May 2017 - Release-announce - lists.openstack.org

openstack-ansible-security 14.2.3 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are excited to announce the release of: openstack-ansible-security 14.2.3: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.3 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 14.1.0 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 14.1.0: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.8..14.1.0 ---------------------------------------------------- f33e72f Handle SELinux properly when it is disabled Diffstat (except docs and test files) ------------------------------------- tasks/misc.yml | 1 + 1 file changed, 1 insertion(+)

1 0

openstack-ansible-security 13.3.5
by no-reply＠openstack.org 26 May '17

26 May '17

We contentedly announce the release of: openstack-ansible-security 13.3.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.4..13.3.5 ---------------------------------------------------- 1446cc3 Fix a minor documentation typo. Diffstat (except docs and test files) ------------------------------------- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 14.2.2 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are jazzed to announce the release of: openstack-ansible-security 14.2.2: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.2 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 13.3.3
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.3.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.0..13.3.3 ---------------------------------------------------- 373a03e Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 13.3.11
by no-reply＠openstack.org 26 May '17

26 May '17

We are satisfied to announce the release of: openstack-ansible-security 13.3.11: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.11 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.2.0
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.2.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 13.3.17
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.3.17: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.17 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 14.0.2 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We eagerly announce the release of: openstack-ansible-security 14.0.2: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.1..14.0.2 ---------------------------------------------------- 5e8714c Replace github with git.o.o Diffstat (except docs and test files) ------------------------------------- README.md | 2 +- bindep.txt | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-)

1 0

openstack-ansible-security 13.3.8
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 13.3.8: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.8 ---------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.1.4
by no-reply＠openstack.org 26 May '17

26 May '17

We are pumped to announce the release of: openstack-ansible-security 13.1.4: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.4 ^^^^^^ New Features ************ * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. Bug Fixes ********* * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run.

1 0

openstack-ansible-security 12.0.14
by no-reply＠openstack.org 26 May '17

26 May '17

We are stoked to announce the release of: openstack-ansible-security 12.0.14: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.14 ^^^^^^^ Bug Fixes * The dictionary-based variables in "defaults/main.yml" are now individual variables. The dictionary-based variables could not be changed as the documentation instructed. Instead it was required to override the entire dictionary. Deployers must use the new variable names to enable or disable the security configuration changes applied by the security role. For more information, see Launchpad Bug 1577944 (https://bugs.launchpad.net/openstack- ansible/+bug/1577944). * Failed access logging is now disabled by default and can be enabled by changing "security_audit_failed_access" to "yes". The rsyslog daemon checks for the existence of log files regularly and this audit rule was triggered very frequently, which led to very large audit logs. * The security role now handles "ssh_config" files that contain "Match" stanzas. A marker is added to the configuration file and any new configuration items will be added below that marker. In addition, the configuration file is validated for each change to the ssh configuration file.

1 0

openstack-ansible-security 13.3.12
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 13.3.12: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.12 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.3.14
by no-reply＠openstack.org 26 May '17

26 May '17

We are chuffed to announce the release of: openstack-ansible-security 13.3.14: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.14 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.3.15
by no-reply＠openstack.org 26 May '17

26 May '17

We are delighted to announce the release of: openstack-ansible-security 13.3.15: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.14..13.3.15 ------------------------------------------------------ 65b28f9 Make all tests use upper-constraints 4664346 Use stable/mitaka branch when cloning plugins repo Diffstat (except docs and test files) ------------------------------------- tox.ini | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-)

1 0

openstack-ansible-security 15.0.0 (ocata)
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 15.0.0: OpenStack-Ansible: Host security hardening This release is part of the ocata release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.0.0.0rc2..15.0.0 --------------------------------------------------------- 2d4fb83 Add missing STIG ID tags 82cc48f Install python2-pyOpenSSL package on CentOS 333d11c Install python2-pyOpenSSL package on CentOS dcad939 Only enable ssh, not start 656dad3 Use async for file perms corrections 9f4a20d Use async for updating ClamAV DB 602f3e0 Use async for RPM verification a678596 Fix the regex 9b820be Update repo for stable/ocata 4c23bf1 Update UPPER_CONSTRAINTS_FILE for stable/ocata bf514f7 Update .gitreview for stable/ocata 1025238 Restore RHEL 6 STIG content gating 8d223fe Move test plugins into security role 87b635e Always check for EFI b14056e Don't fail when checking for FIPS dc8dc3d Install chrony when enabled in RHEL7 STIG dc949de Add Ubuntu audit packages for RHEL 7 STIG cdcfb46 Fix clamav_service variable to "clamav-daemon" 6f6c08f Enable RHEL 7 STIG tasks as default [+Docs] cd0fad3 Make umask change opt-in 354b87c Fix copy/paste error in task name c322abe Updated from global requirements ea8a0f0 Remove groupby filter to avoid bug 30ad9d5 DOC Remove some repeated words f69e851 Updated the broken link 672c028 Fix pip check in run_tests.sh 2a11c9c Add openstack-ansible-plugins dependency cce8ed6 Update and clean up run_tests.sh 17a4661 Fix invalid user/group checks bug 3e908d3 Handle SELinux properly when it is disabled 3942b20 Unblock security role gate f60dc47 Fix a typo de5f161 Updated from global requirements 9294b06 [Docs] Exceptions for user init files 8e82b13 Set cron.allow owner/group owner [+Docs] c0517ec Find world-writable dirs with bad group owners 5fdee29 Set home dir mode/owner/group owner [+Docs] ce386ec Add libxslt headers to bindep 1cf9fba Enable FIPS [+Docs] 111fa30 [Docs] Fix missing code-block property 61dd6e6 [Docs] Update for RHEL7 STIG a0b88da Add checks for remote syslog [+Docs] 71a3847 Fix issues from new CentOS 7 release 325fe75 Ensure separate filesystems exist [+Docs] f92f29d Set permissions on sshd host keys [+Docs] 7534fba Check for default SNMP comm strings [+Docs] 5b06a44 Check for TFTP secure mode [+Docs] fc2c356 Restrict mail relaying [+Docs] 14fa6e5 Enable chrony [+Docs] b1435ff Set TMOUT variable for all sessions [+Docs] 81807a1 Check for promiscuous interfaces [+Docs] 553ad01 Set action_email_acct in auditd [+Docs] 9f3921a Set space_left_action in auditd [+Docs] 42ca47b Set space_left in auditd [+Docs] efbeb69 Add AIDE checks for ACL/xattrs [+Docs] af84a27 Remove .shosts/shosts.equiv files [+Docs] 28cd873 Check for pam_lastlogin [+Docs] 404175d Check for cackey/coolkey values [+Docs] 4bee87b Check for ocsp_on in PKCS config [+Docs] 280e797 Set grub2 password [+Docs] e5db852 Enable automatic package updates [+Docs] 505a4a9 Enable AIDE [+Docs] 0e05d2e Search for unlabeled device files [+Docs] 46bb44c [Docs] User init file exceptions 222627c [Docs] Refer to other control for firewalld 2944081 [Docs] Exception: firewall port auditing 0e8feaf Verify password age limits [+Docs] d5ee4c3 Check for groups that don't exist [+Docs] 30c225b Extend get_users module to get groups 9c7b923 [Docs] Exception for firewalld config d63a709 [Docs] Exception: Disable syslog reception 3d51712 [Docs] Exception: Add AUTH_GSS for NFS fd4fa2d Set audisp failure options [+Docs] 806e364 Set maxlogins limit [+Docs] 2a17cd1 Disable accounts w/expired passwords [+Docs] 655b5f9 [Docs] Add missing docs for GSSAPI e841a78 [Docs] Docs for TFTP server removal c9aaf90 [Docs] Fix swapped docs 69db20a [Docs] Exception: grub on removable media 25f3d5c [Docs] Exception: logging level 5559b1c [Docs] Virus definition update frequency 1487c85 [Docs] Fix broken/missing auditd docs 439cd3d Enable/start auditd [+Docs] 85a337b [Docs] Exception for cron logging 21454af Disable kdump [+Docs] 83fe89e [Docs] Exception for user init file umask ec68313 [Docs] Exceptions for filesystem mounts 4e8bf67 Trivial fix to the documentation 2ac6dd6 [Docs] Exception for removing unnecessary accounts ab8cdc3 Fix status/tag for RHEL-07-010040 971c6df [Docs] Exception for removing default accounts fa65790 Apply pam_faillock restrictions [+Docs] 113947b Delete deprecated Hacking in tox.ini 8ad6816 Set minimum password length [+Docs] 708cb62 Prevent password re-use [+Docs] e06fc87 Ensure prep tasks have 'always' tag 0eef112 Refactor login.defs adjustments [+Docs] 711dc28 Updated from global requirements f9a3a16 Check for two nameservers [+Docs] 0085792 Add firewalld rate limit rule [+Docs] 61dbdd6 Check for SHA512 password storage [+Docs] 3fa6fd2 Display MOTD warning banner [+Docs] 51bd12f Point roles docs bugs to openstack-ansible LP e84a295 [Docs] Enable graphical login banner 992f196 Enable sshd [+Docs] c777f73 Enable firewalld [+Docs] 40ca9cf Disable ctrl-alt-del key sequence [+Docs] 9880ceb Disable autofs [+Docs] c229c43 Find files/dirs without valid owners [+Docs] 8fe505e Expire cached sssd authenticators [+Docs] f61fc49 Require auth for sudo [+Docs] fce1e4f Verify that home directories exist [+Docs] acdd6d5 Create home directories by default [+Docs] 66ebdc9 Check for users w/o home dirs [+Docs] 637d0f3 Set lifetime limits for passwords [+Docs] 0eece28 Set auditd failure flag [+Docs] 3efe849 Enable SELinux/AppArmor [+Docs] dcb3034 [Docs] Exceptions for disk encryption aacea94 Disable usb-storage module [+Docs] 2739579 [Docs] Exception for SELinux user confinement 63a900f [Docs] Exception for MFA/smartcards 29cbeb5 [Docs] Apply password quality rules 06090a2 Ensure libuser crypt_style is SHA512 [+Docs] 63131e0 Ensure passwords hashed with SHA512 [+Docs] c59d5b6 Apply password quality rules b8597c8 [Docs] Capitalize severity 04ff6e1 Show team and repo badges on README 4c79244 Move common variables to common.yml 53ffc83 Use dynamic includes for speedup 85630fd Enable graphical login banner 57748b7 Correct lineinfile option 60a8205 [Docs] Refactor auditd rules ff5bbe1 Refactor auditd rules 5c97321 Move clamav packages to rhel7 vars 6f256af [Docs] Set cn_map permissions/owner 6a3ee0f Set cn_map permissions/owner 4c91f21 Fix stig_packages_rhel7 typo 716232c [Docs] Securing sysctl configurations 746816c Securing sysctl configurations 1435ce5 [Doc] Exceptions for LDAP SSL/TLS checks 401f321 [Docs] Exception for PKI revocation 300c9f8 Check for other UID 0 accounts 215001c Add exception for supported release check f23aace Handle sshd_config without Match properly 8868011 Disable repo GPG checks by default 8efb235 Change package state to 'present' 3c0cc41 Enable virus scanner 770b2ad [Docs] Set graphical session locks 5fbc456 Set graphical session locks db2663b Automatically remove package deps 4405271 [Docs] Configure sshd based on the RHEL 7 STIG 1335d0b [Docs] Audit rules 09487fd Add template for audit rules 235ee06 Use ansible_service_mgr fact 9d12469 [Docs] Declutter controls listing 14baa91 [Docs] Exception for RHEL-07-040830 365ad65 Configure sshd based on the RHEL 7 STIG f383afe Encrypt transmitted audit logs 8daae8c Transmit audit logs to other servers a3e0f68 Remove deprecated always_run 9e66cde [Docs] Auditing setuid/setgid applications 35fa42e Refactor package removal 9d74dbd Install screen and ssh client/server 1f557eb Fix tags 0df4169 GPG verification for packages e5f3528 Remove packages according to STIG fec2cb3 Add conf file entry for chrony 23af709 Fix auditd restart handler d63b6ce Remove ansible<2.2 apt cache hack 784a38e Speed up package install/removal 0b2a381 Fix linting issues for ansible-lint 3.4.1 7f7d1da [Docs] Adjust docs for Ocata 20976bc Updated from global requirements 8424eb4 Replace github with git.o.o e4d3ea4 Add RHEL-07-010430 and RHEL-07-010431 19cfb16 [Docs] Add 'only' to clarify status 0637257 Add RHEL-07-010270 (ssh - empty password) de92fbd [Docs] Fix indentation for bullets bc9cc7b Fix stdout_lines check 1a0724d Security: Add tasks for RHEL-07-010260 0a7a993 Security: Add tasks for RHEL-07-010020 6971f03 Security: Add tasks for RHEL-07-010010 eed96b4 Use upper constraints for all tox targets 13e3fd4 Security: Remove quotes from extra vars 90c3630 Use centralised Ansible test scripts c906216 Enable release notes translation 3fdc656 Initial docs scaffolding for RHEL 7 STIG b87effb Add dividers to defaults/main.yml 4e7e57a Skip some test assertions for RHEL7 STIG 687dcdc Remove install_test_packages variable d001b9d Initial scaffolding for RHEL 7 STIG 401ccd7 Skip V-38620 (chrony) in gate 4913b29 Updated from global requirements b8c7c40 Update reno for stable/newton ec1b42a Use centralised test scripts Diffstat (except docs and test files) ------------------------------------- .gitignore | 4 +- .gitreview | 1 + README.md | 2 +- README.rst | 9 + bindep.txt | 6 +- defaults/main.yml | 302 +- ...Enterprise_Linux_7_STIG_V1R0-2_Manual-xccdf.xml | 10364 +++++++++++++++++++ files/aide_extra.conf | 14 + files/dconf-profile-gdm | 3 + files/dconf-user-profile | 2 + handlers/main.yml | 25 +- library/get_users | 122 + manual-test.rc | 2 +- .../chrony-config-variable-7a1a7862c05c9675.yaml | 5 + .../package-state-present-951161faa5384abd.yaml | 7 + .../notes/rhel7-stig-default-f6c7c97498a8b2e7.yaml | 19 + releasenotes/source/conf.py | 3 + releasenotes/source/index.rst | 1 + releasenotes/source/newton.rst | 6 + tasks/aide.yml | 115 - tasks/apt.yml | 112 - tasks/auditd.yml | 313 - tasks/auth.yml | 467 - tasks/boot.yml | 66 - tasks/console.yml | 59 - tasks/file_perms.yml | 184 - tasks/kernel.yml | 222 - tasks/lsm.yml | 83 - tasks/mail.yml | 92 - tasks/main.yml | 52 +- tasks/misc.yml | 375 - tasks/nfsd.yml | 74 - tasks/rhel6stig/aide.yml | 94 + tasks/rhel6stig/apt.yml | 129 + tasks/rhel6stig/auditd.yml | 290 + tasks/rhel6stig/auth.yml | 408 + tasks/rhel6stig/boot.yml | 66 + tasks/rhel6stig/console.yml | 61 + tasks/rhel6stig/file_perms.yml | 188 + tasks/rhel6stig/kernel.yml | 222 + tasks/rhel6stig/lsm.yml | 52 + tasks/rhel6stig/mail.yml | 72 + tasks/rhel6stig/main.yml | 42 + tasks/rhel6stig/misc.yml | 339 + tasks/rhel6stig/nfsd.yml | 74 + tasks/rhel6stig/rpm.yml | 125 + tasks/rhel6stig/services.yml | 167 + tasks/rhel6stig/sshd.yml | 234 + tasks/rhel7stig/aide.yml | 102 + tasks/rhel7stig/apt.yml | 92 + tasks/rhel7stig/auditd.yml | 186 + tasks/rhel7stig/auth.yml | 521 + tasks/rhel7stig/file_perms.yml | 187 + tasks/rhel7stig/graphical.yml | 154 + tasks/rhel7stig/kernel.yml | 94 + tasks/rhel7stig/lsm.yml | 89 + tasks/rhel7stig/main.yml | 86 + tasks/rhel7stig/misc.yml | 408 + tasks/rhel7stig/packages.yml | 90 + tasks/rhel7stig/rpm.yml | 71 + tasks/rhel7stig/sshd.yml | 108 + tasks/rpm.yml | 109 - tasks/services.yml | 312 - tasks/sshd.yml | 234 - templates/chrony.conf.j2 | 2 +- templates/dconf-gdm-banner-message.j2 | 3 + templates/dconf-screensaver-lock.j2 | 24 + templates/dconf-session-user-config-lockout.j2 | 8 + templates/osas-auditd-rhel7.j2 | 97 + templates/osas-auditd.j2 | 6 + templates/pam_faillock.j2 | 3 + templates/pwquality.conf.j2 | 8 + templates/sshd_config_block.j2 | 58 + test-requirements.txt | 12 +- tox.ini | 180 +- vars/common.yml | 337 + vars/main.yml | 30 +- vars/redhat.yml | 150 +- vars/ubuntu.yml | 134 +- 351 files changed, 20987 insertions(+), 3345 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 73b06a3..326f6eb 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ pyOpenSSL>=0.14 # Apache-2.0 -requests>=2.10.0 # Apache-2.0 +requests!=2.12.2,>=2.10.0 # Apache-2.0 @@ -12,2 +12,2 @@ ndg-httpsclient>=0.4.2;python_version<'3.0' # BSD -sphinx!=1.3b1,<1.3,>=1.2.1 # BSD -oslosphinx!=3.4.0,>=2.5.0 # Apache-2.0 +sphinx!=1.3b1,<1.4,>=1.2.1 # BSD +oslosphinx>=4.7.0 # Apache-2.0 @@ -16,3 +16,3 @@ doc8 # Apache-2.0 -reno>=1.8.0 # Apache2 -Jinja2>=2.8 # BSD License (3 clause) -lxml>=2.3 # BSD +reno>=1.8.0 # Apache-2.0 +Jinja2!=2.9.0,!=2.9.1,!=2.9.2,!=2.9.3,!=2.9.4,>=2.8 # BSD License (3 clause) +lxml!=3.7.0,>=2.3 # BSD

1 0

openstack-ansible-security 14.2.0 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We contentedly announce the release of: openstack-ansible-security 14.2.0: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.0 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 14.0.5 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are chuffed to announce the release of: openstack-ansible-security 14.0.5: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 14.0.5 ^^^^^^ New Features * The installation of "chrony" is still enabled by default, but it is now controlled by the "security_enable_chrony" variable. Changes in openstack-ansible-security 14.0.3..14.0.5 ---------------------------------------------------- 4251bc5 Backport of package optimization Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 4 +- .../chrony-config-variable-7a1a7862c05c9675.yaml | 5 + tasks/aide.yml | 23 ---- tasks/apt.yml | 32 +++++ tasks/auditd.yml | 32 ----- tasks/auth.yml | 75 ----------- tasks/lsm.yml | 31 ----- tasks/mail.yml | 20 --- tasks/misc.yml | 48 +------ tasks/rpm.yml | 41 ++++-- tasks/services.yml | 145 --------------------- tox.ini | 2 +- vars/redhat.yml | 55 ++++++++ vars/ubuntu.yml | 56 ++++++++ 15 files changed, 196 insertions(+), 380 deletions(-)

1 0

openstack-ansible-security 14.2.1 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We joyfully announce the release of: openstack-ansible-security 14.2.1: OpenStack-Ansible: Host security hardening This release is part of the newton stable release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 14.1.1..14.2.1 ---------------------------------------------------- 5f49ce1 Add missing STIG ID tags e7185d2 Install python2-pyOpenSSL package on CentOS dd52e48 Prepare vagrant centos/7 box for role testing 2a2b1e6 Fix auditd restart handler d97e7b8 Add conf file entry for chrony Diffstat (except docs and test files) ------------------------------------- Vagrantfile | 9 +++++++++ bindep.txt | 2 +- handlers/main.yml | 11 +++++++---- tasks/misc.yml | 10 +++++++++- vars/redhat.yml | 1 + vars/ubuntu.yml | 1 + 8 files changed, 38 insertions(+), 6 deletions(-)

1 0

openstack-ansible-security 13.3.0
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: openstack-ansible-security 13.3.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.15
by no-reply＠openstack.org 26 May '17

26 May '17

We joyfully announce the release of: openstack-ansible-security 12.0.15: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.15 ^^^^^^^ Bug Fixes * The security role previously set the permissions on all audit log files in "/var/log/audit" to "0400", but this prevents the audit daemon from writing to the active log file. This will prevent "auditd" from starting or restarting cleanly. The task now removes any permissions that are not allowed by the STIG. Any log files that meet or exceed the STIG requirements will not be modified.

1 0

openstack-ansible-security 14.0.0 (newton)
by no-reply＠openstack.org 26 May '17

26 May '17

We are chuffed to announce the release of: openstack-ansible-security 14.0.0: OpenStack-Ansible: Host security hardening This release is part of the newton release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 14.0.0 ^^^^^^ New Features ************ * The role now enables auditing during early boot to comply with the requirements in V-38438. By default, the GRUB configuration variables in "/etc/default/grub.d/" will be updated and the active "grub.cfg" will be updated. Deployers can opt-out of the change entirely by setting a variable: security_enable_audit_during_boot: no Deployers may opt-in for the change without automatically updating the active "grub.cfg" file by setting the following Ansible variables: security_enable_audit_during_boot: yes security_enable_grub_update: no * A task was added to disable secure ICMP redirects per the requirements in V-38526. This change can cause problems in some environments, so it is disabled by default. Deployers can enable the task (which disables secure ICMP redirects) by setting "security_disable_icmpv4_redirects_secure" to "yes". * A new task was added to disable ICMPv6 redirects per the requirements in V-38548. However, since this change can cause problems in running OpenStack environments, it is disabled by default. Deployers who wish to enable this task (and disable ICMPv6 redirects) should set "security_disable_icmpv6_redirects" to "yes". * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * The auditd rules template included a rule that audited changes to the AppArmor policies, but the SELinux policy changes were not being audited. Any changes to SELinux policies in "/etc/selinux" are now being logged by auditd. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes * The security role now has tasks that will disable the graphical interface on a server using upstart (Ubuntu 14.04) or systemd (Ubuntu 16.04 and CentOS 7). These changes take effect after a reboot. Deployers that need a graphical interface will need to set the following Ansible variable: security_disable_x_windows: no * An Ansible was added to disable the "rdisc" service on CentOS systems if the service is installed on the system. Deployers can opt-out of this change by setting "security_disable_rdisc" to "no". * The Linux Security Module (LSM) that is appropriate for the Linux distribution in use will be automatically enabled by the security role by default. Deployers can opt out of this change by setting the following Ansible variable: security_enable_linux_security_module: False The documentation for STIG V-51337 has more information about how each LSM is enabled along with special notes for SELinux. * A task was added that restricts ICMPv4 redirects to meet the requirements of V-38524 in the STIG. This configuration is disabled by default since it could cause issues with LXC in some environments. Deployers can enable this configuration by setting an Ansible variable: security_disable_icmpv4_redirects: yes * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. * A new configuration parameter "security_ntp_bind_local_interfaces" was added to the security role to restrict the network interface to which chronyd will listen for NTP requests. * The security role now supports the ability to configure whether apt/yum tasks install the latest available package, or just ensure that the package is present. The default action is to ensure that the latest package is present. The action taken may be changed to only ensure that the package is present by setting "security_package_state" to "present". * The GPG key checks for package verification in V-38476 are now working for Red Hat Enterprise Linux 7 in addition to CentOS 7. The checks only look for GPG keys from Red Hat and any other GPG keys, such as ones imported from the EPEL repository, are skipped. * Tasks were added to search for any device files without a proper SELinux label on CentOS systems. If any of these device labels are found, the playbook execution will stop with an error message. * The openstack-ansible-security role supports the application of the Red Hat Enterprise Linux 6 STIG configurations to systems running CentOS 7 and Ubuntu 16.04 LTS. Upgrade Notes ************* * The variable "security_audit_apparmor_changes" is now renamed to "security_audit_mac_changes" and is enabled by default. Setting "security_audit_mac_changes" to "no" will disable syscall auditing for any changes to AppArmor policies (in Ubuntu) or SELinux policies (in CentOS). * The variable "security_sysctl_enable_tcp_syncookies" has replaced "security_sysctl_tcp_syncookies" and it is now a boolean instead of an integer. It is still enabled by default, but deployers can disable TCP syncookies by setting the following Ansible variable: security_sysctl_enable_tcp_syncookies: no * The security role always checks whether the latest package is installed when executed. If a deployer wishes to change the check to only validate the presence of the package, the option "security_package_state" should be set to "present". * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no * All variables in the security role are now prepended with "security_" to avoid collisions with variables in other roles. All deployers who have used the security role in previous releases will need to prepend all security role variables with "security_". For example, a deployer could have disabled direct root ssh logins with the following variable: ssh_permit_root_login: yes That variable would become: security_ssh_permit_root_login: yes Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "security_initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * The dictionary-based variables in "defaults/main.yml" are now individual variables. The dictionary-based variables could not be changed as the documentation instructed. Instead it was required to override the entire dictionary. Deployers must use the new variable names to enable or disable the security configuration changes applied by the security role. For more information, see Launchpad Bug 1577944 (https://bugs.launchpad.net/openstack- ansible/+bug/1577944). * Failed access logging is now disabled by default and can be enabled by changing "security_audit_failed_access" to "yes". The rsyslog daemon checks for the existence of log files regularly and this audit rule was triggered very frequently, which led to very large audit logs. * An Ansible task was added to disable the "netconsole" service on CentOS systems if the service is installed on the system. Deployers can opt-out of this change by setting "security_disable_netconsole" to "no". * The security role previously set the permissions on all audit log files in "/var/log/audit" to "0400", but this prevents the audit daemon from writing to the active log file. This will prevent "auditd" from starting or restarting cleanly. The task now removes any permissions that are not allowed by the STIG. Any log files that meet or exceed the STIG requirements will not be modified. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run. * The security role now handles "ssh_config" files that contain "Match" stanzas. A marker is added to the configuration file and any new configuration items will be added below that marker. In addition, the configuration file is validated for each change to the ssh configuration file. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 13.0.0..14.0.0 ---------------------------------------------------- 72ef48f Update tox.ini tests target for stable/newton 5ee9ead Skip V-38620 (chrony) in gate 5f263af Use centralised test scripts 081e46e Update UPPER_CONSTRAINTS_FILE for stable/newton 888fd8e Update .gitreview for stable/newton f460a97 [Docs] Fix sphinx pickling error 481ad31 Force Ansible to use dynamic includes bb37cfd Fix a minor typo in documentation e5a346f Update testing bits for consistency 4cdf533 [Docs] More cleanup c93b167 Add network conf auditing on CentOS 3d6cac0 [Docs] Update configuration/controls docs 3c19f00 [Docs] Metadata cleanup 4b6cbd5 [Docs] Update dev guide for metadata docs 79eeaa4 Updated from global requirements e57593d Automate the STIG documentation 28c73b4 Use command to avoid alias execution for log compression in CI 6d67b6a Rename collected logs for easier CI viewing 98fdd52 Disable DAC change auditing 1889953 Collect compressed logs after functional test execution 2aca828 Adding V-38438 (auditd during boot) e58ae24 Disable martian logging by default 83dd342 Add additional nullok check 427cd00 Enable log collection after functional testing 1fdd5b4 Remove extra AIDE tasks 129e629 Exclude /run from AIDE checks 4525cae Updated from global requirements 87e2190 Disable automatic ToC generation 578ce32 Ensure AIDE initializes on subsequent runs 31823b7 Implemented: V-38548. a189e05 Fix numbering on V-38583 fb33be7 Update to Ansible 2.1.1 8945ecb Restore logrotate cron job in CI 9ea5033 Fix AIDE cron job creation 862b713 Make all linting tests use upper-constraints 2c4393f Added SNI support for os_security role via OS packages 822ffad Add AIDE cron job in CentOS 7 704e1c8 Implemented: V-38526. 36e7d54 Updated from global requirements f85e9e4 Skip SNMPv1/2 (V-38660) checks in gate 06997d1 Add python packages for SNI support in tests f1acb0f Move other-requirements.txt to bindep.txt 1625f2a Add workaround for CVE-2016-5696 675c9e8 Show idempotency check output a715acf Fix auditd rpmverify check 8d2cde7 Add python-apt for check mode c458db6 Include ansible commands for ansible linting 43c81eb Adjust TCP syncookes variable to bool 08bd55d Correct tags attribute typo 70d9224 Add ability to change apt/yum package state 088884c Ensure that doc linting is included in the linters test 5e70944 Add audit rules to support ppc64le architecture. fa11dd4 Add idempotency check 983f20a Updated from global requirements 20b8d9a Fix duplicated config options in auditd.conf 7f7098c Restore check/audit test in tox.ini b5b92c1 Fix chrony daemon name for rh derivatives cc01563 Use plugins repo version of the human_log callback plugin 7eeaf92 Updated from global requirements e75613e Resolve 'E501 line too long' linters error 7003129 Remove doc8 check ignores 7751415 Update sphinx configuration 65293e8 Update tox configuration e831f70 Docs: Add note about RHEL 7 testing 432a9eb Switch to openstackdocs theme 5f8a93c Ignore ansible-lint warnings about rpm command usage 076be96 Docs: Fix rendering of :orphan: a95aeaa Pin test-requirements to match OpenStack requirements ff07803 Add support for Xenial and CentOS 7 to the Vagrantfile 2538d3c Fix documentation warnings from sphinx 6a9230c Ensure aide-common package is installed ba25681 Use standard check for systemd b937e5b Docs: Specify supported distributions 809b6cb Restart auditd after running augenrules 44e6056 Add key fields to audit rules ef69ba2 Add initial support for Red Hat Enterprise Linux 7 24f3f73 Add release note for V-38524 implementation d56468f Docs: Add developer guide for security role 03d436f Fix grub configuration file path in RHEL/CentOS 7 d8ae1e3 Set check_mode variable every time ee00627 Add check/audit to gate testing 5112569 Implemented: V-38524. 2683e56 Fix broken check mode for CentOS 7 45330fe Don't start LSM in check mode ecb0329 Consistency for multi-os in the includes bf28fdf Search for unlabeled device files 42deedc Remove one more "FAILED" from a custom fail message 40634db Add /etc/apparmor.d/ for auditing 6476ef7 Ensure V-38574 works reliably on CentOS 65a7bc4 Setting default runlevel/target to non-graphical 9fbe88a Fix unlocked account check on Ansible 2.2 09a60bf Remove "FAILED" from custom fail messages 7d2964a Add a note to the README file where to report bugs 7b313ee Adding audit rule for SELinux policy modifications 3114703 Add new parameter 'security_ntp_bind_local_interfaces_only' 31424a4 Enable LSM instead of checking status a841e18 Docs: Update dev notes for Cat 2 controls 32ce224 Docs: Update dev notes for Cat 3 controls e954ff5 Docs: Update dev notes for Cat 1 controls a972b4f Fix null password auth in CentOS 490d2f4 Fix auditd log permission bug 5cd0192 Fixing the "dry-run" errors. 2459cb4 Disable the rdisc service (if present) 3107e7c Disable the netconsole service (if present) 750260d Use ansible_managed variable in templates 05e3a1f Do not use bare variables with with_items b562271 Use fail module instead of debug module with failed_when 8a3a83a Add multi-release docs index 22c4c21 Add CentOS 7 and Ubuntu 16.04 support fa28004 Migrate to unique variable names 54de1b5 Handle Match properly in sshd_config 6f8b686 Removing equal signs in docs f5061fd Switch from dict to individual variables c7d2d84 Add .swp files to .gitignore e57f251 Fix verbiage in docs on auditd rule 19999b4 Add dependencies for paramiko 2.0 77b8b45 Disable failed access auditd logging 8389ec0 Add reno scaffolding for release notes management 5b5eabd blacklist Ansible 1.9.6 d1ca8db Add ability to enable unattended upgrades e44efd0 Doc updates 72cbd94 Fix flake8 violation in conf.py 9058a3f Improved search for unlocked system accounts Diffstat (except docs and test files) ------------------------------------- .gitignore | 19 +- .gitreview | 1 + README.md | 50 +- README.rst | 26 +- Vagrantfile | 59 +- bindep.txt | 44 + defaults/main.yml | 237 +- files/20auto-upgrades | 2 + handlers/main.yml | 23 +- manual-test.rc | 33 + meta/main.yml | 4 + other-requirements.txt | 16 - releasenotes/notes/.placeholder | 0 .../notes/add-v38438-3f7e905892be4b4f.yaml | 21 + .../notes/adding-v38526-381a407caa566b14.yaml | 8 + .../notes/adding-v38548-9c51b30bf9780ff3.yaml | 8 + .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 + .../aide-initialization-fix-16ab0223747d7719.yaml | 17 + ...diting-mac-policy-changes-fb83e0260a6431ed.yaml | 15 + .../notes/augenrules-restart-39fe3e1e2de3eaba.yaml | 5 + ...figurable-martian-logging-370ede40b036db0b.yaml | 13 + ...tionary-variables-removed-957c7b7b2108ba1f.yaml | 9 + ...iled-access-audit-logging-789dc01c8bcbef17.yaml | 6 + ...sable-graphical-interface-5db89cd1bef7e12d.yaml | 13 + ...isable-netconsole-service-915bb33449b4012c.yaml | 7 + .../disabling-rdisc-centos-75115b3509941bfa.yaml | 8 + .../notes/enable-lsm-bae903e463079a3f.yaml | 14 + ...ble-tcp-syncookes-boolean-4a884a66a3a0e4d7.yaml | 11 + ...-audit-log-permission-bug-81a772e2e6d0a5b3.yaml | 10 + .../fix-check-mode-with-tags-bf798856a27c53eb.yaml | 7 + ...ndling-sshd-match-stanzas-fa40b97689004e46.yaml | 7 + .../notes/implemented-v38524-b357edec95128307.yaml | 12 + .../improved-audit-rule-keys-9fa85f758386446c.yaml | 5 + ...ind-local-interfaces-only-05f03de632e81097.yaml | 5 + .../notes/package-state-6684c5634bdf127a.yaml | 13 + .../reduce-auditd-logging-633677a74aee5481.yaml | 25 + .../notes/rhel-gpg-check-0b483a824314d1b3.yaml | 7 + ...rch-for-unlabeled-devices-cb047c5f767e93ce.yaml | 6 + ...support-for-centos-xenial-2b89c318cc3df4b0.yaml | 5 + ...unique-variable-migration-c0639030b495438f.yaml | 20 + releasenotes/source/_static/.placeholder | 0 releasenotes/source/_templates/.placeholder | 0 releasenotes/source/conf.py | 281 ++ releasenotes/source/index.rst | 10 + releasenotes/source/liberty.rst | 6 + releasenotes/source/mitaka.rst | 6 + releasenotes/source/unreleased.rst | 5 + setup.cfg | 2 +- setup.py | 11 +- tasks/aide.yml | 115 + tasks/apt.yml | 60 +- tasks/auditd.yml | 97 +- tasks/auth.yml | 167 +- tasks/boot.yml | 32 +- tasks/console.yml | 27 +- tasks/file_perms.yml | 18 +- tasks/kernel.yml | 67 +- tasks/lsm.yml | 83 + tasks/mail.yml | 27 +- tasks/main.yml | 56 +- tasks/misc.yml | 218 +- tasks/nfsd.yml | 24 +- tasks/rpm.yml | 109 + tasks/services.yml | 191 +- tasks/sshd.yml | 82 +- templates/ZZ_aide_exclusions.j2 | 5 +- templates/chrony.conf.j2 | 14 +- templates/jail.local.j2 | 6 +- templates/osas-auditd.j2 | 346 +- test-requirements.txt | 22 +- tox.ini | 172 +- vars/redhat.yml | 38 + vars/ubuntu.yml | 41 + 889 files changed, 10206 insertions(+), 10525 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 3422d65..73b06a3 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -1,4 +1,9 @@ -ansible-lint<=2.3.9 -ansible>=1.9.1,<2.0.0 -bashate -flake8 +# The order of packages is significant, because pip processes them in the order +# of appearance. Changing the order has an impact on the overall integration +# process, which may cause wedges in the gate later. +bashate>=0.2 # Apache-2.0 +flake8<2.6.0,>=2.5.4 # MIT +pyasn1 # BSD +pyOpenSSL>=0.14 # Apache-2.0 +requests>=2.10.0 # Apache-2.0 +ndg-httpsclient>=0.4.2;python_version<'3.0' # BSD @@ -7,2 +12,7 @@ flake8 -sphinx!=1.2.0,!=1.3b1,<1.3,>=1.1.2 -oslosphinx>=2.5.0 # Apache-2.0 +sphinx!=1.3b1,<1.3,>=1.2.1 # BSD +oslosphinx!=3.4.0,>=2.5.0 # Apache-2.0 +openstackdocstheme>=1.5.0 # Apache-2.0 +doc8 # Apache-2.0 +reno>=1.8.0 # Apache2 +Jinja2>=2.8 # BSD License (3 clause) +lxml>=2.3 # BSD

1 0

openstack-ansible-security 13.3.2
by no-reply＠openstack.org 26 May '17

26 May '17

We are chuffed to announce the release of: openstack-ansible-security 13.3.2: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.0..13.3.2 ---------------------------------------------------- 373a03e Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 13.1.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.1.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.2.0
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: openstack-ansible-security 12.2.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 13.3.13
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.3.13: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.13 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 12.2.7
by no-reply＠openstack.org 26 May '17

26 May '17

We are pleased to announce the release of: openstack-ansible-security 12.2.7: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.7 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 12.2.8
by no-reply＠openstack.org 26 May '17

26 May '17

We joyfully announce the release of: openstack-ansible-security 12.2.8: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.8 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 12.2.3
by no-reply＠openstack.org 26 May '17

26 May '17

We are ecstatic to announce the release of: openstack-ansible-security 12.2.3: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.0..12.2.3 ---------------------------------------------------- 6826bcc Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 12.2.2
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: openstack-ansible-security 12.2.2: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.0..12.2.2 ---------------------------------------------------- 6826bcc Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 12.2.4
by no-reply＠openstack.org 26 May '17

26 May '17

We eagerly announce the release of: openstack-ansible-security 12.2.4: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.3..12.2.4 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 12.2.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are stoked to announce the release of: openstack-ansible-security 12.2.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.0..12.2.1 ---------------------------------------------------- 6826bcc Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 13.3.10
by no-reply＠openstack.org 26 May '17

26 May '17

We enthusiastically announce the release of: openstack-ansible-security 13.3.10: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.5..13.3.10 ----------------------------------------------------- d57be75 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.3.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are glad to announce the release of: openstack-ansible-security 13.3.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 13.3.0..13.3.1 ---------------------------------------------------- 373a03e Fix duplicated config options in auditd.conf Diffstat (except docs and test files) ------------------------------------- tasks/auditd.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

1 0

openstack-ansible-security 13.1.2
by no-reply＠openstack.org 26 May '17

26 May '17

We are amped to announce the release of: openstack-ansible-security 13.1.2: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.2 ^^^^^^ Bug Fixes * The dictionary-based variables in "defaults/main.yml" are now individual variables. The dictionary-based variables could not be changed as the documentation instructed. Instead it was required to override the entire dictionary. Deployers must use the new variable names to enable or disable the security configuration changes applied by the security role. For more information, see Launchpad Bug 1577944 (https://bugs.launchpad.net/openstack- ansible/+bug/1577944). * The security role now handles "ssh_config" files that contain "Match" stanzas. A marker is added to the configuration file and any new configuration items will be added below that marker. In addition, the configuration file is validated for each change to the ssh configuration file.

1 0

openstack-ansible-security 13.1.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 13.1.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 13.1.1 ^^^^^^ Bug Fixes * Failed access logging is now disabled by default and can be enabled by changing "auditd_rules['failed_access']" to "yes". The rsyslog daemon checks for the existence of log files regularly and this audit rule was triggered very frequently, which led to very large audit logs.

1 0

openstack-ansible-security 12.1.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.1.0: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.13
by no-reply＠openstack.org 26 May '17

26 May '17

We are psyched to announce the release of: openstack-ansible-security 12.0.13: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.0 (liberty)
by no-reply＠openstack.org 26 May '17

26 May '17

We are thrilled to announce the release of: openstack-ansible-security 12.0.0: Security hardening role for openstack-ansible This release is part of the liberty release series. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 13.0.1
by no-reply＠openstack.org 26 May '17

26 May '17

We are glad to announce the release of: openstack-ansible-security 13.0.1: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.2.5
by no-reply＠openstack.org 26 May '17

26 May '17

We are tickled pink to announce the release of: openstack-ansible-security 12.2.5: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.2.5 ^^^^^^ New Features ************ * AIDE is configured to skip the entire "/var" directory when it does the database initialization and when it performs checks. This reduces disk I/O and allows these jobs to complete faster. This also allows the initialization to become a blocking process and Ansible will wait for the initialization to complete prior to running the next task. * Although the STIG requires martian packets to be logged, the logging is now disabled by default. The logs can quickly fill up a syslog server or make a physical console unusable. Deployers that need this logging enabled will need to set the following Ansible variable: security_sysctl_enable_martian_logging: yes Upgrade Notes ************* * All of the discretionary access control (DAC) auditing is now disabled by default. This reduces the amount of logs generated during deployments and minor upgrades. The following variables are now set to "no": security_audit_DAC_chmod: no security_audit_DAC_chown: no security_audit_DAC_lchown: no security_audit_DAC_fchmod: no security_audit_DAC_fchmodat: no security_audit_DAC_fchown: no security_audit_DAC_fchownat: no security_audit_DAC_fremovexattr: no security_audit_DAC_lremovexattr: no security_audit_DAC_fsetxattr: no security_audit_DAC_lsetxattr: no security_audit_DAC_setxattr: no Bug Fixes ********* * The "/run" directory is excluded from AIDE checks since the files and directories there are only temporary and often change when services start and stop. * AIDE initialization is now always run on subsequent playbook runs when "initialize_aide" is set to "yes". The initialization will be skipped if AIDE isn't installed or if the AIDE database already exists. See bug 1616281 (https://launchpad.net/bugs/1616281) for more details. * The auditd rules for auditing V-38568 (filesystem mounts) were incorrectly labeled in the auditd logs with the key of "export-V-38568". They are now correctly logged with the key "filesystem_mount-V-38568". Changes in openstack-ansible-security 12.2.3..12.2.5 ---------------------------------------------------- 77eaaf2 Disable DAC change auditing 31a8ff5 Disable martian logging by default e7373c4 Exclude /run from AIDE checks 6c9eb50 Ensure AIDE initializes on subsequent runs 23fe90b Fix numbering on V-38583 Diffstat (except docs and test files) ------------------------------------- defaults/main.yml | 22 +++--- handlers/main.yml | 6 -- .../notes/aide-exclude-run-4d3c97a2d08eb373.yaml | 6 ++ .../aide-initialization-fix-16ab0223747d7719.yaml | 17 +++++ ...figurable-martian-logging-370ede40b036db0b.yaml | 13 ++++ .../reduce-auditd-logging-633677a74aee5481.yaml | 25 +++++++ tasks/aide.yml | 86 ++++++++++++++++++++++ tasks/boot.yml | 4 +- tasks/kernel.yml | 2 +- tasks/main.yml | 1 + tasks/misc.yml | 49 ------------ templates/osas-auditd.j2 | 8 +- 22 files changed, 293 insertions(+), 94 deletions(-)

1 0

openstack-ansible-security 12.2.6
by no-reply＠openstack.org 26 May '17

26 May '17

We are overjoyed to announce the release of: openstack-ansible-security 12.2.6: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. Changes in openstack-ansible-security 12.2.5..12.2.6 ---------------------------------------------------- 44c1bc9 Skip V-38620 (chrony) in gate Diffstat (except docs and test files) ------------------------------------- tox.ini | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)

1 0

openstack-ansible-security 13.0.0
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 13.0.0: Security hardening role for openstack-ansible This is the first release of openstack-ansible-security. Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below.

1 0

openstack-ansible-security 12.0.16
by no-reply＠openstack.org 26 May '17

26 May '17

We exuberantly announce the release of: openstack-ansible-security 12.0.16: Security hardening role for openstack-ansible Download the package from: https://tarballs.openstack.org/ansible-hardening/ For more details, please see below. 12.0.16 ^^^^^^^ New Features ************ * The audit rules added by the security role now have key fields that make it easier to link the audit log entry to the audit rule that caused it to appear. Bug Fixes ********* * The role previously did not restart the audit daemon after generating a new rules file. The bug (https://launchpad.net/bugs/1590916) has been fixed and the audit daemon will be restarted after any audit rule changes. * When the security role was run in Ansible's check mode and a tag was provided, the "check_mode" variable was not being set. Any tasks which depend on that variable would fail. This bug is fixed (https://bugs.launchpad.net/openstack-ansible/+bug/1590086) and the "check_mode" variable is now set properly on every playbook run.

1 0

[cinder] python-cinderclient 2.1.0 (pike)
by no-reply＠openstack.org 25 May '17

25 May '17

We are overjoyed to announce the release of: python-cinderclient 2.1.0: OpenStack Block Storage API Client Library This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/python-cinderclient Download the package from: https://pypi.python.org/pypi/python-cinderclient Please report issues through launchpad: https://bugs.launchpad.net/python-cinderclient For more details, please see below. 2.1.0 ^^^^^ New Features ************ * Use 'cinder reset-state' as generic resource reset state command for resource 'volume', 'snapshot', 'backup' 'group' and 'group- snapshot'. Also change volume's default status from 'available' to none when no status is specified. * Cinderclient now supports noauth mode using *--os-auth-type noauth* param. Also python-cinderclient now supports keystoneauth1 plugins. Deprecation Notes ***************** * --bypass-url param is now deprecated. Please use --os-endpoint instead of it. --os-auth-system param is now deprecated. Please --os-auth-type instead of it. Bug Fixes ********* * The mountpoint argument was ignored when creating an attachment and now has been fixed. [Bug 1675973 (https://bugs.launchpad.net/bugs/1675973) * The 'tenant' argument was ignored when listing attachments, and now has been fixed. [Bug 1675974 (https://bugs.launchpad.net/bugs/1675974) * The 'server_id' is now a required parameter when creating an attachment, that means we should create an attachment with a command like, 'cinder attachment-create <volume> <server_id>'. [Bug 1675975 (https://bugs.launchpad.net/bugs/1675975) Changes in python-cinderclient 2.0.1..2.1.0 ------------------------------------------- 5075eb2 support global_request_id in constructor 8471c6c Eliminate function redefined pylint error 2bfd512 Updated from global requirements 69f0090 Handle dashes in encryption-type-create arguments da4e810 Add doc for noauth usage 3a62acc Updated from global requirements af921bb Cinder client reset-state improvements 990527e Fix the wrong help message of marker 16af9f7 Pretty print 'extra_specs' and 'group_specs' 85b56e1 Fix client `retries` default value. 371831a Tests: Add info to assert_called failure message 650dc13 Replace http with https c384975 Remove direct dependency on requests 51f6668 Updated from global requirements ae7ab7d [BugFix] Make 'instance_id' required in attachment-create CLI. 4ed7118 [BugFix] Add 'all_tenants', 'project_id' in attachment-list 273c724 [BugFix] 'Mountpoint' is missing in attachment CLIs. 60f92db Fix noauth support 7b213a9 Remove log translations bb912de Remove duplicate do_upload_to_image() method def 31a7ba7 Update README.rst to remain consistent with python-cinderclient. c022b73 Fix pep8 errors 25ba0fb Add cinder tests for cinder snapshot create commands with parameters 7b5a91a Update tox to delete py34 Diffstat (except docs and test files) ------------------------------------- README.rst | 315 +++++++++++++---- cinderclient/__init__.py | 5 +- cinderclient/_i18n.py | 10 - cinderclient/auth_plugin.py | 141 -------- cinderclient/client.py | 40 ++- cinderclient/contrib/__init__.py | 0 cinderclient/contrib/noauth.py | 77 ++++ cinderclient/shell.py | 116 +++--- cinderclient/utils.py | 12 +- cinderclient/v1/client.py | 2 +- cinderclient/v2/client.py | 2 +- cinderclient/v2/shell.py | 66 +--- cinderclient/v2/volume_backups.py | 3 +- cinderclient/v3/client.py | 2 +- cinderclient/v3/group_snapshots.py | 15 + cinderclient/v3/groups.py | 15 + cinderclient/v3/shell.py | 125 +++++-- cinderclient/v3/volume_snapshots.py | 3 +- ...neric-reset-state-command-d83v1f3accbf5807.yaml | 7 + .../notes/bug-1675973-ad91a7a9f50e658a.yaml | 5 + .../notes/bug-1675974-34edd5g9870e65b2.yaml | 5 + .../notes/bug-1675975-ad91a7a34e0esywc.yaml | 6 + releasenotes/notes/noauth-7d95e5af31a00e96.yaml | 11 + requirements.txt | 9 +- setup.cfg | 6 +- test-requirements.txt | 4 +- tox.ini | 2 +- 40 files changed, 1054 insertions(+), 813 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 35e2989..d453c69 100644 --- a/requirements.txt +++ b/requirements.txt @@ -4 +4 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 @@ -6,2 +6 @@ PrettyTable<0.8,>=0.7.1 # BSD -keystoneauth1>=2.18.0 # Apache-2.0 -requests!=2.12.2,!=2.13.0,>=2.10.0 # Apache-2.0 +keystoneauth1>=2.20.0 # Apache-2.0 @@ -9 +8 @@ simplejson>=2.2.0 # MIT -Babel>=2.3.4 # BSD +Babel!=2.4.0,>=2.3.4 # BSD @@ -11 +10 @@ six>=1.9.0 # MIT -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 8f2783a..c2d1d5b 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -6 +6 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -14 +14 @@ requests-mock>=1.1 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

ldappool 2.1.0
by no-reply＠openstack.org 25 May '17

25 May '17

We are amped to announce the release of: ldappool 2.1.0: A simple connector pool for python-ldap. Download the package from: https://pypi.python.org/pypi/ldappool For more details, please see below.

1 0

[oslo] oslo.middleware 3.27.0 (pike)
by no-reply＠openstack.org 24 May '17

24 May '17

We are pumped to announce the release of: oslo.middleware 3.27.0: Oslo Middleware library This release is part of the pike release series. The source is available from: https://git.openstack.org/cgit/openstack/oslo.middleware Download the package from: https://pypi.python.org/pypi/oslo.middleware Please report issues through launchpad: https://bugs.launchpad.net/oslo.middleware For more details, please see below. 3.27.0 ^^^^^^ New Features * This adds a new "compat_headers" class attribute to the "RequestId" middleware. That allows projects like Nova that have API contracts on alternative request-id headers to adopt the oslo "RequestId" middleware but still retain their API contract. * This adds support for "global_request_id" to the "RequestId" middleware. An inbound header of "X-OpenStack-Request-ID" is accepted as long as it is of the format "req-$uuid", and made available to oslo.context. This will allow for cross project request id tracking. Changes in oslo.middleware 3.26.0..3.27.0 ----------------------------------------- 0e3dbba Set global_request_id if passed in as X-OpenStack-Request-ID. 9b94bae Allow compatibility headers for request_id c45f9a2 Updated from global requirements e4bf01a Updated from global requirements 2eaf1eb Updated from global requirements 93a07b7 Optimize the link address Diffstat (except docs and test files) ------------------------------------- CONTRIBUTING.rst | 4 +- README.rst | 6 +- oslo_middleware/request_id.py | 30 +++++++++- .../notes/compat_headers-55a635b8ec01b6f1.yaml | 7 +++ .../notes/global_request_id-a8ec7260fbd76444.yaml | 8 +++ requirements.txt | 2 +- test-requirements.txt | 4 +- 8 files changed, 118 insertions(+), 10 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 344c088..39cda6a 100644 --- a/requirements.txt +++ b/requirements.txt @@ -9 +9 @@ oslo.context>=2.12.0 # Apache-2.0 -oslo.i18n>=2.1.0 # Apache-2.0 +oslo.i18n!=3.15.2,>=2.1.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 6462cd9..7f665ad 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -10 +10 @@ oslotest>=1.10.0 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD @@ -12 +12 @@ testtools>=1.4.0 # MIT -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0

1 0

[oslo] oslo.context 2.14.0 (pike)
by no-reply＠openstack.org 24 May '17

24 May '17

We exuberantly announce the release of: oslo.context 2.14.0: Oslo Context library This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/oslo.context Download the package from: https://pypi.python.org/pypi/oslo.context Please report issues through launchpad: http://bugs.launchpad.net/oslo.context For more details, please see below. Changes in oslo.context 2.13.0..2.14.0 -------------------------------------- cce83ad Provide unified calling interface for global_id ec7cdc4 Add global_request_id to context f147f09 Updated from global requirements a6f994b Updated from global requirements 68b0476 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- oslo_context/context.py | 17 ++++++++++++++++- requirements.txt | 2 +- test-requirements.txt | 4 ++-- 5 files changed, 39 insertions(+), 7 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index 8366c07..42d89c8 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 5a52edd..bb821ca 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -8 +8 @@ oslotest>=1.10.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -12 +12 @@ oslosphinx>=4.7.0 # Apache-2.0 -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0

[cinder] os-brick 1.13.1 (pike)
by no-reply＠openstack.org 24 May '17

24 May '17

We are stoked to announce the release of: os-brick 1.13.1: OpenStack Cinder brick library for managing local volume attaches This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/os-brick Download the package from: https://pypi.python.org/pypi/os-brick Please report issues through launchpad: http://bugs.launchpad.net/os-brick For more details, please see below. Changes in os-brick 1.13.0..1.13.1 ---------------------------------- 32b4b24 Stop ignoring E123 and E125 pycodestyle rules 4e17533 Update hacking version to align with Cinder 06e9d9c Fixed the veritas connector path Diffstat (except docs and test files) ------------------------------------- os_brick/initiator/connectors/scaleio.py | 2 +- os_brick/initiator/connectors/vrtshyperscale.py | 2 +- test-requirements.txt | 2 +- tox.ini | 3 +-- 6 files changed, 8 insertions(+), 9 deletions(-) Requirements updates -------------------- diff --git a/test-requirements.txt b/test-requirements.txt index 5c550ae..eef55e9 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -5 +5 @@ -hacking<0.11,>=0.10.0 +hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0

1 0

[ironic] sushy 0.2.0 (pike)
by no-reply＠openstack.org 24 May '17

24 May '17

We are jazzed to announce the release of: sushy 0.2.0: Sushy is a small Python library to communicate with Redfish based systems This release is part of the pike release series. The source is available from: http://git.openstack.org/cgit/openstack/sushy Download the package from: https://tarballs.openstack.org/sushy/ Please report issues through launchpad: http://bugs.launchpad.net/sushy For more details, please see below. Changes in sushy 0.1.0..0.2.0 ----------------------------- 0c3ebfb Declarative approach to parsing JSON fields ee0925e Updated from global requirements a279b3d Updated from global requirements 11ec354 Fix working with requests Session object fe07266 Improve logging and error handling in base code 18febd0 Add System Processor/Memory info 3a6e665 Properly support upper-constraints d616dc0 Updated from global requirements Diffstat (except docs and test files) ------------------------------------- requirements.txt | 2 +- sushy/connector.py | 73 +++---- sushy/exceptions.py | 82 +++++++- sushy/resources/base.py | 195 ++++++++++++++++--- sushy/resources/system/constants.py | 12 ++ sushy/resources/system/mappings.py | 11 ++ sushy/resources/system/processor.py | 131 +++++++++++++ sushy/resources/system/system.py | 173 ++++++++++------- .../unit/json_samples/processor_collection.json | 16 ++ test-requirements.txt | 4 +- tools/tox_install.sh | 55 ++++++ tox.ini | 3 +- 21 files changed, 1228 insertions(+), 260 deletions(-) Requirements updates -------------------- diff --git a/requirements.txt b/requirements.txt index b358c17..ab2bdb0 100644 --- a/requirements.txt +++ b/requirements.txt @@ -5 +5 @@ -pbr>=2.0.0 # Apache-2.0 +pbr!=2.1.0,>=2.0.0 # Apache-2.0 diff --git a/test-requirements.txt b/test-requirements.txt index 3f920d2..44d6906 100644 --- a/test-requirements.txt +++ b/test-requirements.txt @@ -7 +7 @@ hacking!=0.13.0,<0.14,>=0.12.0 # Apache-2.0 -coverage>=4.0 # Apache-2.0 +coverage!=4.4,>=4.0 # Apache-2.0 @@ -9 +9 @@ python-subunit>=0.0.18 # Apache-2.0/BSD -sphinx>=1.5.1 # BSD +sphinx!=1.6.1,>=1.5.1 # BSD

1 0