line":"other than glance."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_7c610139","line":37,"range":{"start_line":37,"start_character":32,"end_line":37,"end_character":36},"updated":"2017-02-22 05:23:46.000000000","message":"do","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":34,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":35,"context_line":"to root and glance respectively. The above commands show output of root glance."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"**Fail:** If the above commands does not return any output as the user"},{"line_number":38,"context_line":"and group ownership might have set to any user other than root or any group"},{"line_number":39,"context_line":"other than glance."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":".. _check_image_02:"},{"line_number":42,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_bc5b7986","line":39,"range":{"start_line":37,"start_character":60,"end_line":39,"end_character":18},"updated":"2017-02-22 05:23:46.000000000","message":"This is confusing. Consider rewording?","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Check-Image-02: Are strict permissions set for configuration files?"},{"line_number":44,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Similar to the previous check, it is recommended to set strict access"},{"line_number":47,"context_line":"permissions for such configuration files."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Run the following commands:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_1c51e562","line":46,"range":{"start_line":46,"start_character":31,"end_line":46,"end_character":36},"updated":"2017-02-22 05:23:46.000000000","message":"we","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":43,"context_line":"Check-Image-02: Are strict permissions set for configuration files?"},{"line_number":44,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":"Similar to the previous check, it is recommended to set strict access"},{"line_number":47,"context_line":"permissions for such configuration files."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Run the following commands:"}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_3c50695d","line":46,"range":{"start_line":46,"start_character":49,"end_line":46,"end_character":51},"updated":"2017-02-22 05:23:46.000000000","message":"you","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":46,"context_line":"Similar to the previous check, it is recommended to set strict access"},{"line_number":47,"context_line":"permissions for such configuration files."},{"line_number":48,"context_line":""},{"line_number":49,"context_line":"Run the following commands:"},{"line_number":50,"context_line":""},{"line_number":51,"context_line":".. code:: console"},{"line_number":52,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_fc55f14f","line":49,"range":{"start_line":49,"start_character":4,"end_line":49,"end_character":17},"updated":"2017-02-22 05:23:46.000000000","message":"these","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"dde97d27615a411a4de14d7174e7a3ca4be861c9","unresolved":false,"context_lines":[{"line_number":109,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":110,"context_line":""},{"line_number":111,"context_line":"OpenStack components communicate with each other using various protocols and"},{"line_number":112,"context_line":"the communication might involve sensitive / confidential data. An attacker may"},{"line_number":113,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":114,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":115,"context_line":"secured communication protocol."}],"source_content_type":"text/x-rst","patch_set":2,"id":"da36d5c6_1cd805ef","line":112,"range":{"start_line":112,"start_character":41,"end_line":112,"end_character":44},"updated":"2017-02-22 05:23:46.000000000","message":"or","commit_id":"a792dab9036345c9afb27f1ed20586a06df5785c"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"0908bad6faae6363e1db0a134e12d6f2fb54b377","unresolved":false,"context_lines":[{"line_number":13,"context_line":"the file itself then it would cause severe availability issues resulting in a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to ``root`` and group ownership must be set to"},{"line_number":16,"context_line":"``cinder``."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run these commands:"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"ba2be162_1c431e6d","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":10},"updated":"2017-03-06 09:18:16.000000000","message":"should that not be `glance`?","commit_id":"451934f176de535fad30a47378e83bb78b21de2d"},{"author":{"_account_id":22781,"name":"Khanak Nangia","email":"khanak.nangia@intel.com","username":"khanaknangia"},"change_message_id":"d4c59ddb7c00a5eb73edf40970b8678670c6f6a5","unresolved":false,"context_lines":[{"line_number":13,"context_line":"the file itself then it would cause severe availability issues resulting in a"},{"line_number":14,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":15,"context_line":"configuration files must be set to ``root`` and group ownership must be set to"},{"line_number":16,"context_line":"``cinder``."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run these commands:"},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"dfeb2761_9ec2fa84","line":16,"range":{"start_line":16,"start_character":0,"end_line":16,"end_character":10},"in_reply_to":"ba2be162_1c431e6d","updated":"2017-04-01 17:05:10.000000000","message":"+1, should be \"glance\"","commit_id":"451934f176de535fad30a47378e83bb78b21de2d"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"768fa8ce5296b4a26d999b6df99201e294451fee","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"Run the following commands:"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":".. code:: console"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/glance-api-paste.ini | egrep \"root glance\""},{"line_number":23,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/glance-api.conf | egrep \"root glance\""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/glance-cache.conf | egrep \"root glance\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/glance/glance-manage.conf | egrep \"root glance\""}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_8646fe20","line":22,"range":{"start_line":20,"start_character":0,"end_line":22,"end_character":79},"updated":"2017-04-04 01:00:31.000000000","message":"I think the content in the code blocks is off by one column","commit_id":"fc0a3c1ebb6b3965dccf7f69d7a2c30152dfd3bb"},{"author":{"_account_id":9162,"name":"Lana Brindley","email":"openstack@lanabrindley.com","username":"loquacity"},"change_message_id":"768fa8ce5296b4a26d999b6df99201e294451fee","unresolved":false,"context_lines":[{"line_number":88,"context_line":"Check-Image-03: Is keystone used for authentication?"},{"line_number":89,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":90,"context_line":""},{"line_number":91,"context_line":"OpenStack supports various authentication strategies like noauth, and keystone."},{"line_number":92,"context_line":"If the ``noauth`` strategy is used, then users can interact with OpenStack"},{"line_number":93,"context_line":"services without any authentication. This could be a potential risk since an"},{"line_number":94,"context_line":"attacker might gain unauthorized access to the OpenStack components. We"}],"source_content_type":"text/x-rst","patch_set":5,"id":"dfeb2761_c65d26ea","line":91,"range":{"start_line":91,"start_character":53,"end_line":91,"end_character":57},"updated":"2017-04-04 01:00:31.000000000","message":"including","commit_id":"fc0a3c1ebb6b3965dccf7f69d7a2c30152dfd3bb"}]}