diff options
| author |   Oliver Walsh <owalsh@redhat.com> | 2017-04-19 14:39:42 +0100 |
|---|---|---|
| committer |   Emilien Macchi <emilien@redhat.com> | 2017-05-03 20:20:01 +0000 |
| commit | f8ca94a5b7c7658631f5b0a9b010251ebbcff65e (patch) | |
| tree | 78a29b35d20ad0268634048e525c8f609faf32c3 /spec/classes/tripleo_profile_base_octavia_api_spec.rb | |
| parent | 55d2c44a3b79b7b47972d6166e643d91a3af4465 (diff) | |
Restrict nova migration ssh tunnel
This change enhances the security of the migration ssh tunnel:
- The ssh authorized_keys file is only writeable by root.
- Creates a new user for migration instead of using root/nova.
- Disables SSH forwarding for this user.
- Optionally restricts the networks that this user can connect from.
- Uses an ssh wrapper command to whitelist the commands that this user can run
over ssh.
Requires the openstack-nova-migration package from
https://review.rdoproject.org/r/6327
bp tripleo-cold-migration
Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293
Diffstat (limited to 'spec/classes/tripleo_profile_base_octavia_api_spec.rb')
0 files changed, 0 insertions, 0 deletions