Would there be any advantage in moving the quota checks inside the MQ?<br><br>eg for nodes, links, RAM usage, disk usage, etc.<br><br>Would there also be an advantage in using the SASL 'authzid' and 'authcid', ie user authenticated as x, but authorized to act as role y?<br>
<br clear="all">Raphael Cohn<br>Managing Director<br>raphael.cohn@StormMQ.com<br>StormMQ Limited<br><br>UK Office: <br>Gateshead int'l Business Centre, Mulgrave Terrace, Gateshead, NE8 1AN, United Kingdom<br>Telephone: +44 845 3712 567<br>
<br>Registered office:<br>78 Broomfield Road, Chelmsford, Essex, CM1 1SS, United Kingdom<br>StormMQ Limited is Registered in England and Wales under Company Number 07175657<br>StormMQ.com<br>
<br><br><div class="gmail_quote">On 2 October 2011 03:13, Mike Scherbakov <span dir="ltr"><<a href="mailto:mihgen@gmail.com">mihgen@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Joshua,<div>user is authorized before the call gets to the scheduler.</div><div>If user authorized, before any calls to the scheduler, there is a check if he doesn't exceed quotas.</div><div><br></div><div>If user authorized, has right role and doesn't exceed quotas - then message is sent to the scheduler.</div>
<div><br></div><div>My point of view is these checks along with SASL for MQ are enough.</div><div>I would also recommend to run all OpenStack services in separated management VLAN,</div><div>so Rabbit should not even be accessible from projects' networks.</div>
<div><br></div><div>Regards,</div><div><div><div></div><div class="h5"><br><div class="gmail_quote">On Sat, Oct 1, 2011 at 6:27 PM, l jv <span dir="ltr"><<a href="mailto:ljvsss@gmail.com" target="_blank">ljvsss@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
If i am not wrong,the rabbitmq have a password<div><div></div><div><br><br><div class="gmail_quote">2011/10/2 Joshua Harlow <span dir="ltr"><<a href="mailto:harlowja@yahoo-inc.com" target="_blank">harlowja@yahoo-inc.com</a>></span><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<font face="Calibri, Verdana, Helvetica, Arial"><span style="font-size: 11pt;">The question is more along the lines of this:<br>
<br>
So say u have ssl enabled, which is good.<br>
<br>
But should all actions/messages on the message queue also be verified before they are applied as coming from the correct user?<br>
<br>
Say u have an initial API call that says make me a server for user X. <br>
<br>
Now the scheduler gets that, it should then again verify that X can make a server (and so on).<br>
<br>
This kind of verification (time sensitive also) should seem like it would be useful, complimenting SSL for each component that receives a message.<br>
<br>
This would stop malicious (or limit) users hacking the message queue and spawning requests themselves. Just a thought.<div><div></div><div><br>
<br>
On 9/29/11 8:11 PM, "Mike Scherbakov" <<a href="http://mihgen@gmail.com" target="_blank">mihgen@gmail.com</a>> wrote:<br>
<br>
</div></div></span></font><div><div></div><div><blockquote><font face="Calibri, Verdana, Helvetica, Arial"><span style="font-size: 11pt;">Joshua,<br>
your question scares me :)<br>
<br>
Actually you can define user/pass for rabbitmq:<br>
See in rpc/impl_kombu.py, which is used by default:<br>
308 self.params = dict(hostname=FLAGS.rabbit_host,<br>
309 port=FLAGS.rabbit_port,<br>
310 userid=FLAGS.rabbit_userid,<br>
311 password=FLAGS.rabbit_password,<br>
312 virtual_host=FLAGS.rabbit_virtual_host)<br>
<br>
But this seems to be not secured connection, since I don't see here usage of SSL.<br>
In rpc/impl_carrot.py:<br>
66 params = dict(hostname=FLAGS.rabbit_host,<br>
67 port=FLAGS.rabbit_port,<br>
<b> 68 ssl=FLAGS.rabbit_use_ssl,<br>
</b> 69 userid=FLAGS.rabbit_userid,<br>
70 password=FLAGS.rabbit_password,<br>
71 virtual_host=FLAGS.rabbit_virtual_host)<br>
</span></font><span style="font-size: 11pt;"><font face="Arial">but I never tried this carrot and don't know if it works.<br>
<br>
Can someone else clarify the question? It seems important in terms of security.<br>
<br>
Thanks,<br>
</font><font face="Calibri, Verdana, Helvetica, Arial"><br>
On Wed, Sep 21, 2011 at 2:20 PM, Joshua Harlow <<a href="http://harlowja@yahoo-inc.com" target="_blank">harlowja@yahoo-inc.com</a>> wrote:<br>
</font></span><blockquote><span style="font-size: 11pt;"><font face="Calibri, Verdana, Helvetica, Arial">A quick security question.<br>
<br>
Is there any plan to force authentication/authorization of the rabbitmq messages?<br>
<br>
Right now it seems like keystone (tbd) will protect the external<->openstack layers but what about the openstack<->openstack layers.<br>
<br>
If someone got access to the rabbitmq it seems like without this kind of layer bad things could happen (create me 1000 nodes...).<br>
<br>
Has there been any thought in that area?<br>
<br>
-Josh<br>
<br>
<br>
_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="http://openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br>
</font></span></blockquote><span style="font-size: 11pt;"><font face="Calibri, Verdana, Helvetica, Arial"><br>
<br>
</font></span></blockquote>
</div></div></div>
<br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net" target="_blank">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br>
</div></div></blockquote></div><br><br clear="all"><div><br></div></div></div><font color="#888888">-- <br>Mike Scherbakov<br>
</font></div>
<br>_______________________________________________<br>
Mailing list: <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
Post to : <a href="mailto:openstack@lists.launchpad.net">openstack@lists.launchpad.net</a><br>
Unsubscribe : <a href="https://launchpad.net/%7Eopenstack" target="_blank">https://launchpad.net/~openstack</a><br>
More help : <a href="https://help.launchpad.net/ListHelp" target="_blank">https://help.launchpad.net/ListHelp</a><br>
<br></blockquote></div><br>