- OpenStack-announce - lists.openstack.org

[OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)
by Jeremy Stanley 23 May '13

23 May '13

OpenStack Security Advisory: 2013-013 CVE: CVE-2013-2013 Date: May 23, 2013 Title: Keystone client local information disclosure Reporter: Jake Dahn (Nebula) Products: python-keystoneclient Affects: All versions Description: Jake Dahn from Nebula reported a vulnerability that the keystone client only allows passwords to be updated in a clear text command-line argument, which may enable other local users to obtain sensitive information by listing the process and potentially leaves a record of the password within the shell command history. Fix: https://review.openstack.org/28702 Notes: A fix has already been merged to the python-keystoneclient master branch on 2013-05-21 (commit f2e0818) which adds an interactive password prompt, and will appear in the next release of python-keystoneclient. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2013 https://bugs.launchpad.net/python-keystoneclient/+bug/938315 -- Jeremy Stanley (fungi) OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 10-17)
by Stefano Maffulli 18 May '13

18 May '13

OpenStack Compute (Nova) Roadmap for Havana <http://russellbryantnet.wordpress.com/2013/05/13/openstack-compute-nova-roa…> The Havana design summit was held mid-April. Since then the Nova team has been documenting the Havana roadmap and going full speed ahead on development of these features. The list of features that developers have committed to completing for the Havana release is tracked using blueprints on Launchpad <https://blueprints.launchpad.net/nova/havana>. At the time of writing, there are 74 blueprints listed that cover a wide range of development efforts. Russell Bryant <http://russellbryantnet.wordpress.com/>, Nova Tech Lead, highlights some of them. Stacker Voices: Thierry Carrez, OpenStack Foundation <http://engineering.cloudscaling.com/stacker-voices-thierry-carrez-openstack…> Thierry Carrez handles release management for the OpenStack Foundation and is chair of the project's Technical Committee. Thierry was involved with the earliest incarnations of OpenStack while at Rackspace. Cloudscaling's team caught up with him at the OpenStack Summit in Portland to get Thierry's insights into the release cycle, governance and his wish list for the project. Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> Enovance was asked to migrate and synchronize two swift clusters in order to provide a customer a way to handle a swift migration easily. For that they started a project called swiftsync <https://github.com/enovance/swiftsync> hosted in github. Tips 'n Tricks * By Ceph <http://ceph.com/>: Incremental Snapshots with RBD <http://ceph.com/dev-notes/incremental-snapshots-with-rbd/> * By eNovance <http://www.enovance.com/>: Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> * By Loïc Dachary <http://dachary.org/>: Disaster recovery on host failure in OpenStack <http://dachary.org/?p=1961> Security Issues * Nova fails to verify image virtual size (CVE-2013-2096) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). * Canadian Web Hosting to Launch Public Cloud Built on OpenStack Software <http://www.dailyhostnews.com/canadian-web-hosting-to-launch-public-cloud-bu…> Upcoming Events * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 -- Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * 3rd London OpenStack Meetup <http://www.meetup.com/Openstack-London/events/116975682/> May 23, 2013 -- London, UK Details <http://www.meetup.com/Openstack-London/events/116975682/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 -- Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 -- Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 -- Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 -- 30, 2013 -- Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 -- Budapest, Hungary Details <http://openstackceeday.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Other News * Crowbar cuts OpenStack Grizzly ("pebbles") branch & seeks community testing <http://robhirschfeld.com/2013/05/17/crowbar-cuts-openstack-grizzly/> * OpenStack Grizzly Webinar Preview: Availability Zones vs. Host Aggregates <http://www.mirantis.com/blog/segregation-in-grizzly-availability-zones-vers…> * Nested Virtualization --- KVM, Intel, with VMCS Shadowing <http://kashyapc.wordpress.com/2013/05/16/nested-virtualization-kvm-intel-wi…> * OpenStack Upstream University training <http://dachary.org/?p=1978> * A new (configurable) cgroups layout for libvirt with QEMU, KVM & LXC <https://www.berrange.com/posts/2013/05/13/a-new-configurable-cgroups-layout…> * How to guarantee success of the I Design Summit in HK <http://lists.openstack.org/pipermail/openstack-dev/2013-May/009048.html> * OpenStack Project Meeting:Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…>. Welcome New Developers * Hugh Saunders * Bruno Semperlotti * YAMAMOTO Takashi, VALinux * Fujioka Yuuichi, NEC Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Trying to run pki_setup for keystone however the command doesn't exist <https://ask.openstack.org/question/1315/trying-to-run-pki_setup-for-keyston…> * Authentication credentials are being ignored <https://ask.openstack.org/question/1313/authentication-credentials-are-bein…> * Instance failed to start "qemu-img: Could not open...No such file or directory" <https://ask.openstack.org/question/1311/instance-failed-to-start-qemu-img-c…> * How to attach volume for instance (iso) on /dev/hda <https://ask.openstack.org/question/1302/how-to-attach-volume-for-instance-i…> * Can Openstack Choose the physical resources to boot a VM? <https://ask.openstack.org/question/1282/can-openstack-choose-the-physical-r…> * What causes "cloud-init-nonet gave up waiting for a network device"? <https://ask.openstack.org/question/1258/what-causes-cloud-init-nonet-gave-u…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-012] Nova fails to verify image virtual size (CVE-2013-2096)
by Michael Still 16 May '13

16 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2013-012 CVE: CVE-2013-2096 Date: May 16, 2013 Title: Nova fails to verify image virtual size Reporter: Loganathan Parthipan Products: Nova Affects: All versions Description: Loganathan Parthipan publicly reported a vulnerability in Nova. Nova did not implement checking for the virtual size of a qcow2 image used as ephemeral storage for instances. It is therefore possible for a user to create an image which has a large virtual size, but little data. Once the instance is created, the user can then proceed to fill the virtual disk, and consume all available disk on the host node file system. Havana (development branch) fix: https://review.openstack.org/28717 Grizzly fix: https://review.openstack.org/28901 Folsom fix: https://review.openstack.org/29192 References: https://bugs.launchpad.net/nova/+bug/1177830 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2096 Thanks, Michael Still OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlGUoRQACgkQlhS32Mrx3702BgCeKZUDDA/W6Nj/xgC1a1n9vHvP vvoAnRfIOXnuvJ01c7IxGyXON7LIh5kt =YfoG -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (May 3 – 10)
by Stefano Maffulli 11 May '13

11 May '13

OpenStack 2013.1.1 released <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000100.html> 2013.1.1 release, the latest in the series of stable releases. These releases are bugfix updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. A total of 85 bugs have been fixed in this release. OpenStack Grizzly documentation released <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000097.html> We have released a version of the OpenStack official documentation for grizzly and it is now available at http://docs.openstack.org/grizzly. We continue to update docs through our continuous publishing process so feedback is always welcome. If you have questions about how OpenStack documentation is maintained or would like to get involved, see http://wiki.openstack.org/Documentation/HowTo. We had nearly 80 contributors to the documentation for the Grizzly release. Thanks to everyone who helped create and maintain accurate information for OpenStack. Guidelines for answering question on Ask <http://lists.openstack.org/pipermail/community/2013-May/000252.html> It’s time we start collecting guidelines for the moderators so we keep having a very informative tool, with consistently good questions and answers. This wiki page hosts the draft of the Guidelines for Moderators https://wiki.openstack.org/wiki/Community/AskModerators. Comments welcome before they’re moved to their natural home on Ask OpenStack. Discussions at Breakfast with the Board – OpenStack April 2013 Summit <http://www.openstack.org/blog/2013/05/discussions-at-breakfast-with-the-boa…> The summary written by OpenStack Foundation’s Board of Directors of the things discussed during the Breakfast with the Bard in Portland, ranging from marketing to wifi, transparency to elections to what makes a contribution. A must read. Use existing RBD images and put it into Glance <http://sebastien-han.fr/blog/2013/05/07/use-existing-rbd-images-and-put-it-…> What if Glance, the OpenStack Image Service, was capable of converting images within its store, say from QCOW2 image to a RAW? Waiting for this capability to be added, Sébastien Han <http://sebastien-han.fr/> plays with a scenario where you have a KVM cluster backed by a Ceph Cluster and your CTO wants you to migrate the whole environment to OpenStack. Science fiction in action. Security Issues * Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html> * Keystone tokens not immediately invalidated when user is deleted (CVE-2013-2059) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000099.html> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). More content from Portland Summit: * Using OpenStack In A Traditional Hosting Environment <http://www.openstack.org/summit/portland-2013/session-videos/presentation/u…> by EIG/Bluehost Upcoming Events * OpenStack Atlanta Meetup <http://www.meetup.com/openstack-atlanta/events/107062982/> May 16, 2013 – Atlanta, USA Details <http://www.meetup.com/openstack-atlanta/events/107062982/> * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 – Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * 3rd London OpenStack Meetup <http://www.meetup.com/Openstack-London/events/116975682/> May 23, 2013 – London, UK Details <http://www.meetup.com/Openstack-London/events/116975682/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 – Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 – Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 – Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 – Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 – 30, 2013 – Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 – Budapest, Hungary Details <http://openstackceeday.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 – Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 – Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 – 23, 2013 – Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia – OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 – Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 – 26, 2013 – Portland, OR Details <http://www.oscon.com/oscon2013> Other News * Rant about Github pull-request workflow implementation <http://julien.danjou.info/blog/2013/rant-about-github-pull-request-workflow…> * Open Marketing Meeting – May 15 <http://lists.openstack.org/cgi-bin/mailman/private/marketing/2013-May/00005…> * Fixes and upgrades to Search on OpenStack Activity Board <http://markmail.org/message/h3k6tmoatgbfe5an> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-07-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-07-21.…>. Welcome New Developers * Matt Wagner, Redhat Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Can I still use nova-network in Grizzly? <https://ask.openstack.org/question/992/can-i-still-use-nova-network-in-griz…> * VM stops boot right after initializing tun <https://ask.openstack.org/question/261/vm-stops-boot-right-after-initializi…> * Why do I get “Could not find token” error using Swift with s3 API? <https://ask.openstack.org/question/661/why-do-i-get-could-not-find-token-er…> * How do I effectively disable/enable a tenant using the API? <https://ask.openstack.org/question/534/how-do-i-effectively-disableenable-a…> * How do I debug Nova service with eclipse and pydev <https://ask.openstack.org/question/815/how-do-i-debug-nova-service-with-ecl…> * What causes error “service n-net is not running” when running stack.sh? <https://ask.openstack.org/question/963/what-causes-error-service-n-net-is-n…> * How to list Server Id using python-novaclient Python API? <https://ask.openstack.org/question/989/how-to-list-server-id-using-python-n…> * Is it possible to modify a network while in use? <https://ask.openstack.org/question/947/is-it-possible-to-modify-a-network-w…> * How to set up metadata service on a flat network? <https://ask.openstack.org/question/945/how-to-set-up-metadata-service-on-a-…> * Keystone remove_user command removing ALL users not just the specified ones <https://ask.openstack.org/question/910/keystone-remove_user-command-removin…> * How do I debug Nova service with eclipse and pydev <https://ask.openstack.org/question/815/how-do-i-debug-nova-service-with-ecl…> * ENABLE_TENANT_TUNNELS, OVS Version check in Compute fails <https://ask.openstack.org/question/813/enable_tenant_tunnels-ovs-version-ch…> * How to make openstack_auth the default authentication backend for django admin? <https://ask.openstack.org/question/695/how-to-make-openstack_auth-the-defau…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack 2013.1.1 released
by Alan Pevec 10 May '13

10 May '13

Hi everybody, In the time since the Grizzly release, we have been busy selectively back-porting bugfixes to the stable/grizzly branch according to our "safe source of high-impact fixes" criteria documented here: http://wiki.openstack.org/StableBranch We're happy to announce the 2013.1.1 release, the latest in the series of stable releases. These releases are bugfix updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. A total of 85 bugs have been fixed in this release. The list of bugs fixed can be seen here: https://launchpad.net/nova/grizzly/2013.1.1 https://launchpad.net/cinder/grizzly/2013.1.1 https://launchpad.net/quantum/grizzly/2013.1.1 https://launchpad.net/keystone/grizzly/2013.1.1 https://launchpad.net/horizon/grizzly/2013.1.1 Please read (and add to!) the release notes at: http://wiki.openstack.org/ReleaseNotes/2013.1.1 The work on Grizzly stable release series continues, next release 2013.1.2 is planned for June 6th and will be managed by Adam Gandelman. Enjoy! Alan

1 0

[OSSA 2013-011] Keystone tokens not immediately invalidated when user is deleted (CVE-2013-2059)
by Thierry Carrez 09 May '13

09 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-011 CVE: CVE-2013-2059 Date: May 9, 2013 Title: Keystone tokens not immediately invalidated when user is deleted Reporter: Sam Stoelinga Products: Keystone Affects: All versions Description: Sam Stoelinga reported a vulnerability in Keystone. When users are deleted through Keystone v2 API, existing tokens for those users are not immediately invalidated and remain valid for the duration of the token's life (by default, up to 24 hours). This may result in users retaining access when the administrator of the system thought them disabled. You can workaround this issue by disabling a user before deleting it: in that case the tokens belonging to the disabled user are immediately invalidated. Keystone setups using the v3 API call to delete users are unaffected. Havana (development branch) fix: https://review.openstack.org/#/c/28677/ Grizzly fix: https://review.openstack.org/#/c/28678/ Folsom fix: https://review.openstack.org/#/c/28679/ References: https://bugs.launchpad.net/keystone/+bug/1166670 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2059 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRi8UUAAoJEFB6+JAlsQQjarMQAL64x2OlW3SbgOoCUDhi91lv JdBStMO6/6H1Njjv0cLEAOE/50rAJSFLsdLlzSkXHimD9NWnXogpbaKj+gWd/Jbm xDOgVtRDa8IgmaXVgA88tAO0/C6QHTQMBwBce8hVzMRRDZZ6zW7SAvofTBjdjmEj tC8nwhxF/QAx/lHwIyWHQsGCip+z9JQxT+UCQ5ytQQbSnYI/wmRWMHCCcst7XFqn H6Y9LQ8cLQAOZk0fHZx7wsFFVJ9XIiQcZxYSGPDn5/aRXlbbF6cWTy4UPB3jmMkp wJ7XSjpXzPLsTCimXwYT9CkhUYjvC7Y9Yu2XF3VycFL+bifobIfPQ2ABNBqkd/U1 2iIMq8rCTIG+GEhgBMHyrBdXJclsdzY/mFOHZhOdCsLH2pO6EPCUjO3Zs6BPtYfk zBNPRzrUXAnay+xjJhjQqxCOuskx/gxt2kOF00G1c/jZTytqzx7M4yf5GL9DYD6g LLUZpb+Ia5voocBpK2484fXlouVoQY+encQopnSZb5GarsMgO1hRK8qtExeeR3+o NPxeat15YaSvVaCgSL2msqnjIr6g3wXI1vLGdvmGny4hvNnLd+UeeQ9eT0Nc7LN9 aotaXRhDeYz71aFd8ZCYpUtoZ6I50/XnRT9+FrQ2QZ7cEKSVZjUv+mcEn0mCvZpC hqKVwOK6strcPXDlQwZr =e4jK -----END PGP SIGNATURE-----

1 0

[OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)
by Thierry Carrez 09 May '13

09 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-010 CVE: CVE-2013-2030 Date: May 9, 2013 Title: Nova uses insecure keystone middleware tmpdir by default Reporter: Grant Murphy (Red Hat), Anton Lundin Products: Nova Affects: Folsom, Grizzly Description: Grant Murphy from Red Hat and Anton Lundin both independently reported a vulnerability in Nova's default location for the Keystone middleware signing directory (signing_dir). By previously setting up a malicious directory structure, an attacker with local shell access on the Nova node could potentially issue forged tokens that would be accepted by the middleware. Only setups that use the default value for signing_dir are affected. Note that future versions of the Keystone middleware will issue a warning if an insecure signing directory is used. Havana (development branch) fix: https://review.openstack.org/#/c/28568/ Grizzly fix: https://review.openstack.org/#/c/28569/ Folsom fix: https://review.openstack.org/#/c/28570/ References: https://bugs.launchpad.net/nova/+bug/1174608 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2030 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRi72dAAoJEFB6+JAlsQQjJZAQAJ5w/+BoBD4em8YklBsxU6wU Bn1wWu3W5ngCNuHwr4ydWzC3U1TT1zWtogWJpv/+87m2KPESWhs7YGCkTIE9tLpA sNOniOG9hGUsWwRgtUqjA8/8QzLgbNJ/PDJx0lrNPNkvMbHwP/jxotx353edhelQ QAPJwVPBqu0vn2VZOeFWYNO/AnWNcjTXE0po92qaFvw3HWL3ykMd30w4Ejxv9clC VjBjaNkReSkmcd/BaArtr1IenyYyVqM7nv/VWl5O5Up02+uvAozDmy6Cyc1O5VOW 6m9nRH2WKE/bFXcTEG4rpH+/BZxG2RuyklUBvVtSaEAQOWYFSwQKzjxGM3rItsWt iuQYrakl6H69tRS3HS9pAXWdxSikSb8CqmVJauf3RG1/EQ7GtCO0kXVPi8fYBaTX GpLmpY8bj6o2iY1Kh1bozZ2oYVLgPrhP2R4oj+4iaSN++gy2qs0d3AvIK0BzBKT+ fd7wAUpdxltM9eZS82VEQxIaOGUDqnGompEu3nPRv9KD5kZqgz/L/jp5I+PR3y1D Uaj8W+FfF/AZtMRLJHl3I0kUHRhfuIusir5zja7UCoR6UEeipLvBzbi/DSGfBCRY /VbBv9ZZBeQ+Kw4EwS4/7G5nw1RX4/bKGSi0zcwwmD2unB7Plm9MjI65yR4oFidl uOpCYFwNk6PqCFED/mCz =wjZ/ -----END PGP SIGNATURE-----

1 0

OpenStack Grizzly documentation released 4/30/13
by Anne Gentle 06 May '13

06 May '13

Hi all, We have released a version of the OpenStack official documentation for grizzly and it is now available at http://docs.openstack.org/grizzly. We continue to update docs through our continuous publishing process so feedback is always welcome. Sorry for the delayed announcement. The release happened 4/30, less than a month after the code release. Contributor docs at http://docs.openstack.org/developer/ are completed at the same time as the code release, but operator and deployer documentation takes a little more time to bake and test. If you have questions about how OpenStack documentation is maintained or would like to get involved, see http://wiki.openstack.org/Documentation/HowTo. We had nearly 80 contributors to the documentation for the Grizzly release. Thanks to everyone who helped create and maintain accurate information for OpenStack. Thanks, Anne --- Anne Gentle Rackspace Content Stacker

1 0

OpenStack Community Weekly Newsletter (Apr 25 – May 3)
by Stefano Maffulli 04 May '13

04 May '13

Introducing Murano: Bringing Windows Environments to OpenStack <http://www.mirantis.com/blog/introducing-murano-bringing-windows-environmen…> In response to growing demand for deploying and running Windows based applications on OpenStack cloud, the team at Mirantis started Murano <https://wiki.openstack.org/wiki/Murano>: a native OpenStack component that enables fast provisioning and operation of Windows Environments on demand. Who Wrote OpenStack Grizzly Docs? <http://justwriteclick.com/2013/04/26/who-wrote-openstack-grizzly-docs/> Sneaking a peek at the numbers for documentation along with the code should show us pointers about docs keeping up with code. Anne Gentle <http://justwriteclick.com/> dives into the documentation with data and insights. “I” release cycle naming <https://wiki.openstack.org/wiki/Release_Naming#.22I.22_release_cycle_naming> The next OpenStack summit will happen in Hong Kong. That creates a pretty challenging naming problem, since there is no word starting with “i’ in classic transliteration of Chinese words. So the Technical Committee is willing to bend the rules /a little/ to extend the range of candidates… Feel free to add suggestions to the list on the wiki. Stacker Voices: Monty Taylor, HP <http://engineering.cloudscaling.com/stacker-voices-monty-taylor-hp/> Cloudscaling Engineering <http://engineering.cloudscaling.com/> talked with Monty Taylor of HP (reaching rockstar status also with a wired.com <http://www.wired.com/> profile <http://www.wired.com/wiredenterprise/2013/04/new-hackers-taylor/> this week) at the OpenStack Summit in Portland. Monty leads the CI (continuous innovation) project for OpenStack. In that role, he and his group have built testing systems that have made it possible for the OpenStack project to scale from a few dozen contributors for the Bexar release to more than 700 developers now pushing hundreds of patches daily to OpenStack. Watch the video on YouTube <http://www.youtube.com/watch?v=eqw4zxqPelc>. A little tracing hack <http://markmail.org/message/kjv4kry67732nawb> Timothy Daly at Yahoo! added metrics and tracing for OpenStack and released tomograph <https://github.com/timjr/tomograph>: a tool to see what and how OpenStack is doing behind the curtains. Contribute to OpenStack Activity Board <http://www.openstack.org/blog/2013/05/contribute-to-openstack-activity-boar…> We’ve released the complete documentation <http://activity.openstack.org/data/display/WIKIDS/Home> for OpenStack Insights <http://activity.openstack.org/data/>, with binaries and source code downloadable from Sourceforge <https://sourceforge.net/projects/wikidsopenstack> while the OpenStack Dash <http://activity.openstack.org/dash/> tools are the vanilla MetricsGrimoire <http://metricsgrimoire.github.io/> set hosted on github <https://github.com/MetricsGrimoire>. The code is free as in freedom so you’re welcome to play with it. How to run pylint with few false positives <http://cloudystuffhappens.blogspot.com/2013/04/how-to-run-pylint-with-few-f…> Testing your python code can get complex and with pylint, you /will /see false positives, meaning it will complain some lines as bugs that are actually correct. lintstack is designed to address this problem: *reduce false positives from pylint as much as possible without sacrificing accuracy*. Yun Mao <http://cloudystuffhappens.blogspot.com/search/label/openstack> describes how lintstack works. Report from Previous Events * By Alessio Ababilov <http://aababilov.wordpress.com/>: OpenStack Summit April 2013: a First Experience <http://aababilov.wordpress.com/2013/05/02/openstack-summit-april-2013-a-fir…> * By Amar Kapadia <http://www.buildcloudstorage.com/>: Coming of Age of Swift <http://blogs.evault.com/cloud-connected-recovery/cloud-connected-storage/op…>. Tips and Tricks * By Adam Young <http://adam.younglogic.com/>: Kerberizing PostgreSQL with FreeIPA for Keystone <http://adam.younglogic.com/2013/05/kerberizing-postgresql-with-freeipa-for-…> * By Giulio Fidente <http://giuliofidente.com/>: OpenStack Cinder – Add more volume nodes <http://giuliofidente.com/2013/04/openstack-cinder-add-more-volume-nodes.html> * By Flavio Percoco <http://blog.flaper87.org/>: Dynamic TTL Collection in Mongodb for Marconi <http://blog.flaper87.org/post/517c3ea50f06d3497faffe5a/> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). Meanwhile watch the keynotes from Portland Summit: * Bloomberg User Spotlight <http://www.openstack.org/summit/portland-2013/session-videos/presentation/k…> * Keynote: Comcast User Spotlight <http://www.openstack.org/summit/portland-2013/session-videos/presentation/k…> * Keynote: Best Buy User Spotlight <http://www.openstack.org/summit/portland-2013/session-videos/presentation/k…> * Keynote: Clouds in High Energy Physics <http://www.openstack.org/summit/portland-2013/session-videos/presentation/k…> * Keynote: OpenStack at the National Security Agency (NSA) <http://www.openstack.org/summit/portland-2013/session-videos/presentation/k…> Upcoming Events * OpenStack meeting in Cologne <http://www.meetup.com/OpenStack-DACH/events/108876542/> May 04, 2013 – Cologne, Germany Details <http://www.meetup.com/OpenStack-DACH/events/108876542/> * OpenStack Atlanta Meetup <http://www.meetup.com/openstack-atlanta/events/107062982/> May 16, 2013 – Atlanta, USA Details <http://www.meetup.com/openstack-atlanta/events/107062982/> * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 – Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 – Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 – Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/99146542/> May 27, 2013 – Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * OpenStack CEE Day <http://www.openstack.org/> May 29, 2013 – Budapest Details <http://www.openstack.org/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 – Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 – Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 – 26, 2013 – Portland, OR Details <http://www.oscon.com/oscon2013> Other News * A brief introduction to Keystone and PKI Tokens <http://www.enovance.com/fr/blog/5641/keystone-pki-tokens> * Glance wants to go public <http://blog.flaper87.org/post/517da0e10f06d35562ce7376/>: the future of OpenStack Image Service * OpenStack Common Vulnerability Database <http://secstack.org/2013/04/openstack-common-vulnerability-database/> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-04-30-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-04-30-21.…> o /HELP/: please participate to the thread that Gabriel started on API version discovery <http://markmail.org/message/xn7cyjskq2wznqhj> Welcome New Developers * Shawn Hartsock, VMwware * David Martin, redbrick health Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * openstack tries to use cache=none when using glusterfs, when it should be writethrough <https://ask.openstack.org/question/758/openstack-tries-to-use-cachenone-whe…> * Ceilometer BinApiTestCase fails with 503 error connecting to localhost <https://ask.openstack.org/question/669/ceilometer-binapitestcase-fails-with…> * Why do I get “Could not find token” error using Swift with s3 API? <https://ask.openstack.org/question/661/why-do-i-get-could-not-find-token-er…> * What p2v (physical to Virtual) capabilities does OpenStack have? <https://ask.openstack.org/question/651/what-p2v-physical-to-virtual-capabil…> * Why isn’t OpenStack Swift sending metrics to Statsd server? <https://ask.openstack.org/question/755/why-isnt-openstack-swift-sending-met…> * “Package ‘openstack-keystone’ isn’t signed with proper key” installing OpenStack on CentOS 6.4 <https://ask.openstack.org/question/747/package-openstack-keystone-isnt-sign…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

OpenStack Community Weekly Newsletter (Apr 12 – 25)
by Stefano Maffulli 26 Apr '13

26 Apr '13

Special post-Summit issue * OpenStack Design Summit Havana, from a Ceilometer point of view <http://julien.danjou.info/blog/2013/openstack-summit-havana-ceilometer> by Julien Danjou <http://julien.danjou.info/blog/> * Havana Design Summit: Swift API Discussions <http://swiftstack.com/blog/2013/04/24/openstack-summit-api-discussion/> by SwiftStack Team <http://swiftstack.com/> * OpenStack Summit Portland Aftermath <http://www.siliconloons.com/?p=448> by Kyle Mestery <http://www.siliconloons.com/> * OpenStack Developer Summit: Heat Followup <http://technicae.cogitat.io/2013/04/openstack-developer-summit-heat-followu…> by Duncan McGreggor <http://technicae.cogitat.io/search/label/openstack> * Havana! <http://secstack.org/2013/04/havana/> by OpenStack Security Blog <http://secstack.org/> * Portland OpenStack Summit <https://tropicaldevel.wordpress.com/2013/04/22/portland-openstack-summit/> by John Bresnahan <https://tropicaldevel.wordpress.com/> * Dan’s Partial Summary of the Nova Track <http://www.danplanet.com/blog/2013/04/22/dans-partial-summary-of-the-nova-t…> by Dan Smith <http://www.danplanet.com/blog> * The Rocket Ship to Havana – OpenStack Summit Spring 2013 <http://fewbar.com/2013/04/the-rocket-ship-to-havana-openstack-summit-spring…> by Clint Byrum <http://fewbar.com/> * Women of OpenStack at the Portland Summit <http://www.openstack.org/blog/2013/04/women-of-openstack-at-the-portland-su…> by Anne Gentle <http://www.openstack.org/blog> * Michael’s surprisingly unreliable predictions for the Havana Nova release <http://www.stillhq.com/openstack/havana/000002.html> by Michael Still <http://www.stillhq.com/> * Havana Design Summit: Extending ACLs and Metadata <http://swiftstack.com/blog/2013/04/17/openstack-summit-extending-swift-acls…> by SwiftStack Team <http://swiftstack.com/> * Design Summit in Portland <http://www.enovance.com/fr/blog/5567/openstack-havana-design-summit-in-port…>: Day 1 <http://www.enovance.com/fr/blog/5534/openstack-havana-design-summit-in-port…>,Day 2 <http://www.enovance.com/fr/blog/5550/openstack-havana-design-summit-in-port…>, Day 3 <http://www.enovance.com/fr/blog/5567/openstack-havana-design-summit-in-port…>, Day 4 <http://www.enovance.com/fr/blog/5594/openstack-havana-design-summit-in-port…> by eNovance <http://www.enovance.com/> * Havana Design Summit: Swift Extensions Talk <http://swiftstack.com/blog/2013/04/15/openstack-summit-talks-swift-extensio…> by SwiftStack Team <http://swiftstack.com/> * Havana Design Summit: Extending ACLs and Metadata <http://swiftstack.com/blog/2013/04/15/openstack-summit-extending-swift-acls…> by SwiftStack Team <http://swiftstack.com/> * OpenStack Design Summit <http://princessleia.com/journal/?p=7943>days 1-2 <http://princessleia.com/journal/?p=7930>, days 3-4 <http://princessleia.com/journal/?p=7943> by Elizabeth Krumbach <http://princessleia.com/journal> * “Stack Shop” cover of Macklemore’s Thrift Shop <http://robhirschfeld.com/2013/04/22/stack-shop-macklemore-thrift-shop/> by Rob <http://rob/>Hirschfeld <http://robhirschfeld.com/2013/04/22/stack-shop-macklemore-thrift-shop/> and others * The Making of Cloud of USB Sticks <http://anystacker.com/2013/04/the-making-of-cloud-of-usb-sticks/> by eglute OpenStack docs and tooling in 20 minutes <http://www.rhonabwy.com/wp/2013/04/19/openstack-docs-and-tooling-in-20-minu…> Howto get started with all the tooling and setup needed to build, review, and contribute to OpenStack Documentation. By Joe Heck <http://www.rhonabwy.com/wp>. How It’s Made: the OpenStack API Reference Page <http://justwriteclick.com/2013/04/14/how-its-made-the-openstack-api-referen…> The site at http://api.openstack.org <http://api.openstack.org/> is a collection of HTML pages, and one page has an especially interesting story about how it is built. Anne Gentle <http://justwriteclick.com/> reveals the secret. Storage != Transfer <https://tropicaldevel.wordpress.com/2013/04/24/storage-transfer/> John Bresnahan argues that concepts of data transfer and data storage should not be conflated into a single solution. He believes that OpenStack can benefit from a new component that offloads the burden of optimally transferring images from existing components like nova-compute and swift. Report from Previous Events * 3rd Swiss OpenStack User Group Meetup <http://www.openstack.org/blog/2013/04/3rd-swiss-openstack-user-group-meet-u…> Tips and Tricks * By Sébastien Han <http://sebastien-han.fr/>: Ceph and Cinder multi-backend <http://sebastien-han.fr/blog/2013/04/25/ceph-and-cinder-multi-backend/> * By Chmouel Boudjnah <http://blog.chmouel.com/> :: Howto revoke a token with keystone and PKI (v2.0 API) <http://blog.chmouel.com/2013/04/22/howto-revoke-a-token-with-keystone-and-p…> * By Running PostgreSQL and Mysql Unit tests in Keystone <http://adam.younglogic.com/2013/04/database-tests-keystone/> * By SwiftStack Team <http://swiftstack.com/>: Havana Design Summit: Benchmarking Swift <http://swiftstack.com/blog/2013/04/18/openstack-summit-benchmarking-swift/> * By Giulio Fidente <http://www.giuliofidente.com/>: Deploy OpenStack Heat on RHEL (and derivates) <http://www.giuliofidente.com/2013/04/deploy-openstack-heat-on-rhel-and-deri…> Upcoming Events * OpenStack meeting in Cologne <http://www.meetup.com/OpenStack-DACH/events/108876542/> May 04, 2013 – Cologne, Germany Details <http://www.meetup.com/OpenStack-DACH/events/108876542/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 – Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack Israel <http://www.meetup.com/IGTCloud/events/99146542/> May 27, 2013 – Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * OpenStack CEE Day <http://www.openstack.org/> May 29, 2013 – Budapest Details <http://www.openstack.org/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 – Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 – Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 – 26, 2013 – Portland, OR Details <http://www.oscon.com/oscon2013> Other News * OpenStack Project Technical Lead Interview Series #1: Mark McClain, OpenStack Networking Project <http://www.mirantis.com/blog/openstack-project-technical-lead-interview-ser…> * Crowbar and our Pivot (or, how we slipped and shipped Grizzly) <http://robhirschfeld.com/2013/04/24/crowbar-slipped-and-shipped-grizzly/> * Project Savanna Moves Ahead: Red Hat and Hortonworks are on board <http://www.mirantis.com/blog/project-savanna-moves-ahead-red-hat-and-horton…> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-04-23-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-04-23-21.…> Welcome New Developers * Tilottama Gaat, Rackspace * Zang MingJie, None * Jason Dunsmore, Rackspace * James Slagle, None Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Why is the quantum linuxbridge plugin getting sudo errors? <https://ask.openstack.org/question/524/why-is-the-quantum-linuxbridge-plugi…> * How to do automated deployment of a new node? <https://ask.openstack.org/question/82/how-to-do-automated-deployment-of-a-n…> * Is it safe to use WMI python library to manage HyperV driver from a Linux host? <https://ask.openstack.org/question/220/is-it-safe-to-use-wmi-python-library…> * Why do I see “Unable to find authentication token in headers” using swift with staticweb? <https://ask.openstack.org/question/225/why-do-i-see-unable-to-find-authenti…> * What’s causing permission error with Vmware Vcenter/ESX 4.1.0 on Grizzly? <https://ask.openstack.org/question/183/whats-causing-permission-error-with-…> * Why is the quantum linuxbridge plugin getting sudo errors? <https://ask.openstack.org/question/524/why-is-the-quantum-linuxbridge-plugi…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0