x
/
fuel-ccp-keystone
Code Issues Proposed changes

Restricting access to fernet keys folder 

Leaving access to fernet dir for owner only. This improves security
and resolves 'fernet dir is world-readable' warning.

Change-Id: I463a56d41697b8c4c1454758267e906665187b15
This commit is contained in:
Dmitry Klenov 2017-02-28 10:43:53 +00:00
parent be6b501f26
commit a797cce765
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
service/keystone.yaml
View File

@ -29,11 +29,12 @@ service:
command: "sudo /bin/chown keystone:keystone /var/log/ccp/keystone" command: "sudo /bin/chown keystone:keystone /var/log/ccp/keystone"
- name: chown-fernet-dir - name: chown-fernet-dir
command: "sudo /bin/chown keystone:keystone /etc/keystone/fernet-keys" command: "sudo /bin/chown keystone:keystone /etc/keystone/fernet-keys"
- name: remove-fernet-dir-sticky-bit - name: fernet-dir-permissions
command: /bin/chmod -t /etc/keystone/fernet-keys command: "/bin/chmod 0700 /etc/keystone/fernet-keys"
- name: generate-fernet-keys dependencies:
- chown-fernet-dir
- name: keystone-generate-fernet-keys
command: "/usr/bin/python /opt/ccp/bin/fernet-manage.py fernet_setup" command: "/usr/bin/python /opt/ccp/bin/fernet-manage.py fernet_setup"
image: keystone
type: single type: single
files: files:
- fernet-manage - fernet-manage
@ -61,6 +62,7 @@ service:
- keystone-conf - keystone-conf
dependencies: dependencies:
- keystone-db-sync - keystone-db-sync
- keystone-generate-fernet-keys
type: single type: single
command: keystone-manage bootstrap command: keystone-manage bootstrap
--bootstrap-password {{ openstack.user_password }} --bootstrap-password {{ openstack.user_password }}