August 2013 - OpenStack-announce - lists.openstack.org

OpenStack Community Weekly Newsletter (Aug 23-30)
by Stefano Maffulli 31 Aug '13

31 Aug '13

Register Now For The Summit in Hong Kong <http://www.openstack.org/summit/openstack-summit-hong-kong-2013Register> <???????????????????? ???????, ???????? <http://openstacksummitnovember2013.eventbrite.com/> Ambassador Program -- Specifics <http://www.openstack.org/blog/2013/08/ambassador-program-specifics/> Following from the previous post <http://www.openstack.org/blog/2013/08/ambassador-program/>, we've had a range of people express their support for the program and quite a number already looking for the application form! So, some more details about the Ambassador Program. Ambassadors will be recognised on the OpenStack website for their efforts, and provided with support from foundation staff to conduct their duties. They will also get access to a funding program -- allowing them to request funds for activities of impact in their region. We'd also expect ambassadors to attend the summits, and the Foundation would likely assist if it wasn't possible for them to be there using their own methods. How Heat Orchestrates your OpenStack Resources <http://www.zerobanana.com/archive/2013/08/29#heat-dependencies> One of the great things about orchestration <http://www.zerobanana.com/archive/2013/07/30#openstack-orchestration-introd…> is that it automatically figures out the operations it needs to perform. So whenever you deploy (or modify) your infrastructure you need not write a script to do so; you simply describe the infrastructure you want and the orchestration engine does the rest. Zane Bitter <http://www.zerobanana.com/tags/OpenStack> describes how this works in Heat <https://wiki.openstack.org/wiki/Heat>. Autoscaling with Heat and Ceilometer <http://techs.enovance.com/5991/autoscaling-with-heat-and-ceilometer> Like AWS CloudFormation, Heat allows to create auto scaling stacks. In order to do this, some metrics need to be retrieved from your VM and some actions need to be triggered when a specified event occurs on these metrics. These actions are usually upscaling (create some new VMs) or downscaling (destroy some Vms). Starting with the Havana version (currently trunk), Ceilometer can now trigger actions when something happens to these metrics by creating alarms. The Heat agent inside the VM is no more needed. Taking OpenStack Core discussions to community <http://robhirschfeld.com/2013/08/27/taking-openstack-core-discussions-to-co…> We've been building up to a broad discussion about the OpenStack Core <http://robhirschfeld.com/2013/07/22/kicking-off-core/> and I'd like to invite everyone in the OpenStack community to participate (review latest <http://robhirschfeld.com/2013/08/13/openstack-core-positions/>). Alan Clark (Board Chairman) officially kicked off this open discussion with his post on the OpenStack blog <http://www.openstack.org/blog/2013/08/addressing-the-topic-of-core-through-…> last week. And we're trying to have face-to-face events for dialog like the Core meetup tonight in San Francisco <http://www.meetup.com/openstack/events/134495312/>. Look for more to come! Of course, this will also be a topic at the summit <https://www.openstack.org/blog/2013/08/voting-is-open-help-choose-who-will-…>. The Board needs to move this forward in the November meeting, so NOW is the time to review and give us input. The OpenStack T-Shirt Design Contest Winner is... <http://www.openstack.org/blog/2013/08/the-openstack-t-shirt-design-contest-…> Raul Chan's design. Check it out on OpenStack's blog. OpenStack in Production OpenStack Swift & many small files <http://engineering.spilgames.com/openstack-swift-lots-small-files/?utm_sour…> Spil Games has been running Swift for more than two years now, hosting over 400 million files with an average file size of about 50 KB per object. They have a replica count of three so there are*1.2 billion* files to be stored on the object servers. Generally speaking, Swift has turned out to be a solid object storage system. They however run into some performance issues and in a blog post they describe how they analyzed and solved them. Tips 'n Tricks * By eNovance Engineering Teams <http://techs.enovance.com/>: Manage Jenkins Jobs with YAML <http://techs.enovance.com/6006/manage-jenkins-jobs-with-yaml> * By Sébastien Han <http://sebastien-han.fr/>: Want to save money in the Cloud? OpenStack CoreOS image is there <http://sebastien-han.fr/blog/2013/08/30/want-to-save-money-in-the-cloud-cor…> * By The Official Rackspace Blog <http://www.rackspace.com/blog>: A .NET Developer's Guide To The World Of Open Source <http://www.rackspace.com/blog/a-net-developers-guide-to-the-world-of-open-s…> * By HTTP GET-outta here! <https://tropicaldevel.wordpress.com/2013/08/26/http-get-outta-here/> Setup Nova to get images from local disks instead of HTTP * By Lorin Hochstein <http://lorinhochstein.wordpress.com/>: Automated DevStack install inside of VirtualBox with Vagrant <http://lorinhochstein.wordpress.com/2013/08/17/automated-devstack-install-i…> Upcoming Events * 2nd Openstack Athens User Group meeting <http://www.meetup.com/Athens-OpenStack-User-Group/events/131129272/> Sep 06, 2013 - Athens, Greece Details <http://www.meetup.com/Athens-OpenStack-User-Group/events/131129272/> * 2nd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/>Sep 11, 2013 -- Kista, Stockholm Details <http://www.meetup.com/OpenStack-User-Group-Nordics/> * OpenStack In Action -- Powering IaaS Cloud <http://barcampbangalore.org/bcb/bcb14/openstack-in-action-powering-iaas-clo…>Sep 14, 2013 -- SAP Labs Whitefield, Bangalore Details <http://barcampbangalore.org/bcb/bcb14/openstack-in-action-powering-iaas-clo…> * Cloud Connect China <http://www.cloudconnectevent.cn/>, September 15-17 2013, Shanghai, China * LinuxCon/Cloud Open North America <http://events.linuxfoundation.org/events/cloudopen-north-america>, September 16-18 2013, New Orleans, LA, USA, * GigaOM Structure UK <http://event.gigaom.com/structure>, September 18-19 2013, London, England, UK * OpenStack India Day <http://openstackindia.wordpress.com/2013/08/14/openstack-india-day-2013-ann…> Sep 21, 2013 -- Bangalore Details <http://openstackindia.wordpress.com/2013/08/14/openstack-india-day-2013-ann…> * Hosting & Cloud Transformation Summit <http://na.hostingtransformation.com/>Sep 23 -- 25, 2013 -- Las Vegas, USA Details <http://na.hostingtransformation.com/> * OpenStack on Ales <http://openstack.onales.com/> Sep 30 -- Oct 01, 2013 -- Bend, OR Details <http://openstack.onales.com/> * Open World Forum (Paris) <http://www.openworldforum.com/>,October 3-5 2013, Paris, France * Gartner Symposium/IT Expo North America <http://www.gartner.com/technology/symposium/orlando/>, October 6-10 2013, Orlando, FL, USA, * OpenStack in action! -- The Canadian Chapter <https://openstackinactioncanada.eventbrite.com/> Oct 08, 2013 -- Montreal, Canada Details <https://openstackinactioncanada.eventbrite.com/> * Swift Hackathon <http://swifthackathon.eventbrite.com/> Oct 15 -- 17, 2013 -- Aust, TX Details <http://swifthackathon.eventbrite.com/> * LinuxCon/Cloud Open Europe <http://events.linuxfoundation.org/events/cloudopen-europe>, October 21-23 2013, Edinburgh, Scotland, UK * Cloud Connect <http://www.cloudconnectevent.com/chicago>, October 21-24 2013, Chicago, IL, USA * USENIX LISA <https://www.usenix.org/conference/lisa13>, November 3-8 2013, Washington DC, USA * OW2 Annual Conference <http://www.ow2.org/view/OW2con-2013/>, November 13-14 2013, Paris, France * INTEROP <http://www.interop.in/> Nov 20 -- 22, 2013 -- Mumbai, India Details <http://www.interop.in/> * Gartner Data Center Conference <http://www.gartner.com/technology/summits/na/data-center/>, December 9-12 2013, Las Vegas, NV, USA Reports from Previous Events * Slides from OpenStack in production <http://sebastien-han.fr/blog/2013/08/15/openstack-in-production-slides/> * OpenStack in Debian <http://www.enovance.com/fr/blog/5900/openstack-in-debian> * Wrap Up: Google+ Hangout with Puppet Labs <http://rafstack.tumblr.com/post/58158674229> Other News * Open Mic Spotlight: Julie Pichon <http://www.openstack.org/blog/2013/08/open-mic-spotlight-julie-pichon/> * The Fanatical Faces of Rackspace Private Cloud: Anne Gentle <http://www.rackspace.com/blog/the-fanatical-faces-of-rackspace-private-clou…> * Brian Aker Talks to Linux.com <https://blog.hpcloud.com/brian-aker-talks-linuxcom> * Hadoop on OpenStack: Elastic Data Processing (EDP) with Savanna 0.3 <http://www.mirantis.com/blog/savannah-0-3-edp-analytics-as-a-service/> * OpenStack Community Meeting: Summary <http://eavesdrop.openstack.org/meetings/openstack_community/2013/openstack_…> and full logs <http://eavesdrop.openstack.org/meetings/openstack_community/2013/openstack_…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-27-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-27-21.…> Security Advisories * Resource limit circumvention in Nova private flavors (CVE-2013-4278) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.…> Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Is there a way of passing the language header to openstack REST API calls so that the message returned by openstack is localized? <https://ask.openstack.org/en/question/4346/is-there-a-way-of-passing-the-la…> * No symmetric pinging connectivity between VMs and routers/DHCP servers <https://ask.openstack.org/en/question/4673/no-symmetric-pinging-connectivit…> * How to integrate anti virus / anti malware for vm's? <https://ask.openstack.org/en/question/4654/how-to-integrate-anti-virus-anti…> * Nova security group not working properly <https://ask.openstack.org/en/question/4613/nova-security-group-not-working-…> * How to upgrade from grizzly to havana? <https://ask.openstack.org/en/question/4576/how-to-upgrade-from-grizzly-to-h…> * How to create a baremetal virtual machine provisioned by openstack grizzly? <https://ask.openstack.org/en/question/4568/how-to-create-a-baremetal-virtua…> * How to setup image metadata with python API 0.11.0? <https://ask.openstack.org/en/question/4502/how-to-setup-image-metadata-with…> Welcome New Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! * Jakub Krajcovic, Rackspace * Michal Jura, Suse * Maris Fogels, None * Tim Smith, Gridcentric * Claudiu Belu, Cloudbase Solutions * David Stanek, AG Interactive * John Dennis, Red Hat * Mikhail Dubov, Mirantis * Scott Radvan, Red Hat * Michael Solberg, Red Hat * Auston McReynolds, eBay * Ilya Sviridov, Mirantis * Chris Johnson, Rackspace /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-024] Resource limit circumvention in Nova private flavors (CVE-2013-4278)
by Thierry Carrez 28 Aug '13

28 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-024 CVE: CVE-2013-4278 Date: August 28, 2013 Title: Resource limit circumvention in Nova private flavors Reporter: Ken'ichi Ohmichi (NEC) Products: Nova Affects: All versions Description: Ken'ichi Ohmichi from NEC reported that the fix for OSSA 2013-019 (CVE-2013-2256) was incomplete. Any tenant was still able to boot any other tenant's private flavors by guessing a flavor ID. This potentially allowed circumvention of any resource limits enforced through the os-flavor-access:is_public property. Havana (development branch) fix: https://review.openstack.org/#/c/42922/ Grizzly fix: https://review.openstack.org/#/c/43281/ Folsom fix: https://review.openstack.org/#/c/43296/ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4278 https://bugs.launchpad.net/nova/+bug/1212179 Regards, - -- Thierry Carrez OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIbBAEBCAAGBQJSHfbsAAoJEFB6+JAlsQQjPUkP9i/41IQPecZ/1V7nsQLPWssp AUgP5tEwEUGVNGaMM6ptaQtQxrLD+aACi7z8zRZgJopHrDptbIckbRikeSxrzsLB eWQxynkFPhcjRQTFZOuoEwDdqYUFCr614uGUmCFomYTBIWEZS3ea5aN7PAO4fd62 6hsOHr6xcj7JcZY1GlVNZBcpWel9rvxcXroPrPqmecyDdSPCuiWj8QNiWQ8Y62Vy ZSOzHjyAWe32sqMSYp3zygdhpX1yacTVf76jDNw+FcLHkqFf4kRX7uJCCPFKNpIk 2nngSjWZEizIkinIc+mzt2vFKt7JMjCJsy7uLKIp9HsJzVN8qH0x6axe3nuMoliC xdzybOzlCfEOU+L1q0fVVAiuTnXqE562mnm7HchHiUpKHJRv+4hWwukOsy2Wv+aD TweNziKwmxYdakhEduql4BJ1/6Mqk+1014Q/uOAyO8iKra8JO9i/ZULvuJgQNIao oXdFCJoKItP+UouaZ4PrRwilwWgVu4rsRWL1STcHgnHorFrCJQ0iO/W9ofn+ft4z R2q3tBpJDaeorM2D/Q2VkzYvUzAEAa+BCh1CRxMCVIMh6VmSv40TzczmgrdSRUVj 7cKaxc0xiLiPOoYorWuL0A7RPkadOMk9SihmakX70UR5NyfoqdOoAYnl8xcKNaD8 MlxVcQfdPQMWbw6UltQ= =DGPB -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Aug 10-23)
by Stefano Maffulli 23 Aug '13

23 Aug '13

Cast your vote for the presentation to be presented at OpenStack Summit, November 5-8, in Hong Kong <http://www.openstack.org/rate/> ???????????????????? ???????, ???????? <http://openstacksummitnovember2013.eventbrite.com/> Introducing the OpenStack Ambassador Program <http://www.openstack.org/blog/2013/08/ambassador-program/> OpenStack Community Manager Tom Fifield started the discussion on the formation of an OpenStack Ambassador Program, which aims to create a framework of community leaders to sustainably expand the reach of OpenStack around the world. We would like to recognize and further empower these community members to achieve the OpenStack mission, as well as provide more structure and resources to the growing community and user groups. Your feedback would be excellent! For more specifics on the program, and information about becoming an ambassador, stay tuned for the next post. Managing identities in the cloud <http://openstack-in-production.blogspot.com/2013/08/managing-identities-in-…> CERN has 11,000 physicists who use the lab's facilities including the central IT department resources. As with any research environment, there are many students, PhDs and other project members who join one of the experiments at CERN. They need to have computing accounts to access CERN's cloud but we also need to make sure these resources are handled correctly when they are no longer affiliated with the organisation. Why OpenStack Puppet modules did not have vacation <http://my1.fr/blog/why-openstack-puppet-modules-did-not-have-vacation/?utm_…> A lot of work has been done on Puppet modules lately. There is no doubt to say that puppet modules are designed for high-quality and best-practices configurations around an important community who takes care of those concepts. Yet another way to monitor OpenStack <http://my1.fr/blog/yet-another-way-to-monitor-openstack/?utm_source=rss&utm…> Emilien Macchi <http://my1.fr/blog> decided to write some useful scripts to check if every OpenStack service are running. He was not fully satisfied with current methods because he feels they lack some deepness. refined: 10 OpenStack Core Positions <http://robhirschfeld.com/2013/08/13/openstack-core-positions/> OpenStack Foundation Board member Rob Hirschfeld <http://robhirschfeld.com/> keeps iterating looking for a proposal to define "what is core" <http://robhirschfeld.com/2013/07/22/kicking-off-core/> in the context of OpenStack. This is a must-read for anybody interested in joining the meeting in San Francisco on Aug 27 <http://www.meetup.com/openstack/events/134495312/>. Tips 'n Tricks * By Adam Young <http://adam.younglogic.com/>: Deploying Keystone via Puppet on Fedora 19 <http://adam.younglogic.com/2013/08/deploying-keystone-via-puppet-on-f19/> * By Sébastien Han <http://sebastien-han.fr/>: Configure Ceph RBD caching on OpenStack Nova <http://sebastien-han.fr/blog/2013/08/22/configure-rbd-caching-on-nova/> * By Sébastien Han <http://sebastien-han.fr/>: Best localrc for DevStack <http://sebastien-han.fr/blog/2013/08/16/best-localrc-for-devstack/> * By Kenneth Hui <http://cloudarchitectmusings.com/>: OpenStack Compute For vSphere Admins, Part 5: Designing A Multi-hypervisor Cloud <http://cloudarchitectmusings.com/2013/08/22/openstack-compute-for-vsphere-a…> * By Sandro Mathys <http://www.blog.sandro-mathys.ch/search/label/OpenStack>: Install OpenStack Havana-2 from RDO on Fedora 19 and avoid the pitfalls <http://www.blog.sandro-mathys.ch/2013/08/install-rdo-havana-2-on-fedora-19-…> * By Lorin Hochstein <http://lorinhochstein.wordpress.com/>: Automated DevStack install inside of VirtualBox with Vagrant <http://lorinhochstein.wordpress.com/2013/08/17/automated-devstack-install-i…> * By John Bresnahan <https://tropicaldevel.wordpress.com/>: Preparing Fedora 19 for OpenStack Glance Development <https://tropicaldevel.wordpress.com/2013/08/14/preparing-fedora-19-for-open…> * By Mehdi Abaakouk <http://blog.sileht.net/>: Using a sharding/replicaSet mongodb with ceilometer <http://blog.sileht.net/using-a-shardingreplicaset-mongodb-with-ceilometer> * By Flavio Percoco <http://blog.flaper87.org/>: Using libgfapi to access Glusterfs Volumes in Nova <http://blog.flaper87.org/post/520b7ff00f06d37b7a766dc0/> * By Loïc Dachary <http://dachary.org/>: HOWTO install Ceph teuthology on OpenStack <http://dachary.org/?p=2204> * By ICCLab <http://www.cloudcomp.ch/>: OpenStack HA: why is Pacemaker such a slow recovery tool? <http://www.cloudcomp.ch/2013/08/openstack-ha-why-is-pacemaker-such-a-slow-r…> * By Mirantis <http://www.mirantis.com/>: Demo Video: Using Heat for Auto-scaling with OpenStack cloud <http://www.mirantis.com/blog/heat-autoscaling-in-action/> * By The Official Rackspace Blog <http://www.rackspace.com/blog>: OpenStack Nova-Scheduler And vSphere DRS <http://www.rackspace.com/blog/openstack-nova-scheduler-and-vsphere-drs/> * By Daniel P. Berrangé <https://www.berrange.com/>: Fine grained access control in libvirt using polkit <https://www.berrange.com/posts/2013/08/12/fine-grained-access-control-in-li…> Upcoming Events * Bangalore Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> Aug 24, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> * Primer Evento Grupo Venezolano OpenStack <https://plus.google.com/u/0/106856980692854321746/posts/bFpvMPqffp9> Aug 24, 2013 -- Caracas, Venezuela Details <https://plus.google.com/u/0/106856980692854321746/posts/bFpvMPqffp9> * 2nd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/>Sep 11, 2013 -- Kista, Stockholm Details <http://www.meetup.com/OpenStack-User-Group-Nordics/> * OpenStack In Action -- Powering IaaS Cloud <http://barcampbangalore.org/bcb/bcb14/openstack-in-action-powering-iaas-clo…>Sep 14, 2013 -- SAP Labs Whitefield, Bangalore Details <http://barcampbangalore.org/bcb/bcb14/openstack-in-action-powering-iaas-clo…> * Cloud Connect China <http://www.cloudconnectevent.cn/>, September 15-17 2013, Shanghai, China * LinuxCon/Cloud Open North America <http://events.linuxfoundation.org/events/cloudopen-north-america>, September 16-18 2013, New Orleans, LA, USA, * GigaOM Structure UK <http://event.gigaom.com/structure>, September 18-19 2013, London, England, UK * OpenStack India Day <http://openstackindia.wordpress.com/2013/08/14/openstack-india-day-2013-ann…> Sep 21, 2013 -- Bangalore Details <http://openstackindia.wordpress.com/2013/08/14/openstack-india-day-2013-ann…> * Hosting & Cloud Transformation Summit <http://na.hostingtransformation.com/>Sep 23 -- 25, 2013 -- Las Vegas, USA Details <http://na.hostingtransformation.com/> * OpenStack on Ales <http://openstack.onales.com/> Sep 30 -- Oct 01, 2013 -- Bend, OR Details <http://openstack.onales.com/> * Open World Forum (Paris) <http://www.openworldforum.com/>,October 3-5 2013, Paris, France * Gartner Symposium/IT Expo North America <http://www.gartner.com/technology/symposium/orlando/>, October 6-10 2013, Orlando, FL, USA, * OpenStack in action! -- The Canadian Chapter <https://openstackinactioncanada.eventbrite.com/> Oct 08, 2013 -- Montreal, Canada Details <https://openstackinactioncanada.eventbrite.com/> * Swift Hackathon <http://swifthackathon.eventbrite.com/> Oct 15 -- 17, 2013 -- Aust, TX Details <http://swifthackathon.eventbrite.com/> * LinuxCon/Cloud Open Europe <http://events.linuxfoundation.org/events/cloudopen-europe>, October 21-23 2013, Edinburgh, Scotland, UK * Cloud Connect <http://www.cloudconnectevent.com/chicago>, October 21-24 2013, Chicago, IL, USA * USENIX LISA <https://www.usenix.org/conference/lisa13>, November 3-8 2013, Washington DC, USA * OW2 Annual Conference <http://www.ow2.org/view/OW2con-2013/>, November 13-14 2013, Paris, France * INTEROP <http://www.interop.in/> Nov 20 -- 22, 2013 -- Mumbai, India Details <http://www.interop.in/> * Gartner Data Center Conference <http://www.gartner.com/technology/summits/na/data-center/>, December 9-12 2013, Las Vegas, NV, USA Reports from Previous Events * Slides from OpenStack in production <http://sebastien-han.fr/blog/2013/08/15/openstack-in-production-slides/> * OpenStack in Debian <http://www.enovance.com/fr/blog/5900/openstack-in-debian> * Wrap Up: Google+ Hangout with Puppet Labs <http://rafstack.tumblr.com/post/58158674229> Other News * Benchmark OpenStack Swift <http://www.enovance.com/fr/blog/5893/benchmark-openstack-swift> * OpenMic Spotlight: Gabriel Hurley <http://www.openstack.org/blog/2013/08/openmic-spotlight-gabriel-hurley/> * OpenMic Spotlight: Kyle Mestery <http://www.openstack.org/blog/2013/08/openmic-spotlight-kyle-mestery/> * The Fanatical Faces Of Rackspace Private Cloud: Joe Burke <http://www.rackspace.com/blog/the-fanatical-faces-of-rackspace-private-clou…> * The Fanatical Faces Of Rackspace Private Cloud: Tech Writer Karin Levenstein <http://www.rackspace.com/blog/the-fanatical-faces-of-rackspace-private-clou…> * OpenStack Community Meeting: Summary <http://eavesdrop.openstack.org/meetings/openstack_community/2013/openstack_…> and full logs <http://eavesdrop.openstack.org/meetings/openstack_community/2013/openstack_…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-20-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-20-21.…> Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: previous week's: * How to troubleshoot a Swift Container running with a high CPU amount? <https://ask.openstack.org/en/question/4431/how-to-troubleshoot-a-swift-cont…> * Failed to mount filesystem: no operating system was found on this disk <https://ask.openstack.org/en/question/4409/failed-to-mount-filesystem-no-op…> * Is there a way of passing the language header to openstack REST API calls so that the message returned by openstack is localized? <https://ask.openstack.org/en/question/4346/is-there-a-way-of-passing-the-la…> * How to create the connection between OVS bridge and the linux bridge? <https://ask.openstack.org/en/question/4293/how-to-create-the-connection-bet…> * Realm Value need to be passed from horizon to get the complete list of available Idp's in Keystone ? <https://ask.openstack.org/en/question/4280/realm-value-need-to-be-passed-fr…> * Slow virtio network performance <https://ask.openstack.org/en/question/4240/slow-virtio-network-performance/> * Unable to configure baremetal for grizzly: DatabaseNotControlledError <https://ask.openstack.org/en/question/4237/unable-to-configure-baremetal-fo…> Welcome New Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! * Jaime Gil de Sagredo Luna, StackOps * Joshua Hesketh * Oleg Gelbukh, Mirantis * Jiri Stransky, Red Hat * Steffen Gebert, None * Trevor Robert, Jr, Cisco * Pei Zhen, None * Sabari Kumar Murugesan, Vmware * Ignacio Barrio, Stackops * Charles V Bock, Intel * Jordan OMara, Red Hat * Sarah Novotny, Meteor Entertainment * Maksym Iarmak, Mirantis * Marton Kiss, Fremont Ltd * Petr Blaho, Red Hat * Ryan Hsu, Vmware * Alan Jiang, IBM * Zhang Guoqing, None * Hwbi * Abhijeet Malawade, NTT Data * Shuangtai Tian, Intel * Jake Liu, None * Vladislav Kuzmin, Mirantis * Nejc Saje, Xlab d.o.o. * Peter Mooshammer, None * Floren Llanos, None /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[Swift] Swift 1.9.9 RC available
by John Dickinson 13 Aug '13

13 Aug '13

Today we have released Swift 1.9.1 (RC1). The tarball for the RC is at http://tarballs.openstack.org/swift/swift-milestone-proposed.tar.gz This release was initially prompted by a bug found by Peter Portante (https://bugs.launchpad.net/swift/+bug/1196932) and includes a patch for it. All clusters are recommended to upgrade to this new release. As always, you can upgrade to this version of Swift with no end-user downtime. In addition to the patch mentioned above, this release contains a few other important features: * The default worker count has changed from 1 to auto. The new default value will for workers in the proxy, container, account & object wsgi servers will spawn as many workers per process as you have cpu cores. * A "reveal_sensitive_prefix" config parameter was added to the proxy_logging config. This value allows the auth token to be obscured in the logs. * The Keystone middleware will now enforce that the reseller_prefix ends in an underscore. Previously, this was a recommendation, and now it is enforced. There are several other changes in this release. I'd encourage you to read the full changelog at https://github.com/openstack/swift/blob/master/CHANGELOG. On the community side, this release includes the work of 7 new contributors. They are: Alistair Coles (alistair.coles(a)hp.com) Thomas Leaman (thomas.leaman(a)hp.com) Dirk Mueller (dirk(a)dmllr.de) Newptone (xingchao(a)unitedstack.com) Jon Snitow (otherjon(a)swiftstack.com) TheSriram (sriram(a)klusterkloud.com) Koert van der Veer (koert(a)cloudvps.com) Thanks to everyone for your hard work. I'm very happy with where Swift is and where we are going together. --John

1 1

OpenStack Community Weekly Newsletter (Aug 2-9)
by Stefano Maffulli 10 Aug '13

10 Aug '13

Hong Kong Summit -- Registration, Call for Sponsors Now Open! <http://www.openstack.org/blog/2013/06/hong-kong-summit-registration-call-fo…> ???????????????????? ???????, ???????? <http://openstacksummitnovember2013.eventbrite.com/> DevStack in 1 minute <http://sebastien-han.fr/blog/2013/08/08/devstack-in-1-minute/> It can be as easy as it looks: step by step instructions by Sébastien Han <http://sebastien-han.fr/>. *OpenStack Compute For vSphere Admins <http://cloudarchitectmusings.com/2013/08/05/openstack-compute-for-vsphere-a…>* An ongoing series of posts by Kenneth Hui <http://cloudarchitectmusings.com/> about OpenStack for vSphere Admins. You can catch up on previous posts by following the links here for part 1 <http://cloudarchitectmusings.com/2013/06/24/openstack-for-vmware-admins-nov…>, part 2 <http://cloudarchitectmusings.com/2013/06/26/openstack-for-vmware-admins-nov…>, part 3 <http://cloudarchitectmusings.com/2013/07/09/openstack-compute-for-vsphere-a…> and part 4 <http://cloudarchitectmusings.com/2013/08/05/openstack-compute-for-vsphere-a…>. OpenStack's Test Driven Core <http://robhirschfeld.com/2013/08/08/openstacks-test-driven-core-its-where-i…> In helping drive OpenStack's "what is core" dialog <http://robhirschfeld.com/2013/08/06/core-community-dialogue/>, board member Rob Hirschfeld <http://robhirschfeld.com/> has reported a lot of viewpoints about what OpenStack is and what it should be <http://robhirschfeld.com/2013/07/22/making-openstack-meaningful/>. As a good steward of this process he has successfully managed to be an objective listener <http://web.missouri.edu/%7Ecampbellr/Leadership/chapter6.htm>. In the recent post in the series, he expresses his point of view. This is one of the most important conversations for the OpenStack Foundation and it's happening now. Flavors -- An English perspective <http://openstack-in-production.blogspot.com/2013/08/flavors-english-perspec…> OpenStack has the capability to define flavors of virtual machines, how many cores, swap, disk and memory. As a native UK English speaker, Tim Bell finds the term /flavor/ to already be a problem. In his post describing how flavors are used at CERN he appeals to the OpenStack technical committee to not accept any term which is not the same in US and UK English or to allow an alias. His post has lots of other interesting information, too. Non-Relational Database-as-a-Service in OpenStack <http://www.zerobanana.com/archive/2013/08/07#non-relational-trove> The OpenStack Technical Committee voted this week <http://eavesdrop.openstack.org/meetings/tc/2013/tc.2013-08-06-20.01.html> to expand the scope of the Trove <https://wiki.openstack.org/wiki/Trove> program, which is currently in incubation, to encompass non-relational as well as relational databases. Tips 'n Tricks * By John Bresnahan <https://tropicaldevel.wordpress.com/>: Download Modules In Nova <https://tropicaldevel.wordpress.com/2013/08/07/download-modules-in-nova/> * By Marconi's mongodb driver improvements <http://blog.flaper87.org/post/520172de0f06d356d434d61d/> * By Emilien Macchi <http://my1.fr/blog>: Yet another way to monitor OpenStack <http://my1.fr/blog/yet-another-way-to-monitor-openstack/?utm_source=rss&utm…> * By Steve Hardy <http://hardysteven.blogspot.com/search/label/openstack>: Heat Nested Resource Introspection <http://hardysteven.blogspot.com/2013/08/heat-nested-resource-introspection.…> * By The Official Rackspace Blog <http://www.rackspace.com/blog>: Architecting VMware vSphere For OpenStack <http://www.rackspace.com/blog/architecting-vmware-vsphere-for-openstack/> * By Christian Berendt <http://www.cberendt.de/>: Using Redis with Horizon <http://www.cberendt.de/2013/08/using-redis-with-horizon/?utm_source=rss&utm…> * By Michael Still <http://www.stillhq.com/>: Exploring a single database migration <http://www.stillhq.com/openstack/tips/000002.html> Upcoming Events * Openstack Bucharest Meeting <http://www.meetup.com/Openstack-Bucharest/events/123884092/> Aug 12, 2013 -- Bucharest, Romania Details <http://www.meetup.com/Openstack-Bucharest/events/123884092/> * Bangalore Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> Aug 24, 2013 -- Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> * Primer Evento Grupo Venezolano OpenStack <https://plus.google.com/u/0/106856980692854321746/posts/bFpvMPqffp9> Aug 24, 2013 -- Caracas, Venezuela Details <https://plus.google.com/u/0/106856980692854321746/posts/bFpvMPqffp9> * 2nd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/>Sep 11, 2013 -- Kista, Stockholm Details <http://www.meetup.com/OpenStack-User-Group-Nordics/> * OpenStack on Ales <http://openstack.onales.com/> Sep 30 -- Oct 01, 2013 -- Bend, OR Details <http://openstack.onales.com/> * Swift Hackathon <http://swifthackathon.eventbrite.com/> Oct 15 -- 17, 2013 -- Aust, TX Details <http://swifthackathon.eventbrite.com/> * INTEROP <http://www.interop.in/> Nov 20 -- 22, 2013 -- Mumbai, India Details <http://www.interop.in/> Reports from Previous Events * HP Public Cloud OSCON Sessions -- Videos <https://blog.hpcloud.com/hp-public-cloud-oscon-sessions-videos> * Aug 6th OpenStack Foundation Board Meeting <http://blogs.gnome.org/markmc/2013/08/08/aug-6th-openstack-foundation-board…> * Google+ Hangout with Puppet Labs <http://rafstack.tumblr.com/post/57600686980/august-8-google-hangout-with-pu…> Other News * python-heatclient 0.2.4 released <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000128.…> * heat-cfntools 1.2.5 released <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000129.…> * python-novaclient 2.14.0 released <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000125.…> * Open Mic Spotlight: Brad Topol <http://www.openstack.org/blog/2013/08/open-mic-spotlight-brad-topol/> * The Fanatical Faces Of Rackspace Private Cloud: Ryan Yard <http://www.rackspace.com/blog/the-fanatical-faces-of-rackspace-private-clou…> * Marconi's mongodb driver improvements <http://blog.flaper87.org/post/520172de0f06d356d434d61d/> * OpenStack Project Technical Lead Interview Series #7: Gabriel Hurley, OpenStack Horizon Project <http://www.mirantis.com/blog/openstack-project-technical-lead-interview-ser…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-06-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-08-06-21.…> * OpenStack Foundation Board official meeting minutes June 27 2013 <https://wiki.openstack.org/wiki/Governance/Foundation/27June2013BoardMinutes> * OpenStack Foundation Board meeting official summary <http://lists.openstack.org/pipermail/foundation/2013-August/001454.html> and Mark McLoughlin's notes <http://blogs.gnome.org/markmc/2013/08/08/aug-6th-openstack-foundation-board…> Security Advisories * Denial of Service using XML entities in Nova/Cinder extensions (CVE-2013-4179, CVE-2013-4202) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000133.…> * Denial of Service in Nova network source security groups (CVE-2013-4185) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000127.…> * Resource limit circumvention in Nova private flavors (CVE-2013-2256) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000126.…> * Swift Denial of Service using superfluous object tombstones (CVE-2013-4155) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000131.…> * Cinder LVM volume driver does not support secure deletion (CVE-2013-4183) <http://lists.openstack.org/pipermail/openstack-announce/2013-August/000130.…> Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How Do I allow IP protocols other than TCP, UDP, or ICMP (such as GRE)through my security group? <https://ask.openstack.org/en/question/3888/how-do-i-allow-ip-protocols-othe…> * How should I use the VIF Isolation Rules with XenServer 6.2 and OpenStack? <https://ask.openstack.org/en/question/3869/how-should-i-use-the-vif-isolati…> * Adding Ubuntu Image to XenServer Powered Openstack filesystem already mounted <https://ask.openstack.org/en/question/3766/adding-ubuntu-image-to-xenserver…> * What other steps should I take with networking after adding a compute node? <https://ask.openstack.org/en/question/3703/what-other-steps-should-i-take-w…> * glance-api failed to start up with latest devstack <https://ask.openstack.org/en/question/3839/glance-api-failed-to-start-up-wi…> Welcome New Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! * Jing Sun, IBM * Zhi kun Liu, IBM * ZhiQiang Fan, None * raiesmh08, ? * Toni Zehnder, ZHAW ICCLab * Yijing Zhang, None * Roman Verchikov, Mirantis * Noorul Islam K M, None * Teran McKinney, Rackspace * Mark Collier, OpenStack Foundation * Deepti Navale, Red Hat * Tracy Jones, VMware * Joe H. Rahme, Enovance /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack 2013.1.3 released
by Alan Pevec 08 Aug '13

08 Aug '13

Hello, The OpenStack Stable Maintenance team is happy to announce the release of the 2013.1.3 stable Grizzly release. We have been busy reviewing and accepting backported bugfixes to the stable/grizzly branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 116 bugs have been fixed across all core projects. These updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/cinder/grizzly/2013.1.3 https://launchpad.net/glance/grizzly/2013.1.3 https://launchpad.net/horizon/grizzly/2013.1.3 https://launchpad.net/keystone/grizzly/2013.1.3 https://launchpad.net/nova/grizzly/2013.1.3 https://launchpad.net/neutron/grizzly/2013.1.3 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.1.3 In addition to core projects, we've also cut a 2013.1.3 stable release for both Heat and Ceilometer projects, closing another 15 bugs: https://launchpad.net/ceilometer/grizzly/2013.1.3 https://launchpad.net/heat/grizzly/2013.1.3 The freeze on the stable/grizzly branches will be lifted today as we begin working toward the 2013.1.4 release, planned for October 10 and managed by Adam Gandelman. Thanks, Alan

1 0

[OSSA 2013-023] Denial of Service using XML entities in Nova/Cinder extensions (CVE-2013-4179, CVE-2013-4202)
by Thierry Carrez 08 Aug '13

08 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-023 CVE: CVE-2013-4179, CVE-2013-4202 Date: August 8, 2013 Title: Denial of Service using XML entities in Nova/Cinder extensions Reporter: Grant Murphy (Red Hat) Products: Nova, Cinder Affects: Grizzly and later Description: Grant Murphy from Red Hat reported that vulnerabilities in XML request parsers were not fully patched in OSSA 2013-004. By leveraging XML entity expansion in specific extensions, an unauthenticated attacker may still consume excessive resources on the Nova (CVE-2013-4179) or Cinder (CVE-2013-4202) API servers, resulting in a denial of service and potentially a crash. Only Nova setups making use of the security group extension in Grizzly are affected. Only Cinder setups making use of the backups or volume transfer API extension in Grizzly are affected. Havana (development branch) fixes: Nova: https://review.openstack.org/40879 Cinder: https://review.openstack.org/40881 Grizzly fixes: Nova: https://review.openstack.org/40880 Cinder: https://review.openstack.org/40883 Note: The Nova and Cinder Grizzly fixes will be included in the upcoming 2013.1.3 stable release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4179 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4202 https://launchpad.net/bugs/1190229 Regards, - -- Thierry Carrez OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJSA8K6AAoJEFB6+JAlsQQj05EP/Rq9FXVZJCNfXgCBEpeSgrh/ kaglidx9JMqnvxJd92M+KFHZrZgBazwH9ZwsD1i4zs64XP1KH2UbvXzlwfaCb3M0 5/9cbqocyHJAeOFpYPvQCz/TmsHVH7CgftNL474AGixyTXfaH745/zveABNIYhou aEpq3CxHOcNycCuPYj4FgcXZ7lf8Eu7vaVsNhXmk/qgWo+l6N4LYznHf6UxHMnHf fB7+ZcjMCZtfZHO/9LRmROiprHHX9CprWtTZX+RUNjTa38VzyEetXG50zCEIiI/S wsxAUSOA6tremYLeuNXZwRawLdpolzvhEt04GITa7AC8udnjXkvHyA1VUcAtysMT SP5abGWdKMibSVwOmJ6+YLVMMXpTn9ww5LD2yJrcRy+xXyD9k2ofq8VMY9P/DJ2w kEEEQaMtmmqYqoVZc/rLRjBNiGgvD58hxYtLEVMShgbkduAUgfWmBnsZ7zgbzY9X ZDUN3wYkEQk6UZepa4g4mIjTFM0PkqXNoCOl8q7xNpLNYpmbF5rheIeE1HjIglGq hbCWzxDJZtKjvd2MqtYlZGfTgjpPA6tEDC3vto8nfsHQqvZUxv/OKg6KSCIq/6UA wxUD952GPmhImN+UVYiFMuNufufb0EI/EkVsmPJm54siOeq/ZOYvEc44M6K++7ve 3MySqda3xPZMaZn8KTFz =XFeJ -----END PGP SIGNATURE-----

1 0

[OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)
by Thierry Carrez 07 Aug '13

07 Aug '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-022 CVE: CVE-2013-4155 Date: August 7, 2013 Title: Swift Denial of Service using superfluous object tombstones Reporter: Peter Portante (Red Hat) Products: Swift Affects: All versions Description: Peter Portante from Red Hat reported a vulnerability in Swift. By issuing requests with an old X-Timestamp value, an authenticated attacker can fill an object server with superfluous object tombstones, which may significantly slow down subsequent requests to that object server, facilitating a Denial of Service attack against Swift clusters. Havana (development branch) fix: https://review.openstack.org/40643 Grizzly fix: https://review.openstack.org/40645 Folsom fix: https://review.openstack.org/40646 Note: The havana fix will be included in the upcoming Swift 1.9.1 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4155 https://bugs.launchpad.net/swift/+bug/1196932 Regards, - -- Thierry Carrez OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJSAmwaAAoJEFB6+JAlsQQjgbEP/2hCZIRuMQoMPCcPg1LzA2PR BIOGBII7jXTjc/ku5/E29kTL2GwtiHC6PLezXdlGQFcLdJV4wi8Tq4OtVwFDEhHz 8wIhFVzKyPP1N9kktWH80PXhYUVECffuhL3+GKGcIMkz8+BPUj5EKeEHAZpkVw+S bu37N3IB5kpBN2riNBo+7BciKK81fXvJh5QH9T10pee6VrQMYk+fyAITPD91Ft1S ramVEM+L9m0n4oDXSg9bTuKdACPxNqR1ftn3AIS2xJFNz0jeECuI6bV/6MPpCtds 0bVDjgZfidz3LDvY/1LsUKGSAkcVViWCxYqYgZYFnnnGKgopPcvOzGXM2zZ5EHMa ypciysUSJ/HC4jQpmqNBmHbaHHaWIhO5krVC4Soh2Kj4gA5YgUFi2ybKkKo/RLpm THHjgo8bfCVdnVZMt+BjkGGXvNenv3tsE8ByfEKWZ+AGf0CcZGih5ONtRRgLsiew vC4p0haonrHkzWqNusdtXZcEXdEQRmMlCWS0PO+pzSypKgI8I5Pg34IHrNjgk4fa inkSMLxYDTTtHWoeQoczL6MQ0UYrDZmmSlXO4U7FE69I0uMPYt5b0eLWG28YEF3T pe+fbm4qkpMZN11DvduMtswSro1BZq9zJrJLGFG9HdOXN7vrXc0bWVuykh6q31tv w1Tar2ybFkiV+huvn2zb =YWXH -----END PGP SIGNATURE-----

1 0

[OSSA 2013-021] Cinder LVM volume driver does not support secure deletion (CVE-2013-4183)
by Jeremy Stanley 07 Aug '13

07 Aug '13

OpenStack Security Advisory: 2013-021 CVE: CVE-2013-4183 Date: August 7, 2013 Title: Cinder LVM volume driver does not support secure deletion Reporter: Rongze Zhu (UnitedStack) Products: Cinder Affects: 2013.1 (Grizzly) and later Description: Rongze Zhu from UnitedStack reported a vulnerability in the Cinder LVM volume driver. The contents of LVM snapshots may not be cleared upon deletion even when secure deletes are configured, resulting in potential exposure of latent data to subsequent servers for other tenants. Only setups using LVMVolumeDriver are affected. Havana (development branch) fix: https://review.openstack.org/36506 Grizzly fix: https://review.openstack.org/39565 Notes: This fix is included in the havana-2 development milestone and will appear in a future 2013.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4183 https://launchpad.net/bugs/1198185 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

heat-cfntools 1.2.5 released
by Steve Baker 07 Aug '13

07 Aug '13

The heat development community would like to announce the release of heat-cfntools version 1.2.5. heat-cfntools contains the tools that can be installed on Heat provisioned cloud instances to implement portions of CloudFormation compatibility. This release can be installed from the following locations: http://tarballs.openstack.org/heat-cfntools/heat-cfntools-1.2.5.tar.gz <http://tarballs.openstack.org/heat-cfntools/heat-cfntools-1.2.5.tar.gz> https://pypi.python.org/pypi/heat-cfntools/1.2.5 <https://pypi.python.org/pypi/heat-cfntools/1.2.5> Bugs fixed in this release: https://launchpad.net/heat-cfntools/+milestone/v1.2.5 <https://launchpad.net/heat-cfntools/+milestone/v1.2.5>

1 0

python-heatclient 0.2.4 released
by Steve Baker 07 Aug '13

07 Aug '13

The heat development community would like to announce the release of python-heatclient version 0.2.4. python-heatclient is a client library for Heat built on the Heat orchestration API. It provides a Python API (the heatclient module) and a command-line tool (heat). This release can be installed from the following locations: http://tarballs.openstack.org/python-heatclient/python-heatclient-0.2.4.tar… <http://tarballs.openstack.org/python-heatclient/python-heatclient-0.2.4.tar…> https://pypi.python.org/pypi/python-heatclient/0.2.4 <https://pypi.python.org/pypi/python-heatclient/0.2.4> Bugs fixed in this release: https://launchpad.net/python-heatclient/+milestone/v0.2.4 <https://launchpad.net/python-heatclient/+milestone/v0.2.4>

1 0

[OSSA 2013-020] Denial of Service in Nova network source security groups (CVE-2013-4185)
by Jeremy Stanley 06 Aug '13

06 Aug '13

OpenStack Security Advisory: 2013-020 CVE: CVE-2013-4185 Date: August 6, 2013 Title: Denial of Service in Nova network source security groups Reporter: Vishvananda Ishaya (Nebula) Products: Nova Affects: All versions Description: Vishvananda Ishaya from Nebula reported a denial of service vulnerability in Nova's handling of network source security group policy updates. By performing a large number of server creation operations, the proportion of updates increases quadratically and may overwhelm nova-network such that it is no longer able to service other requests in a timely fashion. Only setups relying on nova-network are affected. Havana (development branch) fix: https://review.openstack.org/39541 Grizzly fix: https://review.openstack.org/39543 Folsom fix: https://review.openstack.org/39544 Notes: This fix will be included in the havana-3 development milestone and in a future 2013.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4185 https://bugs.launchpad.net/nova/+bug/1184041 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

[OSSA 2013-019] Resource limit circumvention in Nova private flavors (CVE-2013-2256)
by Jeremy Stanley 06 Aug '13

06 Aug '13

OpenStack Security Advisory: 2013-019 CVE: CVE-2013-2256 Date: August 6, 2013 Title: Resource limit circumvention in Nova private flavors Reporter: hzrandd (NetEase) Products: Nova Affects: All versions Description: hzrandd from NetEase reported a resource limit circumvention vulnerability in Nova's handling of private flavors. Any tenant is able to show and boot any other tenant's private flavors by guessing a flavor ID. This not only exposes the flavor's name, memory and disk size, swap allocation, VCPU count and similar flavor properties, but potentially allows circumvention of any resource limits enforced through the os-flavor-access:is_public property. Havana (development branch) fix: https://review.openstack.org/34963 Grizzly fix: https://review.openstack.org/37992 Folsom fix: https://review.openstack.org/38318 Notes: This fix is included in the havana-2 development milestone and will appear in a future 2013.1.3 release. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2256 https://bugs.launchpad.net/nova/+bug/1194093 -- Jeremy Stanley OpenStack Vulnerability Management Team

1 0

python-novaclient 2.14.0 released
by Russell Bryant 06 Aug '13

06 Aug '13

Greetings, I just pushed out a new release of python-novaclient - 2.14.0. This release contains a number of features and bug fixes from the last 4 months. Here is a list of changes in this release: Feature commits include: 0d45408 Support programmatic use of disk config extension 8b5dcee Add user quota client API support 4025b7e Add name argument to aggregate commands de250bf Add name argument to hypervisor commands cc2c0a8 Enable force_delete and restore instance via novaclient. d095b8a CLI for disable service reason 2770e05 Adds zsh completion ea47123 Return Customer's Quota Usage through Admin API 267dbd2 Support force update quota ee411a6 Cells Support be299d8 Adds support for ExtendedFloatingIps APi extension 7f03b09 Migrate each instances of a host to another. 0d678ed Evacuate each instance from one host to another 87bd54f The 'nova keypair-show key_name' command added. 37da28c Provide nova CLI man page. 789d156 Allow deleting multiple images from shell d43b923 Delete a quota through admin api. 50fe79b Add 'flavor-list --all' admin switch 328805f Add coverage-reset command to reset Nova coverage data. Everything else: ec58616 Sync with global requirements 852e2e5 Check whether the security group id is integer 7fdb52a Fixing host-action on V2 ddda3f3 Fix net-id metavar for interface-attach 5fe9408 make findall in novaclient/base.py more efficient 8311862 Fix the help text process and the generated wrong help 0d061f0 Merge v1_1's base module into main base module 3f0312e Remove python 2.4 and python 2.5 support. 1b5ed91 recognize 429 as an rate limiting status f702c25 Fix backwards-incompatible API change (method signature) af7ca70 Fix and enable gating on H402 c360c3e Add AgregatesManager.get() f50ff36 Skip setting volume_size if not given 70e6cd9 Fix interface-list got none mac address. b5c9101 Remove uncessary code related to nova start/stop 912288c make v2_auth and plugin_auth explictly return their results a5558f8 Sync install_venv_common from oslo 1b3cd6f Clean up and make HACKING.rst point to openstack-dev/hacking 02f906b Allow tenant ID for authentication c7e9b1b Bring stdout/stderr capturing in line w/ nova 0134008 Fixup trivial License Header mismatch. b526c9b Remove Diablo compatibility options 07fd520 python3: Fix print statements a25d4fe python3: Compatibility for iteritems differences 8c4e145 python3: Fix unicode compatibility python2/python3 909a53b Discard possibly expired token before re-authenticating 85a4f6c Update help for --nic opt and make net-id or port-id required 3457394 Remove explicit distribute depend. cdee7e1 Set default value of flavorid to "auto" 96706d5 Set/Delete metadata on all instances of a host. e476179 Use Python 3.x compatible except: construct fa0d6e8 Exit w/ valid code when no servers are deleted. 8820623 python3: Introduce py33 to tox.ini 67c8055 Start using Hacking and PyFlakes 66a9896 Add update method of security group name and description def5df2 Fix shell tests for older prettytable versions. a8ed2f2 Improve error messages for invalid --nic / --file. ff85bd4 100% test coverage for security groups and rules f2559c4 Add MethodNotAllowed and Conflict exception classes c34c371 Move tests into the novaclient package. 51f0596 Add CONTRIBUTING file. 3bbdcda Rename requires files to standard names. 1a0b7b0 Code cleanup in advance of flake8. 9d4db6f Migrate to flake8. c305a45 Revert "Support force update quota" e8e7a0e Only add logging handlers if there currently aren't any d274077 Convert to more modern openstack-common.conf format. ecbf770 Cleanup unused local variables bc0ad1c Reuse oslo for is_uuid_like() implementation 20a3595 Synchronize code from oslo f08ac04 Migrate to pbr. b1802a5 Cleanup nova subcommands for security groups and rules c9fc9b5 Make ManagerWithFind abstract and fix its descendants 3c97f76 Cleanup some flavor commands 075e9ca Fix the default parameter in print_list e745b46 Fix for --bridge-interface being ignore by nova network-create a3a7ebf Add setuptools_git-*.egg to .gitignore eae3d72 Expose retry_after attribute of OverLimit exception e009bec Adds extended status fields to nova list 201b74b Clean up exceptions.from_response c15c8f8 Synchronize code from oslo e5d2e2c Fix nova instance-action-list output field and order 3396894 Make list flavor show extra specs optional. 27e904a Use HTTP keep-alive feature in HTTPClient class dccdd02 Cleanup unused import c230812 Make --vlan option work in network-create in VLAN mode e8b665e Support force update quota 2a495c0 make sure .get() also updates _info 1216a32 Fixing shell command 'service-disable' description 69f9971 Correct a unit test failure that crept into trunk 8ce2330 Fix problem with nova --version ea94b09 Make "multi_host" True when it is set to 'T' in network_create. 20ede68 Fix IBM copyright strings 90b3a1c Allow for bypass_url when using proxy_token Thanks, -- Russell Bryant

1 0

OpenStack Community Weekly Newsletter (July 26 – Aug 2)
by Stefano Maffulli 03 Aug '13

03 Aug '13

Hong Kong Summit – Registration, Call for Sponsors Now Open! <http://www.openstack.org/blog/2013/06/hong-kong-summit-registration-call-fo…> ???????????????????? ???????, ???????? <http://openstacksummitnovember2013.eventbrite.com/> Benchmarking Performance of OpenStack Swift Configurations <http://www.mirantis.com/blog/openstack-swift-configurations-performance-ben…> The latest OpenStack Object Storage Swift release 1.9.0 features full global clusters support <https://github.com/openstack/swift/blob/master/CHANGELOG>, which allows to /distribute one cluster over multiple, geographically dispersed sites, connected through a high-latency network/. Mirantis published a brief introduction to how to use benchmarks to take full advantage of the new features. Hardware Extension for Ceilometer <http://www.cloudcomp.ch/2013/07/hardware-extension-for-ceilometer/> Ceilometer <https://launchpad.net/ceilometer> is a monitoring tool for OpenStack <http://www.openstack.org/> cloud environments. In the next OpenStack <http://www.openstack.org/> release called Havana it will take part as a core component. However, Ceilometer <https://launchpad.net/ceilometer> is also available for the OpenStack <http://www.openstack.org/> releases Folsom and Grizzly. Currently Ceilometer <https://launchpad.net/ceilometer> offers only data of the OpenStack <http://www.openstack.org/> core components and the virtual machines of the cloud. For this reason the ICCLab <http://www.cloudcomp.ch/> decided to extend Ceilometer <https://launchpad.net/ceilometer> in a way that it is possible to collect data from hardware devices as well. An Introduction to OpenStack Orchestration <http://www.zerobanana.com/archive/2013/07/30#openstack-orchestration-introd…> The forthcoming Havana (2013.2) release of OpenStack <http://www.openstack.org/> will mark the debut of orchestration as part of the official release. It arrives in the form of the Heat <https://wiki.openstack.org/Heat> project, which kicked off in early 2012 and graduated from incubation into OpenStack-proper after the Havana Summit in March this year. Tips ‘n Tricks * By Christian Berendt <http://www.cberendt.de/>: Running Horizon with Gunicorn <http://www.cberendt.de/2013/08/running-horizon-with-gunicorn/?utm_source=rs…> * By eNovance <http://www.enovance.com/>: Role delegation in keystone: Trusts <http://www.enovance.com/fr/blog/5858/role-delegation-in-keystone-trusts> * By Cloudify Engineering <http://cloudifysource.tumblr.com/>: How to Install Heat and DevStack on EC2 <http://cloudifysource.tumblr.com/post/56965159501> * By Oren Katz <http://orenscloudplatformthoughts.tumblr.com/>: Monitoring a distributed cloud <http://orenscloudplatformthoughts.tumblr.com/post/56962987606> * By Terri Yu <http://terriyu.info/blog/>: Becoming a new contributor to open source through Outreach Program for Women and OpenStack <http://terriyu.info/blog/posts/2013/07/becoming-foss-contributor/> * By Terri Yu <http://terriyu.info/blog/>: How to install Devstack and Ceilometer on a Vagrant VM <http://terriyu.info/blog/posts/2013/07/installing-devstack-ceilometer/> * By John Bresnahan <https://tropicaldevel.wordpress.com/>: RDO on Fedora 19 <https://tropicaldevel.wordpress.com/2013/07/29/rdo-on-fedora-19/> * By Alessandro Pilotti <http://www.cloudbase.it/>: Multi-node OpenStack RDO on RHEL and Hyper-V – Part 1 <http://www.cloudbase.it/rdo-multi-node/> Upcoming Events * Bangalore Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> Aug 24, 2013 – Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/132218642/> * 2nd OpenStack User Group Nordics meetup <http://www.meetup.com/OpenStack-User-Group-Nordics/>Sep 11, 2013 – Kista, Stockholm Details <http://www.meetup.com/OpenStack-User-Group-Nordics/> * OpenStack on Ales <http://openstack.onales.com/> Sep 30 – Oct 01, 2013 – Bend, OR Details <http://openstack.onales.com/> * INTEROP <http://www.interop.in/> Nov 20 – 22, 2013 – Mumbai, India Details <http://www.interop.in/> Reports from Previous Events * OSCON 2013 – Recap <http://rafstack.tumblr.com/post/56984490142> Other News * Using legacy auth v1 with Keystone <http://www.enovance.com/fr/blog/5882/legacy-auth-v1-keystone> * Open Mic Spotlight: Melanie Witt <http://www.openstack.org/blog/2013/07/open-mic-spotlight-melanie-witt/> * Open Mic Spotlight: Victoria Martínez de la Cruz <http://www.openstack.org/blog/2013/07/open-mic-spotlight-victoria-martinez-…> * Open Mic Spotlight: Dirk Müller <http://www.openstack.org/blog/2013/07/open-mic-spotlight-dirk-muller/> * OpenStack Ceilometer Havana-2 milestone released <http://julien.danjou.info/blog/2013/openstack-ceilometer-havana-2-milestone…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-07-30-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-07-30-21.…> Security Advisories * Missing SSL certificate check in Python glance client (CVE-2013-4111) <http://lists.openstack.org/pipermail/openstack-announce/2013-July/000123.ht…> Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * live migration fails when a cinder volume is attached to a running instance – glusterFS <https://ask.openstack.org/en/question/3702/live-migration-fails-when-a-cind…> * whats the difference between Policies stored in policy.json and policies that can be created using openstack/identity/v3/policies <https://ask.openstack.org/en/question/3073/whats-the-difference-between-pol…> * Is sluggish performance caused by scheduler startup errors? <https://ask.openstack.org/en/question/1238/is-sluggish-performance-caused-b…> * Terms of support for x-glance-api-copy-from header in Glance API <https://ask.openstack.org/en/question/2974/terms-of-support-for-x-glance-ap…> * console url on a different domain <https://ask.openstack.org/en/question/3015/console-url-on-a-different-domai…> * heat Bad port format: port uuid is not in proper format <https://ask.openstack.org/question/3697/heat-bad-port-format-port-uuid-is-n…> * Which deployment tool is good for openstack multinode HA deployment with Xenserver 6.2 and Ceph? <https://ask.openstack.org/question/3635/which-deployment-tool-is-good-for-o…> Welcome New Developers Is your affiliation correct? Check your profile in the OpenStack Foundation Members Database! * Yuiko Takada, NEC * Rich Bowen, Red Hat * Alejandro Cabrera, Rackspace /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0