<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:MingLiU;
panose-1:2 2 5 9 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@MingLiU";
panose-1:2 2 5 9 0 0 0 0 0 0;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoPlainText>* Create a report on the state of SSL within OpenStack<o:p></o:p></p><p class=MsoPlainText>* Start a hardening guide (really big interest in this at the talk)<o:p></o:p></p><p class=MsoPlainText>* Work on Swift Message Authentication<o:p></o:p></p><p class=MsoPlainText>* Work on Nova RPC signing/encryption<o:p></o:p></p><p class=MsoPlainText>* Work on Nova messaging RBAC<o:p></o:p></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></b></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span lang=EN-US style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Mandell Degerness [mailto:mandell@pistoncloud.com] <br><b>Sent:</b> 24 October 2012 14:14<br><b>To:</b> OpenStack Development Mailing List<br><b>Subject:</b> Re: [openstack-dev] [OSSG] OpenStack Security Group Task List<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p>Seriously? There is a security environment where rsync is preferred over passwordless ssh? Raw rsync trusts the source that it is the ip address and user it says it is with no validation other than the use of a low numbered source port. <o:p></o:p></p><p>-Mandell Degerness<o:p></o:p></p><div><p class=MsoNormal>On Oct 23, 2012 8:39 PM, "<span style='font-family:"MS Gothic"'>文</span><span style='font-family:MingLiU'>剑</span>" <<a href="mailto:wenjianhn@gmail.com">wenjianhn@gmail.com</a>> wrote:<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>I have implemented a blueprint which solves a security problem last month, but didn't push<br> the code yet.<br><br><a href="https://blueprints.launchpad.net/nova/+spec/rysnc-without-ssh" target="_blank">https://blueprints.launchpad.net/nova/+spec/rysnc-without-ssh</a><br><br>It's description:<br><br>The disks are copied from source to destination via rysnc over ssh during resizing/migrating.<br>It means that we will need a password-less ssh private key setup among all compute nodes.<br>It is a security problem in some environment. This blueprint will use rsync itself(not over ssh) <br>to copy/delete the disks.<br><br><o:p></o:p></p><div><p class=MsoNormal>2012/10/24 Bryan D. Payne <<a href="mailto:bdpayne@acm.org" target="_blank">bdpayne@acm.org</a>><o:p></o:p></p><p class=MsoNormal>As the OpenStack Security Group (OSSG) begins to take shape, we are<br>looking to identify what work needs to be done. We have lots of<br>things in our heads, but I know others have similar lists in their<br>heads as well. I'd like to start this thread to collect security<br>related issues for any OpenStack core project. These can be things<br>with existing bug reports, or things that have just been sitting in<br>your head without actually making it into a bug report yet.<br><br>The idea is to have a list of problems where it would be useful for<br>security people to help. I'll start with the following to get us<br>going.<br><br>* Fix problems with clients using SSL (see slide 19 of<br><a href="http://www.bryanpayne.org/storage/ossg-oct2012.pdf" target="_blank">http://www.bryanpayne.org/storage/ossg-oct2012.pdf</a>)<br>* Start a hardening guide<br>* Work with swift team on Swift Message Authentication<br>* Work with nova team on Nova RPC signing<br>* Work with keystone team on new PKI tokens and related code<br>* Work with oslo team on rootwrap code<br>* Add a 'SecurityImpact' tag to mark pull requests as needing a review<br>by someone in OSSG<br><br>Please help us out by replying with your additions.<br><br>Cheers,<br>-bryan<br><br>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org" target="_blank">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br><br clear=all><br>-- <br>Best,<br><br>Ivan<br><br>_______________________________________________<br>OpenStack-dev mailing list<br><a href="mailto:OpenStack-dev@lists.openstack.org">OpenStack-dev@lists.openstack.org</a><br><a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev</a><o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p></div></div></div></body></html>