Open Stack

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Service accounts may have cloud admin privileges
- ---

### Summary ###
OpenStack services (for example Nova and Glance) typically use a
service account in Keystone to perform actions.  In some cases this
service account has full admin privileges, may therefore perform any
action on your cloud, and should be protected appropriately.

### Affected Services / Software ###
Most OpenStack services / all versions

### Discussion ###
In many cases, OpenStack services require an OpenStack account to
perform API actions such as validating Keystone tokens.  Some
deployment tools grant administrative level access to these service
accounts, making these accounts very powerful.

A service account with administrator access could be used to:

  - destroy/modify/access data
  - create or destroy admin accounts
  - potentially escalate to undercloud access
  - log in to Horizon

### Recommended Actions ###
Service accounts can use the "service" role rather than admin.  You
can check what role the service account has by performing the following
steps:

1. List roles:

     openstack role list

2. Check the role assignment for the service user in question:

     openstack role assignment list --user <service_user>

3. Compare the ID listed in the "role" column from step 2 with the role
IDs listed in step 1.  If the role is listed as "admin", the service
account has full admin privileges on the cloud.

It is possible to change the role to "service" for some accounts but
this may have unexpected consequences for services such as Nova and
Neutron, and is therefore not recommended for inexperienced admins.

If a service account does have admin, it's advisable to closely
monitor login events for that user to ensure that it is not used
unexpectedly.  In particular, pay attention to unusual IPs using the
service account.

### Contacts / References ###
This OSSN : https://wiki.openstack.org/wiki/OSSN/OSSN-0055
Original LaunchPad Bug : https://bugs.launchpad.net/ossn/+bug/1464750
OpenStack Security ML : openstack-security at lists.openstack.org
OpenStack Security Group : https://launchpad.net/~openstack-ossg
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQEcBAEBCAAGBQJV+wq6AAoJEJa+6E7Ri+EVN3QIAKOxc+unYELzWsJxqGII+40c
pSS5qEfa5ejHN9/xBCiT8+RFIAlVNdnYuGiqrk0zFqsRHrfV7mrY0JkZ8dGlk9ia
bbj5zZjsaUp4vIdb3gPy3AFQr2G52N+HvvjsA/WSABKfPUUrN55bD3nQTRPrVqhU
fbVeaZp5kLgr7y2ZaPE4Hm9D6+ajzC/f5uInQud2mBdrZyeekmC2kKWbVKblo0yq
YB46eAUajiGmKKAhLNGNnUykUa/vWDi2SSFT/Cl7gqaTgxZJj+OSjae8KqQwhHXq
NM6mqBRrEuvt7vF5MB8+kHaiSseb3eaZV3EPv8Yn6QH6+L+nuE8wfpOlR9Vo+i4=
=fFnw
-----END PGP SIGNATURE-----