March 2014 - OpenStack-announce - lists.openstack.org

[OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237)
by Tristan Cacqueray 04 Mar '14

04 Mar '14

OpenStack Security Advisory: 2014-006 CVE: CVE-2014-2237 Date: March 04, 2014 Title: Trustee token revocation does not work with memcache backend Reporter: Morgan Fainberg (Metacloud) Products: Keystone Versions: 2013.1 up to 2013.1.4 and 2013.2 versions up to 2013.2.2 Description: Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected. Icehouse (development branch) fix: https://review.openstack.org/60743 Havana fix: https://review.openstack.org/75521 Grizzly fix: https://review.openstack.org/75526 Notes: This fix will be included in the icehouse-3 development milestone and in future 2013.1.5 and 2013.2.3 releases. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-2237 https://launchpad.net/bugs/1260080 -- Tristan Cacqueray OpenStack Vulnerability Management Team

1 0

[Swift] Swift 1.13.0 released
by John Dickinson 03 Mar '14

03 Mar '14

I'm please to announce that OpenStack Swift 1.13 has been released. This release has some important new features (highlighted below), and it also serves as a good checkpoint before Swift's final release in the Icehouse cycle. Launchpad page for this release: https://launchpad.net/swift/icehouse/1.13.0 Highlights from the Swift 1.13 changelog (https://github.com/openstack/swift/blob/master/CHANGELOG): * Account-level ACLs and ACL format v2 Accounts now have a new privileged header to represent ACLs or any other form of account-level access control. The value of the header is a JSON dictionary string to be interpreted by the auth system. A reference implementation is given in TempAuth. Please see the full docs at http://swift.openstack.org/overview_auth.html * Moved all DLO functionality into middleware The proxy will automatically insert the dlo middleware at an appropriate place in the pipeline the same way it does with the gatekeeper middleware. Clusters will still support DLOs after upgrade even with an old config file that doesn't mention dlo at all. * Remove python-swiftclient dependency Please read the full changelog for a full report of this release. As always, this release is considered production-ready, and deployers can upgrade to it with no client downtime in their cluster. I'd like to thank the following new contributors to Swift, each of whom contributed to the project for the first time during this release: - Luis de Bethencourt (luis(a)debethencourt.com) - Florent Flament (florent.flament-ext(a)cloudwatt.com) - David Moreau Simard (dmsimard(a)iweb.com) - Shane Wang (shane.wang(a)intel.com) Thank you to everyone who has contributed. --John

1 0

python-heatclient 0.2.5 released
by Steve Baker 02 Mar '14

02 Mar '14

The heat development community would like to announce the release of python-heatclient version 0.2.5. python-heatclient is a client library for Heat built on the Heat orchestration API. It provides a Python API (the heatclient module) and a command-line tool (heat). This release can be installed from the following locations: http://tarballs.openstack.org/python-heatclient <http://tarballs.openstack.org/python-heatclient> https://pypi.python.org/pypi/python-heatclient <https://pypi.python.org/pypi/python-heatclient> Bugs fixed in this release: https://launchpad.net/python-heatclient/+milestone/v0.2.5 <https://launchpad.net/python-heatclient/+milestone/v0.2.5>

1 2

OpenStack Community Weekly Newsletter (Feb 14 – 28)
by Stefano Maffulli 01 Mar '14

01 Mar '14

Why you should be reviewing more OpenStack code <https://dague.net/2014/02/28/why-you-should-be-reviewing-more-openstack-cod…> Icehouse 3 is upon us, and as someone that is on a bunch of core review teams, it means a steady drum beat of everyone asking how do they get core reviewers to review their code. Sean Dague explains quite well why you should be doing code reviews. Trusted Cloud computing with Intel TXT: The challenge <http://www.mirantis.com/blog/challenge/> In today’s connected environments, attacks on compute infrastructure are ubiquitous. Major players have been compromised by hackers and malware, with damages inflicted both to their reputation and their business. Protecting the infrastructure from external and internal threats is an important part of operating production grade cloud environments. Christian Huebner <http://www.mirantis.com/blog/challenge/> introduces how OpenStack integrates with TXT. Our Cloud in Havana <http://openstack-in-production.blogspot.com/2014/02/our-cloud-in-havana.html> Upgrading a nearly 50,000 core cloud from Grizzly to Havana can be done with a series of steps, each of which can have short periods of reduced functionality but with constant VM availability. Tim Bell <http://openstack-in-production.blogspot.com/> tells us how CERN upgraded its OpenStack cloud. Status of the OpenStack port to Python 3 <http://techs.enovance.com/6722/status-of-the-openstack-port-to-python-3-2> Python 3 has been around for about 5 years, and we have excellent reasons <http://techs.enovance.com/6521/openstack_python3> to make sure OpenStack runs well on it. Unfortunately, this is not the case. In his article, Cyril Roelandt <http://techs.enovance.com/6722/status-of-the-openstack-port-to-python-3-2> explains what works, what doesn’t, and what *you* can do to help. OpenStack selected as mentoring organization for Google Summer of Code 2014 <http://www.openstack.org/blog/2014/02/openstack-selected-as-mentoring-organ…> OpenStack has been selected to be a mentoring organization for Google Summer of Code 2014. Thanks to the hard work of many contributors we could join GSoC <http://www.google-melange.com/gsoc/org2/google/gsoc2014/openstack> for the first time. The road to Juno Summit – Atlanta 2014 * *Redeem**your invite code **NOW*! Check your inbox and spam folder if you contributed code before January 25 for your invitation. * Next batch of invites will be sent regularly after each milestone until feature freeze. * It’s time to vote for presentations you wish to see in Atlanta <https://www.openstack.org/vote-atlanta/>. * Applying for Visa? Looking for accommodation in Atlanta? Visit http://openstack.org/summit * Applications for Travel Support Program. <https://wiki.openstack.org/wiki/Travel_Support_Program> *Apply by Mar 2*. Tips ‘n Tricks * By Evgeniya Shumakher <http://www.mirantis.com/blog/building-test-environments-openstack/>: Building test environments with OpenStack <http://www.mirantis.com/blog/building-test-environments-openstack/> * By Christian Hoge <http://developerblog.redhat.com/author/christianhoge/>: Deployment to Upgrade: Puppet OpenStack Modules Are Your Friends <http://developerblog.redhat.com/2014/01/28/deploy-to-upgrade-puppet-opensta…> * By Victor Stinner <http://techs.enovance.com/6562/asyncio-openstack-python3>: Use the new asyncio module and Trollius in OpenStack <http://techs.enovance.com/6562/asyncio-openstack-python3> * By Guillaume <http://blog.xlcloud.me/post/2014/02/27/Running-an-OpenGL-application-on-a-G…>: Running an OpenGL application on a GPU-accelerated Nova Instance (Part 2) <http://blog.xlcloud.me/post/2014/02/27/Running-an-OpenGL-application-on-a-G…> * By Lars Kellogg-Stedman <http://blog.oddbit.com/>: Multinode OpenStack with Packstack <http://blog.oddbit.com/2014/02/27/multinode> * By Oleg Gelbukh: <http://www.mirantis.com/blog/benchmarking-openstack-megascale-tested-mirant…>Benchmarking OpenStack at megascale: How we tested Mirantis OpenStack at SoftLayer <http://www.mirantis.com/blog/benchmarking-openstack-megascale-tested-mirant…> * By Adam Young <http://adam.younglogic.com/>: Using Certmonger to Generate a selfsign Cert for CMS <http://adam.younglogic.com/2014/02/certmonger-selfsigned-cms-cert/> * By Kevin Jackson <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…>: Inside My Home Rackspace Private Cloud, OpenStack Lab, Part 2 <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…> and Part 3 <http://www.rackspace.com/blog/inside-my-home-rackspace-private-cloud-openst…> * By Jamie Lennox <http://www.jamielennox.net/>: Client Session Objects <http://www.jamielennox.net/blog/2014/02/24/client-session-objects/> * By Jay Pipes <http://www.joinfu.com/>: Setting Up an External OpenStack Testing System – Part 2 <http://www.joinfu.com/2014/02/setting-up-an-openstack-external-testing-syst…> * By Dimitar Vlassarev <mailto:dimitar.m.vlassarev@seagate.com>:When is RAID Not Enough? <http://cloud.media.seagate.com/2014/02/18/when-is-my-data-too-big-for-a-rai…> Reports from Previous Events * OpenStack at the Chicago Mercantile Exchange Group: Chicago-land Meetup <http://www.openstack.org/blog/2014/02/openstack-at-the-chicago-mercantile-e…> * What’s going on in India? <http://sayalilunkad.github.io/posts/Updates> Upcoming Events * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/163302142/> Mar 01, 2014 – Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/163302142/> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/166858252/> Mar 01, 2014 – Chennai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/166858252/> * Athens OpenStack User Group meeting <http://www.meetup.com/Athens-OpenStack-User-Group/events/166868392/> Mar 05, 2014 – Athens, Greece Details <http://www.meetup.com/Athens-OpenStack-User-Group/events/166868392/> * Eventually OpenStack for M&E <http://www.eventbrite.com/e/eventually-openstack-for-me-tickets-10322247119…> Mar 17, 2014 – Santa Monica, CA Details <http://www.eventbrite.com/e/eventually-openstack-for-me-tickets-10322247119…> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Mar 20, 2014 – Details <http://www.meetup.com/openstack/> * Open Source Festival <http://ocs.opensourcefestival.org/index.php/osf/osf14> Mar 29, 2014 – University at Albany, NY Details <http://ocs.opensourcefestival.org/index.php/osf/osf14> * Cloud Connect Summit at Interop <http://www.interop.com/lasvegas/conference/cloud-connect.php> Mar 31 – Apr 01, 2014 – Las Vegas, Nevada Details <http://www.interop.com/lasvegas/conference/cloud-connect.php> * World Hosting Days <http://www.worldhostingdays.com/eng/> Apr 01 – 03, 2014 – Rust, Germany Details <http://www.worldhostingdays.com/eng/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227592/> Apr 03, 2014 – Sunnyvale, CA Details <http://www.meetup.com/openstack/events/123227592/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Apr 03, 2014 – Details <http://www.meetup.com/openstack/> * PyCon <https://us.pycon.org/2014/> Apr 09 – 17, 2014 – Montreal, Canada Details <https://us.pycon.org/2014/> * SFBay OpenStack Hackathon #OSSFO <http://www.meetup.com/openstack/> Apr 17, 2014 – Sunnyvale,CA Details <http://www.meetup.com/openstack/> * SFBay Meetup – Beginner track <http://www.meetup.com/openstack/events/123227622/> May 01, 2014 – Sunnyvale,CA Details <http://www.meetup.com/openstack/events/123227622/> Security Advisories * Missing SSL certificate check in Python Swift client (CVE-2013-6396) <http://lists.openstack.org/pipermail/openstack-announce/2014-February/00019…> Popular OpenStack Videos of the Week * Outreach Program for Women – May-Aug 2014 <http://lists.openstack.org/pipermail/openstack/2014-February/005535.html> * Windows on OpenStack: Best Practices and Pitfalls <https://www.youtube.com/watch?v=JMDxpAmR_XQ> Other News * Outreach Program for Women – May-Aug 2014 <http://lists.openstack.org/pipermail/openstack/2014-February/005535.html> * GCE API – Available Now on OpenStack StackForge <http://www.cloudscaling.com/blog/openstack/gce-api-available-now-on-opensta…> * OpenStack Havana 2013.2.2 Hyper-V compute installer released! <http://www.cloudbase.it/openstack-havana-2013-2-2-hyper-v-compute-installer…> * python-heatclient 0.2.7 released <http://lists.openstack.org/pipermail/openstack-announce/2014-February/00019…> * python-novaclient 2.16.0 released <http://lists.openstack.org/pipermail/openstack-announce/2014-February/00020…> * A beginners guide to understanding OpenStack <http://opensource.com/business/14/2/openstack-beginners-guide> * Open Mic Spotlight: Derek Higgins <http://www.openstack.org/blog/2014/02/open-mic-spotlight-derek-higgins/> * The dilemma of open innovation <http://fnords.wordpress.com/2014/02/24/the-dilemma-of-open-innovation/> * How does Horizon Stack up versus other Cloud Computing UIs? <http://uxd-stackabledesign.rhcloud.com/?p=78> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-02-25-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-02-25-21.…> Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How do nova-cells really works? <https://ask.openstack.org/en/question/12585/how-do-nova-cells-really-works/> * what filters spoofed traffic? <https://ask.openstack.org/en/question/12547/what-filters-spoofed-traffic/> * Can quantum be run on child cells to create separate L2fabric in each cell? <https://ask.openstack.org/en/question/12538/can-quantum-be-run-on-child-cel…> * RDO: Packstack (fedora) neutron local flat typedrives <https://ask.openstack.org/en/question/12528/rdo-packstack-fedora-neutron-lo…> * Controlling physical switch ports with Neutron? <https://ask.openstack.org/en/question/12500/controlling-physical-switch-por…> * VMware vnc ports using VCDriver <https://ask.openstack.org/en/question/12446/vmware-vnc-ports-using-vcdriver/> * How to interpret actual and rss memory in diagnostic results? <https://ask.openstack.org/en/question/12674/how-to-interpret-actual-and-rss…> * Trying to change user credentials using REST API but the response is 404 not found? <https://ask.openstack.org/en/question/12661/trying-to-change-user-credentia…> * Can’t fetch the device UUID when deploying the baremetal node <https://ask.openstack.org/en/question/12622/cant-fetch-the-device-uuid-when…> * Autoscaling and load balancing with Heat <https://ask.openstack.org/en/question/12579/autoscaling-and-load-balancing-…> * DHCP problem: instances cannot obtain a specific IP <https://ask.openstack.org/en/question/12577/dhcp-problem-instances-cannot-o…> * Is it acceptable to adjust policy.json to allow non-root Savanna access to cinder? <https://ask.openstack.org/en/question/12498/is-it-acceptable-to-adjust-poli…> Latest Activity In Projects Do you want to see at a glance the bugs filed and solved this week? Latest patches submitted for review? Check out the individual project pages on OpenStack Activity Board – Insights <http://activity.openstack.org/data/display/OPNSTK2/>. * Telemetry (Ceilometer) <http://activity.openstack.org/data/display/OPNSTK2/ceilometer> * Block Storage (Cinder) <http://activity.openstack.org/data/display/OPNSTK2/cinder> * Image Service (Glance) <http://activity.openstack.org/data/display/OPNSTK2/glance> * Orchestration API <http://activity.openstack.org/data/display/OPNSTK2/heat> (Heat) <http://activity.openstack.org/data/display/OPNSTK2/heat> * Dashboard (Horizon) <http://activity.openstack.org/data/display/OPNSTK2/horizon> * Bare Metal Provisioning (Ironic) <http://activity.openstack.org/data/display/OPNSTK2/ironic> * Identity (Keystone) <http://activity.openstack.org/data/display/OPNSTK2/keystone> * Manuals <http://activity.openstack.org/data/display/OPNSTK2/openstack-manuals> * Networking (Neutron) <http://activity.openstack.org/data/display/OPNSTK2/neutron> * Compute (Nova) <http://activity.openstack.org/data/display/OPNSTK2/nova> * Hadoop Cluster as a Service (Savanna) <http://stackalytics.com/?release=icehouse&metric=commits&project_type=opens…> * Object Storage (Swift) <http://activity.openstack.org/data/display/OPNSTK2/swift> * Database As A Service (Trove) <http://activity.openstack.org/data/display/OPNSTK2/trove> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0