Restrict nova migration ssh tunnel

This change enhances the security of the migration ssh tunnel:
- The ssh authorized_keys file is only writeable by root.
- Creates a new user for migration instead of using root/nova.
- Disables SSH forwarding for this user.
- Optionally restricts the networks that this user can connect from.
- Uses an ssh wrapper command to whitelist the commands that this user can run
  over ssh.

Requires the openstack-nova-migration package from
https://review.rdoproject.org/r/6327

bp tripleo-cold-migration

Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293

2 files changed, 160 insertions, 10 deletions

diff --git a/spec/classes/tripleo_profile_base_nova_spec.rb b/spec/classes/tripleo_profile_base_nova_spec.rb
index 8f7bfdc..d77ba1b 100644
--- a/spec/classes/tripleo_profile_base_nova_spec.rb
+++ b/spec/classes/tripleo_profile_base_nova_spec.rb
@@ -95,6 +95,9 @@ describe 'tripleo::profile::base::nova' do
         is_expected.to contain_class('nova::cache')
         is_expected.to contain_class('nova::placement')
         is_expected.to_not contain_class('nova::migration::libvirt')
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'absent'
+        )
       }
     end
 
@@ -128,6 +131,9 @@ describe 'tripleo::profile::base::nova' do
           :configure_libvirt => params[:libvirt_enabled],
           :configure_nova    => params[:nova_compute_enabled]
         )
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'absent'
+        )
       }
     end
 
@@ -162,13 +168,22 @@ describe 'tripleo::profile::base::nova' do
           :configure_libvirt => params[:libvirt_enabled],
           :configure_nova    => params[:nova_compute_enabled],
         )
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'absent'
+        )
       }
     end
 
     context 'with step 4 with libvirt and migration ssh key' do
-      let(:pre_condition) {
-        'include ::nova::compute::libvirt::services'
-      }
+      let(:pre_condition) do
+        <<-eof
+        include ::nova::compute::libvirt::services
+        class { '::ssh::server':
+          storeconfigs_enabled => false,
+          options              => {}
+        }
+        eof
+      end
       let(:params) { {
         :step           => 4,
         :libvirt_enabled => true,
@@ -185,8 +200,8 @@ describe 'tripleo::profile::base::nova' do
         is_expected.to contain_class('nova').with(
           :default_transport_url => /.+/,
           :notification_transport_url => /.+/,
-          :nova_public_key  => {'key' => 'bar', 'type' => 'ssh-rsa'},
-          :nova_private_key => {'key' => 'foo', 'type' => 'ssh-rsa'}
+          :nova_public_key  => nil,
+          :nova_private_key => nil,
         )
         is_expected.to contain_class('nova::config')
         is_expected.to contain_class('nova::placement')
@@ -196,13 +211,120 @@ describe 'tripleo::profile::base::nova' do
           :configure_libvirt => params[:libvirt_enabled],
           :configure_nova    => params[:nova_compute_enabled]
         )
+        is_expected.to contain_ssh__server__match_block('nova_migration allow').with(
+          :type  => 'User',
+          :name  => 'nova_migration',
+          :options => {
+            'ForceCommand'           => '/bin/nova-migration-wrapper',
+            'PasswordAuthentication' => 'no',
+            'AllowTcpForwarding'     => 'no',
+            'X11Forwarding'          => 'no',
+            'AuthorizedKeysFile'     => '/etc/nova/migration/authorized_keys'
+          }
+        )
+        is_expected.to_not contain_ssh__server__match_block('nova_migration deny')
+        is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
+          :content => 'ssh-rsa bar',
+          :mode => '0640',
+          :owner => 'root',
+          :group => 'nova_migration',
+        )
+        is_expected.to contain_file('/etc/nova/migration/identity').with(
+          :content => 'foo',
+          :mode => '0600',
+          :owner => 'nova',
+          :group => 'nova',
+        )
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'installed'
+        )
       }
     end
 
-    context 'with step 4 with libvirt TLS and migration ssh key' do
-      let(:pre_condition) {
-        'include ::nova::compute::libvirt::services'
+    context 'with step 4 with libvirt and migration ssh key and migration_ssh_localaddrs' do
+      let(:pre_condition) do
+        <<-eof
+        include ::nova::compute::libvirt::services
+        class { '::ssh::server':
+          storeconfigs_enabled => false,
+          options              => {}
+        }
+        eof
+      end
+      let(:params) { {
+        :step           => 4,
+        :libvirt_enabled => true,
+        :manage_migration => true,
+        :nova_compute_enabled => true,
+        :bootstrap_node  => 'node.example.com',
+        :oslomsg_rpc_hosts => [ 'localhost' ],
+        :oslomsg_rpc_password => 'foo',
+        :migration_ssh_key => { 'private_key' => 'foo', 'public_key' => 'ssh-rsa bar'},
+        :migration_ssh_localaddrs => ['127.0.0.1', '127.0.0.2']
+      } }
+
+      it {
+        is_expected.to contain_class('tripleo::profile::base::nova')
+        is_expected.to contain_class('nova').with(
+          :default_transport_url => /.+/,
+          :notification_transport_url => /.+/,
+          :nova_public_key  => nil,
+          :nova_private_key => nil,
+        )
+        is_expected.to contain_class('nova::config')
+        is_expected.to contain_class('nova::placement')
+        is_expected.to contain_class('nova::cache')
+        is_expected.to contain_class('nova::migration::libvirt').with(
+          :transport         => 'ssh',
+          :configure_libvirt => params[:libvirt_enabled],
+          :configure_nova    => params[:nova_compute_enabled]
+        )
+        is_expected.to contain_ssh__server__match_block('nova_migration allow').with(
+          :type  => 'LocalAddress 127.0.0.1,127.0.0.2 User',
+          :name  => 'nova_migration',
+          :options => {
+            'ForceCommand'           => '/bin/nova-migration-wrapper',
+            'PasswordAuthentication' => 'no',
+            'AllowTcpForwarding'     => 'no',
+            'X11Forwarding'          => 'no',
+            'AuthorizedKeysFile'     => '/etc/nova/migration/authorized_keys'
+          }
+        )
+        is_expected.to contain_ssh__server__match_block('nova_migration deny').with(
+          :type  => 'LocalAddress',
+          :name  => '!127.0.0.1,!127.0.0.2',
+          :options => {
+            'DenyUsers' => 'nova_migration'
+          }
+        )
+        is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
+          :content => 'ssh-rsa bar',
+          :mode => '0640',
+          :owner => 'root',
+          :group => 'nova_migration',
+        )
+        is_expected.to contain_file('/etc/nova/migration/identity').with(
+          :content => 'foo',
+          :mode => '0600',
+          :owner => 'nova',
+          :group => 'nova',
+        )
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'installed'
+        )
       }
+    end
+
+    context 'with step 4 with libvirt TLS and migration ssh key' do
+      let(:pre_condition) do
+        <<-eof
+        include ::nova::compute::libvirt::services
+        class { '::ssh::server':
+          storeconfigs_enabled => false,
+          options              => {}
+        }
+        eof
+      end
       let(:params) { {
         :step           => 4,
         :libvirt_enabled => true,
@@ -220,8 +342,8 @@ describe 'tripleo::profile::base::nova' do
         is_expected.to contain_class('nova').with(
           :default_transport_url => /.+/,
           :notification_transport_url => /.+/,
-          :nova_public_key  => {'key' => 'bar', 'type' => 'ssh-rsa'},
-          :nova_private_key => {'key' => 'foo', 'type' => 'ssh-rsa'}
+          :nova_public_key  => nil,
+          :nova_private_key => nil,
         )
         is_expected.to contain_class('nova::config')
         is_expected.to contain_class('nova::placement')
@@ -231,6 +353,33 @@ describe 'tripleo::profile::base::nova' do
           :configure_libvirt => params[:libvirt_enabled],
           :configure_nova    => params[:nova_compute_enabled]
         )
+        is_expected.to contain_ssh__server__match_block('nova_migration allow').with(
+          :type  => 'User',
+          :name  => 'nova_migration',
+          :options => {
+            'ForceCommand'           => '/bin/nova-migration-wrapper',
+            'PasswordAuthentication' => 'no',
+            'AllowTcpForwarding'     => 'no',
+            'X11Forwarding'          => 'no',
+            'AuthorizedKeysFile'     => '/etc/nova/migration/authorized_keys'
+          }
+        )
+        is_expected.to_not contain_ssh__server__match_block('nova_migration deny')
+        is_expected.to contain_file('/etc/nova/migration/authorized_keys').with(
+          :content => 'ssh-rsa bar',
+          :mode => '0640',
+          :owner => 'root',
+          :group => 'nova_migration',
+        )
+        is_expected.to contain_file('/etc/nova/migration/identity').with(
+          :content => 'foo',
+          :mode => '0600',
+          :owner => 'nova',
+          :group => 'nova',
+        )
+        is_expected.to contain_package('openstack-nova-migration').with(
+          :ensure => 'installed'
+        )
       }
     end
 
diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml
index 873a49e..3cf2693 100644
--- a/spec/fixtures/hieradata/default.yaml
+++ b/spec/fixtures/hieradata/default.yaml
@@ -44,3 +44,4 @@ memcached_node_ips:
 # octavia related items
 octavia::rabbit_password: 'password'
 horizon::secret_key: 'secrete'
+service_names: ['sshd']