Hardening Red Hat OpenStack Platform Red Hat OpenStack Platform 17.1 Good Practices, Compliance, and Security Hardening OpenStack Documentation Team rhos-docs@redhat.com

Commands:
openstack network create internal-network
openstack network create internal-network --project testing
source /home/stack/stackrc
openstack subnet list -c Name -c Subnet +---------------------+------------------+ | Name | Subnet | +---------------------+------------------+ | ctlplane-subnet | 192.168.101.0/24 | | storage_mgmt_subnet | 172.16.105.0/24 | | tenant_subnet | 172.16.102.0/24 | | external_subnet | 10.94.81.0/24 | | internal_api_subnet | 172.16.103.0/24 | | storage_subnet | 172.16.104.0/24 | +---------------------+------------------+
openstack server list -c Name -c Networks +-------------------------+-------------------------+ | Name | Networks | +-------------------------+-------------------------+ | overcloud-controller-0 | ctlplane=192.168.101.15 | | overcloud-controller-1 | ctlplane=192.168.101.19 | | overcloud-controller-2 | ctlplane=192.168.101.14 | | overcloud-novacompute-0 | ctlplane=192.168.101.18 | | overcloud-novacompute-2 | ctlplane=192.168.101.17 | | overcloud-novacompute-1 | ctlplane=192.168.101.11 | +-------------------------+-------------------------+
ssh tripleo-admin@192.168.101.15 ip addr
cp overcloud-deploy/overcloud/overcloud-passwords.yaml overcloud-deploy/overcloud/overcloud-passwords.yaml.old
ansible-playbook -i ./tripleo-deploy/undercloud/tripleo-ansible-inventory.yaml /usr/share/ansible/tripleo-playbooks/rotate-passwords.yaml
[WARNING]: Invalid characters were found in group names but not replaced, use -vvvv to see details PLAY [Rotate passwords] ************************************************************************************************************************************************************************************ TASK [Set passwords environment file path] ***************************************************************************************************************************************************************** ok: [undercloud-0] TASK [Rotate passwords] ************************************************************************************************************************************************************************************ changed: [undercloud-0] TASK [Create rotated password parameter fact] ************************************************************************************************************************************************************** ok: [undercloud-0] TASK [Update existing password environment file] *********************************************************************************************************************************************************** changed: [undercloud-0] PLAY RECAP ************************************************************************************************************************************************************************************************* undercloud-0 : ok=4 changed=2 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
cat > ~/templates/firewall.yaml <<EOF parameter_defaults: ExtraFirewallRules: '300 allow custom application 1': dport: 999 proto: udp '301 allow custom application 2': dport: 8081 proto: tcp EOF
openstack overcloud deploy --templates / -e /home/stack/templates/firewall.yaml / .
[tripleo-admin@overcloud-controller-2 ~]USD sudo iptables -L | grep rabbitmq ACCEPT tcp -- anywhere anywhere multiport dports vtr-emulator,epmd,amqp,25672,25673:25683 state NEW /* 109 rabbitmq-bundle ipv4 */
cat > ~/templates/firewall.yaml <<EOF parameter_defaults: ExtraFirewallRules: '098 allow rabbit from internalapi network': dport: - 4369 - 5672 - 25672 proto: tcp source: 10.0.0.0/24 '099 drop other rabbit access': dport: - 4369 - 5672 - 25672 proto: tcp action: drop EOF
openstack overcloud deploy --templates / -e /home/stack/templates/firewall.yaml / .
parameter_defaults: ExtraConfig: snmp::ro_community: mysecurestring snmp::ro_community6: myv6securestring
parameter_defaults: ExtraConfig: snmp::com2sec: ["notConfigUser default mysecurestring"] snmp::com2sec6: ["notConfigUser default myv6securestring"]
NeutronOVSFirewallDriver: openvswitch
cd ~/templates tree . ├── environments │ └── network-environment.yaml ├── hci.yaml ├── network │ └── config │ └── multiple-nics │ ├── computehci.yaml │ ├── compute.yaml │ └── controller.yaml ├── network_data.yaml ├── plan-environment.yaml └── roles_data_hci.yaml
cd ~/templates find . -name *role* > ./templates/roles_data_hci.yaml
openstack overcloud roles generate > --roles-path /usr/share/openstack-tripleo-heat-templates/roles > -o roles_data.yaml Controller Compute
source ~/stackrc
openstack baremetal node list -c Name +--------------+ | Name | +--------------+ | controller-0 | | controller-1 | | controller-2 | | compute-0 | | compute-1 | | compute-2 | +--------------+
openstack baremetal introspection data save <node> | jq
openstack baremetal introspection data save controller-0 | jq '.inventory | keys' [ "bmc_address", "bmc_v6address", "boot", "cpu", "disks", "hostname", "interfaces", "memory", "system_vendor" ]
openstack baremetal introspection data save controller-1 | jq '.inventory.disks' [ { "name": "/dev/sda", "model": "QEMU HARDDISK", "size": 85899345920, "rotational": true, "wwn": null, "serial": "QM00001", "vendor": "ATA", "wwn_with_extension": null, "wwn_vendor_extension": null, "hctl": "0:0:0:0", "by_path": "/dev/disk/by-path/pci-0000:00:01.1-ata-1" } ]
cat /etc/hosts source stackrc ; openstack endpoint list source overcloudrc ; openstack endpoint list
ssh tripleo-admin@compute-0 podman ps
parameter_defaults KeystoneLockoutDuration: 3600 KeystoneLockoutFailureAttempts: 3
openstack overcloud deploy --templates -e keystone_config.yaml
./cipherscan https://openstack.lab.local ........................... Target: openstack.lab.local:443 prio ciphersuite protocols pfs curves 1 ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 2 ECDHE-RSA-AES256-GCM-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 3 DHE-RSA-AES128-GCM-SHA256 TLSv1.2 DH,1024bits None 4 DHE-RSA-AES256-GCM-SHA384 TLSv1.2 DH,1024bits None 5 ECDHE-RSA-AES128-SHA256 TLSv1.2 ECDH,P-256,256bits prime256v1 6 ECDHE-RSA-AES256-SHA384 TLSv1.2 ECDH,P-256,256bits prime256v1 7 ECDHE-RSA-AES128-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 8 ECDHE-RSA-AES256-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 9 DHE-RSA-AES128-SHA256 TLSv1.2 DH,1024bits None 10 DHE-RSA-AES128-SHA TLSv1.2 DH,1024bits None 11 DHE-RSA-AES256-SHA256 TLSv1.2 DH,1024bits None 12 DHE-RSA-AES256-SHA TLSv1.2 DH,1024bits None 13 ECDHE-RSA-DES-CBC3-SHA TLSv1.2 ECDH,P-256,256bits prime256v1 14 EDH-RSA-DES-CBC3-SHA TLSv1.2 DH,1024bits None 15 AES128-GCM-SHA256 TLSv1.2 None None 16 AES256-GCM-SHA384 TLSv1.2 None None 17 AES128-SHA256 TLSv1.2 None None 18 AES256-SHA256 TLSv1.2 None None 19 AES128-SHA TLSv1.2 None None 20 AES256-SHA TLSv1.2 None None 21 DES-CBC3-SHA TLSv1.2 None None Certificate: trusted, 2048 bits, sha256WithRSAEncryption signature TLS ticket lifetime hint: None NPN protocols: None OCSP stapling: not supported Cipher ordering: server Curves ordering: server - fallback: no Server supports secure renegotiation Server supported compression methods: NONE TLS Tolerance: yes Intolerance to: SSL 3.254 : absent TLS 1.0 : PRESENT TLS 1.1 : PRESENT TLS 1.2 : absent TLS 1.3 : absent TLS 1.4 : absent
Intolerance to: SSL 3.254 : absent TLS 1.0 : PRESENT TLS 1.1 : PRESENT TLS 1.2 : absent TLS 1.3 : absent TLS 1.4 : absent
search example.com bigcorp.com nameserver USDIDM_SERVER_IP_ADDR
sudo dnf install -y python3-ipalib python3-ipaclient krb5-devel
export IPA_DOMAIN=bigcorp.com export IPA_REALM=BIGCORP.COM export IPA_ADMIN_USER=USDIPA_USER 1 export IPA_ADMIN_PASSWORD=USDIPA_PASSWORD 2 export IPA_SERVER_HOSTNAME=ipa.bigcorp.com export UNDERCLOUD_FQDN=undercloud.example.com 3 export USER=stack export CLOUD_DOMAIN=example.com
ansible-playbook --ssh-extra-args "-o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" /usr/share/ansible/tripleo-playbooks/undercloud-ipa-install.yaml
undercloud_nameservers = USDIDM_SERVER_IP_ADDR overcloud_domain_name = example.com
parameter_defaults: certmonger_krb_realm: EXAMPLE.COMPANY.COM
custom_env_files = /home/stack/hiera_override.yaml
openstack undercloud install
kinit admin ipa host-find
ls /etc/novajoin/krb5.keytab
parameter_defaults: DnsSearchDomains: ["example.com"] CloudDomain: example.com CloudName: overcloud.example.com CloudNameInternal: overcloud.internalapi.example.com CloudNameStorage: overcloud.storage.example.com CloudNameStorageManagement: overcloud.storagemgmt.example.com CloudNameCtlplane: overcloud.ctlplane.example.com IdMServer: freeipa-0.redhat.local IdMDomain: redhat.local IdMInstallClientPackages: False resource_registry: OS::TripleO::Services::IpaClient: /usr/share/openstack-tripleo-heat-templates/deployment/ipa/ipaservices-baremetal-ansible.yaml
CertmongerKerberosRealm: EXAMPLE.COMPANY.COM
DEFAULT_TEMPLATES=/usr/share/openstack-tripleo-heat-templates/ CUSTOM_TEMPLATES=/home/stack/templates openstack overcloud deploy -e USD{DEFAULT_TEMPLATES}/environments/ssl/tls-everywhere-endpoints-dns.yaml -e USD{DEFAULT_TEMPLATES}/environments/services/haproxy-public-tls-certmonger.yaml -e USD{DEFAULT_TEMPLATES}/environments/ssl/enable-internal-tls.yaml -e USD{CUSTOM_TEMPLATES}/tls-parameters.yaml
openstack endpoint list
parameter_defaults: MemcachedTLS: true MemcachedPort: 11212
openstack overcloud deploy --templates -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-internal-tls.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-everywhere-endpoints-dns.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/services/haproxy-public-tls-certmonger.yaml -e /home/stack/memcached.yaml
parameter_defaults: CertificateKeySize: '4096' RedisCertificateKeySize: '2048'
#File modified by ipa-client-install [global] basedn = dc=redhat,dc=local realm = REDHAT.LOCAL domain = redhat.local server = freeipa-0.redhat.local host = undercloud-0.redhat.local xmlrpc_uri = https://freeipa-0.redhat.local/ipa/xml enable_ra = True
export IPA_DOMAIN=bigcorp.com export IPA_REALM=BIGCORP.COM export IPA_ADMIN_USER=USDIPA_USER export IPA_ADMIN_PASSWORD=USDIPA_PASSWORD export IPA_SERVER_HOSTNAME=ipa.bigcorp.com export UNDERCLOUD_FQDN=undercloud.example.com export USER=stack export CLOUD_DOMAIN=example.com
sudo mkdir -p /etc/pki/CA sudo touch /etc/pki/CA/index.txt
echo '1000' | sudo tee /etc/pki/CA/serial
openssl genrsa -out ca.key.pem 4096 openssl req -key ca.key.pem -new -x509 -days 7300 -extensions v3_ca -out ca.crt.pem
parameter_defaults: PublicTLSCAFile: /etc/pki/ca-trust/source/anchors/cacert.pem
sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust extract
openssl genrsa -out server.key.pem 2048
cp /etc/pki/tls/openssl.cnf .
[req] distinguished_name = req_distinguished_name req_extensions = v3_req [req_distinguished_name] countryName = Country Name (2 letter code) countryName_default = AU stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Queensland localityName = Locality Name (eg, city) localityName_default = Brisbane organizationalUnitName = Organizational Unit Name (eg, section) organizationalUnitName_default = Red Hat commonName = Common Name commonName_default = 192.168.0.1 commonName_max = 64 Extensions to add to a certificate request basicConstraints = CA:FALSE keyUsage = nonRepudiation, digitalSignature, keyEncipherment subjectAltName = @alt_names [alt_names] IP.1 = 192.168.0.1 DNS.1 = instack.localdomain DNS.2 = vip.localdomain DNS.3 = 192.168.0.1
openssl req -config openssl.cnf -key server.key.pem -new -out server.csr.pem
sudo mkdir -p /etc/pki/CA/newcerts
sudo openssl ca -config openssl.cnf -extensions v3_req -days 3650 -in server.csr.pem -out server.crt.pem -cert ca.crt.pem -keyfile ca.key.pem
cat server.crt.pem server.key.pem > undercloud.pem
sudo mkdir /etc/pki/undercloud-certs sudo cp ~/undercloud.pem /etc/pki/undercloud-certs/. sudo semanage fcontext -a -t etc_t "/etc/pki/undercloud-certs(/.*)?" sudo restorecon -R /etc/pki/undercloud-certs
undercloud_service_certificate = /etc/pki/undercloud-certs/undercloud.pem
sudo cp ca.crt.pem /etc/pki/ca-trust/source/anchors/ sudo update-ca-trust extract
openssl crl2pkcs7 -nocrl -certfile /etc/pki/tls/certs/ca-bundle.crt | openssl pkcs7 -print_certs -text | grep <CN of the CA issuer> -A 10 -B 10
cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/enable-tls.yaml ~/templates/.
parameter_defaults: SSLCertificate: | -----BEGIN CERTIFICATE----- MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGS sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQ -----END CERTIFICATE-----
parameter_defaults: SSLIntermediateCertificate: | -----BEGIN CERTIFICATE----- sFW3S2roS4X0Af/kSSD8mlBBTFTCMBAj6rtLBKLaQbIxEpIzrgvpBCwUAMFgxCzAJB MIIDgzCCAmugAwIBAgIJAKk46qw6ncJaMA0GCSqGSIb3DQE -----END CERTIFICATE-----
parameter_defaults: SSLKey: | -----BEGIN RSA PRIVATE KEY----- MIIEowIBAAKCAQEAqVw8lnQ9RbeI1EdLN5PJP0lVO ctlKn3rAAdyumi4JDjESAXHIKFjJNOLrBmpQyES4X -----END RSA PRIVATE KEY-----
cp -r /usr/share/openstack-tripleo-heat-templates/environments/ssl/inject-trust-anchor-hiera.yaml ~/templates/.
parameter_defaults: CAMap: undercloud-ca: content: | -----BEGIN CERTIFICATE----- MIIDlTCCAn2gAwIBAgIJAOnPtx2hHEhrMA0GCS BAYTAlVTMQswCQYDVQQIDAJOQzEQMA4GA1UEBw UmVkIEhhdDELMAkGA1UECwwCUUUxFDASBgNVBA -----END CERTIFICATE----- overcloud-ca: content: | -----BEGIN CERTIFICATE----- MIIDBzCCAe+gAwIBAgIJAIc75A7FD++DMA0GCS BAMMD3d3dy5leGFtcGxlLmNvbTAeFw0xOTAxMz Um54yGCARyp3LpkxvyfMXX1DokpS1uKi7s6CkF -----END CERTIFICATE-----
openstack overcloud deploy --templates [...] -e /home/stack/templates/enable-tls.yaml -e ~/templates/custom-domain.yaml -e ~/templates/inject-trust-anchor-hiera.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml
openstack overcloud deploy --templates [...] --limit Controller --tags facts,host_prep_steps -e /home/stack/templates/enable-tls.yaml -e ~/templates/custom-domain.yaml -e ~/templates/inject-trust-anchor-hiera.yaml -e /usr/share/openstack-tripleo-heat-templates/environments/ssl/tls-endpoints-public-dns.yaml
[stack@director ~]USD source ~/stackrc [stack@director ~]USD openstack server list -------------------------------------- ------------------------- -------- ---------------------+ | ID | Name | Status | Networks | -------------------------------------- ------------------------- -------- ---------------------+ | 756fbd73-e47b-46e6-959c-e24d7fb71328 | overcloud-controller-0 | ACTIVE | ctlplane=192.0.2.16 | | 62b869df-1203-4d58-8e45-fac6cd4cfbee | overcloud-novacompute-0 | ACTIVE | ctlplane=192.0.2.8 | -------------------------------------- ------------------------- -------- ---------------------+
[tripleo-admin@overcloud-controller-0 ~]USD ssh tripleo-admin@192.0.2.16
[tripleo-admin@overcloud-controller-0 ~]USD sudo crudini --get /var/lib/config-data/puppet-generated/keystone/etc/keystone/keystone.conf token driver sql [tripleo-admin@overcloud-controller-0 ~]USD sudo crudini --get /var/lib/config-data/puppet-generated/keystone/etc/keystone/keystone.conf token provider fernet
[tripleo-admin@overcloud-controller-0 ~]USD exit [stack@director ~]USD source ~/overcloudrc [stack@director ~]USD openstack token issue ------------ -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Field | Value | ------------ -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | expires | 2016-09-20 05:26:17+00:00 | | id | gAAAAABX4LppE8vaiFZ992eah2i3edpO1aDFxlKZq6a_RJzxUx56QVKORrmW0-oZK3-Xuu2wcnpYq_eek2SGLz250eLpZOzxKBR0GsoMfxJU8mEFF8NzfLNcbuS-iz7SV-N1re3XEywSDG90JcgwjQfXW-8jtCm-n3LL5IaZexAYIw059T_-cd8 | | project_id | 26156621d0d54fc39bf3adb98e63b63d | | user_id | 397daf32cadd490a8f3ac23a626ac06c | ------------ -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
fips-mode-setup --enable
fips-mode-setup --check
sudo dnf -y install rhosp-director-images-uefi-fips-x86_64
mkdir /home/stack/images cd /home/stack/images
for i in /usr/share/rhosp-director-images/*fips*.tar; do tar -xvf USDi; done
ln -s ironic-python-agent-fips.initramfs ironic-python-agent.initramfs ln -s ironic-python-agent-fips.kernel ironic-python-agent.kernel ln -s overcloud-hardened-uefi-full-fips.qcow2 overcloud-hardened-uefi-full.qcow2
openstack overcloud image upload --update-existing --whole-disk
openstack overcloud deploy -e /usr/share/openstack-tripleo-heat-templates/environments/fips.yaml
openstack overcloud deploy --templates ... -e /usr/share/openstack-tripleo-heat-templates/environments/enable-secure-rbac.yaml
openstack role add --user <user> --user-domain <domain> --project <project> --project-domain <project-domain> admin
openstack role add --user <user> --user-domain <domain> --project <project> --project-domain <project-domain> member
openstack role add --user <user> --user-domain <domain> --project <project> --project-domain <project-domain> reader
/etc/USDservice/policy.json
/var/lib/config-data/puppet-generated/USDservice/etc/USDservice/policy.json
exec -i keystone oslopolicy-policy-generator --namespace keystone
"identity:create_user": "rule:admin_required"
"identity:create_user": "!"
openstack role create PowerUsers +-----------+----------------------------------+ | Field | Value | +-----------+----------------------------------+ | domain_id | None | | id | 7061a395af43455e9057ab631ad49449 | | name | PowerUsers | +-----------+----------------------------------+
openstack role add --project [PROJECT_NAME] --user [USER_ID] [PowerUsers-ROLE_ID]
sudo podman exec -i nova_compute oslopolicy-policy-generator --namespace nova
sudo podman exec -it nova_compute oslopolicy-policy-generator --namespace nova > /tmp/nova-policy.json
"os_compute_api:servers:start": "role:PowerUsers", "os_compute_api:servers:stop": "role:PowerUsers" "os_compute_api:servers:create:attach_volume": "role:PowerUsers" "os_compute_api:os-volumes-attachments:index": "role:PowerUsers" "os_compute_api:os-volumes-attachments:create": "role:PowerUsers" "os_compute_api:os-volumes-attachments:show": "role:PowerUsers" "os_compute_api:os-volumes-attachments:update": "role:PowerUsers" "os_compute_api:os-volumes-attachments:delete": "role:PowerUsers"
cp /tmp/nova-policy.json nova_compute:etc/nova/policy.json
"os_compute_api:os-keypairs:delete": "rule:admin_api or user_id:%(user_id)s"
"admin_or_owner": "is_admin:True or project_id:%(project_id)s"
"admin_or_user": "is_admin:True or user_id:%(user_id)s" "os_compute_api:os-instance-actions": "rule:admin_or_user"
parameter_defaults: KeystonePolicies: { keystone-context_is_admin: { key: context_is_admin, value: 'role:admin' } }
parameter_defaults: NovaApiPolicies: { nova-context_is_admin: { key: 'compute:get_all', value: '@' } }
openstack role list -c Name -f value swiftoperator ResellerAdmin admin _member_ heat_stack_user
openstack role assignment list --names --role admin +-------+------------------------------------+-------+-----------------+------------+--------+-----------+ | Role | User | Group | Project | Domain | System | Inherited | +-------+------------------------------------+-------+-----------------+------------+--------+-----------+ | admin | heat-cfn@Default | | service@Default | | | False | | admin | placement@Default | | service@Default | | | False | | admin | neutron@Default | | service@Default | | | False | | admin | zaqar@Default | | service@Default | | | False | | admin | swift@Default | | service@Default | | | False | | admin | admin@Default | | admin@Default | | | False | | admin | zaqar-websocket@Default | | service@Default | | | False | | admin | heat@Default | | service@Default | | | False | | admin | ironic-inspector@Default | | service@Default | | | False | | admin | nova@Default | | service@Default | | | False | | admin | ironic@Default | | service@Default | | | False | | admin | glance@Default | | service@Default | | | False | | admin | mistral@Default | | service@Default | | | False | | admin | heat_stack_domain_admin@heat_stack | | | heat_stack | | False | | admin | admin@Default | | | | all | False | +-------+------------------------------------+-------+-----------------+------------+--------+-----------+
openstack token issue --debug 2>&1 | egrep ^'{\"token\":' > access.file.json
ssh tripleo-admin@CONTROLLER-1 sudo podman exec cinder_api oslopolicy-policy-generator --config-file /etc/cinder/cinder.conf --namespace cinder > cinderpolicy.json
oslopolicy-checker --policy cinderpolicy.json --access access.file.json
cat /proc/cpuinfo | egrep "vmx|svm"
ssh stack@director
ansible-playbook -i /home/stack/overcloud-deploy/<stack_name>/tripleo-ansible-inventory.yaml \ 1 -e undercloud_backup_folder=/home/stack/overcloud_backup_keys \ 2 -e stack_name=<stack_name> \ 3 /usr/share/ansible/tripleo-playbooks/ssh_key_rotation.yaml
ansible-playbook -i /home/stack/overcloud-deploy/<stack_name>/tripleo-ansible-inventory.yaml \ 1 -e stack_name=<stack_name> -e rotate_undercloud_key=false \ 2 -e ansible_ssh_private_key_file=/home/stack/overcloud_backup_keys/id_rsa 3 tripleo-ansible/playbooks/ssh_key_rotation.yaml
sudo podman inspect <container_name> | less
sudo less /var/log/containers/nova/nova-compute.log
exec -it nova_compute /bin/bash
sudo sed -i 's/^debug=.*/debug=True' /var/lib/config-data/puppet-generated/nova/etc/nova/nova.conf
sudo podman restart nova_compute
cat > /home/stack/templates/libvirt-keysize.yaml parameter_defaults: LibvirtCertificateKeySize: 4096 EOF
openstack overcloud deploy --templates -e /home/stack/templates/libvirt-keysize.yaml
./deploy.sh
resource_registry: OS::TripleO::Services::Sshd: /usr/share/openstack-tripleo-heat-templates/deployment/sshd/sshd-baremetal-puppet.yaml parameter_defaults: BannerText: | ****************************************************************** * This system is for the use of authorized users only. Usage of * * this system may be monitored and recorded by system personnel. * * Anyone using this system expressly consents to such monitoring * * and is advised that if such monitoring reveals possible * * evidence of criminal activity, system personnel may provide * * the evidence from such monitoring to law enforcement officials.* ******************************************************************
openstack overcloud deploy --templates -e <full environment> -e ssh_banner.yaml
resource_registry: OS::TripleO::Services::AuditD: /usr/share/openstack-tripleo-heat-templates/deployment/auditd/auditd-baremetal-puppet.yaml parameter_defaults: AuditdRules: 'Record Events that Modify User/Group Information': content: '-w /etc/group -p wa -k audit_rules_usergroup_modification' order : 1 'Collects System Administrator Actions': content: '-w /etc/sudoers -p wa -k actions' order : 2 'Record Events that Modify the Systems Mandatory Access Controls': content: '-w /etc/selinux/ -p wa -k MAC-policy' order : 3
parameter_defaults: ControllerExtraConfig: ExtraFirewallRules: '301 allow zabbix': dport: 10050 proto: tcp source: 10.0.0.8
parameter_defaults: ControllerParameters ExtraFirewallRules: '098 allow rabbit from internalapi network': dport: [4369,5672,25672] proto: tcp source: 10.0.0.0/24 '099 drop other rabbit access: dport: [4369,5672,25672] proto: tcp action: drop
iptables-save [...] -A INPUT -p tcp -m multiport --dports 4369,5672,25672 -m comment --comment "109 rabbitmq" -m state --state NEW -j ACCEPT
ExtraFirewallRules: '109 rabbitmq': dport: - 4369 - 5672 - 25672
resource_registry: OS::TripleO::Services::Aide: /usr/share/openstack-tripleo-heat-templates/deployment/aide/aide-baremetal-ansible.yaml parameter_defaults: AideRules: 'TripleORules': content: 'TripleORules = p+sha256' order: 1 'etc': content: '/etc/ TripleORules' order: 2 'boot': content: '/boot/ TripleORules' order: 3 'sbin': content: '/sbin/ TripleORules' order: 4 'var': content: '/var/ TripleORules' order: 5 'not var/log': content: '!/var/log.*' order: 6 'not var/spool': content: '!/var/spool.*' order: 7 'not nova instances': content: '!/var/lib/nova/instances.*' order: 8
openstack overcloud deploy --templates -e /home/stack/templates/aide.yaml
MyAlias = p+i+n+u+g+s+b+m+c+sha512
resource_registry: OS::TripleO::Services::Securetty: ../puppet/services/securetty.yaml parameter_defaults: TtyValues: - console - tty1 - tty2 - tty3 - tty4 - tty5 - tty6
parameter_defaults: KeystoneNotificationFormat: cadf
resource_registry: OS::TripleO::Services::LoginDefs: ../puppet/services/login-defs.yaml parameter_defaults: PasswordMaxDays: 60 PasswordMinDays: 1 PasswordMinLen: 5 PasswordWarnAge: 7 FailDelay: 4
parameter_defaults: HorizonAllowedHosts: <value>
parameter_defaults: ControllerExtraConfig: horizon::disallow_iframe_embed: false
horizon::enable_secure_proxy_ssl_header: true
ssh tripleo-admin@controller-0
sudo egrep ^SECURE_PROXY_SSL_HEADER /var/lib/config-data/puppet-generated/horizon/etc/openstack-dashboard/local_settings SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
horizon::cache_backend: django.core.cache.backends.memcached.MemcachedCache horizon::django_session_engine: 'django.contrib.sessions.backends.cache'
parameter_defaults: HorizonPasswordValidator: '^.{8,18}USD' HorizonPasswordValidatorHelp: 'Password must be between 8 and 18 characters.'
openstack overcloud deploy --templates -e <full environment> -e horizon_password.yaml
parameter_defaults: ControllerExtraConfig: horizon::enforce_password_check: false
parameter_defaults: ControllerExtraConfig: horizon::disable_password_reveal: false
<snip> <div class="container"> <div class="row-fluid"> <div class="span12"> <div id="brand"> <img src="../../static/themes/rcue/images/RHOSP-Login-Logo.svg"> </div><!--/#brand--> </div><!--/.span*--> <!-- Start of Logon Banner --> <p>Authentication to this information system reflects acceptance of user monitoring agreement.</p> <!-- End of Logon Banner --> {% include 'auth/_login.html' %} </div><!--/.row-fluid-> </div><!--/.container--> {% block js %} {% include "horizon/_scripts.html" %} {% endblock %} </body> </html>
<Directory /> LimitRequestBody 10737418240 </Directory>
<Directory "/var/www"> LimitRequestBody 10737418240 </Directory>
<Directory "/var/www"> LimitRequestBody 10737418240 </Directory>
manila endpoints +-------------+-----------------------------------------+ | manila | Value | +-------------+-----------------------------------------+ | adminURL | http://172.18.198.55:8786/v1/20787a7b...| | region | RegionOne | | publicURL | http://172.18.198.55:8786/v1/20787a7b...| | internalURL | http://172.18.198.55:8786/v1/20787a7b...| | id | 82cc5535aa444632b64585f138cb9b61 | +-------------+-----------------------------------------+ +-------------+-----------------------------------------+ | manilav2 | Value | +-------------+-----------------------------------------+ | adminURL | http://172.18.198.55:8786/v2/20787a7b...| | region | RegionOne | | publicURL | http://172.18.198.55:8786/v2/20787a7b...| | internalURL | http://172.18.198.55:8786/v2/20787a7b...| | id | 2e8591bfcac4405fa7e5dc3fd61a2b85 | +-------------+-----------------------------------------+
api-paste.ini manila.conf policy.json rootwrap.conf rootwrap.d ./rootwrap.d: share.filters
env | grep OS_ OS_USERNAME=admin OS_TENANT_NAME=admin USD manila type-list --all +----+--------+-----------+-----------+-----------------------------------+-----------------------+ | ID | Name | Visibility| is_default| required_extra_specs | optional_extra_specs | +----+--------+-----------+-----------+-----------------------------------+-----------------------+ | 4..| my_type| private | - | driver_handles_share_servers:False| snapshot_support:True | | 5..| default| public | YES | driver_handles_share_servers:True | snapshot_support:True | +----+--------+-----------+-----------+-----------------------------------+-----------------------+
env | grep OS_ OS_USERNAME=demo OS_TENANT_NAME=demo USD manila type-list --all +----+--------+-----------+-----------+----------------------------------+----------------------+ | ID | Name | Visibility| is_default| required_extra_specs | optional_extra_specs | +----+--------+-----------+-----------+----------------------------------+----------------------+ | 5..| default| public | YES | driver_handles_share_servers:True| snapshot_support:True| +----+--------+-----------+-----------+----------------------------------+----------------------+
env | grep OS_ OS_USERNAME=admin OS_TENANT_NAME=admin USD openstack project list +----------------------------------+--------------------+ | ID | Name | +----------------------------------+--------------------+ | ... | ... | | df29a37db5ae48d19b349fe947fada46 | demo | +----------------------------------+--------------------+ USD manila type-access-add my_type df29a37db5ae48d19b349fe947fada46
env | grep OS_ OS_USERNAME=demo OS_TENANT_NAME=demo USD manila type-list --all +----+--------+-----------+-----------+-----------------------------------+-----------------------+ | ID | Name | Visibility| is_default| required_extra_specs | optional_extra_specs | +----+--------+-----------+-----------+-----------------------------------+-----------------------+ | 4..| my_type| private | - | driver_handles_share_servers:False| snapshot_support:True | | 5..| default| public | YES | driver_handles_share_servers:True | snapshot_support:True | +----+--------+-----------+-----------+-----------------------------------+-----------------------+
context_is_admin: role:admin
admin_or_owner: is_admin:True or project_id:%(project_id)s
default: rule:admin_or_owner
share_extension:quotas:update: rule:admin_api
share_extension:quotas:delete: rule:admin_api
chown -R root:swift /var/lib/config-data/puppet-generated/swift/etc/swift/* find /var/lib/config-data/puppet-generated/swift/etc/swift/ -type f -exec chmod 640 {} \; find /var/lib/config-data/puppet-generated/swift/etc/swift/ -type d -exec chmod 750 {} \;
The sanitization process removes information from the media such that the information cannot be retrieved or reconstructed. Sanitization techniques, including clearing, purging, cryptographic erase, and destruction, prevent the disclosure of information to unauthorized individuals when such media is reused or released for disposal.
parameter_defaults: VerifyGlanceSignatures: True
[ {rabbit, [ {tcp_listeners, [] }, {ssl_listeners, [{"<IP address or hostname of management network interface>", 5671}] }, {ssl_options, [{cacertfile,"/etc/ssl/cacert.pem"}, {certfile,"/etc/ssl/rabbit-server-cert.pem"}, {keyfile,"/etc/ssl/rabbit-server-key.pem"}, {verify,verify_peer}, {fail_if_no_peer_cert,true}]} ]} ].
[DEFAULT] rpc_backend = nova.openstack.common.rpc.impl_kombu rabbit_use_ssl = True rabbit_host = RABBIT_HOST rabbit_port = 5671 rabbit_user = compute01 rabbit_password = RABBIT_PASS kombu_ssl_keyfile = /etc/ssl/node-key.pem kombu_ssl_certfile = /etc/ssl/node-cert.pem kombu_ssl_ca_certs = /etc/ssl/cacert.pem
[DEFAULT] rpc_backend = nova.openstack.common.rpc.impl_qpid qpid_protocol = ssl qpid_hostname = <IP or hostname of management network interface of messaging server> qpid_port = 5671 qpid_username = compute01 qpid_password = QPID_PASS
qpid_sasl_mechanisms = <space separated list of SASL mechanisms to use for auth>
cat open-up-glance-api-metadef.yaml
GlanceApiPolicies: { glance-metadef_default: { key: 'metadef_default', value: '' }, glance-get_metadef_namespace: { key: 'get_metadef_namespace', value: 'rule:metadef_default' }, glance-get_metadef_namespaces: { key: 'get_metadef_namespaces', value: 'rule:metadef_default' }, glance-modify_metadef_namespace: { key: 'modify_metadef_namespace', value: 'rule:metadef_default' }, glance-add_metadef_namespace: { key: 'add_metadef_namespace', value: 'rule:metadef_default' }, glance-delete_metadef_namespace: { key: 'delete_metadef_namespace', value: 'rule:metadef_default' }, glance-get_metadef_object: { key: 'get_metadef_object', value: 'rule:metadef_default' }, glance-get_metadef_objects: { key: 'get_metadef_objects', value: 'rule:metadef_default' }, glance-modify_metadef_object: { key: 'modify_metadef_object', value: 'rule:metadef_default' }, glance-add_metadef_object: { key: 'add_metadef_object', value: 'rule:metadef_default' }, glance-delete_metadef_object: { key: 'delete_metadef_object', value: 'rule:metadef_default' }, glance-list_metadef_resource_types: { key: 'list_metadef_resource_types', value: 'rule:metadef_default' }, glance-get_metadef_resource_type: { key: 'get_metadef_resource_type', value: 'rule:metadef_default' }, glance-add_metadef_resource_type_association: { key: 'add_metadef_resource_type_association', value: 'rule:metadef_default' }, glance-remove_metadef_resource_type_association: { key: 'remove_metadef_resource_type_association', value: 'rule:metadef_default' }, glance-get_metadef_property: { key: 'get_metadef_property', value: 'rule:metadef_default' }, glance-get_metadef_properties: { key: 'get_metadef_properties', value: 'rule:metadef_default' }, glance-modify_metadef_property: { key: 'modify_metadef_property', value: 'rule:metadef_default' }, glance-add_metadef_property: { key: 'add_metadef_property', value: 'rule:metadef_default' }, glance-remove_metadef_property: { key: 'remove_metadef_property', value: 'rule:metadef_default' }, glance-get_metadef_tag: { key: 'get_metadef_tag', value: 'rule:metadef_default' }, glance-get_metadef_tags: { key: 'get_metadef_tags', value: 'rule:metadef_default' }, glance-modify_metadef_tag: { key: 'modify_metadef_tag', value: 'rule:metadef_default' }, glance-add_metadef_tag: { key: 'add_metadef_tag', value: 'rule:metadef_default' }, glance-add_metadef_tags: { key: 'add_metadef_tags', value: 'rule:metadef_default' }, glance-delete_metadef_tag: { key: 'delete_metadef_tag', value: 'rule:metadef_default' }, glance-delete_metadef_tags: { key: 'delete_metadef_tags', value: 'rule:metadef_default' } }
openstack overcloud deploy -e open-up-glance-api-metadef.yaml
touch ~/templates/tls-ciphers.yaml
parameter_defaults: ExtraConfig: # TLSv1.3 configuration tripleo::haproxy::ssl_options:: 'ssl-min-ver TLSv1.3'
openstack overcloud deploy --templates -e /home/stack/templates/tls-ciphers.yaml