diff options
| -rw-r--r-- | .gitignore | 3 | ||||
| -rw-r--r-- | manifests/pacemaker/haproxy_with_vip.pp | 20 | ||||
| -rw-r--r-- | manifests/profile/base/cinder/volume/dellsc.pp | 1 | ||||
| -rw-r--r-- | manifests/profile/base/keystone.pp | 6 | ||||
| -rw-r--r-- | manifests/profile/base/nova.pp | 134 | ||||
| -rw-r--r-- | manifests/profile/base/pacemaker.pp | 1 | ||||
| -rw-r--r-- | releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml | 5 | ||||
| -rw-r--r-- | releasenotes/notes/cold_migration_security-1543136408c76459.yaml | 10 | ||||
| -rw-r--r-- | spec/classes/tripleo_profile_base_nova_spec.rb | 169 | ||||
| -rw-r--r-- | spec/fixtures/hieradata/default.yaml | 1 |
10 files changed, 286 insertions, 64 deletions
@@ -1,7 +1,8 @@ pkg/ Gemfile.lock vendor/ -spec/fixtures/ +spec/fixtures/modules +spec/fixtures/manifests .vagrant/ .bundle/ coverage/ diff --git a/manifests/pacemaker/haproxy_with_vip.pp b/manifests/pacemaker/haproxy_with_vip.pp index a27b94b..1fc3ff7 100644 --- a/manifests/pacemaker/haproxy_with_vip.pp +++ b/manifests/pacemaker/haproxy_with_vip.pp @@ -57,17 +57,25 @@ define tripleo::pacemaker::haproxy_with_vip( $ensure = true) { if($ensure) { + # NB: Until the IPaddr2 RA has a fix for https://bugzilla.redhat.com/show_bug.cgi?id=1445628 + # we need to specify the nic when creating the ipv6 vip. if is_ipv6_address($ip_address) { - $netmask = '64' + $netmask = '128' + $nic = interface_for_ip($ip_address) + $ipv6_addrlabel = '99' } else { - $netmask = '32' + $netmask = '32' + $nic = '' + $ipv6_addrlabel = '' } pacemaker::resource::ip { "${vip_name}_vip": - ip_address => $ip_address, - cidr_netmask => $netmask, - location_rule => $location_rule, - tries => $pcs_tries, + ip_address => $ip_address, + cidr_netmask => $netmask, + nic => $nic, + ipv6_addrlabel => $ipv6_addrlabel, + location_rule => $location_rule, + tries => $pcs_tries, } pacemaker::constraint::order { "${vip_name}_vip-then-haproxy": first_resource => "ip-${ip_address}", diff --git a/manifests/profile/base/cinder/volume/dellsc.pp b/manifests/profile/base/cinder/volume/dellsc.pp index 534bcb7..ab6bbeb 100644 --- a/manifests/profile/base/cinder/volume/dellsc.pp +++ b/manifests/profile/base/cinder/volume/dellsc.pp @@ -44,6 +44,7 @@ class tripleo::profile::base::cinder::volume::dellsc ( dell_sc_api_port => hiera('cinder::backend::dellsc_iscsi::dell_sc_api_port', undef), dell_sc_server_folder => hiera('cinder::backend::dellsc_iscsi::dell_sc_server_folder', undef), dell_sc_volume_folder => hiera('cinder::backend::dellsc_iscsi::dell_sc_volume_folder', undef), + excluded_domain_ip => hiera('cinder::backend::dellsc_iscsi::excluded_domain_ip', undef), } } diff --git a/manifests/profile/base/keystone.pp b/manifests/profile/base/keystone.pp index 9aa3eb3..87f6c7f 100644 --- a/manifests/profile/base/keystone.pp +++ b/manifests/profile/base/keystone.pp @@ -172,6 +172,12 @@ class tripleo::profile::base::keystone ( if $ldap_backend_enable { validate_hash($ldap_backends_config) + if !str2bool($::selinux) { + selboolean { 'authlogin_nsswitch_use_ldap': + value => on, + persistent => true, + } + } create_resources('::keystone::ldap_backend', $ldap_backends_config, { create_domain_entry => $manage_domain, }) diff --git a/manifests/profile/base/nova.pp b/manifests/profile/base/nova.pp index b4330a9..6c097f8 100644 --- a/manifests/profile/base/nova.pp +++ b/manifests/profile/base/nova.pp @@ -67,24 +67,30 @@ # Expects a hash with keys 'private_key' and 'public_key'. # Defaults to {} # +# [*migration_ssh_localaddrs*] +# (Optional) Restrict ssh migration to clients connecting via this list of +# IPs. +# Defaults to [] (no restriction) +# # [*libvirt_tls*] # (Optional) Whether or not libvird TLS service is enabled. # Defaults to false class tripleo::profile::base::nova ( - $bootstrap_node = hiera('bootstrap_nodeid', undef), - $libvirt_enabled = false, - $manage_migration = false, - $messaging_driver = hiera('messaging_service_name', 'rabbit'), - $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), - $messaging_password = hiera('nova::rabbit_password'), - $messaging_port = hiera('nova::rabbit_port', '5672'), - $messaging_username = hiera('nova::rabbit_userid', 'guest'), - $messaging_use_ssl = hiera('nova::rabbit_use_ssl', '0'), - $nova_compute_enabled = false, - $step = hiera('step'), - $migration_ssh_key = {}, - $libvirt_tls = false + $bootstrap_node = hiera('bootstrap_nodeid', undef), + $libvirt_enabled = false, + $manage_migration = false, + $messaging_driver = hiera('messaging_service_name', 'rabbit'), + $messaging_hosts = any2array(hiera('rabbitmq_node_names', undef)), + $messaging_password = hiera('nova::rabbit_password'), + $messaging_port = hiera('nova::rabbit_port', '5672'), + $messaging_username = hiera('nova::rabbit_userid', 'guest'), + $messaging_use_ssl = hiera('nova::rabbit_use_ssl', '0'), + $nova_compute_enabled = false, + $step = hiera('step'), + $migration_ssh_key = {}, + $migration_ssh_localaddrs = [], + $libvirt_tls = false ) { if $::hostname == downcase($bootstrap_node) { $sync_db = true @@ -106,10 +112,22 @@ class tripleo::profile::base::nova ( backend => 'oslo_cache.memcache_pool', memcache_servers => $memcache_servers, } - include ::nova::placement - if $step >= 4 and $manage_migration { + class { '::nova' : + default_transport_url => os_transport_url({ + 'transport' => $messaging_driver, + 'hosts' => $messaging_hosts, + 'port' => sprintf('%s', $messaging_port), + 'username' => $messaging_username, + 'password' => $messaging_password, + 'ssl' => $messaging_use_ssl_real, + }) + } + include ::nova::placement + } + if $step >= 4 { + if $manage_migration { # Libvirt setup (live-migration) if $libvirt_tls { class { '::nova::migration::libvirt': @@ -123,49 +141,75 @@ class tripleo::profile::base::nova ( transport => 'ssh', configure_libvirt => $libvirt_enabled, configure_nova => $nova_compute_enabled, - client_user => 'nova', - client_extraparams => {'keyfile' => '/var/lib/nova/.ssh/id_rsa'} + client_user => 'nova_migration', + client_extraparams => {'keyfile' => '/etc/nova/migration/identity'} } } - if $migration_ssh_key != {} { + $services_enabled = hiera('service_names', []) + if !empty($migration_ssh_key) and 'sshd' in $services_enabled { # Nova SSH tunnel setup (cold-migration) - #TODO: Remove me when https://review.rdoproject.org/r/#/c/4008 lands - user { 'nova': - ensure => present, - shell => '/bin/bash', + # Server side + if !empty($migration_ssh_localaddrs) { + $allow_type = sprintf('LocalAddress %s User', join($migration_ssh_localaddrs,',')) + $deny_type = 'LocalAddress' + $deny_name = sprintf('!%s', join($migration_ssh_localaddrs,',!')) + + ssh::server::match_block { 'nova_migration deny': + name => $deny_name, + type => $deny_type, + order => 2, + options => { + 'DenyUsers' => 'nova_migration' + }, + notify => Service['sshd'] + } + } + else { + $allow_type = 'User' + } + $allow_name = 'nova_migration' + + ssh::server::match_block { 'nova_migration allow': + name => $allow_name, + type => $allow_type, + order => 1, + options => { + 'ForceCommand' => '/bin/nova-migration-wrapper', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + 'AuthorizedKeysFile' => '/etc/nova/migration/authorized_keys' + }, + notify => Service['sshd'] } - $private_key_parts = split($migration_ssh_key['public_key'], ' ') - $nova_public_key = { - 'type' => $private_key_parts[0], - key => $private_key_parts[1] + file { '/etc/nova/migration/authorized_keys': + content => $migration_ssh_key['public_key'], + mode => '0640', + owner => 'root', + group => 'nova_migration', + require => Package['openstack-nova-migration'], } - $nova_private_key = { - 'type' => $private_key_parts[0], - key => $migration_ssh_key['private_key'] + + # Client side + file { '/etc/nova/migration/identity': + content => $migration_ssh_key['private_key'], + mode => '0600', + owner => 'nova', + group => 'nova', + require => Package['openstack-nova-migration'], } + $migration_pkg_ensure = installed } else { - $nova_public_key = undef - $nova_private_key = undef + $migration_pkg_ensure = absent } } else { - $nova_public_key = undef - $nova_private_key = undef + $migration_pkg_ensure = absent } - - class { '::nova' : - default_transport_url => os_transport_url({ - 'transport' => $messaging_driver, - 'hosts' => $messaging_hosts, - 'port' => sprintf('%s', $messaging_port), - 'username' => $messaging_username, - 'password' => $messaging_password, - 'ssl' => $messaging_use_ssl_real, - }), - nova_public_key => $nova_public_key, - nova_private_key => $nova_private_key, + package {'openstack-nova-migration': + ensure => $migration_pkg_ensure } } } diff --git a/manifests/profile/base/pacemaker.pp b/manifests/profile/base/pacemaker.pp index c1d745a..811b911 100644 --- a/manifests/profile/base/pacemaker.pp +++ b/manifests/profile/base/pacemaker.pp @@ -136,6 +136,7 @@ class tripleo::profile::base::pacemaker ( remote_address => $remotes_hash[$title], reconnect_interval => $remote_reconnect_interval, op_params => "monitor interval=${remote_monitor_interval}", + verify_on_create => true, tries => $remote_tries, try_sleep => $remote_try_sleep, } diff --git a/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml b/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml index 800cedc..1e6c327 100644 --- a/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml +++ b/releasenotes/notes/calculate-dhcp-agents-per-network-3089c5e7b15f8b7b.yaml @@ -1,5 +1,6 @@ --- -features: | - - Unless a non-default value is provided, the dhcp_agents_per_network +features: + - | + Unless a non-default value is provided, the dhcp_agents_per_network neutron configuration variable is set to the number of deployed neutron dhcp agents. diff --git a/releasenotes/notes/cold_migration_security-1543136408c76459.yaml b/releasenotes/notes/cold_migration_security-1543136408c76459.yaml new file mode 100644 index 0000000..aaea57e --- /dev/null +++ b/releasenotes/notes/cold_migration_security-1543136408c76459.yaml @@ -0,0 +1,10 @@ +--- +features: + - | + Restrict nova migration ssh tunnel + * The ssh authorized_keys file is only writeable by root. + * Creates a new user for migration instead of using root/nova. + * Disables SSH forwarding for this user. + * Restricts the networks that this user can connect from. + * Uses an ssh wrapper command to whitelist the commands that this user can run over ssh. + Adds new parameter "tripleo::profile::base::nova::migration_ssh_localaddrs" to specify which incoming IPs are allow for SSH tunnel connections. diff --git a/spec/classes/tripleo_profile_base_nova_spec.rb b/spec/classes/tripleo_profile_base_nova_spec.rb index 9056034..31c7719 100644 --- a/spec/classes/tripleo_profile_base_nova_spec.rb +++ b/spec/classes/tripleo_profile_base_nova_spec.rb @@ -95,6 +95,9 @@ describe 'tripleo::profile::base::nova' do is_expected.to contain_class('nova::cache') is_expected.to contain_class('nova::placement') is_expected.to_not contain_class('nova::migration::libvirt') + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'absent' + ) } end @@ -128,6 +131,9 @@ describe 'tripleo::profile::base::nova' do :configure_libvirt => params[:libvirt_enabled], :configure_nova => params[:nova_compute_enabled] ) + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'absent' + ) } end @@ -162,13 +168,22 @@ describe 'tripleo::profile::base::nova' do :configure_libvirt => params[:libvirt_enabled], :configure_nova => params[:nova_compute_enabled], ) + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'absent' + ) } end context 'with step 4 with libvirt and migration ssh key' do - let(:pre_condition) { - 'include ::nova::compute::libvirt::services' - } + let(:pre_condition) do + <<-eof + include ::nova::compute::libvirt::services + class { '::ssh::server': + storeconfigs_enabled => false, + options => {} + } + eof + end let(:params) { { :step => 4, :libvirt_enabled => true, @@ -185,8 +200,8 @@ describe 'tripleo::profile::base::nova' do is_expected.to contain_class('nova').with( :default_transport_url => /.+/, :notification_transport_url => /.+/, - :nova_public_key => {'key' => 'bar', 'type' => 'ssh-rsa'}, - :nova_private_key => {'key' => 'foo', 'type' => 'ssh-rsa'} + :nova_public_key => nil, + :nova_private_key => nil, ) is_expected.to contain_class('nova::config') is_expected.to contain_class('nova::placement') @@ -196,13 +211,120 @@ describe 'tripleo::profile::base::nova' do :configure_libvirt => params[:libvirt_enabled], :configure_nova => params[:nova_compute_enabled] ) + is_expected.to contain_ssh__server__match_block('nova_migration allow').with( + :type => 'User', + :name => 'nova_migration', + :options => { + 'ForceCommand' => '/bin/nova-migration-wrapper', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + 'AuthorizedKeysFile' => '/etc/nova/migration/authorized_keys' + } + ) + is_expected.to_not contain_ssh__server__match_block('nova_migration deny') + is_expected.to contain_file('/etc/nova/migration/authorized_keys').with( + :content => 'ssh-rsa bar', + :mode => '0640', + :owner => 'root', + :group => 'nova_migration', + ) + is_expected.to contain_file('/etc/nova/migration/identity').with( + :content => 'foo', + :mode => '0600', + :owner => 'nova', + :group => 'nova', + ) + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'installed' + ) } end - context 'with step 4 with libvirt TLS and migration ssh key' do - let(:pre_condition) { - 'include ::nova::compute::libvirt::services' + context 'with step 4 with libvirt and migration ssh key and migration_ssh_localaddrs' do + let(:pre_condition) do + <<-eof + include ::nova::compute::libvirt::services + class { '::ssh::server': + storeconfigs_enabled => false, + options => {} + } + eof + end + let(:params) { { + :step => 4, + :libvirt_enabled => true, + :manage_migration => true, + :nova_compute_enabled => true, + :bootstrap_node => 'node.example.com', + :messaging_hosts => [ 'localhost' ], + :messaging_password => 'foo', + :migration_ssh_key => { 'private_key' => 'foo', 'public_key' => 'ssh-rsa bar'}, + :migration_ssh_localaddrs => ['127.0.0.1', '127.0.0.2'] + } } + + it { + is_expected.to contain_class('tripleo::profile::base::nova') + is_expected.to contain_class('nova').with( + :default_transport_url => /.+/, + :notification_transport_url => /.+/, + :nova_public_key => nil, + :nova_private_key => nil, + ) + is_expected.to contain_class('nova::config') + is_expected.to contain_class('nova::placement') + is_expected.to contain_class('nova::cache') + is_expected.to contain_class('nova::migration::libvirt').with( + :transport => 'ssh', + :configure_libvirt => params[:libvirt_enabled], + :configure_nova => params[:nova_compute_enabled] + ) + is_expected.to contain_ssh__server__match_block('nova_migration allow').with( + :type => 'LocalAddress 127.0.0.1,127.0.0.2 User', + :name => 'nova_migration', + :options => { + 'ForceCommand' => '/bin/nova-migration-wrapper', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + 'AuthorizedKeysFile' => '/etc/nova/migration/authorized_keys' + } + ) + is_expected.to contain_ssh__server__match_block('nova_migration deny').with( + :type => 'LocalAddress', + :name => '!127.0.0.1,!127.0.0.2', + :options => { + 'DenyUsers' => 'nova_migration' + } + ) + is_expected.to contain_file('/etc/nova/migration/authorized_keys').with( + :content => 'ssh-rsa bar', + :mode => '0640', + :owner => 'root', + :group => 'nova_migration', + ) + is_expected.to contain_file('/etc/nova/migration/identity').with( + :content => 'foo', + :mode => '0600', + :owner => 'nova', + :group => 'nova', + ) + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'installed' + ) } + end + + context 'with step 4 with libvirt TLS and migration ssh key' do + let(:pre_condition) do + <<-eof + include ::nova::compute::libvirt::services + class { '::ssh::server': + storeconfigs_enabled => false, + options => {} + } + eof + end let(:params) { { :step => 4, :libvirt_enabled => true, @@ -220,8 +342,8 @@ describe 'tripleo::profile::base::nova' do is_expected.to contain_class('nova').with( :default_transport_url => /.+/, :notification_transport_url => /.+/, - :nova_public_key => {'key' => 'bar', 'type' => 'ssh-rsa'}, - :nova_private_key => {'key' => 'foo', 'type' => 'ssh-rsa'} + :nova_public_key => nil, + :nova_private_key => nil, ) is_expected.to contain_class('nova::config') is_expected.to contain_class('nova::placement') @@ -231,6 +353,33 @@ describe 'tripleo::profile::base::nova' do :configure_libvirt => params[:libvirt_enabled], :configure_nova => params[:nova_compute_enabled] ) + is_expected.to contain_ssh__server__match_block('nova_migration allow').with( + :type => 'User', + :name => 'nova_migration', + :options => { + 'ForceCommand' => '/bin/nova-migration-wrapper', + 'PasswordAuthentication' => 'no', + 'AllowTcpForwarding' => 'no', + 'X11Forwarding' => 'no', + 'AuthorizedKeysFile' => '/etc/nova/migration/authorized_keys' + } + ) + is_expected.to_not contain_ssh__server__match_block('nova_migration deny') + is_expected.to contain_file('/etc/nova/migration/authorized_keys').with( + :content => 'ssh-rsa bar', + :mode => '0640', + :owner => 'root', + :group => 'nova_migration', + ) + is_expected.to contain_file('/etc/nova/migration/identity').with( + :content => 'foo', + :mode => '0600', + :owner => 'nova', + :group => 'nova', + ) + is_expected.to contain_package('openstack-nova-migration').with( + :ensure => 'installed' + ) } end diff --git a/spec/fixtures/hieradata/default.yaml b/spec/fixtures/hieradata/default.yaml index 94d2b28..7e6c177 100644 --- a/spec/fixtures/hieradata/default.yaml +++ b/spec/fixtures/hieradata/default.yaml @@ -36,3 +36,4 @@ memcached_node_ips_v6: memcached_node_ips: - '127.0.0.1' horizon::secret_key: 'secrete' +service_names: ['sshd'] |