diff options
| author |   Morgan Richomme <morgan.richomme@orange.com> | 2016-07-06 15:36:10 +0000 |
|---|---|---|
| committer |   Gerrit Code Review <gerrit@172.30.200.206> | 2016-07-06 15:36:10 +0000 |
| commit | e7db19964ae5137ccbec4b39a09a52e19241d32e (patch) | |
| tree | d6982ad90dbc2c0f58fd9ac0eea66d8285b0e19b | |
| parent | c92a48a163a7161874cfb01edcf79e6a721985ba (diff) | |
| parent | 5eabccc1ed6d050cd5ce24944346a1128e49b9f5 (diff) | |
Merge "Adding security_scan section to functest userguide."
| -rw-r--r-- | docs/userguide/index.rst | 30 |
1 files changed, 29 insertions, 1 deletions
diff --git a/docs/userguide/index.rst b/docs/userguide/index.rst index ea2679764..327a1756b 100644 --- a/docs/userguide/index.rst +++ b/docs/userguide/index.rst @@ -388,9 +388,35 @@ the OpenStack 'bgpvpn' API: security_scan ^^^^^^^^^^^^^ -**TODO:** +Security Scanning, is a project to insure security compliance and vulnerability +checks, as part of an automated CI / CD platform delivery process. + +The project makes use of the existing SCAP format[6] to perform deep scanning of +NFVi nodes, to insure they are hardened and free of known CVE reported vulnerabilities. + +The SCAP content itself, is then consumed and run using an upstream opensource tool +known as OpenSCAP[7]. + +The OPNFV Security Group have developed the code that will called by the OPNFV Jenkins +build platform, to perform a complete scan. Resulting reports are then copied to the +OPNFV functest dashboard. + +The current work flow is as follows: + * Jenkins Build Initiated + * security_scan.py script is called, and a config file is passed to the script as + an argument. + * The IP addresses of each NFVi node (compute / control), is gathered. + * A scan profile is matched to the node type. + * The OpenSCAP application is remotely installed onto each target node gathered + on step 3, using upstream packaging (rpm and .deb). + * A scan is made against each node gathered within step 3. + * HTML Reports are downloaded for rendering on a dashboard. + * If the config file value 'clean' is set to 'True' then the application installed in + step 5 is removed, and all reports created at step 6 are deleted. +At present, only the Apex installer is supported, with support for other installers due +within D-release. VNF --- @@ -449,6 +475,8 @@ References .. _`[3]`: https://rally.readthedocs.org/en/latest/index.html .. _`[4]`: http://events.linuxfoundation.org/sites/events/files/slides/Functest%20in%20Depth_0.pdf .. _`[5]`: https://github.com/Orange-OpenSource/opnfv-cloudify-clearwater/blob/master/openstack-blueprint.yaml +.. _`[6]`: https://scap.nist.gov/ +.. _`[7]`: https://github.com/OpenSCAP/openscap .. _`[9]`: https://git.opnfv.org/cgit/functest/tree/testcases/VIM/OpenStack/CI/libraries/os_defaults.yaml .. _`[11]`: http://robotframework.org/ |