)]}'
{"security-guide/source/index.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"   shared-file-systems.rst"},{"line_number":30,"context_line":"   networking.rst"},{"line_number":31,"context_line":"   object-storage.rst"},{"line_number":32,"context_line":"   key-managment.rst"},{"line_number":33,"context_line":"   messaging.rst"},{"line_number":34,"context_line":"   data-processing.rst"},{"line_number":35,"context_line":"   databases.rst"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_735d8677","line":32,"range":{"start_line":32,"start_character":7,"end_line":32,"end_character":16},"updated":"2017-04-12 11:00:11.000000000","message":"management* please rename the file :)","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"}],"security-guide/source/key-management.rst":[{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c493748c6fd15d665e4ec4efd4ce1042f3e9bd15","unresolved":false,"context_lines":[{"line_number":8,"context_line":"In all cases, these cryptographic capabilities require some sort of"},{"line_number":9,"context_line":"*key material* in order to operate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Key Management, often referred to as secrets management describes a"},{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"Hardware Security Modules (HSM). These are typically devices that have"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5f201791_82cd245f","line":11,"range":{"start_line":11,"start_character":44,"end_line":11,"end_character":45},"updated":"2017-06-21 12:28:36.000000000","message":"I agree it\u0027s often miss-named, however I think secrets management is a superset of key management and control of other sensitive materials... No objection to the text as is but maybe consider a stronger delineation between secrets and key management","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"83405d2bd356ed390e2fd43654eb560592c0fee2","unresolved":false,"context_lines":[{"line_number":8,"context_line":"In all cases, these cryptographic capabilities require some sort of"},{"line_number":9,"context_line":"*key material* in order to operate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Key Management, often referred to as secrets management describes a"},{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"Hardware Security Modules (HSM). These are typically devices that have"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_36571b5b","line":11,"range":{"start_line":11,"start_character":44,"end_line":11,"end_character":45},"in_reply_to":"5f201791_82cd245f","updated":"2017-07-18 13:30:36.000000000","message":"noted","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c493748c6fd15d665e4ec4efd4ce1042f3e9bd15","unresolved":false,"context_lines":[{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"Hardware Security Modules (HSM). These are typically devices that have"},{"line_number":15,"context_line":"been physically hardened against tampering. Physical HSM are often"},{"line_number":16,"context_line":"expensive to deploy and difficult to scale."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As technology has advanced, the number of secret things that need to be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"5f201791_020b548e","line":15,"range":{"start_line":15,"start_character":33,"end_line":15,"end_character":42},"updated":"2017-06-21 12:28:36.000000000","message":"Consider a reference to NIST ?","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"83405d2bd356ed390e2fd43654eb560592c0fee2","unresolved":false,"context_lines":[{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"Hardware Security Modules (HSM). These are typically devices that have"},{"line_number":15,"context_line":"been physically hardened against tampering. Physical HSM are often"},{"line_number":16,"context_line":"expensive to deploy and difficult to scale."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As technology has advanced, the number of secret things that need to be"}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_7659138c","line":15,"range":{"start_line":15,"start_character":33,"end_line":15,"end_character":42},"in_reply_to":"5f201791_020b548e","updated":"2017-07-18 13:30:36.000000000","message":"I could not find a decent NIST link, so used wikipedia. Happy to swap it out though if you have a source for me.","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Key Management"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Operators protect sensitive information in cloud deployments using"},{"line_number":6,"context_line":"various applications of cryptography. For example encrypting data at"},{"line_number":7,"context_line":"rest or signing an image to prove that it has not been tampered with."},{"line_number":8,"context_line":"In all cases, these cryptographic capabilities require some sort of"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0c447d1a","line":5,"range":{"start_line":5,"start_character":60,"end_line":5,"end_character":62},"updated":"2017-07-25 12:58:09.000000000","message":"by using *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Operators protect sensitive information in cloud deployments using"},{"line_number":6,"context_line":"various applications of cryptography. For example encrypting data at"},{"line_number":7,"context_line":"rest or signing an image to prove that it has not been tampered with."},{"line_number":8,"context_line":"In all cases, these cryptographic capabilities require some sort of"},{"line_number":9,"context_line":"*key material* in order to operate."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ec4a5925","line":6,"range":{"start_line":6,"start_character":42,"end_line":6,"end_character":49},"updated":"2017-07-25 12:58:09.000000000","message":"example, *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":8,"context_line":"In all cases, these cryptographic capabilities require some sort of"},{"line_number":9,"context_line":"*key material* in order to operate."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Key Management, often referred to as secrets management describes a"},{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"`Hardware Security Modules (HSM) \u003chttps://en.wikipedia.org/wiki/Hardware_security_module/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ac5451cb","line":11,"range":{"start_line":11,"start_character":53,"end_line":11,"end_character":56},"updated":"2017-07-25 12:58:09.000000000","message":"management, *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":12,"context_line":"group of technologies that are designed to protect key materials within"},{"line_number":13,"context_line":"a software system. Traditionally, key management involves deployment of"},{"line_number":14,"context_line":"`Hardware Security Modules (HSM) \u003chttps://en.wikipedia.org/wiki/Hardware_security_module/\u003e`_."},{"line_number":15,"context_line":"These are typically devices that have been physically hardened against"},{"line_number":16,"context_line":"tampering."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As technology has advanced, the number of secret things that need to be"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_4c63a5b2","line":15,"range":{"start_line":15,"start_character":6,"end_line":15,"end_character":27},"updated":"2017-07-25 12:58:09.000000000","message":"These devices have been physically *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":15,"context_line":"These are typically devices that have been physically hardened against"},{"line_number":16,"context_line":"tampering."},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As technology has advanced, the number of secret things that need to be"},{"line_number":19,"context_line":"protected has increased beyond key materials to include certificate"},{"line_number":20,"context_line":"pairs, API keys, system passwords, signing keys and so on. This increase"},{"line_number":21,"context_line":"has created a need for a more scalable approach to key management, and"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ec73797f","line":18,"range":{"start_line":18,"start_character":26,"end_line":18,"end_character":27},"updated":"2017-07-25 12:58:09.000000000","message":"remove","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":17,"context_line":""},{"line_number":18,"context_line":"As technology has advanced, the number of secret things that need to be"},{"line_number":19,"context_line":"protected has increased beyond key materials to include certificate"},{"line_number":20,"context_line":"pairs, API keys, system passwords, signing keys and so on. This increase"},{"line_number":21,"context_line":"has created a need for a more scalable approach to key management, and"},{"line_number":22,"context_line":"resulted in the creation of a number of software services that provide"},{"line_number":23,"context_line":"scalable dynamic key management. In this chapter we briefly describe the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_6c0549c2","line":20,"range":{"start_line":20,"start_character":46,"end_line":20,"end_character":47},"updated":"2017-07-25 12:58:09.000000000","message":"keys, *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":20,"context_line":"pairs, API keys, system passwords, signing keys and so on. This increase"},{"line_number":21,"context_line":"has created a need for a more scalable approach to key management, and"},{"line_number":22,"context_line":"resulted in the creation of a number of software services that provide"},{"line_number":23,"context_line":"scalable dynamic key management. In this chapter we briefly describe the"},{"line_number":24,"context_line":"services that exist today and focus on those that are able to be"},{"line_number":25,"context_line":"integrated into OpenStack clouds."},{"line_number":26,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ccf315e7","line":23,"range":{"start_line":23,"start_character":33,"end_line":23,"end_character":68},"updated":"2017-07-25 12:58:09.000000000","message":"This chapter describes the *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":21,"context_line":"has created a need for a more scalable approach to key management, and"},{"line_number":22,"context_line":"resulted in the creation of a number of software services that provide"},{"line_number":23,"context_line":"scalable dynamic key management. In this chapter we briefly describe the"},{"line_number":24,"context_line":"services that exist today and focus on those that are able to be"},{"line_number":25,"context_line":"integrated into OpenStack clouds."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ac0211b3","line":24,"range":{"start_line":24,"start_character":20,"end_line":24,"end_character":25},"updated":"2017-07-25 12:58:09.000000000","message":"today, and *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":21,"context_line":"has created a need for a more scalable approach to key management, and"},{"line_number":22,"context_line":"resulted in the creation of a number of software services that provide"},{"line_number":23,"context_line":"scalable dynamic key management. In this chapter we briefly describe the"},{"line_number":24,"context_line":"services that exist today and focus on those that are able to be"},{"line_number":25,"context_line":"integrated into OpenStack clouds."},{"line_number":26,"context_line":""},{"line_number":27,"context_line":""},{"line_number":28,"context_line":".. toctree::"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_4c3165a2","line":25,"range":{"start_line":24,"start_character":30,"end_line":25,"end_character":10},"updated":"2017-07-25 12:58:09.000000000","message":"I\u0027m not entirely too sure what this means exactly?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"a2a7f70802c54664d4b141a62416c649a67826c1","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Key Management"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Operators protect sensitive information in cloud deployments by using"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5f2577a7_1c2ff8f6","line":2,"range":{"start_line":2,"start_character":4,"end_line":2,"end_character":5},"updated":"2017-09-13 19:45:20.000000000","message":"oops, lowercase - sorry","commit_id":"b528cef6b4725ac11a558baf7128f917f80dacbc"}],"security-guide/source/key-management/barbican.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8739c435b5ddef4350157ea1101e595327b86c5a","unresolved":false,"context_lines":[{"line_number":5,"context_line":""},{"line_number":6,"context_line":"Integration with other projects"},{"line_number":7,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":8,"context_line":"Barbican is integrated with several OpenStack features, either directly or as a back end of Castellan."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Image signature verification"},{"line_number":11,"context_line":"----------------------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dfeb2761_073d162a","line":8,"range":{"start_line":8,"start_character":78,"end_line":8,"end_character":102},"updated":"2017-04-05 09:02:06.000000000","message":"all text must be wrapped at 79 chars or the build will fail","commit_id":"f23611deb123acb6aa468e5065d61e979ff86d40"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8739c435b5ddef4350157ea1101e595327b86c5a","unresolved":false,"context_lines":[{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Image signature verification"},{"line_number":11,"context_line":"----------------------------"},{"line_number":12,"context_line":"Verification of image signatures assures the user that uploaded them that the image has not been replaced or changed. The image signature verification feature uses Castellan. The image signature and certificate UUID is uploaded along with the image to the Glance image service. Glance can verify the signature after retrieving the certificate from the key manager. When the image is booted, the Nova compute service can also verify the signature after it retrieves the certificate from the key manager. For more details, see the `Trusted Images documentation"},{"line_number":13,"context_line":"\u003chttps://docs.openstack.org/security-guide/instance-management/security-services-for-instances.html#trusted-images/\u003e`__."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Volume encryption"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dfeb2761_871a46c9","line":12,"range":{"start_line":12,"start_character":0,"end_line":12,"end_character":1},"updated":"2017-04-05 09:02:06.000000000","message":"I recommend leaving a line break between the title, and the content. For consistency.","commit_id":"f23611deb123acb6aa468e5065d61e979ff86d40"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8739c435b5ddef4350157ea1101e595327b86c5a","unresolved":false,"context_lines":[{"line_number":10,"context_line":"Image signature verification"},{"line_number":11,"context_line":"----------------------------"},{"line_number":12,"context_line":"Verification of image signatures assures the user that uploaded them that the image has not been replaced or changed. The image signature verification feature uses Castellan. The image signature and certificate UUID is uploaded along with the image to the Glance image service. Glance can verify the signature after retrieving the certificate from the key manager. When the image is booted, the Nova compute service can also verify the signature after it retrieves the certificate from the key manager. For more details, see the `Trusted Images documentation"},{"line_number":13,"context_line":"\u003chttps://docs.openstack.org/security-guide/instance-management/security-services-for-instances.html#trusted-images/\u003e`__."},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Volume encryption"},{"line_number":16,"context_line":"-----------------"}],"source_content_type":"text/x-rst","patch_set":1,"id":"dfeb2761_4710bea8","line":13,"range":{"start_line":13,"start_character":118,"end_line":13,"end_character":119},"updated":"2017-04-05 09:02:06.000000000","message":"You only need a single underscore for links","commit_id":"f23611deb123acb6aa468e5065d61e979ff86d40"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"8739c435b5ddef4350157ea1101e595327b86c5a","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Secret Store Back-ends"},{"line_number":54,"context_line":"\u2028~~~~~~~~~~~~~~~~~~~~~~\u2028\u2028"},{"line_number":55,"context_line":"The Key Manager service has a plugin architecture that allows the deployer to\u2028 store secrets in one or more secret stores.  Secret stores can be software-based\u2028, such as a software token,  or hardware devices such as a hardware security \u2028module (HSM). \u2028\u2028This section describes the plugins that are currently available\u2028 and discusses the security posture of each one. Plugins are enabled and configured with settings in the ``/etc/barbican/barbican.conf`` configuration"},{"line_number":56,"context_line":"File.\u2028"},{"line_number":57,"context_line":""}],"source_content_type":"text/x-rst","patch_set":1,"id":"dfeb2761_6732a260","line":54,"range":{"start_line":54,"start_character":23,"end_line":54,"end_character":25},"updated":"2017-04-05 09:02:06.000000000","message":"remove the red, it\u0027s whitespace and causing the build to fail.","commit_id":"f23611deb123acb6aa468e5065d61e979ff86d40"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Barbican"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Integration with other projects"},{"line_number":6,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":7,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_33537e6d","line":4,"updated":"2017-04-12 11:00:11.000000000","message":"do you have an intro here for barbican?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Barbican"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Integration with other projects"},{"line_number":6,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"Barbican is integrated with several OpenStack features, either directly"},{"line_number":9,"context_line":"or as a back end of Castellan."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_d3c9f225","line":6,"range":{"start_line":5,"start_character":0,"end_line":6,"end_character":31},"updated":"2017-04-12 11:00:11.000000000","message":"probably don\u0027t need this","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":6,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":7,"context_line":""},{"line_number":8,"context_line":"Barbican is integrated with several OpenStack features, either directly"},{"line_number":9,"context_line":"or as a back end of Castellan."},{"line_number":10,"context_line":""},{"line_number":11,"context_line":"Image signature verification"},{"line_number":12,"context_line":"----------------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_93448a75","line":9,"range":{"start_line":9,"start_character":20,"end_line":9,"end_character":30},"updated":"2017-04-12 11:00:11.000000000","message":"link to Castellan please","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":11,"context_line":"Image signature verification"},{"line_number":12,"context_line":"----------------------------"},{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Verification of image signatures assures the user that uploaded them that"},{"line_number":15,"context_line":"the image has not been replaced or changed. The image signature verification"},{"line_number":16,"context_line":"feature uses Castellan. The image signature and certificate UUID is uploaded"},{"line_number":17,"context_line":"along with the image to the Image (glance) service. Glance can verify the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_13587a53","line":14,"range":{"start_line":14,"start_character":55,"end_line":14,"end_character":73},"updated":"2017-04-12 11:00:11.000000000","message":"remove","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Verification of image signatures assures the user that uploaded them that"},{"line_number":15,"context_line":"the image has not been replaced or changed. The image signature verification"},{"line_number":16,"context_line":"feature uses Castellan. The image signature and certificate UUID is uploaded"},{"line_number":17,"context_line":"along with the image to the Image (glance) service. Glance can verify the"},{"line_number":18,"context_line":"signature after retrieving the certificate from the key manager. When the"},{"line_number":19,"context_line":"image is booted, the Compute (nova) service can also verify the signature"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_93392af3","line":16,"range":{"start_line":16,"start_character":27,"end_line":16,"end_character":40},"updated":"2017-04-12 11:00:11.000000000","message":"Is this how? If so, make this clear.","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":13,"context_line":""},{"line_number":14,"context_line":"Verification of image signatures assures the user that uploaded them that"},{"line_number":15,"context_line":"the image has not been replaced or changed. The image signature verification"},{"line_number":16,"context_line":"feature uses Castellan. The image signature and certificate UUID is uploaded"},{"line_number":17,"context_line":"along with the image to the Image (glance) service. Glance can verify the"},{"line_number":18,"context_line":"signature after retrieving the certificate from the key manager. When the"},{"line_number":19,"context_line":"image is booted, the Compute (nova) service can also verify the signature"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_d3333213","line":16,"range":{"start_line":16,"start_character":8,"end_line":16,"end_character":23},"updated":"2017-04-12 11:00:11.000000000","message":"how does it use Castellan?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":25,"context_line":"-----------------"},{"line_number":26,"context_line":""},{"line_number":27,"context_line":"The volume encryption feature provides encryption of data-at-rest using"},{"line_number":28,"context_line":"Castellan. When a user creates an encrypted volume type and creates a"},{"line_number":29,"context_line":"volume using that type, the Block Storage (cinder) service requests the"},{"line_number":30,"context_line":"key manager creates a key to be associated with that volume. When the volume"},{"line_number":31,"context_line":"is attached to an instance, nova compute retrieves the key."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_330b7e2a","line":28,"range":{"start_line":28,"start_character":51,"end_line":28,"end_character":55},"updated":"2017-04-12 11:00:11.000000000","message":"type, *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":28,"context_line":"Castellan. When a user creates an encrypted volume type and creates a"},{"line_number":29,"context_line":"volume using that type, the Block Storage (cinder) service requests the"},{"line_number":30,"context_line":"key manager creates a key to be associated with that volume. When the volume"},{"line_number":31,"context_line":"is attached to an instance, nova compute retrieves the key."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"* https://docs.openstack.org/security-guide/tenant-data/data-encryption.html"},{"line_number":34,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_3ecd8584","line":31,"range":{"start_line":31,"start_character":33,"end_line":31,"end_character":41},"updated":"2017-04-12 11:00:11.000000000","message":"remove. Unless you mean nova-compute","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":30,"context_line":"key manager creates a key to be associated with that volume. When the volume"},{"line_number":31,"context_line":"is attached to an instance, nova compute retrieves the key."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"* https://docs.openstack.org/security-guide/tenant-data/data-encryption.html"},{"line_number":34,"context_line":""},{"line_number":35,"context_line":"* https://docs.openstack.org/ocata/config-reference/block-storage/volume-encryption.html"},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Ephemeral disk encryption"},{"line_number":38,"context_line":"-------------------------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b31f8e6a","line":35,"range":{"start_line":33,"start_character":2,"end_line":35,"end_character":26},"updated":"2017-04-12 11:00:11.000000000","message":"I don\u0027t know what these links are for?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Ephemeral disk encryption"},{"line_number":38,"context_line":"-------------------------"},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"Sahara"},{"line_number":41,"context_line":"------"},{"line_number":42,"context_line":"Sahara generates and stores several passwords during the course of operation."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_bea635c0","line":39,"updated":"2017-04-12 11:00:11.000000000","message":"Is this empty for a reason?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Sahara"},{"line_number":41,"context_line":"------"},{"line_number":42,"context_line":"Sahara generates and stores several passwords during the course of operation."},{"line_number":43,"context_line":"To harden sahara’s usage of passwords it can be instructed to use an external"},{"line_number":44,"context_line":"key manager for storage and retrieval of these secrets. To enable this"},{"line_number":45,"context_line":"feature there must first be an OpenStack Key Manager service deployed"},{"line_number":46,"context_line":"within the stack."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_9ea93191","line":43,"range":{"start_line":43,"start_character":27,"end_line":43,"end_character":37},"updated":"2017-04-12 11:00:11.000000000","message":"passwords, *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":40,"context_line":"Sahara"},{"line_number":41,"context_line":"------"},{"line_number":42,"context_line":"Sahara generates and stores several passwords during the course of operation."},{"line_number":43,"context_line":"To harden sahara’s usage of passwords it can be instructed to use an external"},{"line_number":44,"context_line":"key manager for storage and retrieval of these secrets. To enable this"},{"line_number":45,"context_line":"feature there must first be an OpenStack Key Manager service deployed"},{"line_number":46,"context_line":"within the stack."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_5e972949","line":43,"range":{"start_line":43,"start_character":38,"end_line":43,"end_character":40},"updated":"2017-04-12 11:00:11.000000000","message":"what is \u0027it\u0027 here?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Sahara generates and stores several passwords during the course of operation."},{"line_number":43,"context_line":"To harden sahara’s usage of passwords it can be instructed to use an external"},{"line_number":44,"context_line":"key manager for storage and retrieval of these secrets. To enable this"},{"line_number":45,"context_line":"feature there must first be an OpenStack Key Manager service deployed"},{"line_number":46,"context_line":"within the stack."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"With a Key Manager service deployed on the stack, sahara must be configured to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_be8f5528","line":45,"range":{"start_line":45,"start_character":0,"end_line":45,"end_character":7},"updated":"2017-04-12 11:00:11.000000000","message":"feature, there must *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":42,"context_line":"Sahara generates and stores several passwords during the course of operation."},{"line_number":43,"context_line":"To harden sahara’s usage of passwords it can be instructed to use an external"},{"line_number":44,"context_line":"key manager for storage and retrieval of these secrets. To enable this"},{"line_number":45,"context_line":"feature there must first be an OpenStack Key Manager service deployed"},{"line_number":46,"context_line":"within the stack."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"With a Key Manager service deployed on the stack, sahara must be configured to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_7e854d06","line":45,"range":{"start_line":45,"start_character":31,"end_line":45,"end_character":52},"updated":"2017-04-12 11:00:11.000000000","message":"link","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":45,"context_line":"feature there must first be an OpenStack Key Manager service deployed"},{"line_number":46,"context_line":"within the stack."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"With a Key Manager service deployed on the stack, sahara must be configured to"},{"line_number":49,"context_line":"enable the external storage of secrets. Sahara uses the castellan library to"},{"line_number":50,"context_line":"interface with the OpenStack Key Manager service. This library provides"},{"line_number":51,"context_line":"configurable access to a key manager. For detail"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_3e7b4528","line":48,"range":{"start_line":48,"start_character":7,"end_line":48,"end_character":18},"updated":"2017-04-12 11:00:11.000000000","message":"should this be capitalised?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":46,"context_line":"within the stack."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"With a Key Manager service deployed on the stack, sahara must be configured to"},{"line_number":49,"context_line":"enable the external storage of secrets. Sahara uses the castellan library to"},{"line_number":50,"context_line":"interface with the OpenStack Key Manager service. This library provides"},{"line_number":51,"context_line":"configurable access to a key manager. For detail"},{"line_number":52,"context_line":"see: https://docs.openstack.org/developer/sahara/userdoc/advanced.configuration.guide.html#external-key-manager-usage"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_de91f948","line":49,"range":{"start_line":49,"start_character":56,"end_line":49,"end_character":65},"updated":"2017-04-12 11:00:11.000000000","message":"Castellan* ?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":48,"context_line":"With a Key Manager service deployed on the stack, sahara must be configured to"},{"line_number":49,"context_line":"enable the external storage of secrets. Sahara uses the castellan library to"},{"line_number":50,"context_line":"interface with the OpenStack Key Manager service. This library provides"},{"line_number":51,"context_line":"configurable access to a key manager. For detail"},{"line_number":52,"context_line":"see: https://docs.openstack.org/developer/sahara/userdoc/advanced.configuration.guide.html#external-key-manager-usage"},{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Magnum"},{"line_number":55,"context_line":"------"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_7e9aed61","line":52,"range":{"start_line":51,"start_character":38,"end_line":52,"end_character":4},"updated":"2017-04-12 11:00:11.000000000","message":"For more information, see the `Sahara advanced configuration guide \u003clink\u003e`_.","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":53,"context_line":""},{"line_number":54,"context_line":"Magnum"},{"line_number":55,"context_line":"------"},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Octavia/LBaaS"},{"line_number":58,"context_line":"-------------"},{"line_number":59,"context_line":"The LBaaS (Load Balancer as a Service) feature of Neutron and the Octavia"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_7e366d53","line":56,"updated":"2017-04-12 11:00:11.000000000","message":"Should this have content? Or is this a section heading?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Octavia/LBaaS"},{"line_number":58,"context_line":"-------------"},{"line_number":59,"context_line":"The LBaaS (Load Balancer as a Service) feature of Neutron and the Octavia"},{"line_number":60,"context_line":"project need certificates and their private keys to provide load balancing for"},{"line_number":61,"context_line":"TLS connections. They can use Barbican to store this sensitive information."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_fe415da7","line":59,"range":{"start_line":59,"start_character":25,"end_line":59,"end_character":37},"updated":"2017-04-12 11:00:11.000000000","message":"Load-Balancer-as-a-Service","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":56,"context_line":""},{"line_number":57,"context_line":"Octavia/LBaaS"},{"line_number":58,"context_line":"-------------"},{"line_number":59,"context_line":"The LBaaS (Load Balancer as a Service) feature of Neutron and the Octavia"},{"line_number":60,"context_line":"project need certificates and their private keys to provide load balancing for"},{"line_number":61,"context_line":"TLS connections. They can use Barbican to store this sensitive information."},{"line_number":62,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_be1995d7","line":59,"range":{"start_line":59,"start_character":50,"end_line":59,"end_character":57},"updated":"2017-04-12 11:00:11.000000000","message":"Networking (neutron( service","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":60,"context_line":"project need certificates and their private keys to provide load balancing for"},{"line_number":61,"context_line":"TLS connections. They can use Barbican to store this sensitive information."},{"line_number":62,"context_line":""},{"line_number":63,"context_line":"* https://wiki.openstack.org/wiki/Network/LBaaS/docs/how-to-create-tls-loadbalancer"},{"line_number":64,"context_line":"* https://docs.openstack.org/developer/octavia/guides/basic-cookbook.html#deploy-a-tls-terminated-https-load-balancer"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Swift"},{"line_number":67,"context_line":"-----"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_1e2081f6","line":64,"range":{"start_line":63,"start_character":2,"end_line":64,"end_character":7},"updated":"2017-04-12 11:00:11.000000000","message":"what are these for?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":63,"context_line":"* https://wiki.openstack.org/wiki/Network/LBaaS/docs/how-to-create-tls-loadbalancer"},{"line_number":64,"context_line":"* https://docs.openstack.org/developer/octavia/guides/basic-cookbook.html#deploy-a-tls-terminated-https-load-balancer"},{"line_number":65,"context_line":""},{"line_number":66,"context_line":"Swift"},{"line_number":67,"context_line":"-----"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Barbican role based cccess control"},{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_9e8131c6","line":67,"range":{"start_line":66,"start_character":0,"end_line":67,"end_character":5},"updated":"2017-04-12 11:00:11.000000000","message":"ditto, what\u0027s this for?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":66,"context_line":"Swift"},{"line_number":67,"context_line":"-----"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"Barbican role based cccess control"},{"line_number":70,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":71,"context_line":""},{"line_number":72,"context_line":"Secret store back ends"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_fe1a7dc3","line":69,"range":{"start_line":69,"start_character":20,"end_line":69,"end_character":27},"updated":"2017-04-12 11:00:11.000000000","message":"oops this was me, access*","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":81,"context_line":"configuration file."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"There are two types of plugins: crypto plugins and secret store plugins."},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"Crypto plugins"},{"line_number":86,"context_line":"--------------"},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Crypto plugins store secrets as encrypted blobs within the Barbican database."},{"line_number":89,"context_line":"The plugin is invoked to encrypt the secret, on secret storage, and decrypt"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_fe6f1d25","line":86,"range":{"start_line":84,"start_character":0,"end_line":86,"end_character":14},"updated":"2017-04-12 11:00:11.000000000","message":"probably don\u0027t need this, can just make it a list","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":96,"context_line":"The simple crypto plugin is configured by default in ``barbican.conf``. This"},{"line_number":97,"context_line":"plugin uses single symmetric key (kek - or \u0027key encryption key\u0027)- which is"},{"line_number":98,"context_line":"stored in plain text in the ``barbican.conf`` file to encrypt and decrypt all"},{"line_number":99,"context_line":"secrets. As such, this plugin is completely insecure and is only suitable for"},{"line_number":100,"context_line":"development and testing, it must not be used for production deployments."},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"PKCS#11 crypto plugin"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_9ecff127","line":99,"range":{"start_line":99,"start_character":9,"end_line":99,"end_character":17},"updated":"2017-04-12 11:00:11.000000000","message":"Remove","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":131,"context_line":"Dogtag plugin"},{"line_number":132,"context_line":"-------------"},{"line_number":133,"context_line":""},{"line_number":134,"context_line":"The Dogtag secret store plugin is used to communicate with Dogtag."},{"line_number":135,"context_line":"Dogtag is the upstream project corresponding to the Red Hat Certificate System,"},{"line_number":136,"context_line":"a Common Criteria/FIPS certified PKI solution that contains a Certificate"},{"line_number":137,"context_line":"Manager (CA) and a Key Recovery Authority (KRA) which is used to securely store"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_def21970","line":134,"range":{"start_line":134,"start_character":59,"end_line":134,"end_character":65},"updated":"2017-04-12 11:00:11.000000000","message":"link to dogtag","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":142,"context_line":"not wish to use a HSM. The KRA is a component of FreeIPA, therefore it is"},{"line_number":143,"context_line":"possible to configure the plugin with a FreeIPA server. More detailed"},{"line_number":144,"context_line":"instructions on how to set up Barbican with FreeIPA are"},{"line_number":145,"context_line":"provided `here \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Threat analysis"},{"line_number":148,"context_line":"~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_de97b9eb","line":145,"range":{"start_line":145,"start_character":8,"end_line":145,"end_character":15},"updated":"2017-04-12 11:00:11.000000000","message":"try not to use \u0027here\u0027 - as it tends to break builds if it\u0027s used too much. Try and rephrase the sentence so you\u0027re using the title of the blog","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":147,"context_line":"Threat analysis"},{"line_number":148,"context_line":"~~~~~~~~~~~~~~~"},{"line_number":149,"context_line":""},{"line_number":150,"context_line":"The barbican team worked with the OpenStack Security Project to perform a"},{"line_number":151,"context_line":"security review of a best practise Barbican deployment. The objective of"},{"line_number":152,"context_line":"the security review is to identify weaknesses and defects in the design"},{"line_number":153,"context_line":"and architecture of services, and propose controls or fixes to resolve"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_be9ab510","line":150,"range":{"start_line":150,"start_character":4,"end_line":150,"end_character":5},"updated":"2017-04-12 11:00:11.000000000","message":"Barbican*","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":154,"context_line":"these issues."},{"line_number":155,"context_line":""},{"line_number":156,"context_line":"The barbican threat analysis identified eight security findings and two"},{"line_number":157,"context_line":"recommendations to improve the security of a barbican deployment. These"},{"line_number":158,"context_line":"results can be reviewed in the security analysis repo, along with the"},{"line_number":159,"context_line":"barbican architecture diagram and architecture description page."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_5e8ba9c1","line":157,"range":{"start_line":157,"start_character":45,"end_line":157,"end_character":46},"updated":"2017-04-12 11:00:11.000000000","message":"Barbican*","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":156,"context_line":"The barbican threat analysis identified eight security findings and two"},{"line_number":157,"context_line":"recommendations to improve the security of a barbican deployment. These"},{"line_number":158,"context_line":"results can be reviewed in the security analysis repo, along with the"},{"line_number":159,"context_line":"barbican architecture diagram and architecture description page."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_3e86a5ba","line":159,"updated":"2017-04-12 11:00:11.000000000","message":"ditto","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c493748c6fd15d665e4ec4efd4ce1042f3e9bd15","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Barbican is a REST API designed for the secure storage, provisioning and"},{"line_number":6,"context_line":"management of secrets such as passwords, encryption keys and X.509"},{"line_number":7,"context_line":"Certificates. It is aimed at being useful for all environments,"},{"line_number":8,"context_line":"including large ephemeral Clouds."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Barbican is integrated with several OpenStack features, either directly"},{"line_number":11,"context_line":"or as a back end of `Castellan \u003chttps://wiki.openstack.org/wiki/Castellan\u003e`_."}],"source_content_type":"text/x-rst","patch_set":4,"id":"5f201791_c2879cd7","line":8,"updated":"2017-06-21 12:28:36.000000000","message":"The sections below detail capabilities that are possible because of Barbican but not things that Barbican actually does: I.e Barbican doesn\u0027t encrypt volumes. \n\nThat being the case I think the intro here needs some work","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"83405d2bd356ed390e2fd43654eb560592c0fee2","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Barbican is a REST API designed for the secure storage, provisioning and"},{"line_number":6,"context_line":"management of secrets such as passwords, encryption keys and X.509"},{"line_number":7,"context_line":"Certificates. It is aimed at being useful for all environments,"},{"line_number":8,"context_line":"including large ephemeral Clouds."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Barbican is integrated with several OpenStack features, either directly"},{"line_number":11,"context_line":"or as a back end of `Castellan \u003chttps://wiki.openstack.org/wiki/Castellan\u003e`_."}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_165e5f43","line":8,"in_reply_to":"5f201791_c2879cd7","updated":"2017-07-18 13:30:36.000000000","message":"Agree, added some text to state the below are all examples of features that can be leveraged with barbican.","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Barbican is a REST API designed for the secure storage, provisioning and"},{"line_number":6,"context_line":"management of secrets such as passwords, encryption keys and X.509"},{"line_number":7,"context_line":"Certificates. It is aimed at being useful for all environments,"},{"line_number":8,"context_line":"including large ephemeral Clouds."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Barbican is integrated with several OpenStack features, either directly"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_2cb621fc","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":1},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Barbican is a REST API designed for the secure storage, provisioning and"},{"line_number":6,"context_line":"management of secrets such as passwords, encryption keys and X.509"},{"line_number":7,"context_line":"Certificates. It is aimed at being useful for all environments,"},{"line_number":8,"context_line":"including large ephemeral Clouds."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"Barbican is integrated with several OpenStack features, either directly"},{"line_number":11,"context_line":"or as a back end of `Castellan \u003chttps://wiki.openstack.org/wiki/Castellan\u003e`_."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0cb91de8","line":8,"range":{"start_line":8,"start_character":26,"end_line":8,"end_character":27},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":16,"context_line":"Image signature verification"},{"line_number":17,"context_line":"----------------------------"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Verification of image signatures assures the an image is not replaced or"},{"line_number":20,"context_line":"changed since the time of original user upload. The image signature"},{"line_number":21,"context_line":"verification feature uses Castellan as its Key Manager for storing"},{"line_number":22,"context_line":"cryptographic signatures . An image signature and certificate UUID is"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_acc9f178","line":19,"range":{"start_line":19,"start_character":41,"end_line":19,"end_character":44},"updated":"2017-07-25 12:58:09.000000000","message":"that an *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":17,"context_line":"----------------------------"},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Verification of image signatures assures the an image is not replaced or"},{"line_number":20,"context_line":"changed since the time of original user upload. The image signature"},{"line_number":21,"context_line":"verification feature uses Castellan as its Key Manager for storing"},{"line_number":22,"context_line":"cryptographic signatures . An image signature and certificate UUID is"},{"line_number":23,"context_line":"uploaded along with the image to the Image (glance) service. Glance can"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_4ca4c5b9","line":20,"range":{"start_line":20,"start_character":35,"end_line":20,"end_character":39},"updated":"2017-07-25 12:58:09.000000000","message":"remove","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":18,"context_line":""},{"line_number":19,"context_line":"Verification of image signatures assures the an image is not replaced or"},{"line_number":20,"context_line":"changed since the time of original user upload. The image signature"},{"line_number":21,"context_line":"verification feature uses Castellan as its Key Manager for storing"},{"line_number":22,"context_line":"cryptographic signatures . An image signature and certificate UUID is"},{"line_number":23,"context_line":"uploaded along with the image to the Image (glance) service. Glance can"},{"line_number":24,"context_line":"verify the signature after retrieving the certificate from the key"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_2cabc189","line":21,"range":{"start_line":21,"start_character":43,"end_line":21,"end_character":48},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":19,"context_line":"Verification of image signatures assures the an image is not replaced or"},{"line_number":20,"context_line":"changed since the time of original user upload. The image signature"},{"line_number":21,"context_line":"verification feature uses Castellan as its Key Manager for storing"},{"line_number":22,"context_line":"cryptographic signatures . An image signature and certificate UUID is"},{"line_number":23,"context_line":"uploaded along with the image to the Image (glance) service. Glance can"},{"line_number":24,"context_line":"verify the signature after retrieving the certificate from the key"},{"line_number":25,"context_line":"manager. When the image is booted, the Compute  service (nova) verifys"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0caebd97","line":22,"range":{"start_line":22,"start_character":24,"end_line":22,"end_character":25},"updated":"2017-07-25 12:58:09.000000000","message":"remove space","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":20,"context_line":"changed since the time of original user upload. The image signature"},{"line_number":21,"context_line":"verification feature uses Castellan as its Key Manager for storing"},{"line_number":22,"context_line":"cryptographic signatures . An image signature and certificate UUID is"},{"line_number":23,"context_line":"uploaded along with the image to the Image (glance) service. Glance can"},{"line_number":24,"context_line":"verify the signature after retrieving the certificate from the key"},{"line_number":25,"context_line":"manager. When the image is booted, the Compute  service (nova) verifys"},{"line_number":26,"context_line":"the signature after it retrieves the certificate from the key manager."},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc8f952c","line":24,"range":{"start_line":23,"start_character":68,"end_line":24,"end_character":6},"updated":"2017-07-25 12:58:09.000000000","message":"Glance verifies*","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":49,"context_line":"be accessed on this disk, and vestigial information could remain after"},{"line_number":50,"context_line":"the disk is unmounted."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The Ephemeral disk encryption feature, can interface with a Key"},{"line_number":53,"context_line":"management service through a secure wrapper and support data isolation"},{"line_number":54,"context_line":"by providing ephemeral disk encryption keys on a per-tenant basis."},{"line_number":55,"context_line":"Back-end key storage is recommended for enhanced security (for example,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0c87dd11","line":52,"range":{"start_line":52,"start_character":4,"end_line":52,"end_character":5},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":49,"context_line":"be accessed on this disk, and vestigial information could remain after"},{"line_number":50,"context_line":"the disk is unmounted."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The Ephemeral disk encryption feature, can interface with a Key"},{"line_number":53,"context_line":"management service through a secure wrapper and support data isolation"},{"line_number":54,"context_line":"by providing ephemeral disk encryption keys on a per-tenant basis."},{"line_number":55,"context_line":"Back-end key storage is recommended for enhanced security (for example,"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc78b52c","line":52,"range":{"start_line":52,"start_character":60,"end_line":52,"end_character":62},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":49,"context_line":"be accessed on this disk, and vestigial information could remain after"},{"line_number":50,"context_line":"the disk is unmounted."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The Ephemeral disk encryption feature, can interface with a Key"},{"line_number":53,"context_line":"management service through a secure wrapper and support data isolation"},{"line_number":54,"context_line":"by providing ephemeral disk encryption keys on a per-tenant basis."},{"line_number":55,"context_line":"Back-end key storage is recommended for enhanced security (for example,"},{"line_number":56,"context_line":"an HSM or KMIP server can be used as a barbican back-end secret store)."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc9d5558","line":53,"range":{"start_line":52,"start_character":60,"end_line":53,"end_character":18},"updated":"2017-07-25 12:58:09.000000000","message":"ah - now you\u0027re referring to the service - you need to introduce Barbican as the Key management service and be consistent throughout","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":62,"context_line":"------"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Sahara generates and stores several passwords during the course of"},{"line_number":65,"context_line":"operation.  To harden sahara’s usage of passwords it can be instructed"},{"line_number":66,"context_line":"to use an external key manager for storage and retrieval of these"},{"line_number":67,"context_line":"secrets. To enable this feature, there must first be an OpenStack Key"},{"line_number":68,"context_line":"Manager service deployed within the stack."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ccc6754a","line":65,"range":{"start_line":65,"start_character":40,"end_line":65,"end_character":49},"updated":"2017-07-25 12:58:09.000000000","message":"passwords, *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":62,"context_line":"------"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Sahara generates and stores several passwords during the course of"},{"line_number":65,"context_line":"operation.  To harden sahara’s usage of passwords it can be instructed"},{"line_number":66,"context_line":"to use an external key manager for storage and retrieval of these"},{"line_number":67,"context_line":"secrets. To enable this feature, there must first be an OpenStack Key"},{"line_number":68,"context_line":"Manager service deployed within the stack."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_2cb2a1e7","line":65,"range":{"start_line":65,"start_character":11,"end_line":65,"end_character":12},"updated":"2017-07-25 12:58:09.000000000","message":"remove extra space","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":62,"context_line":"------"},{"line_number":63,"context_line":""},{"line_number":64,"context_line":"Sahara generates and stores several passwords during the course of"},{"line_number":65,"context_line":"operation.  To harden sahara’s usage of passwords it can be instructed"},{"line_number":66,"context_line":"to use an external key manager for storage and retrieval of these"},{"line_number":67,"context_line":"secrets. To enable this feature, there must first be an OpenStack Key"},{"line_number":68,"context_line":"Manager service deployed within the stack."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_acc5713e","line":65,"range":{"start_line":65,"start_character":50,"end_line":65,"end_character":59},"updated":"2017-07-25 12:58:09.000000000","message":"what is \u0027it\u0027 here?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":64,"context_line":"Sahara generates and stores several passwords during the course of"},{"line_number":65,"context_line":"operation.  To harden sahara’s usage of passwords it can be instructed"},{"line_number":66,"context_line":"to use an external key manager for storage and retrieval of these"},{"line_number":67,"context_line":"secrets. To enable this feature, there must first be an OpenStack Key"},{"line_number":68,"context_line":"Manager service deployed within the stack."},{"line_number":69,"context_line":""},{"line_number":70,"context_line":"With a Key Manager service deployed on the stack, sahara must be"},{"line_number":71,"context_line":"configured to enable the external storage of secrets. Sahara uses the"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_8cd50de8","line":68,"range":{"start_line":67,"start_character":50,"end_line":68,"end_character":42},"updated":"2017-07-25 12:58:09.000000000","message":"To enable this feature, first enable the pre-deployed OpenStack Key Manager service within the stack.","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":69,"context_line":""},{"line_number":70,"context_line":"With a Key Manager service deployed on the stack, sahara must be"},{"line_number":71,"context_line":"configured to enable the external storage of secrets. Sahara uses the"},{"line_number":72,"context_line":"Castellan library to interface with the OpenStack Key Manager service."},{"line_number":73,"context_line":"This library provides configurable access to a key manager."},{"line_number":74,"context_line":""},{"line_number":75,"context_line":"For more information, see the `Sahara advanced configuration guide \u003chttps://docs.openstack.org/developer/sahara/userdoc/advanced.configuration.guide.html#external-key-manager-usage\u003e`_."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_acf3319e","line":72,"range":{"start_line":72,"start_character":40,"end_line":72,"end_character":49},"updated":"2017-07-25 12:58:09.000000000","message":"you probably don\u0027t need to keep mentioning that it\u0027s an openstack key manager service?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":77,"context_line":"Magnum"},{"line_number":78,"context_line":"------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"pending"},{"line_number":81,"context_line":""},{"line_number":82,"context_line":"Octavia/LBaaS"},{"line_number":83,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc39d53f","line":80,"range":{"start_line":80,"start_character":0,"end_line":80,"end_character":7},"updated":"2017-07-25 12:58:09.000000000","message":".. TODO:: write magnum section (just the appropriate mark up)","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":82,"context_line":"Octavia/LBaaS"},{"line_number":83,"context_line":"-------------"},{"line_number":84,"context_line":""},{"line_number":85,"context_line":"The LBaaS (Load-Balancer-as-a-Service) feature of Neutron and the"},{"line_number":86,"context_line":"Octavia project need certificates and their private keys to provide"},{"line_number":87,"context_line":"load balancing for TLS connections. Barbican can be used to store this"},{"line_number":88,"context_line":"sensitive information."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_4c1725a5","line":85,"range":{"start_line":85,"start_character":50,"end_line":85,"end_character":51},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase \"of the Networking service (neutron)\"","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":92,"context_line":"Swift"},{"line_number":93,"context_line":"-----"},{"line_number":94,"context_line":""},{"line_number":95,"context_line":"pending"},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"Barbican role based cccess control"},{"line_number":98,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0c111dad","line":95,"range":{"start_line":95,"start_character":0,"end_line":95,"end_character":7},"updated":"2017-07-25 12:58:09.000000000","message":"ditto","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":97,"context_line":"Barbican role based cccess control"},{"line_number":98,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"pending"},{"line_number":101,"context_line":""},{"line_number":102,"context_line":"Secret store back ends"},{"line_number":103,"context_line":"~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc22f501","line":100,"range":{"start_line":100,"start_character":0,"end_line":100,"end_character":7},"updated":"2017-07-25 12:58:09.000000000","message":"ditto","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":115,"context_line":"Crypto plugins"},{"line_number":116,"context_line":"--------------"},{"line_number":117,"context_line":""},{"line_number":118,"context_line":"Crypto plugins store secrets as encrypted blobs within the Barbican"},{"line_number":119,"context_line":"database. The plugin is invoked to encrypt the secret, on secret"},{"line_number":120,"context_line":"storage, and decrypt the secret, on secret retrieval. There are two"},{"line_number":121,"context_line":"flavors of storage plugins currently available: the Simple Crypto plugin"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_4c7cc5ea","line":118,"range":{"start_line":118,"start_character":59,"end_line":118,"end_character":67},"updated":"2017-07-25 12:58:09.000000000","message":"You switch between using \u0027barbican\u0027 and \u0027key management service\u0027 - please be consistent.","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":121,"context_line":"flavors of storage plugins currently available: the Simple Crypto plugin"},{"line_number":122,"context_line":"and the PKCS#11 crypto plugin."},{"line_number":123,"context_line":""},{"line_number":124,"context_line":"Simple crypto plugin"},{"line_number":125,"context_line":"--------------------"},{"line_number":126,"context_line":""},{"line_number":127,"context_line":"The simple crypto plugin is configured by default in ``barbican.conf``."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_6c62e940","line":124,"range":{"start_line":124,"start_character":0,"end_line":124,"end_character":6},"updated":"2017-07-25 12:58:09.000000000","message":"is it really called \u0027simple crypto plugin\u0027?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":136,"context_line":""},{"line_number":137,"context_line":"The PKCS#11 crypto plugin can be used to interface with a Hardware"},{"line_number":138,"context_line":"Security Module (HSM) using the PKCS#11 protocol. Secrets are encrypted"},{"line_number":139,"context_line":"(and decrypted on retrieval) by a project specific Key Encryption Key"},{"line_number":140,"context_line":"(KEK) which resides in the HSM. Since a different KEK is used for each"},{"line_number":141,"context_line":"project, and since the KEKs are stored inside an HSM (instead of in"},{"line_number":142,"context_line":"plaintext in the configuration file) the PKCS#11 plugin is much more"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_2c5ce17c","line":139,"range":{"start_line":139,"start_character":51,"end_line":139,"end_character":69},"updated":"2017-07-25 12:58:09.000000000","message":"lowercase","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"a2a7f70802c54664d4b141a62416c649a67826c1","unresolved":false,"context_lines":[{"line_number":49,"context_line":"be accessed on this disk, and vestigial information could remain after"},{"line_number":50,"context_line":"the disk is unmounted."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The Ephemeral disk encryption feature, can interface with a Key"},{"line_number":53,"context_line":"management service through a secure wrapper and support data isolation"},{"line_number":54,"context_line":"by providing ephemeral disk encryption keys on a per-tenant basis."},{"line_number":55,"context_line":"Back-end key storage is recommended for enhanced security (for example,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5f2577a7_bc6d8433","line":52,"range":{"start_line":52,"start_character":1,"end_line":52,"end_character":63},"updated":"2017-09-13 19:45:20.000000000","message":"the comments that I made on patch set 7 from here down have not been addressed :) I\u0027m happy to update those comments if you\u0027d like!","commit_id":"b528cef6b4725ac11a558baf7128f917f80dacbc"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"b2c734996090562c6a6acf6a3459286e1c26fae9","unresolved":false,"context_lines":[{"line_number":49,"context_line":"be accessed on this disk, and vestigial information could remain after"},{"line_number":50,"context_line":"the disk is unmounted."},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"The Ephemeral disk encryption feature, can interface with a Key"},{"line_number":53,"context_line":"management service through a secure wrapper and support data isolation"},{"line_number":54,"context_line":"by providing ephemeral disk encryption keys on a per-tenant basis."},{"line_number":55,"context_line":"Back-end key storage is recommended for enhanced security (for example,"}],"source_content_type":"text/x-rst","patch_set":8,"id":"5f2577a7_774977ce","line":52,"range":{"start_line":52,"start_character":1,"end_line":52,"end_character":63},"in_reply_to":"5f2577a7_bc6d8433","updated":"2017-09-13 20:25:44.000000000","message":"no worries, these are coming in the next patch (as we just changed up the layout @ the PTG discussion).","commit_id":"b528cef6b4725ac11a558baf7128f917f80dacbc"}],"security-guide/source/key-management/case-studies.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Case studies"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Earlier in :doc:`../introduction/introduction-to-case-studies` we"},{"line_number":6,"context_line":"introduced the Alice and Bob case studies where Alice is deploying a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_fea4bd4c","line":3,"range":{"start_line":1,"start_character":0,"end_line":3,"end_character":12},"updated":"2017-04-12 11:00:11.000000000","message":"This case study entirely new and shiny and verified and workable? Cause I just moved all the case studies into a new folder outside of the doc/source so we can verify them.","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Alice\u0027s private cloud"},{"line_number":13,"context_line":"~~~~~~~~~~~~~~~~~~~~~"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"Alice chooses the PKCS#11 crypto plugin for her barbican deployment."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"She only has a small HSM that does not have enough capacity to store"},{"line_number":18,"context_line":"all her cloud\u0027s secrets.  She does not want to store the KEK in plaintext"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_5e7969c5","line":15,"range":{"start_line":15,"start_character":48,"end_line":15,"end_character":49},"updated":"2017-04-12 11:00:11.000000000","message":"Barbican*","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":15,"context_line":"Alice chooses the PKCS#11 crypto plugin for her barbican deployment."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"She only has a small HSM that does not have enough capacity to store"},{"line_number":18,"context_line":"all her cloud\u0027s secrets.  She does not want to store the KEK in plaintext"},{"line_number":19,"context_line":"in a configuration file, so the perfect compromise is the PKCS#11 plugin."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"She further hardens her deployment by setting strict file permissions"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_1e7f61ab","line":18,"range":{"start_line":18,"start_character":25,"end_line":18,"end_character":27},"updated":"2017-04-12 11:00:11.000000000","message":"remove double space","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":19,"context_line":"in a configuration file, so the perfect compromise is the PKCS#11 plugin."},{"line_number":20,"context_line":""},{"line_number":21,"context_line":"She further hardens her deployment by setting strict file permissions"},{"line_number":22,"context_line":"on her barbican configuration files."},{"line_number":23,"context_line":""},{"line_number":24,"context_line":""},{"line_number":25,"context_line":"Bob\u0027s public cloud"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_de4e9995","line":22,"range":{"start_line":22,"start_character":7,"end_line":22,"end_character":8},"updated":"2017-04-12 11:00:11.000000000","message":"Barbican","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":25,"context_line":"Bob\u0027s public cloud"},{"line_number":26,"context_line":"~~~~~~~~~~~~~~~~~~"},{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Bob already has a deployment of Dogtag in his data center.  He wants to"},{"line_number":29,"context_line":"leverage this investment to ensure that all of his client\u0027s key are"},{"line_number":30,"context_line":"securely protected.  He chooses to use the Dogtag plugin to store his"},{"line_number":31,"context_line":"cloud\u0027s secrets in Dogtag."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_be519538","line":28,"range":{"start_line":28,"start_character":59,"end_line":28,"end_character":60},"updated":"2017-04-12 11:00:11.000000000","message":"remove double space","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"Bob already has a deployment of Dogtag in his data center.  He wants to"},{"line_number":29,"context_line":"leverage this investment to ensure that all of his client\u0027s key are"},{"line_number":30,"context_line":"securely protected.  He chooses to use the Dogtag plugin to store his"},{"line_number":31,"context_line":"cloud\u0027s secrets in Dogtag."},{"line_number":32,"context_line":""},{"line_number":33,"context_line":"He also further hardens his deployment by setting strict file permissions"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_7e478d78","line":30,"range":{"start_line":30,"start_character":20,"end_line":30,"end_character":21},"updated":"2017-04-12 11:00:11.000000000","message":"remove them allllllll","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":7063,"name":"Robert Clark","email":"hyakuhei@gmail.com","username":"hyakuhei"},"change_message_id":"c493748c6fd15d665e4ec4efd4ce1042f3e9bd15","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Case studies"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"5f201791_42738c16","line":1,"updated":"2017-06-21 12:28:36.000000000","message":"I think we are backing out the case studies at the moment...","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"83405d2bd356ed390e2fd43654eb560592c0fee2","unresolved":false,"context_lines":[{"line_number":1,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":2,"context_line":"Case studies"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""}],"source_content_type":"text/x-rst","patch_set":4,"id":"1f1a1f67_b6644b23","line":1,"in_reply_to":"5f201791_42738c16","updated":"2017-07-18 13:30:36.000000000","message":"I will rm this section for now (but keep a back up)","commit_id":"40dc182a9dd18c649b5daf94940bd869f3311428"}],"security-guide/source/key-management/checklist.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":".. _check_key_mgr_01:"},{"line_number":8,"context_line":""},{"line_number":9,"context_line":"Check-Key-Manager-01: Is the ownership of config files set to root/barbican?"},{"line_number":10,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Configuration files contain critical parameters and information required"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_fe527d34","line":9,"range":{"start_line":9,"start_character":22,"end_line":9,"end_character":76},"updated":"2017-04-12 11:00:11.000000000","message":"I had to change the name of this originally as it was too long and breaking the build. Does this work?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":13,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":14,"context_line":"intentionally or accidentally, modifies or deletes any of the parameters or"},{"line_number":15,"context_line":"the file itself then it would cause severe availability issues resulting in a"},{"line_number":16,"context_line":"denial of service to the other end users. Thus user ownership of such critical"},{"line_number":17,"context_line":"configuration files must be set to root and group ownership must be set to"},{"line_number":18,"context_line":"barbican."},{"line_number":19,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_1e2d21a7","line":16,"range":{"start_line":16,"start_character":42,"end_line":16,"end_character":47},"updated":"2017-04-12 11:00:11.000000000","message":"delete. User ownership... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Run the following commands:"},{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. code:: console"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/barbican/barbican.conf | egrep \"root barbican\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/barbican/barbican-api-paste.ini | egrep \"root barbican\""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_de1c5979","line":22,"range":{"start_line":22,"start_character":3,"end_line":22,"end_character":9},"updated":"2017-04-12 11:00:11.000000000","message":"code-block:: console *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. code:: console"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"    $ stat -L -c \"%U %G\" /etc/barbican/barbican.conf | egrep \"root barbican\""},{"line_number":25,"context_line":"    $ stat -L -c \"%U %G\" /etc/barbican/barbican-api-paste.ini | egrep \"root barbican\""},{"line_number":26,"context_line":"    $ stat -L -c \"%U %G\" /etc/barbican/policy.json | egrep \"root barbican\""},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_9e125161","line":24,"range":{"start_line":24,"start_character":3,"end_line":24,"end_character":4},"updated":"2017-04-12 11:00:11.000000000","message":"de-dent one space","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":29,"context_line":"to root and barbican respectively. The above commands show output of root"},{"line_number":30,"context_line":"barbican."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"**Fail:** If the above commands do not return any output as the user"},{"line_number":33,"context_line":"and group ownership might have set to any user other than root or any group"},{"line_number":34,"context_line":"other than barbican."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":".. _check_key_mgr_02:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b952cf11","line":33,"range":{"start_line":32,"start_character":57,"end_line":33,"end_character":47},"updated":"2017-04-12 11:00:11.000000000","message":"I don\u0027t understand this?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":38,"context_line":"Check-Key-Manager-02: Are strict permissions set for configuration files?"},{"line_number":39,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Similar to the previous check, it is recommended to set strict access"},{"line_number":42,"context_line":"permissions for such configuration files."},{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Run the following commands:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_5943c342","line":41,"range":{"start_line":41,"start_character":31,"end_line":41,"end_character":48},"updated":"2017-04-12 11:00:11.000000000","message":"we recommend *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":43,"context_line":""},{"line_number":44,"context_line":"Run the following commands:"},{"line_number":45,"context_line":""},{"line_number":46,"context_line":".. code:: console"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/barbican.conf"},{"line_number":49,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/barbican-api-paste.ini"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_393ebfb7","line":46,"range":{"start_line":46,"start_character":3,"end_line":46,"end_character":7},"updated":"2017-04-12 11:00:11.000000000","message":"code-block","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":".. code:: console"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/barbican.conf"},{"line_number":49,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/barbican-api-paste.ini"},{"line_number":50,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/policy.json"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_1949bb5e","line":48,"range":{"start_line":48,"start_character":3,"end_line":48,"end_character":4},"updated":"2017-04-12 11:00:11.000000000","message":"de-dent one space","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/policy.json"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"**Pass:** If permissions are set to 640 or stricter. The permissions of 640"},{"line_number":53,"context_line":"translates into owner r/w, group r, and no rights to others i.e. \"u\u003drw,g\u003dr,o\u003d\"."},{"line_number":54,"context_line":"Note that with :ref:`check_key_mgr_01` and permissions set to 640, root has"},{"line_number":55,"context_line":"read/write access and barbican has read access to these configuration files."},{"line_number":56,"context_line":"The access rights can also be validated using the following command. This"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b97bef89","line":53,"range":{"start_line":53,"start_character":60,"end_line":53,"end_character":64},"updated":"2017-04-12 11:00:11.000000000","message":"use For example and not i.e please :) (this is for translation purposes)","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":50,"context_line":"    $ stat -L -c \"%a\" /etc/barbican/policy.json"},{"line_number":51,"context_line":""},{"line_number":52,"context_line":"**Pass:** If permissions are set to 640 or stricter. The permissions of 640"},{"line_number":53,"context_line":"translates into owner r/w, group r, and no rights to others i.e. \"u\u003drw,g\u003dr,o\u003d\"."},{"line_number":54,"context_line":"Note that with :ref:`check_key_mgr_01` and permissions set to 640, root has"},{"line_number":55,"context_line":"read/write access and barbican has read access to these configuration files."},{"line_number":56,"context_line":"The access rights can also be validated using the following command. This"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_3967dfeb","line":53,"range":{"start_line":53,"start_character":22,"end_line":53,"end_character":25},"updated":"2017-04-12 11:00:11.000000000","message":"write this out in full please (for the same translation reasonings)","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":51,"context_line":""},{"line_number":52,"context_line":"**Pass:** If permissions are set to 640 or stricter. The permissions of 640"},{"line_number":53,"context_line":"translates into owner r/w, group r, and no rights to others i.e. \"u\u003drw,g\u003dr,o\u003d\"."},{"line_number":54,"context_line":"Note that with :ref:`check_key_mgr_01` and permissions set to 640, root has"},{"line_number":55,"context_line":"read/write access and barbican has read access to these configuration files."},{"line_number":56,"context_line":"The access rights can also be validated using the following command. This"},{"line_number":57,"context_line":"command will only be available on your system if it supports ACLs."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_996eebc6","line":54,"range":{"start_line":54,"start_character":0,"end_line":54,"end_character":4},"updated":"2017-04-12 11:00:11.000000000","message":"put in a note\n\n.. note:: *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":56,"context_line":"The access rights can also be validated using the following command. This"},{"line_number":57,"context_line":"command will only be available on your system if it supports ACLs."},{"line_number":58,"context_line":""},{"line_number":59,"context_line":".. code:: console"},{"line_number":60,"context_line":""},{"line_number":61,"context_line":"    $ getfacl --tabular -a /etc/barbican/barbican.conf"},{"line_number":62,"context_line":"    getfacl: Removing leading \u0027/\u0027 from absolute path names"},{"line_number":63,"context_line":"    # file: etc/barbican/barbican.conf"},{"line_number":64,"context_line":"    USER   root  rw-"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f95cd719","line":61,"range":{"start_line":59,"start_character":3,"end_line":61,"end_character":13},"updated":"2017-04-12 11:00:11.000000000","message":"ditto as above","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":65,"context_line":"    GROUP  barbican  r--"},{"line_number":66,"context_line":"    mask         r--"},{"line_number":67,"context_line":"    other        ---"},{"line_number":68,"context_line":""},{"line_number":69,"context_line":"**Fail:** If permissions are not set to at least 640."},{"line_number":70,"context_line":""},{"line_number":71,"context_line":".. _check_key_mgr_03:"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_79a68711","line":68,"updated":"2017-04-12 11:00:11.000000000","message":"No pass?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":74,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"OpenStack supports various authentication strategies like noauth and keystone."},{"line_number":77,"context_line":"If the \u0027``noauth``\u0027 strategy is used then the users could interact with"},{"line_number":78,"context_line":"OpenStack services without any authentication. This could be a potential risk"},{"line_number":79,"context_line":"since an attacker might gain unauthorized access to the OpenStack components."},{"line_number":80,"context_line":"Thus it is strongly recommended that all services must be authenticated with"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_59c863a4","line":77,"range":{"start_line":77,"start_character":52,"end_line":77,"end_character":57},"updated":"2017-04-12 11:00:11.000000000","message":"can *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":74,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"OpenStack supports various authentication strategies like noauth and keystone."},{"line_number":77,"context_line":"If the \u0027``noauth``\u0027 strategy is used then the users could interact with"},{"line_number":78,"context_line":"OpenStack services without any authentication. This could be a potential risk"},{"line_number":79,"context_line":"since an attacker might gain unauthorized access to the OpenStack components."},{"line_number":80,"context_line":"Thus it is strongly recommended that all services must be authenticated with"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b9ee4f1f","line":77,"range":{"start_line":77,"start_character":7,"end_line":77,"end_character":8},"updated":"2017-04-12 11:00:11.000000000","message":"remove these","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":74,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":75,"context_line":""},{"line_number":76,"context_line":"OpenStack supports various authentication strategies like noauth and keystone."},{"line_number":77,"context_line":"If the \u0027``noauth``\u0027 strategy is used then the users could interact with"},{"line_number":78,"context_line":"OpenStack services without any authentication. This could be a potential risk"},{"line_number":79,"context_line":"since an attacker might gain unauthorized access to the OpenStack components."},{"line_number":80,"context_line":"Thus it is strongly recommended that all services must be authenticated with"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_19e53b38","line":77,"range":{"start_line":77,"start_character":31,"end_line":77,"end_character":36},"updated":"2017-04-12 11:00:11.000000000","message":"user, then the users*","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":77,"context_line":"If the \u0027``noauth``\u0027 strategy is used then the users could interact with"},{"line_number":78,"context_line":"OpenStack services without any authentication. This could be a potential risk"},{"line_number":79,"context_line":"since an attacker might gain unauthorized access to the OpenStack components."},{"line_number":80,"context_line":"Thus it is strongly recommended that all services must be authenticated with"},{"line_number":81,"context_line":"keystone using their service accounts."},{"line_number":82,"context_line":""},{"line_number":83,"context_line":"**Pass:** If the parameter ``authtoken`` is listed under the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f9b85711","line":80,"range":{"start_line":80,"start_character":0,"end_line":80,"end_character":32},"updated":"2017-04-12 11:00:11.000000000","message":"We strongly recommend... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":91,"context_line":"Check-Key-Manager-04: Is TLS enabled for authentication?"},{"line_number":92,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"OpenStack components communicate with each other using various protocols and"},{"line_number":95,"context_line":"the communication might involve sensitive or confidential data. An attacker may"},{"line_number":96,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":97,"context_line":"information. Thus all the components must communicate with each other using a"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f94df73a","line":94,"range":{"start_line":94,"start_character":73,"end_line":94,"end_character":76},"updated":"2017-04-12 11:00:11.000000000","message":"protocols, the communication *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":94,"context_line":"OpenStack components communicate with each other using various protocols and"},{"line_number":95,"context_line":"the communication might involve sensitive or confidential data. An attacker may"},{"line_number":96,"context_line":"try to eavesdrop on the channel in order to get access to sensitive"},{"line_number":97,"context_line":"information. Thus all the components must communicate with each other using a"},{"line_number":98,"context_line":"secured communication protocol."},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_99582bfa","line":97,"range":{"start_line":97,"start_character":13,"end_line":97,"end_character":22},"updated":"2017-04-12 11:00:11.000000000","message":"All the components... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":99,"context_line":""},{"line_number":100,"context_line":"**Pass:** If value of parameter ``auth_protocol`` under"},{"line_number":101,"context_line":"``[keystone_authtoken]`` section in ``barbican.conf`` is set to"},{"line_number":102,"context_line":"``https``, or if value of parameter ``identity_uri`` under"},{"line_number":103,"context_line":"``[keystone_authtoken]`` section in ``barbican.conf`` is set to"},{"line_number":104,"context_line":"Identity API endpoint starting with ``https://`` and value of parameter"},{"line_number":105,"context_line":"``insecure`` under the same ``[keystone_authtoken]`` section in the same"},{"line_number":106,"context_line":"``barbican.conf`` is set to ``False``."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":109,"context_line":"``[keystone_authtoken]`` section in ``barbican.conf`` is set to"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_39711f77","line":106,"range":{"start_line":102,"start_character":11,"end_line":106,"end_character":38},"updated":"2017-04-12 11:00:11.000000000","message":"woah - this is very long, and I don\u0027t know what this says at all. please clarify/simplify","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":106,"context_line":"``barbican.conf`` is set to ``False``."},{"line_number":107,"context_line":""},{"line_number":108,"context_line":"**Fail:** If value of parameter ``auth_protocol`` under"},{"line_number":109,"context_line":"``[keystone_authtoken]`` section in ``barbican.conf`` is set to"},{"line_number":110,"context_line":"``http``, or if value of parameter ``identity_uri`` under"},{"line_number":111,"context_line":"``[keystone_authtoken]`` section in ``barbican.conf`` is not set"},{"line_number":112,"context_line":"to Identity API endpoint starting with ``https://`` or value of parameter"},{"line_number":113,"context_line":"``insecure`` under the same ``[keystone_authtoken]`` section in the same"},{"line_number":114,"context_line":"``barbican.conf`` is set to ``True``."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f96617bb","line":114,"range":{"start_line":109,"start_character":22,"end_line":114,"end_character":37},"updated":"2017-04-12 11:00:11.000000000","message":"ditto","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":12,"context_line":"Configuration files contain critical parameters and information required"},{"line_number":13,"context_line":"for smooth functioning of the component. If an unprivileged user, either"},{"line_number":14,"context_line":"intentionally or accidentally, modifies or deletes any of the parameters"},{"line_number":15,"context_line":"or the file itself then it would cause severe availability issues"},{"line_number":16,"context_line":"resulting in a denial of service to the other end users. User ownership"},{"line_number":17,"context_line":"of such critical configuration files must be set to root and group"},{"line_number":18,"context_line":"ownership must be set to barbican."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_cc71d5e0","line":15,"range":{"start_line":15,"start_character":12,"end_line":15,"end_character":18},"updated":"2017-07-25 12:58:09.000000000","message":"itself, then *","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":21,"context_line":""},{"line_number":22,"context_line":".. code:: console"},{"line_number":23,"context_line":""},{"line_number":24,"context_line":"  $ stat -L -c \"%U %G\" /etc/barbican/barbican.conf | egrep \"root barbican\""},{"line_number":25,"context_line":"  $ stat -L -c \"%U %G\" /etc/barbican/barbican-api-paste.ini | egrep \"root barbican\""},{"line_number":26,"context_line":"  $ stat -L -c \"%U %G\" /etc/barbican/policy.json | egrep \"root barbican\""},{"line_number":27,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ec5ff93e","line":24,"range":{"start_line":24,"start_character":2,"end_line":24,"end_character":3},"updated":"2017-07-25 12:58:09.000000000","message":"indent all by one","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":27,"context_line":""},{"line_number":28,"context_line":"**Pass:** If user and group ownership of all these config files is set"},{"line_number":29,"context_line":"to root and barbican respectively. The above commands show output of"},{"line_number":30,"context_line":"root / barbican."},{"line_number":31,"context_line":""},{"line_number":32,"context_line":"**Fail:** If the above commands do not return any output, it is possible"},{"line_number":33,"context_line":"that the user and group ownership may have been set to any user other"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_6c4c299e","line":30,"range":{"start_line":30,"start_character":0,"end_line":30,"end_character":16},"updated":"2017-07-25 12:58:09.000000000","message":"root barbican? Running barbican as root? Clarify that please :)","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":45,"context_line":""},{"line_number":46,"context_line":".. code:: console"},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"  $ stat -L -c \"%a\" /etc/barbican/barbican.conf"},{"line_number":49,"context_line":"  $ stat -L -c \"%a\" /etc/barbican/barbican-api-paste.ini"},{"line_number":50,"context_line":"  $ stat -L -c \"%a\" /etc/barbican/policy.json"},{"line_number":51,"context_line":""}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0c491d8a","line":48,"range":{"start_line":48,"start_character":2,"end_line":48,"end_character":4},"updated":"2017-07-25 12:58:09.000000000","message":"indent all by one","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":62,"context_line":""},{"line_number":63,"context_line":".. code:: console"},{"line_number":64,"context_line":""},{"line_number":65,"context_line":"  $ getfacl --tabular -a /etc/barbican/barbican.conf"},{"line_number":66,"context_line":"  getfacl: Removing leading \u0027/\u0027 from absolute path names"},{"line_number":67,"context_line":"  # file: etc/barbican/barbican.conf"},{"line_number":68,"context_line":"  USER   root  rw-"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_2c46217e","line":65,"range":{"start_line":65,"start_character":2,"end_line":65,"end_character":3},"updated":"2017-07-25 12:58:09.000000000","message":"indent all by one","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":98,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"OpenStack components communicate with each other using various protocols"},{"line_number":101,"context_line":", and communication might involve sensitive or confidential data. An"},{"line_number":102,"context_line":"attacker may try to eavesdrop on the channel in order to get access to"},{"line_number":103,"context_line":"sensitive information. Therefore all components must communicate with"},{"line_number":104,"context_line":"each other using a secured communication protocol."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_0cbb5d72","line":101,"range":{"start_line":101,"start_character":0,"end_line":101,"end_character":1},"updated":"2017-07-25 12:58:09.000000000","message":"what?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"}],"security-guide/source/key-management/overview.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Summary of existing technologies"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Fixed/Hardcoded keys - It is known that some services have the option to"},{"line_number":6,"context_line":"specify keys in their configuration files. This is the least secure way"},{"line_number":7,"context_line":"to operate and is not recommended for any sort of production operation."},{"line_number":8,"context_line":"Hardware security modules - HSMs can come in multiple forms. The traditional"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_d907d3c9","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":22},"updated":"2017-04-12 11:00:11.000000000","message":"what?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Fixed/Hardcoded keys - It is known that some services have the option to"},{"line_number":6,"context_line":"specify keys in their configuration files. This is the least secure way"},{"line_number":7,"context_line":"to operate and is not recommended for any sort of production operation."},{"line_number":8,"context_line":"Hardware security modules - HSMs can come in multiple forms. The traditional"},{"line_number":9,"context_line":"device is a rack mounted appliance such as"},{"line_number":10,"context_line":"a `here \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b90acfce","line":7,"range":{"start_line":7,"start_character":15,"end_line":7,"end_character":34},"updated":"2017-04-12 11:00:11.000000000","message":"and we do not recommend this for any sort ... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Fixed/Hardcoded keys - It is known that some services have the option to"},{"line_number":6,"context_line":"specify keys in their configuration files. This is the least secure way"},{"line_number":7,"context_line":"to operate and is not recommended for any sort of production operation."},{"line_number":8,"context_line":"Hardware security modules - HSMs can come in multiple forms. The traditional"},{"line_number":9,"context_line":"device is a rack mounted appliance such as"},{"line_number":10,"context_line":"a `here \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."},{"line_number":11,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_990dcbe9","line":8,"range":{"start_line":8,"start_character":1,"end_line":8,"end_character":32},"updated":"2017-04-12 11:00:11.000000000","message":"Hardware Security Modules (HSMs) can come...","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":7,"context_line":"to operate and is not recommended for any sort of production operation."},{"line_number":8,"context_line":"Hardware security modules - HSMs can come in multiple forms. The traditional"},{"line_number":9,"context_line":"device is a rack mounted appliance such as"},{"line_number":10,"context_line":"a `here \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Software Key Managers - [Vault, KeyWhiz, Barbican, Citadel, Confidant,"},{"line_number":13,"context_line":"Conjur, EJSON, Knox, Red October]"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f9fbb7ba","line":10,"range":{"start_line":10,"start_character":3,"end_line":10,"end_character":8},"updated":"2017-04-12 11:00:11.000000000","message":"as I said before, use the name of the blog, and not \u0027here\u0027","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":9,"context_line":"device is a rack mounted appliance such as"},{"line_number":10,"context_line":"a `here \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Software Key Managers - [Vault, KeyWhiz, Barbican, Citadel, Confidant,"},{"line_number":13,"context_line":"Conjur, EJSON, Knox, Red October]"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"- KeyWhiz"},{"line_number":16,"context_line":"- Vault"},{"line_number":17,"context_line":"- Castellan"},{"line_number":18,"context_line":"- Barbican"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_d930f3a1","line":18,"range":{"start_line":12,"start_character":0,"end_line":18,"end_character":10},"updated":"2017-04-12 11:00:11.000000000","message":"I\u0027m not sure what this is at all?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Summary of existing technologies"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Fixed/Hardcoded keys - It is known that some services have the option to"},{"line_number":6,"context_line":"specify keys in their configuration files. This is the least secure way"},{"line_number":7,"context_line":"to operate and we do not recommend this for any sort of production"},{"line_number":8,"context_line":"environment."}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_6c31c90b","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":20},"updated":"2017-07-25 12:58:09.000000000","message":"I\u0027m not sure what this is referencing? Is this a topic?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"2e568ecc4703efa07dfc55dc7547ce5cb9dcb123","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Various Software Key Managers are available:"},{"line_number":14,"context_line":""},{"line_number":15,"context_line":"[Vault, KeyWhiz, Barbican, Citadel, Confidant, Conjur, EJSON, Knox,"},{"line_number":16,"context_line":"Red October]"},{"line_number":17,"context_line":""},{"line_number":18,"context_line":"- KeyWhiz"},{"line_number":19,"context_line":"- Vault"},{"line_number":20,"context_line":"- Castellan"},{"line_number":21,"context_line":"- Barbican"}],"source_content_type":"text/x-rst","patch_set":7,"id":"ff346bd7_ec2499c8","line":21,"range":{"start_line":15,"start_character":0,"end_line":21,"end_character":10},"updated":"2017-07-25 12:58:09.000000000","message":"Are these two separate lists?","commit_id":"9820fb8be918b976f96c2010cb9cba63abb3da0e"}],"security-guide/source/key-managment.rst":[{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Key Management"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Problem Space - What is key management, why is it needed // Introductions"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"We protect sensitive information in cloud deployments using various"},{"line_number":8,"context_line":"applications of cryptography. Simple examples are encrypting data at rest"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_9926eb67","line":5,"range":{"start_line":5,"start_character":0,"end_line":5,"end_character":73},"updated":"2017-04-12 11:00:11.000000000","message":"remove","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Problem Space - What is key management, why is it needed // Introductions"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"We protect sensitive information in cloud deployments using various"},{"line_number":8,"context_line":"applications of cryptography. Simple examples are encrypting data at rest"},{"line_number":9,"context_line":"or signing an image to prove that it has not been tampered with. In all cases"},{"line_number":10,"context_line":"these cryptographic capabilities require some sort of *key material* in order"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_5924e35d","line":7,"range":{"start_line":7,"start_character":0,"end_line":7,"end_character":2},"updated":"2017-04-12 11:00:11.000000000","message":"who is we? Barbican? Key management service?","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":5,"context_line":"Problem Space - What is key management, why is it needed // Introductions"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"We protect sensitive information in cloud deployments using various"},{"line_number":8,"context_line":"applications of cryptography. Simple examples are encrypting data at rest"},{"line_number":9,"context_line":"or signing an image to prove that it has not been tampered with. In all cases"},{"line_number":10,"context_line":"these cryptographic capabilities require some sort of *key material* in order"},{"line_number":11,"context_line":"to operate."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_b9d88f52","line":8,"range":{"start_line":8,"start_character":30,"end_line":8,"end_character":50},"updated":"2017-04-12 11:00:11.000000000","message":"For example, encrypting data at rest, or signing an image... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":6,"context_line":""},{"line_number":7,"context_line":"We protect sensitive information in cloud deployments using various"},{"line_number":8,"context_line":"applications of cryptography. Simple examples are encrypting data at rest"},{"line_number":9,"context_line":"or signing an image to prove that it has not been tampered with. In all cases"},{"line_number":10,"context_line":"these cryptographic capabilities require some sort of *key material* in order"},{"line_number":11,"context_line":"to operate."},{"line_number":12,"context_line":""}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_59e983e3","line":9,"range":{"start_line":9,"start_character":65,"end_line":9,"end_character":77},"updated":"2017-04-12 11:00:11.000000000","message":"In all cases, these cryptographic... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":10,"context_line":"these cryptographic capabilities require some sort of *key material* in order"},{"line_number":11,"context_line":"to operate."},{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Key Management, often referred to as “secrets management” describes a group of"},{"line_number":14,"context_line":"technologies that are designed to protect key materials within a software"},{"line_number":15,"context_line":"system. Traditionally key management involves deployment of Hardware Security"},{"line_number":16,"context_line":"Modules (HSM). These are typically devices that have been physically hardened"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_39e47f0c","line":13,"range":{"start_line":13,"start_character":37,"end_line":13,"end_character":57},"updated":"2017-04-12 11:00:11.000000000","message":"remove the scare quotes","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":12,"context_line":""},{"line_number":13,"context_line":"Key Management, often referred to as “secrets management” describes a group of"},{"line_number":14,"context_line":"technologies that are designed to protect key materials within a software"},{"line_number":15,"context_line":"system. Traditionally key management involves deployment of Hardware Security"},{"line_number":16,"context_line":"Modules (HSM). These are typically devices that have been physically hardened"},{"line_number":17,"context_line":"against tampering. Physical HSM are often expensive to deploy and difficult"},{"line_number":18,"context_line":"to scale."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_f9e977e2","line":15,"range":{"start_line":15,"start_character":8,"end_line":15,"end_character":21},"updated":"2017-04-12 11:00:11.000000000","message":"Traditionally, key management... *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":17,"context_line":"against tampering. Physical HSM are often expensive to deploy and difficult"},{"line_number":18,"context_line":"to scale."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"As technology has advanced, the number of “secret things” that need to be"},{"line_number":21,"context_line":"protected has increased beyond key materials to include certificate pairs,"},{"line_number":22,"context_line":"API keys, system passwords, signing keys etc. This increase has created a"},{"line_number":23,"context_line":"need for a more scalable approach to key management and resulted in the"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_d9beb3d3","line":20,"range":{"start_line":20,"start_character":42,"end_line":20,"end_character":57},"updated":"2017-04-12 11:00:11.000000000","message":"remove scare quotes","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":19,"context_line":""},{"line_number":20,"context_line":"As technology has advanced, the number of “secret things” that need to be"},{"line_number":21,"context_line":"protected has increased beyond key materials to include certificate pairs,"},{"line_number":22,"context_line":"API keys, system passwords, signing keys etc. This increase has created a"},{"line_number":23,"context_line":"need for a more scalable approach to key management and resulted in the"},{"line_number":24,"context_line":"creation of a number of software services that provide scalable dynamic key"},{"line_number":25,"context_line":"management. In this chapter we briefly describe the services that exist today"}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_99b4abf3","line":22,"range":{"start_line":22,"start_character":41,"end_line":22,"end_character":45},"updated":"2017-04-12 11:00:11.000000000","message":"remove, use \u0027and so on\u0027 for translation purposes please","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"},{"author":{"_account_id":10607,"name":"Alexandra Settle","email":"a.settle@outlook.com","username":"asettle"},"change_message_id":"3170c30da980c18e49b6b5ba7551edaf09546ff0","unresolved":false,"context_lines":[{"line_number":20,"context_line":"As technology has advanced, the number of “secret things” that need to be"},{"line_number":21,"context_line":"protected has increased beyond key materials to include certificate pairs,"},{"line_number":22,"context_line":"API keys, system passwords, signing keys etc. This increase has created a"},{"line_number":23,"context_line":"need for a more scalable approach to key management and resulted in the"},{"line_number":24,"context_line":"creation of a number of software services that provide scalable dynamic key"},{"line_number":25,"context_line":"management. In this chapter we briefly describe the services that exist today"},{"line_number":26,"context_line":"and focus on those that are able to be integrated into OpenStack clouds."}],"source_content_type":"text/x-rst","patch_set":3,"id":"bff0334d_79b7a7f6","line":23,"range":{"start_line":23,"start_character":41,"end_line":23,"end_character":51},"updated":"2017-04-12 11:00:11.000000000","message":"management, and resulted *","commit_id":"5b97bb778d1e6d333bd95bca10020e10a3d740ee"}],"security-guide/source/secrets-management.rst":[{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"f35ed672d83791844fd2538847ffd6cea452b004","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"As technology has advanced the number of secret things that need to be"},{"line_number":17,"context_line":"protected has increased beyond key materials to include certificate pairs, API"},{"line_number":18,"context_line":"keys system passwords, signing keys and so on. This increase has created a need"},{"line_number":19,"context_line":"for a more scalable approach to key management, and resulted in the creation of"},{"line_number":20,"context_line":"a number of software services that provide scalable dynamic key management."},{"line_number":21,"context_line":"This chapter describes the services that exist today and focus on those that"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_35df4b0e","line":18,"range":{"start_line":18,"start_character":4,"end_line":18,"end_character":5},"updated":"2017-09-14 19:57:05.000000000","message":"insert comma here?","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"}],"security-guide/source/secrets-management/barbican.rst":[{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"f35ed672d83791844fd2538847ffd6cea452b004","unresolved":false,"context_lines":[{"line_number":15,"context_line":""},{"line_number":16,"context_line":"Barbican is often used as a key management system to enable use cases such as"},{"line_number":17,"context_line":"Image signature verification, Volume encryption. These use cases are outlined"},{"line_number":18,"context_line":"in the Secrets Management Use Cases chapter (\u003c needs link)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Barbican role based cccess control"},{"line_number":21,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_d586c713","line":18,"range":{"start_line":18,"start_character":45,"end_line":18,"end_character":57},"updated":"2017-09-14 19:57:05.000000000","message":"I think it looks like:\n\n:doc:`secrets-management-use-cases`","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"f35ed672d83791844fd2538847ffd6cea452b004","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Image signature verification, Volume encryption. These use cases are outlined"},{"line_number":18,"context_line":"in the Secrets Management Use Cases chapter (\u003c needs link)."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Barbican role based cccess control"},{"line_number":21,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"pending"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_f525435d","line":20,"range":{"start_line":20,"start_character":20,"end_line":20,"end_character":26},"updated":"2017-09-14 19:57:05.000000000","message":"Access","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"f35ed672d83791844fd2538847ffd6cea452b004","unresolved":false,"context_lines":[{"line_number":48,"context_line":"--------------------"},{"line_number":49,"context_line":""},{"line_number":50,"context_line":"The simple crypto plugin is configured by default in ``barbican.conf``."},{"line_number":51,"context_line":"This plugin uses single symmetric key (kek - or \u0027key encryption key\u0027)"},{"line_number":52,"context_line":"which is stored in plain text in the ``barbican.conf`` file to encrypt"},{"line_number":53,"context_line":"and decrypt all secrets. This plugin is completely insecure and is only"},{"line_number":54,"context_line":"suitable for development and testing, it must not be used for production"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_35baabc0","line":51,"range":{"start_line":51,"start_character":39,"end_line":51,"end_character":68},"updated":"2017-09-14 19:57:05.000000000","message":"KEK or \u0027Key Encryption Key\u0027","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"f35ed672d83791844fd2538847ffd6cea452b004","unresolved":false,"context_lines":[{"line_number":50,"context_line":"The simple crypto plugin is configured by default in ``barbican.conf``."},{"line_number":51,"context_line":"This plugin uses single symmetric key (kek - or \u0027key encryption key\u0027)"},{"line_number":52,"context_line":"which is stored in plain text in the ``barbican.conf`` file to encrypt"},{"line_number":53,"context_line":"and decrypt all secrets. This plugin is completely insecure and is only"},{"line_number":54,"context_line":"suitable for development and testing, it must not be used for production"},{"line_number":55,"context_line":"deployments."},{"line_number":56,"context_line":""},{"line_number":57,"context_line":"PKCS#11 crypto plugin"},{"line_number":58,"context_line":"---------------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_15320f60","line":55,"range":{"start_line":53,"start_character":25,"end_line":55,"end_character":12},"updated":"2017-09-14 19:57:05.000000000","message":"I feel like I recall a conversation where we decided we were gonna stay away from strong language like this?  Did we say that some people might want to use this anyway, if they only care minimally about security?","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"9a73b42668151f976cc4f11fe1dfe8f8bd9bec90","unresolved":false,"context_lines":[{"line_number":76,"context_line":"KMIP plugin"},{"line_number":77,"context_line":"-----------"},{"line_number":78,"context_line":""},{"line_number":79,"context_line":"The KMIP secret store plugin is used to communicate with a KMIP device,"},{"line_number":80,"context_line":"such as a Hardware Security Module (HSM). The secret is securely stored"},{"line_number":81,"context_line":"in the KMIP device directly, rather than in the Barbican database. The"},{"line_number":82,"context_line":"Barbican database maintains a reference to the secret\u0027s location for"},{"line_number":83,"context_line":"later retrieval. The plugin can be configured to authenticate to the"},{"line_number":84,"context_line":"KMIP device using either a username and password, or using a client"},{"line_number":85,"context_line":"certificate. This information is stored in the Barbican configuration"},{"line_number":86,"context_line":"file."},{"line_number":87,"context_line":""},{"line_number":88,"context_line":"Dogtag plugin"},{"line_number":89,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":14,"id":"5f2577a7_b557bb58","line":86,"range":{"start_line":79,"start_character":0,"end_line":86,"end_character":5},"updated":"2017-09-14 20:08:50.000000000","message":"The _`Key Management Interoperability Protocol (KMIP) \u003chttps://www.oasis-open.org/committees/tc_home.php?wg_abbrev\u003dkmip\u003e`_ secret store plugin is used to communicate with a KMIP-enabled device,\nsuch as a Hardware Security Module (HSM). The secret is securely stored\nin the KMIP-enabled device directly, rather than in the Barbican database. The\nBarbican database maintains a reference to the secret\u0027s location for\nlater retrieval. The plugin can be configured to authenticate to the\nKMIP-enabled device using either a username and password, or using a client\ncertificate. This information is stored in the Barbican configuration\nfile.","commit_id":"fa8748db92acf4b2a83af0f4fe20ed7866c1d04d"},{"author":{"_account_id":8623,"name":"Kaitlin Farr","email":"kaitlin.farr@jhuapl.edu","username":"kaitlin.farr"},"change_message_id":"93e4c59e0bf7eaa872cb8be42c7daa984948a3d5","unresolved":false,"context_lines":[{"line_number":77,"context_line":"KMIP plugin"},{"line_number":78,"context_line":"-----------"},{"line_number":79,"context_line":""},{"line_number":80,"context_line":"The KMIP secret store plugin is used to communicate with a KMIP device,"},{"line_number":81,"context_line":"such as a Hardware Security Module (HSM). The secret is securely stored"},{"line_number":82,"context_line":"in the KMIP device directly, rather than in the Barbican database. The"},{"line_number":83,"context_line":"Barbican database maintains a reference to the secret\u0027s location for"},{"line_number":84,"context_line":"later retrieval. The plugin can be configured to authenticate to the"},{"line_number":85,"context_line":"KMIP device using either a username and password, or using a client"},{"line_number":86,"context_line":"certificate. This information is stored in the Barbican configuration"},{"line_number":87,"context_line":"file."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"Dogtag plugin"},{"line_number":90,"context_line":"-------------"}],"source_content_type":"text/x-rst","patch_set":16,"id":"5f2577a7_b0c7c996","line":87,"range":{"start_line":80,"start_character":0,"end_line":87,"end_character":5},"updated":"2017-09-14 20:09:27.000000000","message":"The _`Key Management Interoperability Protocol (KMIP) \u003chttps://www.oasis-open.org/committees/tc_home.php?wg_abbrev\u003dkmip\u003e`_ secret store plugin is used to communicate with a KMIP-enabled device,\nsuch as a Hardware Security Module (HSM). The secret is securely stored\nin the KMIP-enabled device directly, rather than in the Barbican database. The\nBarbican database maintains a reference to the secret\u0027s location for\nlater retrieval. The plugin can be configured to authenticate to the\nKMIP-enabled device using either a username and password, or using a client\ncertificate. This information is stored in the Barbican configuration\nfile.","commit_id":"302f06740dd9b38b77fb9b010c578e26f9677463"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":17,"context_line":"Image signature verification, Volume encryption. These use cases are outlined"},{"line_number":18,"context_line":"in the :doc:`secrets-management-use-cases`"},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"Barbican Role based Access Control"},{"line_number":21,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":22,"context_line":""},{"line_number":23,"context_line":"pending"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_5eab711c","line":20,"range":{"start_line":20,"start_character":14,"end_line":20,"end_character":15},"updated":"2017-09-20 20:54:31.000000000","message":"would either capitalize this \u0027b\u0027 or make the others lower case to match the other titles.","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":39,"context_line":"--------------"},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Crypto plugins store secrets as encrypted blobs within the Barbican"},{"line_number":42,"context_line":"database. The plugin is invoked to encrypt the secret, on secret"},{"line_number":43,"context_line":"storage, and decrypt the secret, on secret retrieval. There are two"},{"line_number":44,"context_line":"flavors of storage plugins currently available: the Simple Crypto plugin"},{"line_number":45,"context_line":"and the PKCS#11 crypto plugin."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_9e5fa940","line":42,"range":{"start_line":42,"start_character":53,"end_line":42,"end_character":54},"updated":"2017-09-20 20:54:31.000000000","message":"this comma feels weird here","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":40,"context_line":""},{"line_number":41,"context_line":"Crypto plugins store secrets as encrypted blobs within the Barbican"},{"line_number":42,"context_line":"database. The plugin is invoked to encrypt the secret, on secret"},{"line_number":43,"context_line":"storage, and decrypt the secret, on secret retrieval. There are two"},{"line_number":44,"context_line":"flavors of storage plugins currently available: the Simple Crypto plugin"},{"line_number":45,"context_line":"and the PKCS#11 crypto plugin."},{"line_number":46,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_5e593158","line":43,"range":{"start_line":43,"start_character":31,"end_line":43,"end_character":32},"updated":"2017-09-20 20:54:31.000000000","message":"same as above","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":113,"context_line":""},{"line_number":114,"context_line":"The Barbican threat analysis identified eight security findings and two"},{"line_number":115,"context_line":"recommendations to improve the security of a barbican deployment. These"},{"line_number":116,"context_line":"results can be reviewed in the security analysis repo, along with the"},{"line_number":117,"context_line":"Barbican architecture diagram and architecture description page."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_99122358","line":116,"range":{"start_line":116,"start_character":31,"end_line":116,"end_character":53},"updated":"2017-09-20 20:54:31.000000000","message":"Could we add a link to the repo here?","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"}],"security-guide/source/secrets-management/checklist.rst":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":84,"context_line":"interact with OpenStack services without any authentication. This could"},{"line_number":85,"context_line":"be a potential risk since an attacker might gain unauthorized access to"},{"line_number":86,"context_line":"the OpenStack components. We strongly recommend that all services must"},{"line_number":87,"context_line":"be authenticated with keystone using  their service accounts."},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"**Pass:** If the parameter ``authtoken`` is listed under the"},{"line_number":90,"context_line":"``pipeline:barbican_api`` section in ``barbican-api-paste.ini``."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_d9565b07","line":87,"range":{"start_line":87,"start_character":37,"end_line":87,"end_character":38},"updated":"2017-09-20 20:54:31.000000000","message":"extra space here","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":98,"context_line":"~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~"},{"line_number":99,"context_line":""},{"line_number":100,"context_line":"OpenStack components communicate with each other using various protocols"},{"line_number":101,"context_line":", and communication might involve sensitive or confidential data. An"},{"line_number":102,"context_line":"attacker may try to eavesdrop on the channel in order to get access to"},{"line_number":103,"context_line":"sensitive information. Therefore all components must communicate with"},{"line_number":104,"context_line":"each other using a secured communication protocol."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_3947b74e","line":101,"range":{"start_line":101,"start_character":0,"end_line":101,"end_character":1},"updated":"2017-09-20 20:54:31.000000000","message":"another weird comma imo","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"}],"security-guide/source/secrets-management/faq.rst":[{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"be248a23fa85d884353f43fe3fcbb08006df68f4","unresolved":false,"context_lines":[{"line_number":45,"context_line":"has been written, it is relatively trivial to use the plugin either"},{"line_number":46,"context_line":"directly or behind Barbican."},{"line_number":47,"context_line":""},{"line_number":48,"context_line":"Currently, Vault and Custodia plugins are being developed. "},{"line_number":49,"context_line":"  "}],"source_content_type":"text/x-rst","patch_set":18,"id":"5f2577a7_4b9d93ba","line":49,"range":{"start_line":48,"start_character":58,"end_line":49,"end_character":2},"updated":"2017-09-14 21:04:18.000000000","message":"looks good to me, just some whitespace","commit_id":"f20424679b28393cf97a4f3f4639cff4571019c1"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":2,"context_line":"Frequently Asked Questions"},{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"1. What is the recommended way to secure secrets in OpenStack?"},{"line_number":6,"context_line":""},{"line_number":7,"context_line":"The recommended way to securely store and manage secrets in OpenStack"},{"line_number":8,"context_line":"is to use Barbican."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_3960d7ce","line":5,"range":{"start_line":5,"start_character":34,"end_line":5,"end_character":48},"updated":"2017-09-20 20:54:31.000000000","message":"s/secure secrets/securely store secrets","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":10,"context_line":"2. Why should I use Barbican?"},{"line_number":11,"context_line":""},{"line_number":12,"context_line":"Barbican is an OpenStack service that is multi-tenant aware and that"},{"line_number":13,"context_line":"uses Keystone tokens for authentication.  This means that access to"},{"line_number":14,"context_line":"secrets is controlled via OpenStack policies for tenants and RBAC"},{"line_number":15,"context_line":"roles."},{"line_number":16,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_d9a41b0b","line":13,"range":{"start_line":13,"start_character":41,"end_line":13,"end_character":42},"updated":"2017-09-20 20:54:31.000000000","message":"extra space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":14,"context_line":"secrets is controlled via OpenStack policies for tenants and RBAC"},{"line_number":15,"context_line":"roles."},{"line_number":16,"context_line":""},{"line_number":17,"context_line":"Barbican has multiple pluggable back-ends which can be communicate"},{"line_number":18,"context_line":"with software and hardware based security modules using PKCS#11 or KMIP."},{"line_number":19,"context_line":""},{"line_number":20,"context_line":"3. What if I don\u0027t want to use Barbican?"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_9997c391","line":17,"range":{"start_line":17,"start_character":52,"end_line":17,"end_character":54},"updated":"2017-09-20 20:54:31.000000000","message":"\u0027be\u0027 is not needed here","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":24,"context_line":"those that do not."},{"line_number":25,"context_line":""},{"line_number":26,"context_line":"An example of those secrets that require keystone authentication are"},{"line_number":27,"context_line":"passwords and keys owned by specific projects.  These include,"},{"line_number":28,"context_line":"for instance, encryption keys for a project\u0027s encrypted cinder volumes"},{"line_number":29,"context_line":"or signing keys for a project\u0027s glance images."},{"line_number":30,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_39e33736","line":27,"range":{"start_line":27,"start_character":47,"end_line":27,"end_character":48},"updated":"2017-09-20 20:54:31.000000000","message":"extra space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":34,"context_line":""},{"line_number":35,"context_line":"Secrets that require a keystone token should be stored using Barbican."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Secrets that do not can be stored in any secret store that implements"},{"line_number":38,"context_line":"the simple key storage API that is exposed through Castellan.  This also"},{"line_number":39,"context_line":"includes Barbican."},{"line_number":40,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_39bc5704","line":37,"range":{"start_line":37,"start_character":13,"end_line":37,"end_character":19},"updated":"2017-09-20 20:54:31.000000000","message":"\"do not require keystone authentication\"","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":35,"context_line":"Secrets that require a keystone token should be stored using Barbican."},{"line_number":36,"context_line":""},{"line_number":37,"context_line":"Secrets that do not can be stored in any secret store that implements"},{"line_number":38,"context_line":"the simple key storage API that is exposed through Castellan.  This also"},{"line_number":39,"context_line":"includes Barbican."},{"line_number":40,"context_line":""},{"line_number":41,"context_line":"4. How can I use Vault, Keywhiz, Custodia etc ...?"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_193753b3","line":38,"range":{"start_line":38,"start_character":62,"end_line":38,"end_character":63},"updated":"2017-09-20 20:54:31.000000000","message":"space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":41,"context_line":"4. How can I use Vault, Keywhiz, Custodia etc ...?"},{"line_number":42,"context_line":""},{"line_number":43,"context_line":"The key manager of your choice can be used with Openstack if Castellan"},{"line_number":44,"context_line":"plugin has been written for that key manager.  Once that plugin"},{"line_number":45,"context_line":"has been written, it is relatively trivial to use the plugin either"},{"line_number":46,"context_line":"directly or behind Barbican."},{"line_number":47,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_d9409b0a","line":44,"range":{"start_line":44,"start_character":46,"end_line":44,"end_character":47},"updated":"2017-09-20 20:54:31.000000000","message":"space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":11307,"name":"Andreas Scheuring","email":"andreas.scheuring@de.ibm.com","username":"uniqueName"},"change_message_id":"504de3385fb7517b34ac06db58dd03c8a48e49a7","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Secrets that require a keystone token should be stored using Barbican."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Secrets that do not require keystone authentication can be stored in any secret"},{"line_number":37,"context_line":"store that implements he simple key storage API that is exposed through"},{"line_number":38,"context_line":"Castellan. This also includes Barbican."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"4. How can I use Vault, Keywhiz, Custodia etc ...?"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_e4dcb947","line":37,"range":{"start_line":37,"start_character":22,"end_line":37,"end_character":24},"updated":"2017-09-25 11:58:25.000000000","message":"the","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"787ee94621e79c3e713910d1c6f498d6e08a7d7d","unresolved":false,"context_lines":[{"line_number":34,"context_line":"Secrets that require a keystone token should be stored using Barbican."},{"line_number":35,"context_line":""},{"line_number":36,"context_line":"Secrets that do not require keystone authentication can be stored in any secret"},{"line_number":37,"context_line":"store that implements he simple key storage API that is exposed through"},{"line_number":38,"context_line":"Castellan. This also includes Barbican."},{"line_number":39,"context_line":""},{"line_number":40,"context_line":"4. How can I use Vault, Keywhiz, Custodia etc ...?"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_2284feb0","line":37,"range":{"start_line":37,"start_character":22,"end_line":37,"end_character":24},"in_reply_to":"7f515b1d_e4dcb947","updated":"2017-09-25 14:41:34.000000000","message":"good catch","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"}],"security-guide/source/secrets-management/related-projects.rst":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":21,"id":"bf57530f_3951f7d9","updated":"2017-09-20 20:54:31.000000000","message":"lots of double spaces","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"}],"security-guide/source/secrets-management/secrets-management-use-cases.rst":[{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":51,"context_line":"------"},{"line_number":52,"context_line":""},{"line_number":53,"context_line":"Sahara generates and stores several passwords during the course of"},{"line_number":54,"context_line":"operation.  To harden sahara’s usage of passwords it can be instructed"},{"line_number":55,"context_line":"to use an external key manager for storage and retrieval of these"},{"line_number":56,"context_line":"secrets. To enable this feature, there must first be an OpenStack Key"},{"line_number":57,"context_line":"Manager service deployed within the stack."}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_d9277b64","line":54,"range":{"start_line":54,"start_character":11,"end_line":54,"end_character":12},"updated":"2017-09-20 20:54:31.000000000","message":"space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":87,"context_line":"-------------------------"},{"line_number":88,"context_line":""},{"line_number":89,"context_line":"The configuration files for the OpenStack services contain a number of"},{"line_number":90,"context_line":"passwords which are in plain text.  These include, for instance, the"},{"line_number":91,"context_line":"passwords used by service users to authenticate to keystone to validate"},{"line_number":92,"context_line":"keystone tokens."},{"line_number":93,"context_line":""}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_3918d71b","line":90,"range":{"start_line":90,"start_character":35,"end_line":90,"end_character":36},"updated":"2017-09-20 20:54:31.000000000","message":"space","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"change_message_id":"3f3adad4efb1484ffa6d89823e5d1c79830b044f","unresolved":false,"context_lines":[{"line_number":91,"context_line":"passwords used by service users to authenticate to keystone to validate"},{"line_number":92,"context_line":"keystone tokens."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"There is no current solution to obfuscate these passwords.  It is recommended"},{"line_number":95,"context_line":"that these files be appropriately secured by file permissions."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"There is currently an effort underway to store these secrets in a Castellan"}],"source_content_type":"text/x-rst","patch_set":21,"id":"bf57530f_99cfc37e","line":94,"range":{"start_line":94,"start_character":0,"end_line":94,"end_character":59},"updated":"2017-09-20 20:54:31.000000000","message":"the sentence below kinda contradicts this. Unless we are talking about official solutions?","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"74a8340c8000395640917260fe678646a430db67","unresolved":false,"context_lines":[{"line_number":91,"context_line":"passwords used by service users to authenticate to keystone to validate"},{"line_number":92,"context_line":"keystone tokens."},{"line_number":93,"context_line":""},{"line_number":94,"context_line":"There is no current solution to obfuscate these passwords.  It is recommended"},{"line_number":95,"context_line":"that these files be appropriately secured by file permissions."},{"line_number":96,"context_line":""},{"line_number":97,"context_line":"There is currently an effort underway to store these secrets in a Castellan"}],"source_content_type":"text/x-rst","patch_set":21,"id":"7f515b1d_6ee66a47","line":94,"range":{"start_line":94,"start_character":0,"end_line":94,"end_character":59},"in_reply_to":"bf57530f_99cfc37e","updated":"2017-09-25 11:03:43.000000000","message":"Yes, this refers to official (as in oslo).","commit_id":"0ef0df25ad85fd3be374fed419d5c2a9b6f3fe1d"},{"author":{"_account_id":11307,"name":"Andreas Scheuring","email":"andreas.scheuring@de.ibm.com","username":"uniqueName"},"change_message_id":"504de3385fb7517b34ac06db58dd03c8a48e49a7","unresolved":false,"context_lines":[{"line_number":23,"context_line":"The volume encryption feature provides encryption of data-at-rest using"},{"line_number":24,"context_line":"Castellan. When a user creates an encrypted volume type, and creates a"},{"line_number":25,"context_line":"volume using that type, the Block Storage (cinder) service requests the"},{"line_number":26,"context_line":"key manager creates a key to be associated with that volume. When the"},{"line_number":27,"context_line":"volume is attached to an instance, nova retrieves the key."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"For more details, see the `Data Encryption section \u003chttps://docs.openstack.org/security-guide/tenant-data/data-encryption.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_e45959fe","line":26,"range":{"start_line":26,"start_character":3,"end_line":26,"end_character":26},"updated":"2017-09-25 11:58:25.000000000","message":"\"...requests the key manager to create a key...\"?","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"787ee94621e79c3e713910d1c6f498d6e08a7d7d","unresolved":false,"context_lines":[{"line_number":23,"context_line":"The volume encryption feature provides encryption of data-at-rest using"},{"line_number":24,"context_line":"Castellan. When a user creates an encrypted volume type, and creates a"},{"line_number":25,"context_line":"volume using that type, the Block Storage (cinder) service requests the"},{"line_number":26,"context_line":"key manager creates a key to be associated with that volume. When the"},{"line_number":27,"context_line":"volume is attached to an instance, nova retrieves the key."},{"line_number":28,"context_line":""},{"line_number":29,"context_line":"For more details, see the `Data Encryption section \u003chttps://docs.openstack.org/security-guide/tenant-data/data-encryption.html\u003e`_."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_bd281386","line":26,"range":{"start_line":26,"start_character":3,"end_line":26,"end_character":26},"in_reply_to":"7f515b1d_e45959fe","updated":"2017-09-25 14:41:34.000000000","message":"Done","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"}],"security-guide/source/secrets-management/summary-of-technologies.rst":[{"author":{"_account_id":11307,"name":"Andreas Scheuring","email":"andreas.scheuring@de.ibm.com","username":"uniqueName"},"change_message_id":"504de3385fb7517b34ac06db58dd03c8a48e49a7","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Within OpenStack, there are two solutions recommended for secrets"},{"line_number":6,"context_line":"managment, those being `Barbican \u003chttps://docs.openstack.org/barbican/latest/\u003e`_ and `Castellan \u003chttps://docs.openstack.org/castellan/latest/\u003e`_. This document will"},{"line_number":7,"context_line":"outline different scenarios to help an operator make a choice on which"},{"line_number":8,"context_line":"key manager to use."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"A third non supported method is Fixed/Hardcoded keys. It is known that some"},{"line_number":11,"context_line":"OpenStack services have the option to specify keys in their configuration"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_04047514","line":8,"range":{"start_line":6,"start_character":146,"end_line":8,"end_character":19},"updated":"2017-09-25 11:58:25.000000000","message":"I\u0027m missing exactly this section in this document. - ok found it in the file related-projects. Maybe a link to this document helps?","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"787ee94621e79c3e713910d1c6f498d6e08a7d7d","unresolved":false,"context_lines":[{"line_number":3,"context_line":"\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d"},{"line_number":4,"context_line":""},{"line_number":5,"context_line":"Within OpenStack, there are two solutions recommended for secrets"},{"line_number":6,"context_line":"managment, those being `Barbican \u003chttps://docs.openstack.org/barbican/latest/\u003e`_ and `Castellan \u003chttps://docs.openstack.org/castellan/latest/\u003e`_. This document will"},{"line_number":7,"context_line":"outline different scenarios to help an operator make a choice on which"},{"line_number":8,"context_line":"key manager to use."},{"line_number":9,"context_line":""},{"line_number":10,"context_line":"A third non supported method is Fixed/Hardcoded keys. It is known that some"},{"line_number":11,"context_line":"OpenStack services have the option to specify keys in their configuration"}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_3d13035f","line":8,"range":{"start_line":6,"start_character":146,"end_line":8,"end_character":19},"in_reply_to":"7f515b1d_04047514","updated":"2017-09-25 14:41:34.000000000","message":"I replaced this with \u0027chapter\u0027.","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"},{"author":{"_account_id":11307,"name":"Andreas Scheuring","email":"andreas.scheuring@de.ibm.com","username":"uniqueName"},"change_message_id":"504de3385fb7517b34ac06db58dd03c8a48e49a7","unresolved":false,"context_lines":[{"line_number":16,"context_line":"and Red October, however it is outside the scope of this document to cover"},{"line_number":17,"context_line":"every Key Manager available."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"For storage of secrets, it strongly recommended to a Hardware Security"},{"line_number":20,"context_line":"Modules (HSMs). HSMs can come in multiple forms. The traditional device is a"},{"line_number":21,"context_line":"rack mounted appliance such as the one `shown in the following blog post \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_04523514","line":20,"range":{"start_line":19,"start_character":0,"end_line":20,"end_character":14},"updated":"2017-09-25 11:58:25.000000000","message":"I\u0027m not a native speaker (so I might be wrong), but this sentence sounds strange to me. What about \"..., it\u0027s strongly recommended to use HSMs?\" Or what is \"it\" supposed to be?","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"},{"author":{"_account_id":17893,"name":"Luke Hinds","email":"lhinds@redhat.com","username":"lhinds"},"change_message_id":"787ee94621e79c3e713910d1c6f498d6e08a7d7d","unresolved":false,"context_lines":[{"line_number":16,"context_line":"and Red October, however it is outside the scope of this document to cover"},{"line_number":17,"context_line":"every Key Manager available."},{"line_number":18,"context_line":""},{"line_number":19,"context_line":"For storage of secrets, it strongly recommended to a Hardware Security"},{"line_number":20,"context_line":"Modules (HSMs). HSMs can come in multiple forms. The traditional device is a"},{"line_number":21,"context_line":"rack mounted appliance such as the one `shown in the following blog post \u003chttps://vakwetu.wordpress.com/2015/11/30/barbican-and-dogtagipa/\u003e`_."}],"source_content_type":"text/x-rst","patch_set":22,"id":"7f515b1d_dd174f45","line":20,"range":{"start_line":19,"start_character":0,"end_line":20,"end_character":14},"in_reply_to":"7f515b1d_04523514","updated":"2017-09-25 14:41:34.000000000","message":"You\u0027re right, it does not read well..I replaced with \"it\u0027s\"","commit_id":"e42e41efb354e574e1002af350b59df54bc8ad7a"}]}