- OpenStack-announce - lists.openstack.org

[OSSA 2013-015] Authentication bypass when using LDAP backend (CVE-2013-2157)
by Thierry Carrez 13 Jun '13

13 Jun '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-015 CVE: CVE-2013-2157 Date: June 13, 2013 Title: Authentication bypass when using LDAP backend Reporter: Jose Castro Leon (CERN) Products: Keystone Affects: Folsom, Grizzly Description: Jose Castro Leon from CERN reported a vulnerability in the way the Keystone LDAP backend authenticates users. When provided with an empty password, the backend would perform an anonymous LDAP bind that would result in successfully authenticating the user. An attacker could therefore easily impersonate and get valid tokens for any user. Only Keystone setups using LDAP authentication backend are affected. Havana (development branch) fix: https://review.openstack.org/#/c/32896/ Grizzly fix: https://review.openstack.org/#/c/32895/ Folsom fix: https://review.openstack.org/#/c/32894/ References: https://bugs.launchpad.net/keystone/+bug/1187305 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2157 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRue20AAoJEFB6+JAlsQQjiHQP/1Jd8p9Zezo70Vdm4oZksDzH IPuFfeCRUhLvDC1ygz33/7CbRkFtmJS8C+PG+WxiG/49bsCBfIN5fHlOf3DY2X1U 9zgodo3Tm/LwKCrpdceu4VCABt7CtO/CsHnuQGWBOf06MLDTqDvz3LQKpcPXO50l 1OHiOWEX9nbCkNKRCPfK4QfrzbJM5GufEeoEEfKk8ZctivvI2M56OcSiGMdOhGK8 Xw+0bGzBBZzBMhiMq2iw7y0JqWtRLTND/AAP1eyjbHL/xDG/rTtECGaGuONXjpSk WQRpWMznJY83fBnxnVAvKvf6OxG8IW8YNicvTgfx5v9gvX0U00r59y24ClnmvBxb oRWES8bRLHmjf8vTtfZwcATEfUUFZZK+9VUsaIRsRF6+gF/fbQq39SdVESQACvks Sf9/f/Tu6u+58Je2JaTmx3LLV6u12ellP/GUr31OyihKAxFGK4Y1tdrO3v4+u2ZF lSC361D5r5cczTosmXy5HjXwfjATaGuMb1ycDKCmO+98gsluQ1exDFnIXCw38weN KWJIp5zVCdTF0rqZCr3xDBSe4aukX8niBJNnvgJwELAddIWZ6FHUuEsgl3UPs7ZD E+issrQHaGtOJpNvoj17uxxnTY2VrtJ2AjxiU7y+hmt9tHh78rx+OhAdn7zPdoeT EEJ4OWpjLDKre9HsJVxX =kubz -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (May 31 – June 7)
by Stefano Maffulli 08 Jun '13

08 Jun '13

OpenStack 2013.1.2 released <http://lists.openstack.org/pipermail/openstack-announce/2013-June/000109.ht…> The OpenStack Stable Maintenance team is happy to announce the release of the 2013.1.2 stable Grizzly release. We have been busy reviewing and accepting backported bugfixes to the stable/grizzly branches. A total of 80 bugs have been fixed across all core projects. *OpenStack “I” ***release******naming** <http://markmail.org/message/mz3c7thc4oa5vbfc> The next release cycle for OpenStack, starting in November 2013 after we conclude the current *release* cycle (“Havana”) will be called Icehouse. <https://launchpad.net/%7Eopenstack/+poll/i-release-naming> Open Source Sysadmin: Reorganization of the OpenStack Infrastructure Docs <http://princessleia.com/journal/?p=8101> The OpenStack Infrastructure team is constantly evolving its documentation to make it easier for new contributors to join the team. Last week documentation for the OpenStack Project Infrastructure <http://ci.openstack.org/> was reorganised “to re-orient the documentation as an introduction for new contributors and a reference for all contributors.” All of the CI tools are open source, the puppet and other configurations are all hosted in public revision control <https://github.com/openstack-infra/config> and any changes submitted are made by the same process all other changes in OpenStack are made <https://wiki.openstack.org/wiki/GerritWorkflow>. They go through automated tests in Jenkins to test applicable syntax and other formatting and the code changes submitted are reviewed by peers and approved by members of the infrastructure team. This has made it super easy it is for the team to collaborate on changes and offer suggestions (much better than endless pastebins or sharing a screen session with a fellow sysadmin!), plus with all changes in revision control it’s easy to track down where things went wrong and revert as necessary. Enter OpenStack’s T-shirt Design Contest! <http://www.openstack.org/blog/2013/06/enter-openstacks-t-shirt-design-conte…> *Show us your creative talent & submit an original design for our 2013 OpenStack T-shirt Design Contest! Winning design will be announced the last week in August 2013. **Details on **OpenStack blog <http://www.openstack.org/blog/2013/06/enter-openstacks-t-shirt-design-conte…>.* Async I/O and Python <http://blogs.gnome.org/markmc/2013/06/04/async-io-and-python/> When you’re working on OpenStack, you’ll probably hear a lot of references to ‘async I/O’ and how eventlet is the library we use for this in OpenStack. But, well … what exactly is this mysterious ‘asynchronous I/O’ thing? Read it from Mark McLoughlin <http://blogs.gnome.org/markmc>. Ceph integration in OpenStack: Grizzly update and roadmap for Havana <http://sebastien-han.fr/blog/2013/06/03/ceph-integration-in-openstack-grizz…> Sébastien Han <http://sebastien-han.fr/> wrote a summary of the sessions about Ceph integration with OpenStack. His post contains details about upcoming features and a roadmap. OpenStack-Docker: How to manage your Linux Containers with Nova <http://blog.docker.io/2013/06/openstack-docker-manage-linux-containers-with…> A new approach to manage Linux Containers (LXC) within OpenStack Compute. The Docker project released a driver to deploy LXC with Docker, with multiple advantages over the “normal” virtual machines usually deployed by Nova. Those advantages are speed, efficiency, and portability. Details and links to the code on How to manage your Linux Containers with Nova <http://blog.docker.io/2013/06/openstack-docker-manage-linux-containers-with…>. Tips ‘n Tricks * By Adam Young <http://adam.younglogic.com/>: Keystone test coverage <http://adam.younglogic.com/2013/06/keystone-test-coverage/> * By Everett Toews <http://blog.phymata.com/>: Swift/Cloud Files Cross Origin Resource Sharing Container with jclouds <http://blog.phymata.com/2013/06/04/swift-cloud-files-cross-origin-resource-…> * By Aaron Rosen <http://blog.aaronorosen.com/>: OpenStack Interface Hot Plugging <http://blog.aaronorosen.com/openstack-interface-hot-plugging/> OpenStack In The Wild * Live Person OpenStack Usage Case Study <http://www.slideshare.net/openstackil/koby-holzer-live-personopenstackstory> Upcoming Events * OpenStack Meetup Chennai <http://www.meetup.com/Indian-OpenStack-User-Group/events/120677342/> Jun 08, 2013 – Chennai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/120677342/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 10, 2013 – Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * Cloud Expo East 2013 <http://www.cloudcomputingexpo.com/> Jun 10 – 13, 2013 – New York City, NY Details <http://www.cloudcomputingexpo.com/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 – Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * Cloud Connect India <http://www.cloudconnectevent.in/> Jun 13, 2013 – Mumbai, India Details <http://www.cloudconnectevent.in/> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 – 20, 2013 – San Francisco, CA Details <http://event.gigaom.com/structure/> * Openstack a mezza scala! <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> Jun 20, 2013 – Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 – 23, 2013 – Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * OpenStack June Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/122386732/> Jun 22, 2013 – Bangalore, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/122386732/> * EuroPython 2013 <https://ep2013.europython.eu/> Jul 01 – 07, 2013 – Firenze, Italy Details <https://ep2013.europython.eu/> * FISL 14 <http://softwarelivre.org/fisl14> Jul 03 – 06, 2013 – Details <http://softwarelivre.org/fisl14> * PyCon Australia – OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 – Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 – 26, 2013 – Portland, OR Details <http://www.oscon.com/oscon2013> Reports from Previous Events * 1st OpenStack User Group Meetup Poland: Recorded Sessions & Lessons Learned <http://rafstack.tumblr.com/post/52372757366> * It’s the App, Stupid! Uri Cohen’s presentation from OpenStack Israel <http://cloudifysource.tumblr.com/post/51957539224> * OpenStack Day CEE (Central & Eastern Europe): Recap and Video Interviews <http://rafstack.tumblr.com/post/51818838556> Other News * Interview with Noam Shendar from Zadara Storage <http://rafstack.tumblr.com/post/52292533246> * Interview with Bernard Golden at Enstratius <http://rafstack.tumblr.com/post/52206955900> * Interview with Ross Turk from Inktank <http://rafstack.tumblr.com/post/52127480689> * OpenStack Project Technical Lead Interview Series #3: John Griffith, OpenStack Cinder (Block Storage) Project <http://www.mirantis.com/blog/openstack-project-technical-lead-interview-ser…> * Interview with Hendrik Volkmer: „There will be no reliable cloud“ <http://rafstack.tumblr.com/post/52046641668> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-06-04-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-06-04-21.…> Welcome New Developers * Martyn Taylor, Red Hat * Patrick Schaefer, IBM Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * PackStack or puppet-openstack? <https://ask.openstack.org/question/1946/packstack-or-puppet-openstack/> * SWIFT Error: Unable to retrieve container list <https://ask.openstack.org/question/1941/swift-error-unable-to-retrieve-cont…> * How to use python-ceilometerclient <https://ask.openstack.org/question/1929/how-to-use-python-ceilometerclient/> * Can the VMDK image version be set? <https://ask.openstack.org/question/1918/can-the-vmdk-image-version-be-set/> * What is flat network ? <https://ask.openstack.org/question/1906/what-is-flat-network/> * Instance marked as deleted but still present on host? <https://ask.openstack.org/question/1905/instance-marked-as-deleted-but-stil…> * How to Change TMP Directory for Image Upload (Horizon) <https://ask.openstack.org/question/1788/how-to-change-tmp-directory-for-ima…> * Where would I find nova compute service src rpm to be installed on my CN running centos ? <https://ask.openstack.org/question/1807/where-would-i-find-nova-compute-ser…> * Why does beam.smp process have high CPU usage? <https://ask.openstack.org/question/1771/why-does-beamsmp-process-have-high-…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./ -- Ask and answer questions on https://ask.openstack.org

1 0

OpenStack 2013.1.2 released
by Adam Gandelman 07 Jun '13

07 Jun '13

Hello- The OpenStack Stable Maintenance team is happy to announce the release of the 2013.1.2 stable Grizzly release. We have been busy reviewing and accepting backported bugfixes to the stable/grizzly branches according to the criteria set at: https://wiki.openstack.org/wiki/StableBranch A total of 80 bugs have been fixed across all core projects. These updates to Grizzly and are intended to be relatively risk free with no intentional regressions or API changes. The list of bugs, tarballs and other milestone information for each project may be found on Launchpad: https://launchpad.net/cinder/grizzly/2013.1.2 https://launchpad.net/glance/grizzly/2013.1.2 https://launchpad.net/horizon/grizzly/2013.1.2 https://launchpad.net/keystone/grizzly/2013.1.2 https://launchpad.net/nova/grizzly/2013.1.2 https://launchpad.net/quantum/grizzly/2013.1.2 Release notes may be found on the wiki: https://wiki.openstack.org/wiki/ReleaseNotes/2013.1.2 In addition to core projects, we've also cut a 2013.1.2 stable release for both Heat and Ceilometer projects, closing another 12 bugs: https://launchpad.net/ceilometer/grizzly/2013.1.2 https://launchpad.net/heat/grizzly/2013.1.2 The freeze on the stable/grizzly branches will be lifted today as we begin working toward the 2013.1.3 release, planned for August 08 release and managed by Alan Pevec. Thanks, Adam

1 0

OpenStack Community Weekly Newsletter (May 24-31)
by Stefano Maffulli 31 May '13

31 May '13

Havana-1 development milestone available <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000107.html> The first milestone of the Havana development cycle, "havana-1? is now available for Keystone, Glance, Nova, Horizon, Networking, Cinder, Ceilometer, and Heat. It contains all the new features that have been added since the Grizzly pre-release Feature Freeze in March. Including the oslo libraries, 63 blueprints were implemented and 671 bugs were fixed during this milestone. The next development milestone, havana-2, is scheduled for July 18th. Further details by Julien Danjou for Ceilometer <http://julien.danjou.info/blog/2013/openstack-ceilometer-havana-1-milestone…> The challenge of the network <http://lorinhochstein.wordpress.com/2013/05/29/the-challenge-of-the-network/> Lorin Hochstein <http://lorinhochstein.wordpress.com/> shared a very detailed story about debugging the network in OpenStack-powered instances. The story starts with a familiar message: I can't connect to the instance. Hopefully his story will be shared by generations of new OpenStack users and become legend. Travel less, save more: introducing the OpenStack volume affinity filter <http://www.mirantis.com/blog/travel-less-save-more-introducing-openstack-vo…> It is a common desire to have some storage space associated with an instance running on cloud. It is also a common desire to have access to it be as fast as possible. OpenStack doesn't provide a way to fine-tune this particular option out of the box. Mirantis engineer Alexey Ovchinnikov <http://www.mirantis.com/author/alexey-ovchinnikov/> discusses how Mirantis implemented just such an extension, what roadblocks have already been encountered, and what problems one may encounter when using it. OpenStack leaders learning by humility, doing and being good partners <http://robhirschfeld.com/2013/05/28/openstack-leaders-learning-by-humility-…> Director Rob Hirschfeld <http://robhirschfeld.com/> shares his thoughts about OpenStack leadership, open source collaboration and community. What are your thoughts on the matter? Notes from Board Meeting -- May 30th <http://lists.openstack.org/pipermail/foundation/2013-May/001428.html> The OpenStack Foundation Board of Directors had a telephone meeting on May 30^th at 9:00am PDT/1600 UTC. The meeting lasted just about 2 hours, but the Board ran through quite a few updates and short discussions on a number of topics. The board approved and published the minutes for previous meeting on the <https://the/>wiki <https://wiki.openstack.org/wiki/Governance/Foundation/14Apr2013BoardMinutes>. Executive director Jonathan Bryce has published a brief recap of May 3oth meeting. Tips 'n Tricks * By Jay Pipes <http://www.joinfu.com/>: Quick Gerrit review reminder on inline comments <http://www.joinfu.com/2013/05/quick-gerrit-review-reminder-on-inline-commen…> * By Sébastien Han <http://sebastien-han.fr/>: Grizzly Nova: what's new in the API CLI? <http://sebastien-han.fr/blog/2013/05/27/grizzly-nova-whats-new-in-the-api-c…> Security Issues * Missing expiration check in Keystone PKI tokens validation (CVE-2013-2104) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000106.html> Upcoming Events * OpenStack Rocks in Poland <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> Jun 06, 2013 -- Szczecin, Poland Details <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> * OpenStack Meetup Chennai <http://www.meetup.com/Indian-OpenStack-User-Group/events/120677342/> Jun 08, 2013 -- Chennai, India Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/120677342/> * Cloud Expo East 2013 <http://www.cloudcomputingexpo.com/> Jun 10 -- 13, 2013 -- New York City, NY Details <http://www.cloudcomputingexpo.com/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * Openstack a mezza scala! <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> Jun 20, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Reports from Previous Events * Report: May month OpenStack meetup,Bangalore, India <http://www.openstack.org/blog/2013/05/report-may-month-openstack-meetupbang…> Other News * Stacker Voices: Russell Bryant, Red Hat <http://engineering.cloudscaling.com/stacker-voices-russell-bryant-red-hat/> * Mark McLoughlin <http://blogs.gnome.org/markmc>'s recap of April 14th OpenStack Foundation Board Meeting <http://blogs.gnome.org/markmc/2013/05/25/april-14th-openstack-foundation-bo…> * OpenStack Project Meeting:Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-28-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-28-21.…> Welcome New Developers * Zhou Xing, IBM * Jan Provaznik, Redhat * Yang Lei, IBM * Simon Pasquier, None * Chang Bo Guo, IBM * Roman Bogorodskiy, Mirantis Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * What's the recommended way to snapshot images for cloud-init? <https://ask.openstack.org/question/1492/whats-the-recommended-way-to-snapsh…> * Are there plans (or a specific timeframe) to OAuth/OpenID Connect support in OpenStack APIs? <https://ask.openstack.org/question/1736/are-there-plans-or-a-specific-timef…> * How to setup security groups for IPv6 with nova-network? <https://ask.openstack.org/question/1520/how-to-setup-security-groups-for-ip…> * How does quantum (network-type: vlan) configure ESX-host VMs? <https://ask.openstack.org/question/1584/how-does-quantum-network-type-vlan-…> * Migrating Images from Diablo to Folsom. <https://ask.openstack.org/question/1617/migrating-images-from-diablo-to-fol…> * Can Openstack control VM's network bandwidth right now? <https://ask.openstack.org/question/1644/can-openstack-control-vms-network-b…> * Is it possible to access VMs in OpenStack cloud with VMware vSphere? <https://ask.openstack.org/question/1694/is-it-possible-to-access-vms-in-ope…> * Why do ebtables rules with share_dhcp_address block arp traffic? <https://ask.openstack.org/question/1648/why-do-ebtables-rules-with-share_dh…> * Is it possibile to create a quantum network with single nic card? <https://ask.openstack.org/question/1710/is-it-possibile-to-create-a-quantum…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

Havana-1 development milestone available
by Thierry Carrez 30 May '13

30 May '13

Hi everyone, The first milestone of the Havana development cycle, "havana-1" is now available for Keystone, Glance, Nova, Horizon, Networking, Cinder, Ceilometer, and Heat. It contains all the new features that have been added since the Grizzly pre-release Feature Freeze in March. You can see the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/havana/havana-1 https://launchpad.net/glance/havana/havana-1 https://launchpad.net/nova/havana/havana-1 https://launchpad.net/horizon/havana/havana-1 https://launchpad.net/quantum/havana/havana-1 https://launchpad.net/cinder/havana/havana-1 https://launchpad.net/ceilometer/havana/havana-1 https://launchpad.net/heat/havana/havana-1 Including the oslo libraries, 63 blueprints were implemented and 671 bugs were fixed during this milestone. The next development milestone, havana-2, is scheduled for July 18th. Regards, -- Thierry Carrez (ttx) Release Manager, OpenStack

1 0

[OSSA 2013-014] Missing expiration check in Keystone PKI tokens validation (CVE-2013-2104)
by Thierry Carrez 29 May '13

29 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenStack Security Advisory: 2013-014 CVE: CVE-2013-2104 Date: May 28, 2013 Title: Missing expiration check in Keystone PKI tokens validation Reporter: Eoghan Glynn (Red Hat), Alex Meade (Rackspace) Products/Affects: Keystone (Folsom only), python-keystoneclient (0.2.0+) Description: Eoghan Glynn from Red Hat and Alex Meade from Rackspace both reported a vulnerability in expiry checks for PKI tokens in the Keystone authentication middleware. Expired tokens for authenticated users could continue to be used, potentially resulting in the bypass of intended security policies. The effect of PKI token revocation is also reversed when the token expires, in the sense that a revoked token is once again treated as being valid. Only setups using PKI tokens are affected. Note: The affected code was added to Keystone in the Folsom release, but was moved to python-keystoneclient during the Grizzly development cycle. python-keystoneclient fix (will be included in upcoming 0.2.4 release): https://review.openstack.org/#/c/30742/ Keystone (Folsom) fix: https://review.openstack.org/#/c/30743/ References: https://bugs.launchpad.net/python-keystoneclient/+bug/1179615 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2104 - -- Thierry Carrez (ttx) OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with undefined - http://www.enigmail.net/ iQIcBAEBCAAGBQJRpRVGAAoJEFB6+JAlsQQjBRAP/iyScNAht67EMgGed4GWNKd3 2zHOgmqIq31S558ugul1e3qNgggnQ0qJvI1RjcgZuKoJEhH8SaPZBuykyycSvO9M L2Bex+GKAGAMuaz4ryPcnt7xJg+Mc0cksdCldeW1pXMrt8yITSQgXe0GqnGssoC+ 5TCk7JG8ADczbDGMa/nyc65tksbEI8hNJYyLLbCapvxfz4VqL2r5yp0vT0/jWDxy FLocAYnoKm9oxl0In5zioMQs0cSYAAa5EjwMLMMmUF/Axa7GskUOME8Q/GdgpMzJ h5AutinbpANSysz8pTB9bps7WSq33KfGKBN23caP43XvyMVA6CTsLUJH+U/9n+9u 0rTmKcumLXW9nkf5leki1u69VqRZFksrcEzJVtXdDyGGvFbZjPLcoA8lWifluSK/ vhu+T+RSnFWicki/Ifiz7c4tK6RYSB+a4G3/982GBxKp1sm3WLKd3ljsmpsqFeAY sz1o6p8zTgKIsYKrFEO6wMx37Qiga1RRB0As9msmAHJ6LXTO5ev8LcxXBjRjSIPs kTxoxHomRhbJAigvw+qSNSZz3DjrEywcqlNLLINQio21gzPMP4v1GVzwvroI8akf 6oz4DLDMcbdI1yQ7jjEhpnrcpFRHrJi2a45Tv6dlto34LvG7gLvgmLgnkJs0XMw7 BslUz5cGAucwXTz2vSHs =bu2N -----END PGP SIGNATURE-----

1 0

OpenStack Community Weekly Newsletter (May 17-24)
by Stefano Maffulli 25 May '13

25 May '13

The OpenStack Summit is coming to Hong Kong <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/> It's official: we're going to Hong Kong on Nov 5-8. The Summit will take place at Asia World Expo, a large convention center near the airport with a connecting Marriott hotel. The Airport Express train stops within Asia World Expo, making it convenient to access from most parts of the city. Please check the VISA information page <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/visa-inform…> and FAQ <http://www.openstack.org/summit/openstack-summit-hong-kong-2013/conference-…> for more information about your travel plans. We encourage you to book early! Connecting the dots: Dell stays course on OpenStack private <http://robhirschfeld.com/2013/05/23/dell-stays-course-on-openstack-private-…> OpenStack Foundation board member Rob Hirschfeld <http://robhirschfeld.com/> summarizes the /increasing level of investment/ in OpenStack-powered private cloud solutions (Dell <http://jobs.dell/>is hiring! <http://jobs.dell.com/search/openstack/ASCategory/-1/ASPostedDate/-1/ASCount…>). Among the things highlighted, the recent announcements are about increasing investment where Dell is already successful <http://en.community.dell.com/dell-blogs/direct2dell/b/direct2dell/archive/2…> plus accelerating with new features (such as leadership in HyperV enablement <http://www.serverwatch.com/server-news/dell-sets-the-stage-for-hyper-vs-ret…>). An introductory tour of OpenStack Cloud Messaging as a Service <http://www.openstack.org/blog/2013/05/an-introductory-tour-of-openstack-clo…> The need for an OpenStack Messaging Service was recognized by the San Diego Grizzly Summit, and in an unconference track design meeting on the last day, a crowd of interested people met, talked out some requirements, and from that the OpenStack Message Bus <https://wiki.openstack.org/wiki/Marconi> project was born. It was codenamed "Marconi", in honor of Guglielmo Marconi <http://en.wikipedia.org/wiki/Guglielmo_Marconi>, the inventor of wireless messaging. The Marconi team collaborates on Launchpad <https://launchpad.net/marconi>. Working with the OpenStack Code Review and CI system -- Chef Edition <http://www.joinfu.com/2013/05/working-with-the-openstack-code-review-and-ci…> For too long, the state of the OpenStack Chef world had been one of duplicative effort, endless forks of Chef cookbooks, and little integration with how many of the OpenStack projects choose to control source code and integration testing. Recently, however, the Chef + OpenStack community has been getting its proverbial act together. Folks from lots of companies have come together and pushed to align efforts to produce a set of well-documented, flexible, but focused Chef cookbooks that install and configure OpenStack services. StackForge now hosting a set of Chef cookbooks for OpenStack. Virtualizing legacy hardware in OpenStack <http://dachary.org/?p=1991> Loïc Dachary <http://dachary.org/> summarizes how the French non-profit organization April <http://april.org/> migrated the workload of a five years old hardware to OpenStack. Instead of migrating each of the fourteen vservers <http://linux-vserver.org/> on a Debian GNU/Linux lenny <http://www.debian.org/releases/lenny/> running a *2.6.26-2-vserver-686-bigmem* linux individually to an OpenStack instance, it was decided that the vserver host would be copied over to an OpenStack instance. Discussion lists available in non-English languages <https://wiki.openstack.org/wiki/Community#Mailing_lists_in_local_languages> In order to support our growing international communities the OpenStack Infrastructure and the Community team worked to allow groups to create mailing lists in languages other than English. People interested in discussions in Italian <http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-it> and Vietnamese <http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-vi> can join the lists already. A request for a list to discuss in Spanish is pending <https://pending/>review <https://review.openstack.org/#/c/30495/> and other can be created if necessary following the instructions <https://wiki.openstack.org/wiki/Community#Mailing_lists_in_local_languages>. Tips 'n Tricks * By Sébastien Han <http://sebastien-han.fr/>: Nova: archive deleted rows <http://sebastien-han.fr/blog/2013/05/23/nova-archive-deleted-rows/> * By eNovance <http://www.enovance.com/>: The absolute minimum to get you started with Vagrant <http://www.enovance.com/fr/blog/5685/the-absolute-minimum-to-get-you-starte…> * By eNovance <http://www.enovance.com/>: How to create specific Nova flavors for tenants <http://www.enovance.com/fr/blog/5670/how-to-create-specific-nova-flavors-fo…> * By Russell Bryant <http://russellbryantnet.wordpress.com/>: Availability Zones and Host Aggregates in OpenStack Compute (Nova) <http://russellbryantnet.wordpress.com/2013/05/21/availability-zones-and-hos…> * By Cloudscaling Engineering <http://engineering.cloudscaling.com/>: Stacker Voices: Mark McLoughlin, Red Hat <http://engineering.cloudscaling.com/stacker-voices-mark-mcloughlin-red-hat/> Security Issues * Keystone client local information disclosure (CVE-2013-2013) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000104.html> Upcoming Events * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 -- Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 -- Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 -- 30, 2013 -- Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 -- Budapest, Hungary Details <http://openstackceeday.com/> * 2013 Beijing Open Source Convention <http://bj-opensource.com/> May 29, 2013 -- Beijing, China Program <http://bj-opensource.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack Rocks in Poland <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> Jun 06, 2013 -- Szczecin, Poland Details <http://www.meetup.com/OpenStack-User-Group-Poland/events/119500792/> * Cloud Expo East 2013 <http://www.cloudcomputingexpo.com/> Jun 10 -- 13, 2013 -- New York City, NY Details <http://www.cloudcomputingexpo.com/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * Openstack a mezza scala! <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> Jun 20, 2013 -- Milano, Italy Details <http://www.meetup.com/OpenStack-User-Group-Italia/events/101619052/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> Other News * Interview with John Griffith at SolidFire <http://rafstack.tumblr.com/post/51219217031> * Interview with Anne Gentle, OpenStack Technical Writer <http://rafstack.tumblr.com/post/50989644005> * OpenStack Board of Directors Talks: Episode 10 with Joseph George, Director of Product Strategy of Dell's Revolutionary Solutions Team <http://rafstack.tumblr.com/post/51073919838> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-21-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-21-21.…>. Welcome New Developers * Kanzhe Jiang, Big Switch * Marharyta Kislinska * Li Yingjun * Satyanarayana Patibandla, TCS * Ryan Moore, HP * Emanuele Rocca, VU University Amsterdam * Aditi Raveesh, Rackspace Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * How to add data to tables in horizon Dashboard <https://ask.openstack.org/question/1572/how-to-add-data-to-tables-in-horizo…> * Where should I install Dashboard on a 3 nodes architecture? <https://ask.openstack.org/question/1576/where-should-i-install-dashboard-on…> * Migrating from nova-network to quantum <https://ask.openstack.org/question/1565/migrating-from-nova-network-to-quan…> * How to setup security groups for IPv6 with nova-network? <https://ask.openstack.org/question/1520/how-to-setup-security-groups-for-ip…> * Recommended version of libvirt <https://ask.openstack.org/question/1388/recommended-version-of-libvirt/> * Snapshotting images and cloud-init <https://ask.openstack.org/question/1492/snapshotting-images-and-cloud-init/> * Are there any tuning methods in Openstack <https://ask.openstack.org/question/1306/are-there-any-tuning-methods-in-ope…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)
by Jeremy Stanley 24 May '13

24 May '13

OpenStack Security Advisory: 2013-013 CVE: CVE-2013-2013 Date: May 23, 2013 Title: Keystone client local information disclosure Reporter: Jake Dahn (Nebula) Products: python-keystoneclient Affects: All versions Description: Jake Dahn from Nebula reported a vulnerability that the keystone client only allows passwords to be updated in a clear text command-line argument, which may enable other local users to obtain sensitive information by listing the process and potentially leaves a record of the password within the shell command history. Fix: https://review.openstack.org/28702 Notes: A fix has already been merged to the python-keystoneclient master branch on 2013-05-21 (commit f2e0818) which adds an interactive password prompt, and will appear in the next release of python-keystoneclient. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2013 https://bugs.launchpad.net/python-keystoneclient/+bug/938315 -- Jeremy Stanley (fungi) OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (May 10-17)
by Stefano Maffulli 18 May '13

18 May '13

OpenStack Compute (Nova) Roadmap for Havana <http://russellbryantnet.wordpress.com/2013/05/13/openstack-compute-nova-roa…> The Havana design summit was held mid-April. Since then the Nova team has been documenting the Havana roadmap and going full speed ahead on development of these features. The list of features that developers have committed to completing for the Havana release is tracked using blueprints on Launchpad <https://blueprints.launchpad.net/nova/havana>. At the time of writing, there are 74 blueprints listed that cover a wide range of development efforts. Russell Bryant <http://russellbryantnet.wordpress.com/>, Nova Tech Lead, highlights some of them. Stacker Voices: Thierry Carrez, OpenStack Foundation <http://engineering.cloudscaling.com/stacker-voices-thierry-carrez-openstack…> Thierry Carrez handles release management for the OpenStack Foundation and is chair of the project's Technical Committee. Thierry was involved with the earliest incarnations of OpenStack while at Rackspace. Cloudscaling's team caught up with him at the OpenStack Summit in Portland to get Thierry's insights into the release cycle, governance and his wish list for the project. Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> Enovance was asked to migrate and synchronize two swift clusters in order to provide a customer a way to handle a swift migration easily. For that they started a project called swiftsync <https://github.com/enovance/swiftsync> hosted in github. Tips 'n Tricks * By Ceph <http://ceph.com/>: Incremental Snapshots with RBD <http://ceph.com/dev-notes/incremental-snapshots-with-rbd/> * By eNovance <http://www.enovance.com/>: Swiftsync -- A way to synchronize two swift clusters <http://www.enovance.com/fr/blog/5653/swiftsync-a-way-to-synchronize-two-swi…> * By Loïc Dachary <http://dachary.org/>: Disaster recovery on host failure in OpenStack <http://dachary.org/?p=1961> Security Issues * Nova fails to verify image virtual size (CVE-2013-2096) <http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html> OpenStack In The Wild A new section of the weekly newsletter dedicated to users of OpenStack. If you want to showcase how OpenStack helps you (or you know somebody that uses OpenStack) please let us know: email <mailto:communitymngr@openstack.org>, twitter <http://twitter.com/openstack>, reddit <http://www.reddit.com/r/openstack/> or avian carrier <http://en.wikipedia.org/wiki/IP_over_Avian_Carriers> will do). * Canadian Web Hosting to Launch Public Cloud Built on OpenStack Software <http://www.dailyhostnews.com/canadian-web-hosting-to-launch-public-cloud-bu…> Upcoming Events * OpenStack Dublin Meetup <http://www.meetup.com/OpenStack-Ireland/events/116567022/> May 22, 2013 -- Dublin, Ireland Details <http://www.meetup.com/OpenStack-Ireland/events/116567022/> * 3rd London OpenStack Meetup <http://www.meetup.com/Openstack-London/events/116975682/> May 23, 2013 -- London, UK Details <http://www.meetup.com/Openstack-London/events/116975682/> * OpenStack DACH Day <http://www.prweb.com/releases/2013/3/prweb10526716.htm> May 24, 2013 -- Berlin Fairgrounds Details <http://www.prweb.com/releases/2013/3/prweb10526716.htm> * OpenStack India Meetup <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> May 26, 2013 -- Bangalore, India at Anuta Network Details <http://www.meetup.com/Indian-OpenStack-User-Group/events/117132352/> * OpenStack Israel <http://www.openstack-israel.org/> May 27, 2013 -- Tel-Aviv, Israel Details <http://www.openstack-israel.org/> * Australian OpenStack User Group tri-city Meetup <http://aosug.openstack.org.au/> May 27, 2013 -- Australia Details <http://aosug.openstack.org.au/> * OpenStack at CeBit Australia <http://www.cebit.com.au/> May 28 -- 30, 2013 -- Sidney, Australia Booth in Hall 4 <http://www.cebit.com.au/> * OpenStack CEE Day <http://openstackceeday.com/> May 29, 2013 -- Budapest, Hungary Details <http://openstackceeday.com/> * Building an OpenStack Cloud <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> May 30, 2013 -- Chicago, IL Details <http://www.meetup.com/meetup-group-NjZdcegA/events/108731562/> * OpenStack meeting in Munich <http://www.meetup.com/openstack-de/events/109700562/> Jun 11, 2013 -- Munich, Germany Details <http://www.meetup.com/openstack-de/events/109700562/> * DatacenterDynamics Converged <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> Jun 11, 2013 -- Paris, France Details <http://www.datacenterdynamics.com/fr/conferences/2013/paris-2013> * GigaOM Structure <http://event.gigaom.com/structure/> Jun 19 -- 20, 2013 -- San Francisco, CA Details <http://event.gigaom.com/structure/> * OpenStack DevCamp Essen <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> Jun 21 -- 23, 2013 -- Essen, Germany Details <https://wiki.openstack.org/wiki/DevCamp/EssenGermany2013> * PyCon Australia -- OpenStack Miniconf <http://2013.pycon-au.org/programme/schedule/friday> Jul 05, 2013 -- Hobart, Australia Details <http://2013.pycon-au.org/programme/schedule/friday> * OSCON 2013 <http://www.oscon.com/oscon2013> Jul 22 -- 26, 2013 -- Portland, OR Details <http://www.oscon.com/oscon2013> Other News * Crowbar cuts OpenStack Grizzly ("pebbles") branch & seeks community testing <http://robhirschfeld.com/2013/05/17/crowbar-cuts-openstack-grizzly/> * OpenStack Grizzly Webinar Preview: Availability Zones vs. Host Aggregates <http://www.mirantis.com/blog/segregation-in-grizzly-availability-zones-vers…> * Nested Virtualization --- KVM, Intel, with VMCS Shadowing <http://kashyapc.wordpress.com/2013/05/16/nested-virtualization-kvm-intel-wi…> * OpenStack Upstream University training <http://dachary.org/?p=1978> * A new (configurable) cgroups layout for libvirt with QEMU, KVM & LXC <https://www.berrange.com/posts/2013/05/13/a-new-configurable-cgroups-layout…> * How to guarantee success of the I Design Summit in HK <http://lists.openstack.org/pipermail/openstack-dev/2013-May/009048.html> * OpenStack Project Meeting:Summary <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2013/project.2013-05-14-21.…>. Welcome New Developers * Hugh Saunders * Bruno Semperlotti * YAMAMOTO Takashi, VALinux * Fujioka Yuuichi, NEC Got answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Trying to run pki_setup for keystone however the command doesn't exist <https://ask.openstack.org/question/1315/trying-to-run-pki_setup-for-keyston…> * Authentication credentials are being ignored <https://ask.openstack.org/question/1313/authentication-credentials-are-bein…> * Instance failed to start "qemu-img: Could not open...No such file or directory" <https://ask.openstack.org/question/1311/instance-failed-to-start-qemu-img-c…> * How to attach volume for instance (iso) on /dev/hda <https://ask.openstack.org/question/1302/how-to-attach-volume-for-instance-i…> * Can Openstack Choose the physical resources to boot a VM? <https://ask.openstack.org/question/1282/can-openstack-choose-the-physical-r…> * What causes "cloud-init-nonet gave up waiting for a network device"? <https://ask.openstack.org/question/1258/what-causes-cloud-init-nonet-gave-u…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0

[OSSA 2013-012] Nova fails to verify image virtual size (CVE-2013-2096)
by Michael Still 16 May '13

16 May '13

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 OpenStack Security Advisory: 2013-012 CVE: CVE-2013-2096 Date: May 16, 2013 Title: Nova fails to verify image virtual size Reporter: Loganathan Parthipan Products: Nova Affects: All versions Description: Loganathan Parthipan publicly reported a vulnerability in Nova. Nova did not implement checking for the virtual size of a qcow2 image used as ephemeral storage for instances. It is therefore possible for a user to create an image which has a large virtual size, but little data. Once the instance is created, the user can then proceed to fill the virtual disk, and consume all available disk on the host node file system. Havana (development branch) fix: https://review.openstack.org/28717 Grizzly fix: https://review.openstack.org/28901 Folsom fix: https://review.openstack.org/29192 References: https://bugs.launchpad.net/nova/+bug/1177830 http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-2096 Thanks, Michael Still OpenStack Vulnerability Management Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iEYEARECAAYFAlGUoRQACgkQlhS32Mrx3702BgCeKZUDDA/W6Nj/xgC1a1n9vHvP vvoAnRfIOXnuvJ01c7IxGyXON7LIh5kt =YfoG -----END PGP SIGNATURE-----

1 0