- OpenStack-announce - lists.openstack.org

[OSSA 2012-013] Keystone, Lack of authorization for adding users to tenants (CVE-2012-3542)
by Russell Bryant 30 Aug '12

30 Aug '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2012-013 CVE: CVE-2012-3542 Date: August 30, 2012 Title: Lack of authorization for adding users to tenants Impact: Critical Reporter: Dolph Mathews (Rackspace) Products: Keystone Affects: Essex, Folsom Description: Dolph Mathews reported a vulnerability in Keystone. When attempting to update a user's default tenant, Keystone will only partially deny the request when a user is not authorized to complete this action. The API responds with 401 Not Authorized and the user's default tenant is not changed. However, the user is still granted membership to this new tenant.The result is that any client that can reach the administrative API (deployed on port 35357, by default) can add any user to any tenant. Fixes: Folsom: https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e… 2012.1: https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d32… References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-3542 https://bugs.launchpad.net/keystone/+bug/1040626 Notes: This fix will be included in the folsom-rc1 development milestone and in a future Essex (2012.1) release. - -- Russell Bryant OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://www.enigmail.net/ iEYEARECAAYFAlA/iZEACgkQFg9ft4s9SAZ0zQCeKEqxWbDFum/f6l00H0x6FL2L QEEAn3eer5owk4/lEktxTMrdIhtnyaaL =vdh7 -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (Aug 17-24)
by Stefano Maffulli 25 Aug '12

25 Aug '12

Highlights of the week OpenStack at CloudOpen <http://www.openstack.org/blog/2012/08/openstack-at-cloudopen/> OpenStack is a protagonist of CloudOpen, the only conference providing a collaboration and education space dedicated to advancing the open cloud. Next week, from Aug 29 to 31 in San Diego there will be plenty of chances to hear talks about OpenStack and how it's shaping the cloud industry. On Tuesday Aug 28th join the OpenStack community at The Hopping Pig <http://www.thehoppingpig.com/> for a party! Food & drinks sponsored by HP, Intel, Opscode, Rackspace, SUSE, and Ubuntu. The event will immediately follow the official CloudOpen happy hour, and is within walking distance of the Andaz. Reserve your ticket <http://openstack-cloudopen2012.eventbrite.com/>. OpenStack at PuppetConf: Tim Bell of CERN to Keynote <http://www.openstack.org/blog/2012/08/openstack-at-puppetconf-tim-bell-of-c…> PuppetConf is coming up September 27-28 in San Francisco, and we're excited to announce some great OpenStack content, including a keynote presentation from Tim Bell of CERN! OpenStack Won Unprecedented Popularity in Asia/Pacific <http://www.openstack.org/blog/2012/08/openstack-won-unprecedented-popularit…> On August 10 -11, the first two-day OpenStack Asia-Pacific Conference (OSAC) was held in Beijing and Shanghai concurrently. This conference is jointly organized by CSDN (Chinese Software Develop the Net), the world's largest Chinese IT technology community and the OpenStack user group (COSUG). The presentations are on slideshare: http://www.slideshare.net/HuiCheng2/tag/2012osac Submitting new features to Nova <http://blogs.gnome.org/markmc/2012/08/20/submitting-new-features-to-nova/> Mark McLoughlin wrote down a few pieces advice for someone submitting a large feature patch to Nova. OpenStack Folsom & Glance <http://bcwaldon.cc/2012/08/20/openstack-folsom-glance-overview.html> Brian Waldon recaps what landed in Glance in the past months. These are most of the features that will make it in Folsom release. Tips and Tricks * By Derek Higgins: Listing openstack keystone credentials <http://goodsquishy.com/2012/08/listing-openstack-keystone-credentials/> * By Zmanda Team: Storing Pebbles or Boulders: Optimizing Swift Cloud for different workloads <http://www.zmanda.com/blogs/?p=894> * By Mate Lakat: Hello Xen API host plugin <http://blogs.citrix.com/2012/08/17/hello-xen-api-host-plugin/> * By Derek Higgins: rackspace cloud files from the command line <http://goodsquishy.com/2012/08/rackspace-cloud-files-from-the-command-line/> * By Alessandro Tagliapietra: Hetzner Failover IP routing tool for openstack <http://www.alexnetwork.it/2012/08/20/openstack/hetzner-failover-ip-routing-…> * By Brian Waldon: Using Warlock & JSON Schemas <http://bcwaldon.cc/2012/08/19/using-warlock-and-json-schemas.html> * By Everett Toews: Logging in jclouds <http://blog.phymata.com/2012/08/18/logging-in-jclouds/> and How I get a Token from the Rackspace Open Cloud from the Command Line <http://blog.phymata.com/2012/08/17/get-a-token-from-rackspace/> * By Chmouel Boudjnah <http://blog.chmouel.com/>: Using python-novaclient against Rackspace Cloud next generation (powered by OpenStack) <http://blog.chmouel.com/2012/08/17/using-python-novaclient-against-rackspac…> Upcoming Events * OPENSTACK REVOLUTION <http://openstack-cloudopen2012.eventbrite.com/>Aug 28, 2012 -- San Diego, CA RSVP <http://openstack-cloudopen2012.eventbrite.com/> * Australian OpenStack User Group -- Adelaide Meetup with SAGE-AU <http://aosug.openstack.org.au/events/66911242/> Aug 28, 2012 -- Details <http://aosug.openstack.org.au/events/66911242/> * Block Storage Service is Cemented by Cinder <http://www.meetup.com/OpenStack-LA/events/74425192/> Aug 30, 2012 -- Los Angeles, CA Details <http://www.meetup.com/OpenStack-LA/events/74425192/> * OpenStack Swift meetup <http://www.meetup.com/openstack/events/77706042/> Aug 30, 2012 -- San Francisco, CA Details <http://www.meetup.com/openstack/events/77706042/> * OpenStack Summit <http://openstack.org/> Oct 15 -- 18, 2012 -- San Diego, CA Other news * Feature freeze period started: we're on our way to Folsom release * OpenStack Project Meeting 2012-08-21: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> and Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> Welcome new contributors Celebrating the first patches submitted this week by: * Alex Yang /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Folsom-3 development milestone for Keystone, Glance, Nova, Horizon, Quantum and Cinder
by Thierry Carrez 17 Aug '12

17 Aug '12

Hi everyone, The third and last development milestone of the Folsom cycle is now available for Keystone, Glance, Nova, Horizon, Quantum and Cinder ! It contains almost all features that will appear in the final release of Folsom, scheduled for September 27th. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/folsom/folsom-3 https://launchpad.net/glance/folsom/folsom-3 https://launchpad.net/nova/folsom/folsom-3 https://launchpad.net/horizon/folsom/folsom-3 https://launchpad.net/quantum/folsom/folsom-3 https://launchpad.net/cinder/folsom/folsom-3 We are now entering the feature-frozen, bugfixing time before we can produce our release candidates. Please test, try the new features, report bugs, help fix them. Let's all make Folsom another great OpenStack release. Cheers! -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

OpenStack Community Weekly Newsletter (Aug 10-17)
by Stefano Maffulli 17 Aug '12

17 Aug '12

Highlights of the week OpenStack Foundation Board - Gold Member Election Results <http://www.openstack.org/community/openstack-foundation-board-2012-election…> The Gold Members completed their election as planned. DLA Piper administered the election and has passed along the results. The eight elected companies and the individuals they intend to appoint to the board are listed alphabetically below: * Cisco -- Lew Tucker * Cloudscaling -- Randy Bias * Dell -- John Igoe * Dreamhost -- Simon Anderson * ITRI/CCAT -- Dr. Tzi-cker Chiueh * Mirantis -- Boris Renski * Piston -- Joshua McKenty * Yahoo! -- Sean Roberts Congratulations to the first members of OpenStack Foundation Board of Directors. OpenStack Swift: Where do we go from here? <http://markmail.org/message/yioqxntjsjlqyda6> Swift has many exciting features coming in the OpenStack Folsom Release this fall, but where do we go from here? What's next for Swift in grizzly? Join the discussion with the developers and give your feedback. The Return of Hyper-V <http://markmail.org/message/r46uxsblqviqr2j6> It's back: Hyper-V support is integrated back into Nova with https://review.openstack.org/#/c/11276/. OpenStack Security blog: An oldie but a goodie Josh McKenty's EMEA Launch Slides <http://secstack.org/2012/08/an-oldie-but-a-goodie-josh-mckentys-emea-launch…> This is a pretty antiquated presentation. Plenty of stuff has changed in openstack since it was given, for better and for worse. But it gives you an idea that the origins of OpenStack were built with security in mind. When at NASA we had some pretty good security and policy guys contributing heavily to the sprint planning sessions we had. The result was a code base that was fairly flexible when it came to adjusting itself to meet policy requirements. Understanding VlanManager Network Flows in OpenStack Cloud: Six Scenarios <http://www.mirantis.com/blog/vlanmanager-network-flow-analysis/> In a couple of recent posts <http://www.mirantis.com/author/psiwczakmirantis-com/> Mirantis' engineer Piotr Siwczak <http://www.mirantis.com/author/psiwczakmirantis-com/> covered some fundamental concepts of OpenStack networking, including VlanManager <http://www.mirantis.com/blog/openstack-networking-vlanmanager/> and floating IPs <http://www.mirantis.com/blog/configuring-floating-ip-addresses-networking-o…>. This post builds upon such content and aims to present how traffic flows in different scenarios addressed by OpenStack. First OpenStack User Group Meetup in Delhi NCR, India! <http://www.openstack.org/blog/2012/08/first-openstack-user-group-meetup-in-…> Openstack Delhi NCR chapter started yesterday with our first meet up. Students, Professors and Corporate entities attended the meeting. Announcing proof-of-concept Load Balancing as a Service project <http://markmail.org/message/lltovmmtpr2dksbb> Mirantis in collaboration with Cisco OpenStack team and a number of other community members, started socializing the blueprints for an elastic load balancer API service. Assign, commit and review: a Developer's Guide to OpenStack Contribution <http://www.slideshare.net/lzyeval/assign-commit-and-review> Luo Zhongyue asks for feedback to his presentation at OpenStack APAC Conference http://www.slideshare.net/lzyeval/assign-commit-and-review How I contribute to OpenStack series <http://www.openstack.org/blog/2012/08/how-i-contribute-to-openstack-series/> Rackspace is running a series of interviews to the protagonists of OpenStack development. Titled 'How I contribute to OpenStack', it collects insight straight from key developers on the front lines about how they became involved in OpenStack and the open cloud, and what contributions they've made. The first two installments saw SolidFire <http://solidfire.com/> Software Engineer John Griffith <http://www.rackspace.com/blog/how-i-contribute-to-openstack-solidfires-john…> and Red Hat <http://www.redhat.com/> Principal Software Engineer Mark McLoughlin <http://www.rackspace.com/blog/how-i-contribute-to-openstack-red-hats-mark-m…>. More to come on How I contribute to OpenStack <http://www.rackspace.com/blog/tag/how-i-contribute/>. Tips and Tricks * By Lorin Hochstein: Ansible, Vagrant and OpenStack on your laptop <http://lorinhochstein.wordpress.com/2012/08/12/ansible-vagrant-and-openstac…> * By Alessandro Tagliapietra: Openstack: Force writethrough cache mode in qcow2 images <http://www.alexnetwork.it/2012/08/10/tutorials/openstack-force-writethrough…> * By the Clouds Lab: A Step-by-Step Guide to Deploying OpenStack on CentOS Using the KVM Hypervisor and GlusterFS Distributed File System <http://markmail.org/message/gjwza57oniy4uwpk> Upcoming Events + Hack on Chef OpenStack Cookbooks -- Swedish Style <http://www.meetup.com/OpenStack-LA/events/75878692/> Aug 21, 2012 -- Los Angeles, CA Details <http://www.meetup.com/OpenStack-LA/events/75878692/> + Australian OpenStack User Group -- Adelaide Meetup with SAGE-AU <http://aosug.openstack.org.au/events/66911242/> Aug 28, 2012 -- Details <http://aosug.openstack.org.au/events/66911242/> + Block Storage Service is Cemented by Cinder <http://www.meetup.com/OpenStack-LA/events/74425192/> Aug 30, 2012 -- Los Angeles, CA Details <http://www.meetup.com/OpenStack-LA/events/74425192/> + OpenStack Swift meetup <http://www.meetup.com/openstack/events/77706042/> Aug 30, 2012 -- San Francisco, CA Details <http://www.meetup.com/openstack/events/77706042/> + OpenStack Summit <http://openstack.org/> Oct 15 -- 18, 2012 -- San Diego, CA Other news * Nick Lothian published the results of the survey to discover what tools people are using to manage their resources across multiple cloud providers: http://fifthvertex.com/2012/08/07/cloud-tools-survey/ * OpenStack Nova Meeting notes <http://markmail.org/message/btxjvsvpg4mv62zy> * OpenStack Project Meeting 2012-08-14: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> and Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> Welcome new contributors Celebrating the first patches submitted this week by: * Daryl Walleck, Rackspace * Alessandro Pilotti, CloudBase Solutions /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Aug 3-10)
by Stefano Maffulli 10 Aug '12

10 Aug '12

Highlights of the week OpenStack Foundation Board -- <http://www.openstack.org/community/openstack-foundation-board-2012-election…>Gold Member Election Update 2012 Elections <http://www.openstack.org/community/openstack-foundation-board-2012-election…> Recently the gold member formation committee met to discuss the election of directors for the gold members and agreed on the mechanics and timing of our election. Gold Members will be holding the election using cumulative voting the week before the individual member elections. More http://lists.openstack.org/pipermail/foundation/2012-August/001061.html Openstack Networking for Scalability and Multi-tenancy with VlanManager <http://www.mirantis.com/blog/openstack-networking-vlanmanager/> Second post by Mirantis about OpenStack networking, using VlanManager. While flat managers are designed for simple, small scale deployments, VlanManager is a good choice for large scale internal clouds and public clouds. Can OpenStack Swift Hit Amazon S3 like Cost Points? <http://www.buildcloudstorage.com/2012/01/can-openstack-swift-hit-amazon-s3-…> Amar Kapadia tries to answer the question whether a user creating cloud storage with OpenStack Swift can sell it to internal or external users at a price competitive to Amazon S3. Should You Consider SSDs for OpenStack Swift Cloud Storage? <http://www.zmanda.com/blogs/?p=847> Zmanda folks started publishing a series of blog posts investigating pros and cons of using SSD-based Swift installations. With an ongoing move in the industry to move towards building data centers with SSD based storage <http://www.wired.com/wiredenterprise/2012/06/flash-data-centers/>, there has been a lot of interest in the OpenStack Swift community to consider the faster I/O devices when deploying Swift based storage cloud, such as the discussions in [1] <https://answers.launchpad.net/swift/+question/163356>, [2] <https://answers.launchpad.net/swift/+question/181977> and [3] <https://answers.launchpad.net/swift/+question/159085>. Swift 1.6.0 Release <http://swiftstack.com/blog/2012/08/06/swift-1.6.0-release/> The changes highlighted by the team: the bin/swift CLI client and swift/common/client.py have been moved to the new python-swiftclient OpenStack project; Swift now includes the Keystone middleware "keystoneauth"; the swift-dispersion-report now works with a replica count other than three. Full announcement. Congratulations to the team for Swift's new release, v. 1.6.0 <http://swiftstack.com/blog/2012/08/06/swift-1.6.0-release/> and welcome to the five new Swift developers: François Charlier, Iryoung Jeong, Tsuyuzaki Kota, Dan Prince, Vincent Untz. OpenStack Nova, Glance and Keystone 2012.1.2 released <http://lists.openstack.org/pipermail/openstack-announce/2012-August/000020.…> In the time since the Essex release, the stable release team has been busy selectively back-porting bugfixes to the stable/essex branch according to the "safe source of high-impact fixes" criteria http://wiki.openstack.org/StableBranch. These releases are bugfix updates to Essex and are intended to be relatively risk free with no intentional regressions or API changes. Cloud computing and storage with OpenStack <http://www.ibm.com/developerworks/cloud/library/cl-openstack-cloud/index.ht…> IBM's DeveloperWorks published an introductory article about OpenStack and IaaS in general. Upcoming Events * 2012 OpenStack APEC Conference <http://openstack.csdn.net/index.html> Aug 10 -- 11, 2012 -- Bejing+Shanghai, China Details <http://openstack.csdn.net/index.html> * Openstack User Group Meetup ( Delhi NCR ) <http://www.meetup.com/Indian-OpenStack-User-Group/events/75533162/> Aug 12, 2012 -- Dehli Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/75533162/> * Hobart Meetup -- adjacent to PyCon2012, An OpenStack code dojo! <http://aosug.openstack.org.au/events/72708142/> Aug 17, 2012 -- Hobart, Australia Details <http://aosug.openstack.org.au/events/72708142/> * Australian OpenStack User Group -- Adelaide Meetup with SAGE-AU <http://aosug.openstack.org.au/events/66911242/> Aug 28, 2012 -- Adelaide Details <http://aosug.openstack.org.au/events/66911242/> * OpenStack Summit <http://openstack.org/> Oct 15 -- 18, 2012 -- San Diego, CA Other news * Security update: CVE-2012-3447 : Compute node filesystem injection/corruption <http://secstack.org/2012/08/cve-2012-3447-compute-node-filesystem-injection…> * Call for Help --- OpenStack API XML Support <http://markmail.org/message/iu7wnr26l2yclkzp> * Ceilometer Project Technical Leader election result <http://markmail.org/message/7m5l42mfwahfwq74>: Nick Barcet is the new PTL * OpenStack Project Meeting 2012-08-07: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> and Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> Welcome new contributors Celebrating the first patches submitted this week by: * Kylin CG * Ronen Kat, IBM /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[ANNOUNCE] OpenStack Nova, Glance and Keystone 2012.1.2 released
by Mark McLoughlin 10 Aug '12

10 Aug '12

Hey, In the time since the Essex release, we have been busy selectively back-porting bugfixes to the stable/essex branch according to our "safe source of high-impact fixes" criteria documented here: http://wiki.openstack.org/StableBranch We made a first round of those fixes available in the 2012.1.1 release 6 weeks ago and now we're happy to announce a 2012.1.2 release! These releases are bugfix updates to Essex and are intended to be relatively risk free with no intentional regressions or API changes. The list of bugs fixed can be seen here: https://launchpad.net/nova/+milestone/2012.1.2 https://launchpad.net/glance/+milestone/2012.1.2 https://launchpad.net/keystone/+milestone/2012.1.2 Please read (and add to!) the release notes at: http://wiki.openstack.org/ReleaseNotes/2012.1.2 Enjoy! Mark.

1 0

[OSSA 2012-011] Compute node filesystem injection/corruption (CVE-2012-3447)
by Thierry Carrez 08 Aug '12

08 Aug '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-011 CVE: CVE-2012-3447 Date: August 7, 2012 Title: Compute node filesystem injection/corruption Impact: Critical Reporter: Pádraig Brady (Red Hat) Products: Nova Affects: All versions Description: Pádraig Brady from Red Hat discovered that the fix implemented for CVE-2012-3361 (OSSA-2012-008) was not covering all attack scenarios. By crafting a malicious image with root-readable-only symlinks and requesting a server based on it, an authenticated user could still corrupt arbitrary files (all setups affected) or inject arbitrary files (Essex and later setups with OpenStack API enabled and a libvirt-based hypervisor) on the host filesystem, potentially resulting in full compromise of that compute node. Folsom fix: https://github.com/openstack/nova/commit/ce4b2e27be45a85b310237615c47eb53f3… Essex fix: https://github.com/openstack/nova/commit/d9577ce9f266166a297488445b5b0c93c1… Diablo fix: https://review.openstack.org/#/c/10953/ References: https://bugs.launchpad.net/nova/+bug/1031311 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-3447 Notes: This fix will be included in the upcoming Nova 2012.1.2 stable update (due Thursday) and the Folsom-3 development milestone (due next week). - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJQIXv+AAoJEFB6+JAlsQQjnJUQAI+Vp+GCMXAei/ktStVFrkXC ilgIjBB5mcbrj/TGlnqhkS0MB0+kmo8Ucy4tI0O+gAqYaPNcEp6bbGr5pOby8Gdk DehvQuTi4Rvvypnb7ORM+DjqPBtNGGMWKJzO84ls98Ev0z+6Soi4vmQal78wvwpX 3UbyqZG9P85QlDyyK+x/Af2D0YVCQffQ93/7UJi2OwB0hwHy+RS4WN7rYJGD2vh0 50jQYSgw/rrBSUPNupjEH+mXT/DM93z93qWmxHD6TYYUK9MmrfkfUPx8Ki8Fn5oQ 9znwXsIK5h3uexe2dHbABKaIm3AnMP3wCrKynEEjFV/no00r/Evm2zsdam31O3Bv DV8ng6sdSnvltQK2s8F3blp3tNpsAp12QkC0BDI9FlYAACdaTBnDcVhKh4HoO84T cRakJhfj23472GgmwwkIcPNEcfY1fWngUqN4rF2XUggtXzeEHyyqoiZIm4s4ns5+ DkSCmo5qBNbcos1C0BNeyPQ+wdF5U7wzQfggC6SRoKcPj/Mp8P5LCvgjPKwNtBuq gzAVPSlx0Zehlqqey8zkUUGQ4btxiKP5+iwrKajY6QfqgtkqEsG46GR+tm+ygDNR T8ltuixqMWpLPVUFZClaxV0MytSMdjhIgywkzyqHg9bzP4N3MztsGnIBPdQ0HC3a P85xQ28EFbBC5tIZ4WRe =C2MN -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (July 27-Aug 3)
by Stefano Maffulli 05 Aug '12

05 Aug '12

Highlights of the week OpenStack Foundation Board -- 2012 Election Candidates <http://www.openstack.org/community/openstack-foundation-board-2012-election…> See the current list of nominees for the OpenStack Foundation 2012 Board Member Elections who have received at least one nomination. A candidate must receive at least 10 nominations to appear on the ballot. Any active member of the OpenStack Foundation can support a nominee or nominate a new candidate http://www.openstack.org/community/openstack-foundation-board-2012-election…. A candidate must receive at least 10 nominations to appear on the ballot and must be a member of the Foundation. *The final day to nominate a candidate is Monday August 6, 2012.* Rostyslav Slipetskyy's Thesis on OpenStack security <http://secstack.org/2012/08/the-rostyslav-slipetskyy-thesis/> This is a pretty awesome bit of work done by a researcher in Denmark. I enjoyed reading it and I highly recommend it as day 1 reading for Infosec professionals and researchers getting into OpenStack. Slides <http://www.slideshare.net/oldbam/security-issues-in-openstack> and you can download the full thesis (PDF) <http://nordsecmob.aalto.fi/en/programme/publications/nordsecmob_thesis_2011…>. API Stability Statement <http://wiki.openstack.org/Governance/Approved/APIStability> It is critical to the success of OpenStack <http://wiki.openstack.org/OpenStack> that operators be willing to upgrade to new OpenStack <http://wiki.openstack.org/OpenStack> releases. All OpenStack <http://wiki.openstack.org/OpenStack> APIs use a versioning scheme that is completely independent from the named releases (Essex, Folsom, etc.). One obstacle to upgrading to a new OpenStack <http://wiki.openstack.org/OpenStack> release is if there are incompatible API changes that could cause user applications to stop working. Operators want great new features and APIs to be the only aspect of the upgrade process visible to their users. Old API versions should continue to work. More on http://wiki.openstack.org/Governance/Approved/APIStability OpenStack PPB defined "Supporting Project" There is a new category of OpenStack projects in addition to Core, Incubated, Library and Gating projects: "Supporting projects". The initial list of projects in this category is available on the wiki, with more details: http://wiki.openstack.org/Governance/Accepted/SupportingProjectDefinition. OpenStack Security Primer <http://secstack.org/2012/08/openstack-security-primer/> Matt Joyce introduction to security and OpenStack. He's maintaining the blog http://secstack.org <http://secstack.org/>, now available also on http://planet.openstack.org <http://planet.openstack.org/>. Tips and tricks * By Sébastien Han <http://sebastien-han.fr/>: Auto assign floating IP <http://sebastien-han.fr/blog/2012/08/03/openstack-auto-assign-floating-ip/> * By Mirantis <http://www.mirantis.com/>: OpenStack Networking Tutorial: Single-host FlatDHCPManager <http://www.mirantis.com/blog/openstack-networking-single-host-flatdhcpmanag…> * By Mark McLoughlin <http://blogs.gnome.org/markmc>: Nova DB Poking <http://blogs.gnome.org/markmc/2012/07/31/nova-db-poking/> * By Alessandro Tagiapietra <http://www.alexnetwork.it/>: Build an HA Openstack cloud <http://www.alexnetwork.it/2012/07/31/tutorials/build-an-ha-openstack-cloud-…> (multiple parts) Upcoming Events * South Bay OpenStack Hackathon <http://www.meetup.com/openstack/events/57643102/> Aug 09, 2012 -- Sunnyvale, CA Details <http://www.meetup.com/openstack/events/57643102/> * 2012 OpenStack APEC Conference <http://openstack.csdn.net/index.html> Aug 10 -- 11, 2012 -- Bejing+Shanghai, China Details <http://openstack.csdn.net/index.html> Openstack User Group Meetup ( Delhi NCR ) <http://www.meetup.com/Indian-OpenStack-User-Group/events/75533162/> Aug 12, 2012 -- Dehli Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/75533162/> * Hobart Meetup -- adjacent to PyCon2012, An OpenStack code dojo! <http://aosug.openstack.org.au/events/72708142/> Aug 17, 2012 -- Hobart, Australia Details <http://aosug.openstack.org.au/events/72708142/> * Australian OpenStack User Group -- Adelaide Meetup with SAGE-AU <http://aosug.openstack.org.au/events/66911242/> Aug 28, 2012 -- Adelaide Details <http://aosug.openstack.org.au/events/66911242/> * OpenStack Summit <http://openstack.org/> Oct 15 -- 18, 2012 -- San Diego, CA Other news * Security update: CVE-2012-3426 : Keystone does not properly implement token expiration <http://secstack.org/2012/08/cve-2012-3426-keystone-does-not-properly-implem…> * OpenStack Project Meeting 2012-07-31: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> * OpenStack PPB Meeting 2012-07-31: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> and Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> o Voted on Agreement on proposed API Stability Statement http://wiki.openstack.org/Governance/Approved/APIStability o Voted on Creating a "supporting" project official category http://wiki.openstack.org/Governance/Accepted/SupportingProjectDefinition Stats from traffic on docs.openstack.org Statistics taken from the traffic on docs.openstack.org, from January 1st 2012 to July 31st. <http://www.openstack.org/blog/wp-content/uploads/2012/08/H1-2012-country-vi…> Country/Territory visits to docs.openstack.org from Jan 1 2012 to July 31 2012 /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (July 20-27)
by Stefano Maffulli 28 Jul '12

28 Jul '12

Highlights of the week Join The OpenStack Foundation <http://www.openstack.org/blog/2012/07/join-the-openstack-foundation/> The OpenStack community has worked hard since the announcement of intention to establish an OpenStack Foundation in October 2011. We've come to the point where Individual Members can join and begin making important contributions like nominating board members: http://openstack.org/join (It's free!) OpenStack Foundation Board -- 2012 Election Candidates <http://www.openstack.org/community/openstack-foundation-board-2012-election…> See the current list of nominees for the OpenStack Foundation 2012 Board Member Elections who have received at least one nomination. A candidate must receive at least 10 nominations to appear on the ballot. Any active member of the OpenStack Foundation can support a nominee at the links below or nominate a new candidate by emailing secretary(a)openstack.org <mailto:secretary@openstack.org> (the acting secretary is Jonathan Bryce). A candidate must receive at least 10 nominations to appear on the ballot. *The final day to nominate a candidate is August 6, 2012.* *Creating a development cycle that is more user friendly*** <http://markmail.org/message/7pm63xkknide7oob> *Following recent discussions about increasing the involvement of users in the development of OpenStack, a new thread started. Your opinion is appreciated.* A review of the 1st London OpenStack Meetup <http://berrange.com/posts/2012/07/26/a-review-of-the-1st-london-openstack-m…> The report by Daniel P. Berrangé about a fabulous night, with views across London via the open air roof terrace, watered with pizza & drinks and warm weather in London. Daniel's talk is available also as podcast <http://cloudevangelist.org/2012/07/27/openstack_podcast/> on Cloud Evangelist <http://cloudevangelist.org/> blog. Weekly Hyper-V meeting on Freenode/#openstack-hyper-v <http://markmail.org/message/wxbmggolzwdlldgs> Anyone interested in bringing back support for Hyper-V in Nova is invited to join the new OpenStack-Hyper-V team. Tips and tricks * By Mark McLoughlin <http://blogs.gnome.org/markmc>: How <http://blogs.gnome.org/markmc/2012/07/27/ancient-history/>find the bzr merge proposal in launchpad which caused a given commit to be merged. * By Sébastien Han <http://sebastien-han.fr/>: Watch your nova log at the same time <http://sebastien-han.fr/blog/2012/07/23/tips-watch-your-nova-log-at-the-sam…> Upcoming Events * 2012 OpenStack APEC Conference <http://openstack.csdn.net/index.html> Aug 10 -- 11, 2012 -- Bejing+Shanghai, China Details <http://openstack.csdn.net/index.html> * OpenStack Summit <http://openstack.org/> Oct 15 -- 18, 2012 -- San Diego, CA Other news * OpenStack Project Meeting 2012-07-24: Summary <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> and Meeting log <http://eavesdrop.openstack.org/meetings/openstack-meeting/2012/openstack-me…> Welcome new contributors Celebrating the first patches submitted this week by: * Aaron Orosen, Nicira * Nayna Patel, HP /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2012-010] Various Keystone token expiration issues (CVE-2012-3426)
by Thierry Carrez 27 Jul '12

27 Jul '12

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2012-010 CVE: CVE-2012-3426 Date: July 27, 2012 Title: Various Keystone token expiration issues Impact: Medium Reporter: Derek Higgins Products: Keystone Affects: Essex, Folsom Description: Derek Higgins reported various issues affecting Keystone token expiration. A token expiration date can be circumvented by continuously creating new tokens before the old one has expired. Existing tokens also remain valid after a user account is disabled or after an account password changed. An authenticated and authorized user could potentially leverage those vulnerabilities to extend his access beyond the account owner expectations. Folsom fixes: http://github.com/openstack/keystone/commit/375838cfceb88cacc312ff6564e64eb… http://github.com/openstack/keystone/commit/628149b3dc6b58b91fd08e6ca8d91c7… http://github.com/openstack/keystone/commit/a67b24878a6156eab17b9098fa649f0… Essex fixes: http://github.com/openstack/keystone/commit/29e74e73a6e51cffc0371b323545583… http://github.com/openstack/keystone/commit/d9600434da14976463a0bd03abd8e03… http://github.com/openstack/keystone/commit/ea03d05ed5de0c015042876100d37a6… References: https://bugs.launchpad.net/keystone/+bug/998185 https://bugs.launchpad.net/keystone/+bug/997194 https://bugs.launchpad.net/keystone/+bug/996595 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2012-3426 Notes: Those fixes were already included in Keystone 2012.1.1 stable update and the Folsom-1 development milestone. - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBCAAGBQJQErMZAAoJEFB6+JAlsQQjMrkP/juA+StMaNQNNqfPyV4gFJHG mI/ZTFq7lf9HBqqxrKbWKdDdAW+AbGM+EXL6Vhu0xBCIk0Q9+dyj1t6BQd/Y/CMv Je5XWZ3YrufHtNI37I9We8hrNBz4WoVhAyLZNHPHmngRu/Dxz8BNtKC4mSrG5bLL ammjtdnecRLPa3GkqYi6tFQgKSzAiU/edXx0+h9veMaxvxKmDzwIKJ625p6CmouR esCnoMkC23e2IoDnq85WaoqK9V8PyMJJ8auU1P+olA/VdvTIXOPAiMOrclEOuFCw EVENPwXmzh/hM2LZKZSSmRgWxSvADfCWnTWc8VT0CvVbJXkOegwMgsFvzd/oy89Q huEu0HiBdOw7yDet5n1f63Es0NO108jEvlN4LNEF0emEv6fNo6rbKHpIqw5R+Dxp Yiu0j3XOiBhE6eIUvVdXv+mAvaRJsk9KzWQaAyrp2UKO52MU6G11+zwJpJCVCRod yjO2kSm1ksZzSF2ZmoteOeFdqJp11qI1LbfT6vswuacW1zrCPHbAM8RP1DS/5X4d PdgzJBZhE20G1YcY+kMMqIlmIs9hgP6IcaeHKxXcrW3Oq/flI00Rade/HmAamQ51 PsT9cVeE3uZt8plARG1SXyzQp8WF+U//H2af2BGiClX3TdrZU3EIOsKby77Xgwxl Z7A0lu7IqS1+4Fm/6738 =fX6q -----END PGP SIGNATURE-----

1 0