diff options
| author |   Oliver Walsh <owalsh@redhat.com> | 2017-04-19 14:39:42 +0100 |
|---|---|---|
| committer |   Alex Schultz <aschultz@redhat.com> | 2017-06-01 18:33:46 +0000 |
| commit | fd20b306b0bb4be2f5b251b45daeda5d215fb618 (patch) | |
| tree | 290a5e86ebe9752c66d083783c3df02f5fc48e1d /spec/fixtures/hieradata/default.yaml | |
| parent | e4a293695eca090950675d809828cfaa8cc4072a (diff) | |
Restrict nova migration ssh tunnel
This change enhances the security of the migration ssh tunnel:
- The ssh authorized_keys file is only writeable by root.
- Creates a new user for migration instead of using root/nova.
- Disables SSH forwarding for this user.
- Optionally restricts the networks that this user can connect from.
- Uses an ssh wrapper command to whitelist the commands that this user can run
over ssh.
Requires the openstack-nova-migration package from
https://review.rdoproject.org/r/6327
bp tripleo-cold-migration
Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293
(cherry picked from commit f8ca94a5b7c7658631f5b0a9b010251ebbcff65e)
Diffstat (limited to 'spec/fixtures/hieradata/default.yaml')
| -rw-r--r-- | spec/fixtures/hieradata/default.yaml | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml index 94d2b28..7e6c177 100644 --- a/spec/fixtures/hieradata/default.yaml +++ b/spec/fixtures/hieradata/default.yaml @@ -36,3 +36,4 @@ memcached_node_ips_v6: memcached_node_ips: - '127.0.0.1' horizon::secret_key: 'secrete' +service_names: ['sshd'] |