On 09/10/2015 09:54 AM, Major Hayden wrote: > Hey there, > > I've been looking for some ways to harden the systems that are deployed by os-ansible-deployment (soon to be openstack-ansible?) and I've been using the Center for Internet Security (CIS)[1] benchmarks as a potential pathway for that. There are benchmarks available for various operating systems and applications there. > > Many of the items shown there fall into a few different categories: > > 1) things OSAD should configure > 2) things deployers should configure > 3) things nobody should configure (they break the deployment, for example) > > #3 is often quite obvious, but #1 and #2 are a bit more nebulous. For example, I opened a ticket[2] about getting auditd installed by default with openstack-ansible. My gut says that many deployers could use auditd since it collects denials from AppArmor and that can help with troubleshooting broken policies. > > Also, I opened another ticket[3] for compressing all logs by default. This affects availability (part of the information security CIA triad[4]) in a fairly critical way in the long term. > > My question is this: How should I go about determining which security changes should go upstream and which should go into documentation as things deployers should do locally? > > > [1] https://benchmarks.cisecurity.org/ > [2] https://bugs.launchpad.net/openstack-ansible/+bug/1491915 > [3] https://bugs.launchpad.net/openstack-ansible/+bug/1493981 > [4] https://en.wikipedia.org/wiki/Information_security#Key_concepts > > -- > Major Hayden > > __________________________________________________________________________ > OpenStack Development Mailing List (not for usage questions) > Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe > http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev > Sane defaults can't be used? The two bugs you listed look fine to me as default things to do. -- Matthew Thode (prometheanfire) -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 801 bytes Desc: OpenPGP digital signature URL: <http://lists.openstack.org/pipermail/openstack-dev/attachments/20150910/1bd5c480/attachment.pgp>