Joshua,<div>user is authorized before the call gets to the scheduler.</div><div>If user authorized, before any calls to the scheduler, there is a check if he doesn't exceed quotas.</div><div><br></div><div>If user authorized, has right role and doesn't exceed quotas - then message is sent to the scheduler.</div>
<div><br></div><div>My point of view is these checks along with SASL for MQ are enough.</div><div>I would also recommend to run all OpenStack services in separated management VLAN,</div><div>so Rabbit should not even be accessible from projects' networks.</div>
<div><br></div><div>Regards,</div><div><br><div class="gmail_quote">On Sat, Oct 1, 2011 at 6:27 PM, l jv <span dir="ltr"><<a href="mailto:ljvsss@gmail.com">ljvsss@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
If i am not wrong,the rabbitmq have a password<div><div></div><div class="h5"><br><br><div class="gmail_quote">2011/10/2 Joshua Harlow <span dir="ltr"><<a href="mailto:harlowja@yahoo-inc.com" target="_blank">harlowja@yahoo-inc.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<font face="Calibri, Verdana, Helvetica, Arial"><span style="font-size:11pt">The question is more along the lines of this:<br>
<br>
So say u have ssl enabled, which is good.<br>
<br>
But should all actions/messages on the message queue also be verified before they are applied as coming from the correct user?<br>
<br>
Say u have an initial API call that says make me a server for user X. <br>
<br>
Now the scheduler gets that, it should then again verify that X can make a server (and so on).<br>
<br>
This kind of verification (time sensitive also) should seem like it would be useful, complimenting SSL for each component that receives a message.<br>
<br>
This would stop malicious (or limit) users hacking the message queue and spawning requests themselves. Just a thought.<div><div></div><div><br>
<br>
On 9/29/11 8:11 PM, "Mike Scherbakov" <<a href="http://mihgen@gmail.com" target="_blank">mihgen@gmail.com</a>> wrote:<br>
<br>
</div></div></span></font><div><div></div><div><blockquote><font face="Calibri, Verdana, Helvetica, Arial"><span style="font-size:11pt">Joshua,<br>
your question scares me :)<br>
<br>
Actually you can define user/pass for rabbitmq:<br>
See in rpc/impl_kombu.py, which is used by default:<br>
308 self.params = dict(hostname=FLAGS.rabbit_host,<br>
309 port=FLAGS.rabbit_port,<br>
310 userid=FLAGS.rabbit_userid,<br>
311 password=FLAGS.rabbit_password,<br>
312 virtual_host=FLAGS.rabbit_virtual_host)<br>
<br>
But this seems to be not secured connection, since I don't see here usage of SSL.<br>
In rpc/impl_carrot.py:<br>
66 params = dict(hostname=FLAGS.rabbit_host,<br>
67 port=FLAGS.rabbit_port,<br>
<b> 68 ssl=FLAGS.rabbit_use_ssl,<br>
</b> 69 userid=FLAGS.rabbit_userid,<br>
70 password=FLAGS.rabbit_password,<br>
71 virtual_host=FLAGS.rabbit_virtual_host)<br>
</span></font><span style="font-size:11pt"><font face="Arial">but I never tried this carrot and don't know if it works.<br>
<br>
Can someone else clarify the question? It seems important in terms of security.<br>
<br>
Thanks,<br>
</font><font face="Calibri, Verdana, Helvetica, Arial"><br>
On Wed, Sep 21, 2011 at 2:20 PM, Joshua Harlow <<a href="http://harlowja@yahoo-inc.com" target="_blank">harlowja@yahoo-inc.com</a>> wrote:<br>
</font></span><blockquote><span style="font-size:11pt"><font face="Calibri, Verdana, Helvetica, Arial">A quick security question.<br>
<br>
Is there any plan to force authentication/authorization of the rabbitmq messages?<br>
<br>
Right now it seems like keystone (tbd) will protect the external<->openstack layers but what about the openstack<->openstack layers.<br>
<br>
If someone got access to the rabbitmq it seems like without this kind of layer bad things could happen (create me 1000 nodes...).<br>
<br>
Has there been any thought in that area?<br>
<br>
-Josh<br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="http://openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br>
</font></span></blockquote><span style="font-size:11pt"><font face="Calibri, Verdana, Helvetica, Arial"><br>
<br>
</font></span></blockquote>
</div></div></div>
<br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/~openstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br>Mike Scherbakov<br>
</div>