Add security-checklist to ceph-mon
Change-Id: I1b0f24fed7a5c49ba0f2477ee767b7fe5190adbf
This commit is contained in:
Chris MacNaughton
Chris MacNaughton
parent
17de051792
commit
8ffce641b3
|
|
@ -316,4 +316,5 @@ set-noout:
|
|||
description: "Set ceph noout across the cluster."
|
||||
unset-noout:
|
||||
description: "Unset ceph noout across the cluster."
|
||||
|
||||
security-checklist:
|
||||
description: Validate the running configuration against the OpenStack security guides checklist
|
||||
|
|
|
|||
|
|
@ -0,0 +1 @@
|
|||
security_checklist.py
|
||||
|
|
@ -0,0 +1,46 @@
|
|||
#!/usr/bin/env python3
|
||||
#
|
||||
# Copyright 2019 Canonical Ltd
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import sys
|
||||
|
||||
sys.path.append('hooks')
|
||||
|
||||
import charmhelpers.contrib.openstack.audits as audits
|
||||
from charmhelpers.contrib.openstack.audits import (
|
||||
openstack_security_guide,
|
||||
)
|
||||
|
||||
# Via the openstack_security_guide above, we are running the following
|
||||
# security assertions automatically:
|
||||
#
|
||||
# - validate-file-ownership
|
||||
# - validate-file-permissions
|
||||
|
||||
|
||||
def main():
|
||||
config = {
|
||||
'audit_type': audits.AuditType.OpenStackSecurityGuide,
|
||||
'files': openstack_security_guide.FILE_ASSERTIONS['ceph-mon'],
|
||||
'excludes': [
|
||||
'validate-uses-keystone',
|
||||
'validate-uses-tls-for-glance',
|
||||
'validate-uses-tls-for-keystone',
|
||||
],
|
||||
}
|
||||
return audits.action_parse_results(audits.run(config))
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
|
|
@ -11,6 +11,7 @@ include:
|
|||
- contrib.network.ip
|
||||
- contrib.openstack:
|
||||
- alternatives
|
||||
- audits
|
||||
- exceptions
|
||||
- utils
|
||||
- contrib.charmsupport
|
||||
|
|
|
|||
|
|
@ -0,0 +1,212 @@
|
|||
# Copyright 2019 Canonical Limited.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
"""OpenStack Security Audit code"""
|
||||
|
||||
import collections
|
||||
from enum import Enum
|
||||
import traceback
|
||||
|
||||
from charmhelpers.core.host import cmp_pkgrevno
|
||||
import charmhelpers.contrib.openstack.utils as openstack_utils
|
||||
import charmhelpers.core.hookenv as hookenv
|
||||
|
||||
|
||||
class AuditType(Enum):
|
||||
OpenStackSecurityGuide = 1
|
||||
|
||||
|
||||
_audits = {}
|
||||
|
||||
Audit = collections.namedtuple('Audit', 'func filters')
|
||||
|
||||
|
||||
def audit(*args):
|
||||
"""Decorator to register an audit.
|
||||
|
||||
These are used to generate audits that can be run on a
|
||||
deployed system that matches the given configuration
|
||||
|
||||
:param args: List of functions to filter tests against
|
||||
:type args: List[Callable[Dict]]
|
||||
"""
|
||||
def wrapper(f):
|
||||
test_name = f.__name__
|
||||
if _audits.get(test_name):
|
||||
raise RuntimeError(
|
||||
"Test name '{}' used more than once"
|
||||
.format(test_name))
|
||||
non_callables = [fn for fn in args if not callable(fn)]
|
||||
if non_callables:
|
||||
raise RuntimeError(
|
||||
"Configuration includes non-callable filters: {}"
|
||||
.format(non_callables))
|
||||
_audits[test_name] = Audit(func=f, filters=args)
|
||||
return f
|
||||
return wrapper
|
||||
|
||||
|
||||
def is_audit_type(*args):
|
||||
"""This audit is included in the specified kinds of audits.
|
||||
|
||||
:param *args: List of AuditTypes to include this audit in
|
||||
:type args: List[AuditType]
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _is_audit_type(audit_options):
|
||||
if audit_options.get('audit_type') in args:
|
||||
return True
|
||||
else:
|
||||
return False
|
||||
return _is_audit_type
|
||||
|
||||
|
||||
def since_package(pkg, pkg_version):
|
||||
"""This audit should be run after the specified package version (incl).
|
||||
|
||||
:param pkg: Package name to compare
|
||||
:type pkg: str
|
||||
:param release: The package version
|
||||
:type release: str
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _since_package(audit_options=None):
|
||||
return cmp_pkgrevno(pkg, pkg_version) >= 0
|
||||
|
||||
return _since_package
|
||||
|
||||
|
||||
def before_package(pkg, pkg_version):
|
||||
"""This audit should be run before the specified package version (excl).
|
||||
|
||||
:param pkg: Package name to compare
|
||||
:type pkg: str
|
||||
:param release: The package version
|
||||
:type release: str
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _before_package(audit_options=None):
|
||||
return not since_package(pkg, pkg_version)()
|
||||
|
||||
return _before_package
|
||||
|
||||
|
||||
def since_openstack_release(pkg, release):
|
||||
"""This audit should run after the specified OpenStack version (incl).
|
||||
|
||||
:param pkg: Package name to compare
|
||||
:type pkg: str
|
||||
:param release: The OpenStack release codename
|
||||
:type release: str
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _since_openstack_release(audit_options=None):
|
||||
_release = openstack_utils.get_os_codename_package(pkg)
|
||||
return openstack_utils.CompareOpenStackReleases(_release) >= release
|
||||
|
||||
return _since_openstack_release
|
||||
|
||||
|
||||
def before_openstack_release(pkg, release):
|
||||
"""This audit should run before the specified OpenStack version (excl).
|
||||
|
||||
:param pkg: Package name to compare
|
||||
:type pkg: str
|
||||
:param release: The OpenStack release codename
|
||||
:type release: str
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _before_openstack_release(audit_options=None):
|
||||
return not since_openstack_release(pkg, release)()
|
||||
|
||||
return _before_openstack_release
|
||||
|
||||
|
||||
def it_has_config(config_key):
|
||||
"""This audit should be run based on specified config keys.
|
||||
|
||||
:param config_key: Config key to look for
|
||||
:type config_key: str
|
||||
:rtype: Callable[Dict]
|
||||
"""
|
||||
def _it_has_config(audit_options):
|
||||
return audit_options.get(config_key) is not None
|
||||
|
||||
return _it_has_config
|
||||
|
||||
|
||||
def run(audit_options):
|
||||
"""Run the configured audits with the specified audit_options.
|
||||
|
||||
:param audit_options: Configuration for the audit
|
||||
:type audit_options: Config
|
||||
|
||||
:rtype: Dict[str, str]
|
||||
"""
|
||||
errors = {}
|
||||
results = {}
|
||||
for name, audit in sorted(_audits.items()):
|
||||
result_name = name.replace('_', '-')
|
||||
if result_name in audit_options.get('excludes', []):
|
||||
print(
|
||||
"Skipping {} because it is"
|
||||
"excluded in audit config"
|
||||
.format(result_name))
|
||||
continue
|
||||
if all(p(audit_options) for p in audit.filters):
|
||||
try:
|
||||
audit.func(audit_options)
|
||||
print("{}: PASS".format(name))
|
||||
results[result_name] = {
|
||||
'success': True,
|
||||
}
|
||||
except AssertionError as e:
|
||||
print("{}: FAIL ({})".format(name, e))
|
||||
results[result_name] = {
|
||||
'success': False,
|
||||
'message': e,
|
||||
}
|
||||
except Exception as e:
|
||||
print("{}: ERROR ({})".format(name, e))
|
||||
errors[name] = e
|
||||
results[result_name] = {
|
||||
'success': False,
|
||||
'message': e,
|
||||
}
|
||||
for name, error in errors.items():
|
||||
print("=" * 20)
|
||||
print("Error in {}: ".format(name))
|
||||
traceback.print_tb(error.__traceback__)
|
||||
print()
|
||||
return results
|
||||
|
||||
|
||||
def action_parse_results(result):
|
||||
"""Parse the result of `run` in the context of an action.
|
||||
|
||||
:param result: The result of running the security-checklist
|
||||
action on a unit
|
||||
:type result: Dict[str, Dict[str, str]]
|
||||
:rtype: int
|
||||
"""
|
||||
passed = True
|
||||
for test, result in result.items():
|
||||
if result['success']:
|
||||
hookenv.action_set({test: 'PASS'})
|
||||
else:
|
||||
hookenv.action_set({test: 'FAIL - {}'.format(result['message'])})
|
||||
passed = False
|
||||
if not passed:
|
||||
hookenv.action_fail("One or more tests failed")
|
||||
return 0 if passed else 1
|
||||
|
|
@ -0,0 +1,303 @@
|
|||
# Copyright 2019 Canonical Limited.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
import collections
|
||||
import configparser
|
||||
import glob
|
||||
import os.path
|
||||
import subprocess
|
||||
|
||||
from charmhelpers.contrib.openstack.audits import (
|
||||
audit,
|
||||
AuditType,
|
||||
# filters
|
||||
is_audit_type,
|
||||
it_has_config,
|
||||
)
|
||||
|
||||
from charmhelpers.core.hookenv import (
|
||||
cached,
|
||||
)
|
||||
|
||||
|
||||
FILE_ASSERTIONS = {
|
||||
'barbican': {
|
||||
# From security guide
|
||||
'/etc/barbican/barbican.conf': {'group': 'barbican', 'mode': '640'},
|
||||
'/etc/barbican/barbican-api-paste.ini':
|
||||
{'group': 'barbican', 'mode': '640'},
|
||||
'/etc/barbican/policy.json': {'group': 'barbican', 'mode': '640'},
|
||||
},
|
||||
'ceph-mon': {
|
||||
'/var/lib/charm/ceph-mon/ceph.conf':
|
||||
{'owner': 'root', 'group': 'root', 'mode': '644'},
|
||||
'/etc/ceph/ceph.client.admin.keyring':
|
||||
{'owner': 'ceph', 'group': 'ceph'},
|
||||
'/etc/ceph/rbdmap': {'mode': '644'},
|
||||
'/var/lib/ceph': {'owner': 'ceph', 'group': 'ceph', 'mode': '750'},
|
||||
'/var/lib/ceph/bootstrap-*/ceph.keyring':
|
||||
{'owner': 'ceph', 'group': 'ceph', 'mode': '600'}
|
||||
},
|
||||
'ceph-osd': {
|
||||
'/var/lib/charm/ceph-osd/ceph.conf':
|
||||
{'owner': 'ceph', 'group': 'ceph', 'mode': '644'},
|
||||
'/var/lib/ceph': {'owner': 'ceph', 'group': 'ceph', 'mode': '750'},
|
||||
'/var/lib/ceph/*': {'owner': 'ceph', 'group': 'ceph', 'mode': '755'},
|
||||
'/var/lib/ceph/bootstrap-*/ceph.keyring':
|
||||
{'owner': 'ceph', 'group': 'ceph', 'mode': '600'},
|
||||
'/var/lib/ceph/radosgw':
|
||||
{'owner': 'ceph', 'group': 'ceph', 'mode': '755'},
|
||||
},
|
||||
'cinder': {
|
||||
# From security guide
|
||||
'/etc/cinder/cinder.conf': {'group': 'cinder', 'mode': '640'},
|
||||
'/etc/cinder/api-paste.conf': {'group': 'cinder', 'mode': '640'},
|
||||
'/etc/cinder/rootwrap.conf': {'group': 'cinder', 'mode': '640'},
|
||||
},
|
||||
'glance': {
|
||||
# From security guide
|
||||
'/etc/glance/glance-api-paste.ini': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-api.conf': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-cache.conf': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-manage.conf': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-registry-paste.ini':
|
||||
{'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-registry.conf': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-scrubber.conf': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/glance-swift-store.conf':
|
||||
{'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/policy.json': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/schema-image.json': {'group': 'glance', 'mode': '640'},
|
||||
'/etc/glance/schema.json': {'group': 'glance', 'mode': '640'},
|
||||
},
|
||||
'keystone': {
|
||||
# From security guide
|
||||
'/etc/keystone/keystone.conf': {'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/keystone-paste.ini':
|
||||
{'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/policy.json': {'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/logging.conf': {'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/ssl/certs/signing_cert.pem':
|
||||
{'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/ssl/private/signing_key.pem':
|
||||
{'group': 'keystone', 'mode': '640'},
|
||||
'/etc/keystone/ssl/certs/ca.pem': {'group': 'keystone', 'mode': '640'},
|
||||
},
|
||||
'manilla': {
|
||||
# From security guide
|
||||
'/etc/manila/manila.conf': {'group': 'manilla', 'mode': '640'},
|
||||
'/etc/manila/api-paste.ini': {'group': 'manilla', 'mode': '640'},
|
||||
'/etc/manila/policy.json': {'group': 'manilla', 'mode': '640'},
|
||||
'/etc/manila/rootwrap.conf': {'group': 'manilla', 'mode': '640'},
|
||||
},
|
||||
'neutron-gateway': {
|
||||
'/etc/neutron/neutron.conf': {'group': 'neutron', 'mode': '640'},
|
||||
'/etc/neutron/rootwrap.conf': {'mode': '640'},
|
||||
'/etc/neutron/rootwrap.d': {'mode': '755'},
|
||||
'/etc/neutron/*': {'group': 'neutron', 'mode': '644'},
|
||||
},
|
||||
'neutron-api': {
|
||||
# From security guide
|
||||
'/etc/neutron/neutron.conf': {'group': 'neutron', 'mode': '640'},
|
||||
'/etc/nova/api-paste.ini': {'group': 'neutron', 'mode': '640'},
|
||||
'/etc/neutron/rootwrap.conf': {'group': 'neutron', 'mode': '640'},
|
||||
# Additional validations
|
||||
'/etc/neutron/rootwrap.d': {'mode': '755'},
|
||||
'/etc/neutron/neutron_lbaas.conf': {'mode': '644'},
|
||||
'/etc/neutron/neutron_vpnaas.conf': {'mode': '644'},
|
||||
'/etc/neutron/*': {'group': 'neutron', 'mode': '644'},
|
||||
},
|
||||
'nova-cloud-controller': {
|
||||
# From security guide
|
||||
'/etc/nova/api-paste.ini': {'group': 'nova', 'mode': '640'},
|
||||
'/etc/nova/nova.conf': {'group': 'nova', 'mode': '750'},
|
||||
'/etc/nova/*': {'group': 'nova', 'mode': '640'},
|
||||
# Additional validations
|
||||
'/etc/nova/logging.conf': {'group': 'nova', 'mode': '640'},
|
||||
},
|
||||
'nova-compute': {
|
||||
# From security guide
|
||||
'/etc/nova/nova.conf': {'group': 'nova', 'mode': '640'},
|
||||
'/etc/nova/api-paste.ini': {'group': 'nova', 'mode': '640'},
|
||||
'/etc/nova/rootwrap.conf': {'group': 'nova', 'mode': '640'},
|
||||
# Additional Validations
|
||||
'/etc/nova/nova-compute.conf': {'group': 'nova', 'mode': '640'},
|
||||
'/etc/nova/logging.conf': {'group': 'nova', 'mode': '640'},
|
||||
'/etc/nova/nm.conf': {'mode': '644'},
|
||||
'/etc/nova/*': {'group': 'nova', 'mode': '640'},
|
||||
},
|
||||
'openstack-dashboard': {
|
||||
# From security guide
|
||||
'/etc/openstack-dashboard/local_settings.py':
|
||||
{'group': 'horizon', 'mode': '640'},
|
||||
},
|
||||
}
|
||||
|
||||
Ownership = collections.namedtuple('Ownership', 'owner group mode')
|
||||
|
||||
|
||||
@cached
|
||||
def _stat(file):
|
||||
"""
|
||||
Get the Ownership information from a file.
|
||||
|
||||
:param file: The path to a file to stat
|
||||
:type file: str
|
||||
:returns: owner, group, and mode of the specified file
|
||||
:rtype: Ownership
|
||||
:raises subprocess.CalledProcessError: If the underlying stat fails
|
||||
"""
|
||||
out = subprocess.check_output(
|
||||
['stat', '-c', '%U %G %a', file]).decode('utf-8')
|
||||
return Ownership(*out.strip().split(' '))
|
||||
|
||||
|
||||
@cached
|
||||
def _config_ini(path):
|
||||
"""
|
||||
Parse an ini file
|
||||
|
||||
:param path: The path to a file to parse
|
||||
:type file: str
|
||||
:returns: Configuration contained in path
|
||||
:rtype: Dict
|
||||
"""
|
||||
conf = configparser.ConfigParser()
|
||||
conf.read(path)
|
||||
return dict(conf)
|
||||
|
||||
|
||||
def _validate_file_ownership(owner, group, file_name):
|
||||
"""
|
||||
Validate that a specified file is owned by `owner:group`.
|
||||
|
||||
:param owner: Name of the owner
|
||||
:type owner: str
|
||||
:param group: Name of the group
|
||||
:type group: str
|
||||
:param file_name: Path to the file to verify
|
||||
:type file_name: str
|
||||
"""
|
||||
try:
|
||||
ownership = _stat(file_name)
|
||||
except subprocess.CalledProcessError as e:
|
||||
print("Error reading file: {}".format(e))
|
||||
assert False, "Specified file does not exist: {}".format(file_name)
|
||||
assert owner == ownership.owner, \
|
||||
"{} has an incorrect owner: {} should be {}".format(
|
||||
file_name, ownership.owner, owner)
|
||||
assert group == ownership.group, \
|
||||
"{} has an incorrect group: {} should be {}".format(
|
||||
file_name, ownership.group, group)
|
||||
print("Validate ownership of {}: PASS".format(file_name))
|
||||
|
||||
|
||||
def _validate_file_mode(mode, file_name):
|
||||
"""
|
||||
Validate that a specified file has the specified permissions.
|
||||
|
||||
:param mode: file mode that is desires
|
||||
:type owner: str
|
||||
:param file_name: Path to the file to verify
|
||||
:type file_name: str
|
||||
"""
|
||||
try:
|
||||
ownership = _stat(file_name)
|
||||
except subprocess.CalledProcessError as e:
|
||||
print("Error reading file: {}".format(e))
|
||||
assert False, "Specified file does not exist: {}".format(file_name)
|
||||
assert mode == ownership.mode, \
|
||||
"{} has an incorrect mode: {} should be {}".format(
|
||||
file_name, ownership.mode, mode)
|
||||
print("Validate mode of {}: PASS".format(file_name))
|
||||
|
||||
|
||||
@cached
|
||||
def _config_section(config, section):
|
||||
"""Read the configuration file and return a section."""
|
||||
path = os.path.join(config.get('config_path'), config.get('config_file'))
|
||||
conf = _config_ini(path)
|
||||
return conf.get(section)
|
||||
|
||||
|
||||
@audit(is_audit_type(AuditType.OpenStackSecurityGuide),
|
||||
it_has_config('files'))
|
||||
def validate_file_ownership(config):
|
||||
"""Verify that configuration files are owned by the correct user/group."""
|
||||
files = config.get('files', {})
|
||||
for file_name, options in files.items():
|
||||
for key in options.keys():
|
||||
if key not in ["owner", "group", "mode"]:
|
||||
raise RuntimeError(
|
||||
"Invalid ownership configuration: {}".format(key))
|
||||
owner = options.get('owner', config.get('owner', 'root'))
|
||||
group = options.get('group', config.get('group', 'root'))
|
||||
if '*' in file_name:
|
||||
for file in glob.glob(file_name):
|
||||
if file not in files.keys():
|
||||
if os.path.isfile(file):
|
||||
_validate_file_ownership(owner, group, file)
|
||||
else:
|
||||
if os.path.isfile(file_name):
|
||||
_validate_file_ownership(owner, group, file_name)
|
||||
|
||||
|
||||
@audit(is_audit_type(AuditType.OpenStackSecurityGuide),
|
||||
it_has_config('files'))
|
||||
def validate_file_permissions(config):
|
||||
"""Verify that permissions on configuration files are secure enough."""
|
||||
files = config.get('files', {})
|
||||
for file_name, options in files.items():
|
||||
for key in options.keys():
|
||||
if key not in ["owner", "group", "mode"]:
|
||||
raise RuntimeError(
|
||||
"Invalid ownership configuration: {}".format(key))
|
||||
mode = options.get('mode', config.get('permissions', '600'))
|
||||
if '*' in file_name:
|
||||
for file in glob.glob(file_name):
|
||||
if file not in files.keys():
|
||||
if os.path.isfile(file):
|
||||
_validate_file_mode(mode, file)
|
||||
else:
|
||||
if os.path.isfile(file_name):
|
||||
_validate_file_mode(mode, file_name)
|
||||
|
||||
|
||||
@audit(is_audit_type(AuditType.OpenStackSecurityGuide))
|
||||
def validate_uses_keystone(audit_options):
|
||||
"""Validate that the service uses Keystone for authentication."""
|
||||
section = _config_section(audit_options, 'DEFAULT')
|
||||
assert section is not None, "Missing section 'DEFAULT'"
|
||||
assert section.get('auth_strategy') == "keystone", \
|
||||
"Application is not using Keystone"
|
||||
|
||||
|
||||
@audit(is_audit_type(AuditType.OpenStackSecurityGuide))
|
||||
def validate_uses_tls_for_keystone(audit_options):
|
||||
"""Verify that TLS is used to communicate with Keystone."""
|
||||
section = _config_section(audit_options, 'keystone_authtoken')
|
||||
assert section is not None, "Missing section 'keystone_authtoken'"
|
||||
assert not section.get('insecure') and \
|
||||
"https://" in section.get("auth_uri"), \
|
||||
"TLS is not used for Keystone"
|
||||
|
||||
|
||||
@audit(is_audit_type(AuditType.OpenStackSecurityGuide))
|
||||
def validate_uses_tls_for_glance(audit_options):
|
||||
"""Verify that TLS is used to communicate with Glance."""
|
||||
section = _config_section(audit_options, 'glance')
|
||||
assert section is not None, "Missing section 'glance'"
|
||||
assert not section.get('insecure') and \
|
||||
"https://" in section.get("api_servers"), \
|
||||
"TLS is not used for Glance"
|
||||
|
|
@ -29,6 +29,7 @@ from charmhelpers.fetch import (
|
|||
filter_installed_packages,
|
||||
)
|
||||
from charmhelpers.core.hookenv import (
|
||||
NoNetworkBinding,
|
||||
config,
|
||||
is_relation_made,
|
||||
local_unit,
|
||||
|
|
@ -868,7 +869,7 @@ class ApacheSSLContext(OSContextGenerator):
|
|||
addr = network_get_primary_address(
|
||||
ADDRESS_MAP[net_type]['binding']
|
||||
)
|
||||
except NotImplementedError:
|
||||
except (NotImplementedError, NoNetworkBinding):
|
||||
addr = fallback
|
||||
|
||||
endpoint = resolve_address(net_type)
|
||||
|
|
|
|||
|
|
@ -13,6 +13,7 @@
|
|||
# limitations under the License.
|
||||
|
||||
from charmhelpers.core.hookenv import (
|
||||
NoNetworkBinding,
|
||||
config,
|
||||
unit_get,
|
||||
service_name,
|
||||
|
|
@ -175,7 +176,7 @@ def resolve_address(endpoint_type=PUBLIC, override=True):
|
|||
# configuration is not in use
|
||||
try:
|
||||
resolved_address = network_get_primary_address(binding)
|
||||
except NotImplementedError:
|
||||
except (NotImplementedError, NoNetworkBinding):
|
||||
resolved_address = fallback_addr
|
||||
|
||||
if resolved_address is None:
|
||||
|
|
|
|||
|
|
@ -1,21 +0,0 @@
|
|||
# Copyright 2014-2019 Canonical Limited.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
from __future__ import absolute_import
|
||||
|
||||
# deprecated aliases for backwards compatibility
|
||||
from charmhelpers.fetch.python import debug # noqa
|
||||
from charmhelpers.fetch.python import packages # noqa
|
||||
from charmhelpers.fetch.python import rpdb # noqa
|
||||
from charmhelpers.fetch.python import version # noqa
|
||||
|
|
@ -1152,7 +1152,8 @@ class CephBrokerRq(object):
|
|||
'object-prefix-permissions': object_prefix_permissions})
|
||||
|
||||
def add_op_create_pool(self, name, replica_count=3, pg_num=None,
|
||||
weight=None, group=None, namespace=None):
|
||||
weight=None, group=None, namespace=None,
|
||||
app_name=None):
|
||||
"""Adds an operation to create a pool.
|
||||
|
||||
@param pg_num setting: optional setting. If not provided, this value
|
||||
|
|
@ -1160,6 +1161,11 @@ class CephBrokerRq(object):
|
|||
cluster at the time of creation. Note that, if provided, this value
|
||||
will be capped at the current available maximum.
|
||||
@param weight: the percentage of data the pool makes up
|
||||
:param app_name: (Optional) Tag pool with application name. Note that
|
||||
there is certain protocols emerging upstream with
|
||||
regard to meaningful application names to use.
|
||||
Examples are ``rbd`` and ``rgw``.
|
||||
:type app_name: str
|
||||
"""
|
||||
if pg_num and weight:
|
||||
raise ValueError('pg_num and weight are mutually exclusive')
|
||||
|
|
@ -1167,7 +1173,7 @@ class CephBrokerRq(object):
|
|||
self.ops.append({'op': 'create-pool', 'name': name,
|
||||
'replicas': replica_count, 'pg_num': pg_num,
|
||||
'weight': weight, 'group': group,
|
||||
'group-namespace': namespace})
|
||||
'group-namespace': namespace, 'app-name': app_name})
|
||||
|
||||
def set_ops(self, ops):
|
||||
"""Set request ops to provided value.
|
||||
|
|
|
|||
|
|
@ -50,6 +50,11 @@ TRACE = "TRACE"
|
|||
MARKER = object()
|
||||
SH_MAX_ARG = 131071
|
||||
|
||||
|
||||
RANGE_WARNING = ('Passing NO_PROXY string that includes a cidr. '
|
||||
'This may not be compatible with software you are '
|
||||
'running in your shell.')
|
||||
|
||||
cache = {}
|
||||
|
||||
|
||||
|
|
@ -1414,3 +1419,72 @@ def unit_doomed(unit=None):
|
|||
# I don't think 'dead' units ever show up in the goal-state, but
|
||||
# check anyway in addition to 'dying'.
|
||||
return units[unit]['status'] in ('dying', 'dead')
|
||||
|
||||
|
||||
def env_proxy_settings(selected_settings=None):
|
||||
"""Get proxy settings from process environment variables.
|
||||
|
||||
Get charm proxy settings from environment variables that correspond to
|
||||
juju-http-proxy, juju-https-proxy and juju-no-proxy (available as of 2.4.2,
|
||||
see lp:1782236) in a format suitable for passing to an application that
|
||||
reacts to proxy settings passed as environment variables. Some applications
|
||||
support lowercase or uppercase notation (e.g. curl), some support only
|
||||
lowercase (e.g. wget), there are also subjectively rare cases of only
|
||||
uppercase notation support. no_proxy CIDR and wildcard support also varies
|
||||
between runtimes and applications as there is no enforced standard.
|
||||
|
||||
Some applications may connect to multiple destinations and expose config
|
||||
options that would affect only proxy settings for a specific destination
|
||||
these should be handled in charms in an application-specific manner.
|
||||
|
||||
:param selected_settings: format only a subset of possible settings
|
||||
:type selected_settings: list
|
||||
:rtype: Option(None, dict[str, str])
|
||||
"""
|
||||
SUPPORTED_SETTINGS = {
|
||||
'http': 'HTTP_PROXY',
|
||||
'https': 'HTTPS_PROXY',
|
||||
'no_proxy': 'NO_PROXY',
|
||||
'ftp': 'FTP_PROXY'
|
||||
}
|
||||
if selected_settings is None:
|
||||
selected_settings = SUPPORTED_SETTINGS
|
||||
|
||||
selected_vars = [v for k, v in SUPPORTED_SETTINGS.items()
|
||||
if k in selected_settings]
|
||||
proxy_settings = {}
|
||||
for var in selected_vars:
|
||||
var_val = os.getenv(var)
|
||||
if var_val:
|
||||
proxy_settings[var] = var_val
|
||||
proxy_settings[var.lower()] = var_val
|
||||
# Now handle juju-prefixed environment variables. The legacy vs new
|
||||
# environment variable usage is mutually exclusive
|
||||
charm_var_val = os.getenv('JUJU_CHARM_{}'.format(var))
|
||||
if charm_var_val:
|
||||
proxy_settings[var] = charm_var_val
|
||||
proxy_settings[var.lower()] = charm_var_val
|
||||
if 'no_proxy' in proxy_settings:
|
||||
if _contains_range(proxy_settings['no_proxy']):
|
||||
log(RANGE_WARNING, level=WARNING)
|
||||
return proxy_settings if proxy_settings else None
|
||||
|
||||
|
||||
def _contains_range(addresses):
|
||||
"""Check for cidr or wildcard domain in a string.
|
||||
|
||||
Given a string comprising a comma seperated list of ip addresses
|
||||
and domain names, determine whether the string contains IP ranges
|
||||
or wildcard domains.
|
||||
|
||||
:param addresses: comma seperated list of domains and ip addresses.
|
||||
:type addresses: str
|
||||
"""
|
||||
return (
|
||||
# Test for cidr (e.g. 10.20.20.0/24)
|
||||
"/" in addresses or
|
||||
# Test for wildcard domains (*.foo.com or .foo.com)
|
||||
"*" in addresses or
|
||||
addresses.startswith(".") or
|
||||
",." in addresses or
|
||||
" ." in addresses)
|
||||
|
|
|
|||
|
|
@ -19,15 +19,16 @@ import re
|
|||
import six
|
||||
import time
|
||||
import subprocess
|
||||
from tempfile import NamedTemporaryFile
|
||||
|
||||
from charmhelpers.core.host import (
|
||||
lsb_release
|
||||
get_distrib_codename,
|
||||
CompareHostReleases,
|
||||
)
|
||||
from charmhelpers.core.hookenv import (
|
||||
log,
|
||||
DEBUG,
|
||||
WARNING,
|
||||
env_proxy_settings,
|
||||
)
|
||||
from charmhelpers.fetch import SourceConfigError, GPGKeyError
|
||||
|
||||
|
|
@ -303,12 +304,17 @@ def import_key(key):
|
|||
"""Import an ASCII Armor key.
|
||||
|
||||
A Radix64 format keyid is also supported for backwards
|
||||
compatibility, but should never be used; the key retrieval
|
||||
mechanism is insecure and subject to man-in-the-middle attacks
|
||||
voiding all signature checks using that key.
|
||||
compatibility. In this case Ubuntu keyserver will be
|
||||
queried for a key via HTTPS by its keyid. This method
|
||||
is less preferrable because https proxy servers may
|
||||
require traffic decryption which is equivalent to a
|
||||
man-in-the-middle attack (a proxy server impersonates
|
||||
keyserver TLS certificates and has to be explicitly
|
||||
trusted by the system).
|
||||
|
||||
:param keyid: The key in ASCII armor format,
|
||||
including BEGIN and END markers.
|
||||
:param key: A GPG key in ASCII armor format,
|
||||
including BEGIN and END markers or a keyid.
|
||||
:type key: (bytes, str)
|
||||
:raises: GPGKeyError if the key could not be imported
|
||||
"""
|
||||
key = key.strip()
|
||||
|
|
@ -319,35 +325,137 @@ def import_key(key):
|
|||
log("PGP key found (looks like ASCII Armor format)", level=DEBUG)
|
||||
if ('-----BEGIN PGP PUBLIC KEY BLOCK-----' in key and
|
||||
'-----END PGP PUBLIC KEY BLOCK-----' in key):
|
||||
log("Importing ASCII Armor PGP key", level=DEBUG)
|
||||
with NamedTemporaryFile() as keyfile:
|
||||
with open(keyfile.name, 'w') as fd:
|
||||
fd.write(key)
|
||||
fd.write("\n")
|
||||
cmd = ['apt-key', 'add', keyfile.name]
|
||||
try:
|
||||
subprocess.check_call(cmd)
|
||||
except subprocess.CalledProcessError:
|
||||
error = "Error importing PGP key '{}'".format(key)
|
||||
log(error)
|
||||
raise GPGKeyError(error)
|
||||
log("Writing provided PGP key in the binary format", level=DEBUG)
|
||||
if six.PY3:
|
||||
key_bytes = key.encode('utf-8')
|
||||
else:
|
||||
key_bytes = key
|
||||
key_name = _get_keyid_by_gpg_key(key_bytes)
|
||||
key_gpg = _dearmor_gpg_key(key_bytes)
|
||||
_write_apt_gpg_keyfile(key_name=key_name, key_material=key_gpg)
|
||||
else:
|
||||
raise GPGKeyError("ASCII armor markers missing from GPG key")
|
||||
else:
|
||||
# We should only send things obviously not a keyid offsite
|
||||
# via this unsecured protocol, as it may be a secret or part
|
||||
# of one.
|
||||
log("PGP key found (looks like Radix64 format)", level=WARNING)
|
||||
log("INSECURLY importing PGP key from keyserver; "
|
||||
log("SECURELY importing PGP key from keyserver; "
|
||||
"full key not provided.", level=WARNING)
|
||||
cmd = ['apt-key', 'adv', '--keyserver',
|
||||
'hkp://keyserver.ubuntu.com:80', '--recv-keys', key]
|
||||
try:
|
||||
_run_with_retries(cmd)
|
||||
except subprocess.CalledProcessError:
|
||||
error = "Error importing PGP key '{}'".format(key)
|
||||
log(error)
|
||||
raise GPGKeyError(error)
|
||||
# as of bionic add-apt-repository uses curl with an HTTPS keyserver URL
|
||||
# to retrieve GPG keys. `apt-key adv` command is deprecated as is
|
||||
# apt-key in general as noted in its manpage. See lp:1433761 for more
|
||||
# history. Instead, /etc/apt/trusted.gpg.d is used directly to drop
|
||||
# gpg
|
||||
key_asc = _get_key_by_keyid(key)
|
||||
# write the key in GPG format so that apt-key list shows it
|
||||
key_gpg = _dearmor_gpg_key(key_asc)
|
||||
_write_apt_gpg_keyfile(key_name=key, key_material=key_gpg)
|
||||
|
||||
|
||||
def _get_keyid_by_gpg_key(key_material):
|
||||
"""Get a GPG key fingerprint by GPG key material.
|
||||
Gets a GPG key fingerprint (40-digit, 160-bit) by the ASCII armor-encoded
|
||||
or binary GPG key material. Can be used, for example, to generate file
|
||||
names for keys passed via charm options.
|
||||
|
||||
:param key_material: ASCII armor-encoded or binary GPG key material
|
||||
:type key_material: bytes
|
||||
:raises: GPGKeyError if invalid key material has been provided
|
||||
:returns: A GPG key fingerprint
|
||||
:rtype: str
|
||||
"""
|
||||
# trusty, xenial and bionic handling differs due to gpg 1.x to 2.x change
|
||||
release = get_distrib_codename()
|
||||
is_gpgv2_distro = CompareHostReleases(release) >= "bionic"
|
||||
if is_gpgv2_distro:
|
||||
# --import is mandatory, otherwise fingerprint is not printed
|
||||
cmd = 'gpg --with-colons --import-options show-only --import --dry-run'
|
||||
else:
|
||||
cmd = 'gpg --with-colons --with-fingerprint'
|
||||
ps = subprocess.Popen(cmd.split(),
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.PIPE,
|
||||
stdin=subprocess.PIPE)
|
||||
out, err = ps.communicate(input=key_material)
|
||||
if six.PY3:
|
||||
out = out.decode('utf-8')
|
||||
err = err.decode('utf-8')
|
||||
if 'gpg: no valid OpenPGP data found.' in err:
|
||||
raise GPGKeyError('Invalid GPG key material provided')
|
||||
# from gnupg2 docs: fpr :: Fingerprint (fingerprint is in field 10)
|
||||
return re.search(r"^fpr:{9}([0-9A-F]{40}):$", out, re.MULTILINE).group(1)
|
||||
|
||||
|
||||
def _get_key_by_keyid(keyid):
|
||||
"""Get a key via HTTPS from the Ubuntu keyserver.
|
||||
Different key ID formats are supported by SKS keyservers (the longer ones
|
||||
are more secure, see "dead beef attack" and https://evil32.com/). Since
|
||||
HTTPS is used, if SSLBump-like HTTPS proxies are in place, they will
|
||||
impersonate keyserver.ubuntu.com and generate a certificate with
|
||||
keyserver.ubuntu.com in the CN field or in SubjAltName fields of a
|
||||
certificate. If such proxy behavior is expected it is necessary to add the
|
||||
CA certificate chain containing the intermediate CA of the SSLBump proxy to
|
||||
every machine that this code runs on via ca-certs cloud-init directive (via
|
||||
cloudinit-userdata model-config) or via other means (such as through a
|
||||
custom charm option). Also note that DNS resolution for the hostname in a
|
||||
URL is done at a proxy server - not at the client side.
|
||||
|
||||
8-digit (32 bit) key ID
|
||||
https://keyserver.ubuntu.com/pks/lookup?search=0x4652B4E6
|
||||
16-digit (64 bit) key ID
|
||||
https://keyserver.ubuntu.com/pks/lookup?search=0x6E85A86E4652B4E6
|
||||
40-digit key ID:
|
||||
https://keyserver.ubuntu.com/pks/lookup?search=0x35F77D63B5CEC106C577ED856E85A86E4652B4E6
|
||||
|
||||
:param keyid: An 8, 16 or 40 hex digit keyid to find a key for
|
||||
:type keyid: (bytes, str)
|
||||
:returns: A key material for the specified GPG key id
|
||||
:rtype: (str, bytes)
|
||||
:raises: subprocess.CalledProcessError
|
||||
"""
|
||||
# options=mr - machine-readable output (disables html wrappers)
|
||||
keyserver_url = ('https://keyserver.ubuntu.com'
|
||||
'/pks/lookup?op=get&options=mr&exact=on&search=0x{}')
|
||||
curl_cmd = ['curl', keyserver_url.format(keyid)]
|
||||
# use proxy server settings in order to retrieve the key
|
||||
return subprocess.check_output(curl_cmd,
|
||||
env=env_proxy_settings(['https']))
|
||||
|
||||
|
||||
def _dearmor_gpg_key(key_asc):
|
||||
"""Converts a GPG key in the ASCII armor format to the binary format.
|
||||
|
||||
:param key_asc: A GPG key in ASCII armor format.
|
||||
:type key_asc: (str, bytes)
|
||||
:returns: A GPG key in binary format
|
||||
:rtype: (str, bytes)
|
||||
:raises: GPGKeyError
|
||||
"""
|
||||
ps = subprocess.Popen(['gpg', '--dearmor'],
|
||||
stdout=subprocess.PIPE,
|
||||
stderr=subprocess.PIPE,
|
||||
stdin=subprocess.PIPE)
|
||||
out, err = ps.communicate(input=key_asc)
|
||||
# no need to decode output as it is binary (invalid utf-8), only error
|
||||
if six.PY3:
|
||||
err = err.decode('utf-8')
|
||||
if 'gpg: no valid OpenPGP data found.' in err:
|
||||
raise GPGKeyError('Invalid GPG key material. Check your network setup'
|
||||
' (MTU, routing, DNS) and/or proxy server settings'
|
||||
' as well as destination keyserver status.')
|
||||
else:
|
||||
return out
|
||||
|
||||
|
||||
def _write_apt_gpg_keyfile(key_name, key_material):
|
||||
"""Writes GPG key material into a file at a provided path.
|
||||
|
||||
:param key_name: A key name to use for a key file (could be a fingerprint)
|
||||
:type key_name: str
|
||||
:param key_material: A GPG key material (binary)
|
||||
:type key_material: (str, bytes)
|
||||
"""
|
||||
with open('/etc/apt/trusted.gpg.d/{}.gpg'.format(key_name),
|
||||
'wb') as keyf:
|
||||
keyf.write(key_material)
|
||||
|
||||
|
||||
def add_source(source, key=None, fail_invalid=False):
|
||||
|
|
@ -442,13 +550,13 @@ def add_source(source, key=None, fail_invalid=False):
|
|||
def _add_proposed():
|
||||
"""Add the PROPOSED_POCKET as /etc/apt/source.list.d/proposed.list
|
||||
|
||||
Uses lsb_release()['DISTRIB_CODENAME'] to determine the correct staza for
|
||||
Uses get_distrib_codename to determine the correct stanza for
|
||||
the deb line.
|
||||
|
||||
For intel architecutres PROPOSED_POCKET is used for the release, but for
|
||||
other architectures PROPOSED_PORTS_POCKET is used for the release.
|
||||
"""
|
||||
release = lsb_release()['DISTRIB_CODENAME']
|
||||
release = get_distrib_codename()
|
||||
arch = platform.machine()
|
||||
if arch not in six.iterkeys(ARCH_TO_PROPOSED_POCKET):
|
||||
raise SourceConfigError("Arch {} not supported for (distro-)proposed"
|
||||
|
|
@ -461,11 +569,16 @@ def _add_apt_repository(spec):
|
|||
"""Add the spec using add_apt_repository
|
||||
|
||||
:param spec: the parameter to pass to add_apt_repository
|
||||
:type spec: str
|
||||
"""
|
||||
if '{series}' in spec:
|
||||
series = lsb_release()['DISTRIB_CODENAME']
|
||||
series = get_distrib_codename()
|
||||
spec = spec.replace('{series}', series)
|
||||
_run_with_retries(['add-apt-repository', '--yes', spec])
|
||||
# software-properties package for bionic properly reacts to proxy settings
|
||||
# passed as environment variables (See lp:1433761). This is not the case
|
||||
# LTS and non-LTS releases below bionic.
|
||||
_run_with_retries(['add-apt-repository', '--yes', spec],
|
||||
cmd_env=env_proxy_settings(['https']))
|
||||
|
||||
|
||||
def _add_cloud_pocket(pocket):
|
||||
|
|
@ -534,7 +647,7 @@ def _verify_is_ubuntu_rel(release, os_release):
|
|||
:raises: SourceConfigError if the release is not the same as the ubuntu
|
||||
release.
|
||||
"""
|
||||
ubuntu_rel = lsb_release()['DISTRIB_CODENAME']
|
||||
ubuntu_rel = get_distrib_codename()
|
||||
if release != ubuntu_rel:
|
||||
raise SourceConfigError(
|
||||
'Invalid Cloud Archive release specified: {}-{} on this Ubuntu'
|
||||
|
|
|
|||
|
|
@ -564,6 +564,17 @@ class CephBasicDeployment(OpenStackAmuletDeployment):
|
|||
if 'nodown' in output or 'noout' in output:
|
||||
amulet.raise_status(amulet.FAIL, msg="Still has noout,nodown")
|
||||
|
||||
def test_501_security_checklist_action(self):
|
||||
"""Verify expected result on a default install"""
|
||||
u.log.debug("Testing security-checklist")
|
||||
sentry_unit = self.ceph0_sentry
|
||||
|
||||
action_id = u.run_action(sentry_unit, "security-checklist")
|
||||
u.wait_on_action(action_id)
|
||||
data = amulet.actions.get_action_output(action_id, full_output=True)
|
||||
assert data.get(u"status") == "completed", \
|
||||
"Security check is expected to pass by default"
|
||||
|
||||
@staticmethod
|
||||
def find_pool(sentry_unit, pool_name):
|
||||
"""
|
||||
|
|
|
|||
Loading…
Reference in New Issue