| *** bpokorny has quit IRC | 00:01 | |
| *** bpokorny has joined #openstack-security | 00:02 | |
| *** hongbin has quit IRC | 00:02 | |
| *** bpokorny has quit IRC | 00:07 | |
| *** ayoung has quit IRC | 00:07 | |
| *** lamt has quit IRC | 00:14 | |
| *** jamielennox is now known as jamielennox|away | 00:17 | |
| *** jamielennox|away is now known as jamielennox | 00:23 | |
| *** ayoung has joined #openstack-security | 00:28 | |
| *** diazjf has joined #openstack-security | 00:33 | |
| *** bpokorny has joined #openstack-security | 00:38 | |
| *** bpokorny has quit IRC | 00:42 | |
| *** bpokorny has joined #openstack-security | 00:42 | |
| *** ccneill has quit IRC | 00:43 | |
| *** bpokorny has quit IRC | 00:45 | |
| *** bpokorny has joined #openstack-security | 00:45 | |
| *** jamielennox is now known as jamielennox|away | 00:46 | |
| *** jamielennox|away is now known as jamielennox | 00:53 | |
| *** ccneill has joined #openstack-security | 01:01 | |
| *** dave-mccowan has joined #openstack-security | 01:24 | |
| *** ccneill has quit IRC | 01:25 | |
| *** bpokorny_ has joined #openstack-security | 01:33 | |
| *** bpokorny has quit IRC | 01:37 | |
| *** bpokorny_ has quit IRC | 01:38 | |
| *** browne has quit IRC | 01:50 | |
| *** diazjf has quit IRC | 02:02 | |
| *** knangia has quit IRC | 02:04 | |
| *** dave-mccowan has quit IRC | 02:20 | |
| *** dave-mccowan has joined #openstack-security | 02:29 | |
| *** yuanying_ has quit IRC | 02:48 | |
| *** yuanying has joined #openstack-security | 02:52 | |
| *** jamielennox is now known as jamielennox|away | 03:11 | |
| *** diazjf has joined #openstack-security | 03:12 | |
| *** diazjf has quit IRC | 03:16 | |
| *** browne has joined #openstack-security | 03:17 | |
| *** browne has quit IRC | 03:18 | |
| *** jamielennox|away is now known as jamielennox | 03:20 | |
| *** browne has joined #openstack-security | 03:22 | |
| *** dave-mccowan has quit IRC | 03:28 | |
| *** jamielennox is now known as jamielennox|away | 03:30 | |
| *** jamielennox|away is now known as jamielennox | 03:37 | |
| *** yuanying has quit IRC | 03:44 | |
| *** browne has quit IRC | 03:47 | |
| *** openstackgerrit has joined #openstack-security | 05:03 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/anchor: Updated from global requirements https://review.openstack.org/380554 | 05:03 |
|---|---|---|
| *** diazjf has joined #openstack-security | 05:14 | |
| *** gouthamr has joined #openstack-security | 05:43 | |
| *** gouthamr has quit IRC | 06:05 | |
| *** diazjf has quit IRC | 06:20 | |
| *** gouthamr has joined #openstack-security | 06:23 | |
| *** openstackgerrit has quit IRC | 06:33 | |
| *** jamielennox is now known as jamielennox|away | 07:18 | |
| *** edaught has quit IRC | 07:32 | |
| *** rcernin has joined #openstack-security | 07:40 | |
| *** jamielennox|away is now known as jamielennox | 07:44 | |
| *** Serlex has joined #openstack-security | 08:31 | |
| *** Serlex has quit IRC | 09:25 | |
| *** tkelsey has joined #openstack-security | 09:36 | |
| *** shohel has joined #openstack-security | 09:42 | |
| *** tkelsey has quit IRC | 09:48 | |
| *** rcernin has quit IRC | 09:49 | |
| *** rcernin has joined #openstack-security | 09:50 | |
| *** jerlique has joined #openstack-security | 10:04 | |
| *** tesseract has joined #openstack-security | 10:27 | |
| *** tesseract is now known as Guest79986 | 10:27 | |
| *** Serlex has joined #openstack-security | 10:33 | |
| *** openstackgerrit has joined #openstack-security | 11:32 | |
| openstackgerrit | OpenStack Proposal Bot proposed openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/406074 | 11:32 |
| *** rcernin has quit IRC | 12:12 | |
| *** rcernin has joined #openstack-security | 12:15 | |
| openstackgerrit | Merged openstack/security-doc: Updated from openstack-manuals https://review.openstack.org/406074 | 12:30 |
| *** shohel has quit IRC | 12:49 | |
| *** liverpooler has joined #openstack-security | 13:03 | |
| *** rcernin has quit IRC | 13:06 | |
| *** rcernin has joined #openstack-security | 13:08 | |
| *** lamt has joined #openstack-security | 13:17 | |
| *** shohel has joined #openstack-security | 13:20 | |
| *** dave-mccowan has joined #openstack-security | 13:20 | |
| *** dave-mcc_ has joined #openstack-security | 13:32 | |
| *** _elmiko is now known as elmiko | 13:33 | |
| *** dave-mccowan has quit IRC | 13:35 | |
| *** liverpooler has quit IRC | 14:19 | |
| *** rcernin has quit IRC | 14:33 | |
| *** liverpooler has joined #openstack-security | 14:38 | |
| *** rcernin has joined #openstack-security | 14:41 | |
| *** jamielennox is now known as jamielennox|away | 14:45 | |
| *** gouthamr_ has joined #openstack-security | 14:48 | |
| *** edmondsw_ has joined #openstack-security | 14:49 | |
| *** gouthamr has quit IRC | 14:49 | |
| *** edmondsw_ has quit IRC | 14:50 | |
| *** rcernin has quit IRC | 14:55 | |
| *** rcernin has joined #openstack-security | 14:58 | |
| *** dave-mcc_ has quit IRC | 14:58 | |
| *** dave-mccowan has joined #openstack-security | 15:11 | |
| *** edmondsw has joined #openstack-security | 15:18 | |
| *** shohel has quit IRC | 15:19 | |
| *** cleong has joined #openstack-security | 15:22 | |
| *** i13487492 has joined #openstack-security | 15:29 | |
| *** i13487492 has left #openstack-security | 15:30 | |
| *** openstackgerrit has quit IRC | 15:33 | |
| *** xin9972 has joined #openstack-security | 15:35 | |
| *** hongbin has joined #openstack-security | 15:39 | |
| *** tkelsey has joined #openstack-security | 15:43 | |
| *** mvaldes has joined #openstack-security | 15:44 | |
| *** edmondsw has quit IRC | 15:49 | |
| *** Guest79986 has quit IRC | 15:54 | |
| *** ccneill has joined #openstack-security | 16:04 | |
| *** rcernin has quit IRC | 16:05 | |
| *** jmckind has joined #openstack-security | 16:26 | |
| *** nkinder has quit IRC | 16:34 | |
| *** bpokorny has joined #openstack-security | 16:35 | |
| *** Serlex has quit IRC | 16:36 | |
| *** ccneill has quit IRC | 16:36 | |
| *** gouthamr_ has quit IRC | 16:37 | |
| *** gouthamr has joined #openstack-security | 16:37 | |
| *** ccneill has joined #openstack-security | 16:38 | |
| *** gouthamr has quit IRC | 16:41 | |
| *** gouthamr has joined #openstack-security | 16:41 | |
| *** diazjf has joined #openstack-security | 16:42 | |
| *** diazjf has quit IRC | 16:43 | |
| *** diazjf has joined #openstack-security | 16:44 | |
| *** rcernin has joined #openstack-security | 16:45 | |
| *** nkinder has joined #openstack-security | 16:47 | |
| *** tkelsey has quit IRC | 17:06 | |
| *** mdong has joined #openstack-security | 17:06 | |
| *** bpokorny has quit IRC | 17:12 | |
| *** bpokorny has joined #openstack-security | 17:13 | |
| *** bpokorny has quit IRC | 17:17 | |
| *** bpokorny has joined #openstack-security | 17:22 | |
| *** openstackgerrit has joined #openstack-security | 17:27 | |
| *** edaught has joined #openstack-security | 17:28 | |
| *** xin99721 has joined #openstack-security | 17:31 | |
| *** xin9972 has quit IRC | 17:31 | |
| *** xin99721 has quit IRC | 17:33 | |
| *** xin9972 has joined #openstack-security | 17:34 | |
| *** gouthamr has quit IRC | 17:44 | |
| *** gouthamr has joined #openstack-security | 17:44 | |
| *** rcernin has quit IRC | 17:45 | |
| *** rcernin has joined #openstack-security | 17:46 | |
| *** diazjf has quit IRC | 18:13 | |
| *** gouthamr_ has joined #openstack-security | 18:16 | |
| *** gouthamr has quit IRC | 18:17 | |
| *** knangia has joined #openstack-security | 18:19 | |
| *** JAHoagie has joined #openstack-security | 18:19 | |
| *** JAHoagie has quit IRC | 18:19 | |
| *** liverpooler is now known as the_dark_lord_mo | 18:52 | |
| *** the_dark_lord_mo is now known as liverpooler | 18:52 | |
| *** diazjf has joined #openstack-security | 19:16 | |
| *** mvaldes has quit IRC | 19:31 | |
| *** mvaldes has joined #openstack-security | 19:31 | |
| *** serverascode has quit IRC | 19:34 | |
| *** jraim has quit IRC | 19:34 | |
| *** johnsom has quit IRC | 19:34 | |
| *** mvaldes1 has joined #openstack-security | 19:36 | |
| *** mvaldes has quit IRC | 19:37 | |
| *** edtubill has joined #openstack-security | 19:37 | |
| openstackgerrit | Rahul U Nair proposed openstack/syntribos: Removing download count shield https://review.openstack.org/406323 | 19:38 |
| *** diazjf has quit IRC | 19:39 | |
| *** bpokorny has quit IRC | 19:42 | |
| *** bpokorny has joined #openstack-security | 19:42 | |
| *** gouthamr_ has quit IRC | 19:42 | |
| *** jraim has joined #openstack-security | 19:43 | |
| *** gouthamr has joined #openstack-security | 19:44 | |
| *** diazjf has joined #openstack-security | 19:46 | |
| *** bpokorny has quit IRC | 19:46 | |
| *** serverascode has joined #openstack-security | 19:50 | |
| *** cleong has quit IRC | 19:54 | |
| *** cleong has joined #openstack-security | 19:54 | |
| openstackgerrit | Rahul U Nair proposed openstack/security-doc: Removing an extra space after fullstop https://review.openstack.org/406330 | 19:55 |
| *** johnsom has joined #openstack-security | 20:19 | |
| *** diazjf has quit IRC | 20:30 | |
| dotplus | I'm having a bit of trouble getting syntribos configured. I'm using a config file: http://paste.openstack.org/show/KrmfiUMLRBWMmDB6Qdfv/ that seems pretty minimal and is based right off the doc. If I do `syntribos --config-file venv/.syntribos/identity.conf list_tests`, it lists all the tests happily. but if I run try to run/dry_run, syntribos complains "was not initialized". | 20:30 |
| dotplus | have I missed something? | 20:30 |
| *** diazjf has joined #openstack-security | 20:32 | |
| *** knangia has quit IRC | 20:34 | |
| mdong | I can help with that! Syntribos requires that you initialize it before running, which can be done by just running “syntribos init” from the command line before running | 20:34 |
| mdong | see https://github.com/openstack/syntribos#initializing-the-syntribos-environment for the documentation on this part | 20:34 |
| dotplus | yes, I know that. init is to create the structure, & download payloads/templates. But I'm in an isolated CI environment, so that's not possible. syntribos allows you to set it all up manually, which is what I have done. | 20:36 |
| unrahul | Did you download syntribos from pypi or from github ? | 20:38 |
| dotplus | pypi. 0.3.0 | 20:38 |
| dotplus | am I hitting a known and/or fixed problem? that means I need head of master? | 20:38 |
| unrahul | so are you running syntribos from the .syntribos dir inside ur virtualenv or from you home dir ? | 20:39 |
| dotplus | inside the venv | 20:39 |
| mdong | when you initialized Syntribos, did you supply a custom install root? | 20:39 |
| mdong | or did you follow the default prompts | 20:40 |
| dotplus | I *didn't* init, because I need to lay down specific config. | 20:40 |
| *** bpokorny has joined #openstack-security | 20:43 | |
| *** mvaldes1 has quit IRC | 20:43 | |
| dotplus | I have replicated what init would have done. | 20:43 |
| mdong | Gotcha. Supply the directories you created with the —custom_install_root flag | 20:44 |
| mdong | and that should be enough | 20:44 |
| mdong | or actually, to run it, it would be the --syntribos-custom_root flag | 20:44 |
| mdong | or add “custom_root=<whatever>” to your config file in the [syntribos] section | 20:46 |
| dotplus | but what is the custom root in my example venv/.syntribos? | 20:46 |
| unrahul | so I created a virtulenv, install syntribos, created a `.syntribos` dir, syntribos.conf file, templates, payloads dirs etc inside the virtenv and was able to run syntribos | 20:46 |
| *** bpokorny has quit IRC | 20:47 | |
| mdong | yep! the path to your .syntribos folder should do it | 20:47 |
| unrahul | it would be the path of your venv dir | 20:47 |
| *** mvaldes has joined #openstack-security | 20:48 | |
| dotplus | unrahul: in your example, the syntribos.conf file, templates, payloads dirs etc should be inside venv/.syntribos/ ? | 20:51 |
| unrahul | yes | 20:51 |
| dotplus | ok, I'll go verify. thanks | 20:51 |
| unrahul | sure, let us know if you have any trouble | 20:51 |
| dotplus | um. does it have to be called 'syntribos.conf'? I going to be testing various endpoints, so I have identoty.conf, network.conf, compute.conf, etc. | 21:13 |
| *** gouthamr has quit IRC | 21:14 | |
| unrahul | you could call the file anything | 21:14 |
| unrahul | provided you explicit call the config file | 21:14 |
| unrahul | syntribos --config-file file_name {command} | 21:14 |
| dotplus | I had a quick glance through utils/env.py and it looks like the is_syntribos_initialized() method is looking for FILE | 21:15 |
| dotplus | yeah, that's what I had originally | 21:15 |
| unrahul | also, as long as you have explicitly provided the file paths to all dirs (templates, payloads, logs etc) it should be fine where ever the locations are | 21:15 |
| unrahul | ha.. | 21:15 |
| unrahul | which env are you using? Ubuntu ? | 21:15 |
| dotplus | RHEL7 | 21:16 |
| dotplus | what looks suspicious to me is that list_tests can succeed, but [dry_]run cannot. | 21:17 |
| unrahul | mm... let me see if I can recreate the env in my local | 21:17 |
| dotplus | I'm wondering whether the initialization test is bogus/broken | 21:18 |
| unrahul | mdong: any thoughts ? | 21:18 |
| unrahul | dotplus: it works well on mac/debain based machines and a few other that we had tested.. | 21:18 |
| mdong | list_tests doesn’t call is_syntribos_initialized(), so that would be why list_tests works and run doesn't | 21:18 |
| mdong | but Syntribos expects to find a folder where it wants to install them, if you want to point Syntribos somewhere else, you’d need to supply that to the —syntribos-custom_root flag | 21:19 |
| dotplus | right. https://github.com/openstack/syntribos/blob/master/syntribos/utils/env.py#L281 is the only way for the init check to return True. but I'm not using a filename that is the same as get_default_conf_file | 21:20 |
| mdong | ah | 21:20 |
| unrahul | so it seems the file has to be named syntribos.conf , I missed that part | 21:24 |
| dotplus | Should that line 281 be 'if os.path.exists(thecli_specified_conf_file):'? | 21:24 |
| mdong | as a sanity check, if you just create an empty file called “syntribos.conf”, it should work | 21:26 |
| unrahul | I guess you could do a simlink for now to the config file, depending upon which conf you want to use.. ¯\_(ツ)_/¯ | 21:26 |
| mdong | to satisfy the initialization check, but otherwise you should be able to reference whatever config file you want on the command line | 21:26 |
| mdong | it looks like the initialization check is just checking for the existence of the file in the syntribos root directory | 21:26 |
| dotplus | ew. | 21:27 |
| unrahul | yup meanwhile we will fix this and push an update | 21:27 |
| dotplus | but yes, that works | 21:27 |
| dotplus | I can submit a patch to gerrit if you want | 21:28 |
| dotplus | btw, thanks for your assistance, both of you. nice to get verification I'm not crazy | 21:39 |
| *** edtubill has quit IRC | 21:39 | |
| dotplus | presumably somewhere in the data available to env.py is a var that contains the value of --config-file? | 21:40 |
| unrahul | :) , we welcome it, If you can submit the patch, we shall verify it and merge it | 21:41 |
| *** diazjf has quit IRC | 21:41 | |
| unrahul | the config-file is stored in the CONF object, we are using oslo_config to manage our configuration values | 21:41 |
| *** jmckind has quit IRC | 21:42 | |
| mdong | thanks for using syntribos! it’s obviously a work-in-progress so any bugs that are brought to our attention are much appreciated! | 21:42 |
| dotplus | ok, I'll dig and pick it out of there. | 21:42 |
| mdong | and the value you’re looking for is CONF.config_file | 21:42 |
| unrahul | +1 | 21:42 |
| dotplus | this might take me a bit, because it will be my first OS patch. And while my broader team is working on OS heavily, I'm focussed on our tooling/infra. | 21:43 |
| *** bpokorny has joined #openstack-security | 21:43 | |
| unrahul | nice, just curious what are using syntribos for ? internal testing of openstack? | 21:44 |
| mdong | but we also allow for a —config-dir option, so the line should probably read “if os.path.exists(get_default_conf_file()) or CONF.config_file or CONF.config-dir” | 21:44 |
| dotplus | unrahul: I work for Cisco Metacloud. | 21:45 |
| dotplus | so "sort of internal" | 21:45 |
| unrahul | cool, let us know what you think, every feedback at this stage would help | 21:46 |
| mdong | +1 ^ | 21:46 |
| dotplus | I'm just building/improving CI infra at the moment, so I'm not the person who will actually *use* syntribos or even look at the reports/results. I'm just getting ready for those who will wants jobs automated. | 21:48 |
| *** bpokorny has quit IRC | 21:48 | |
| dotplus | but, absolutely, in time, I'm sure some of our infosec folk will want to get deeper involved | 21:49 |
| mdong | Oh, that | 21:49 |
| unrahul | cool.. making syntribos CI friendly is one of our short term goals, so let us know if you see any specific things that you would like to see in syntribos .. we could start a discussion | 21:49 |
| mdong | that’s awesome*! using syntribos as part of CICD is one of our goals so it’s great to hear! | 21:49 |
| dotplus | ok | 21:49 |
| *** diazjf has joined #openstack-security | 21:55 | |
| dotplus | so apart from this bug the first feedback I have is that I'd like to see the templates and payloads come from the same place as the software - they are an integral part. I know you're trying to make syntribos non-openstack-specific and that's great. But I think "community-sourced" payloads/templates for openstack projects (and for anything else anyone wants to create) could still come from github.com/openstack/syntribos | 21:56 |
| unrahul | yup.. this is a temporary measure, we are moving to official templates and payloads repos for openstack in a few days | 21:57 |
| dotplus | ah ok. | 21:58 |
| unrahul | it would be under github.com/openstack/openstack-templates | 21:58 |
| unrahul | and github.com/openstack/openstack-payloads | 21:58 |
| unrahul | this would allow us to easily package the tool and keep the `non-code` part of the tool on separate repos | 21:59 |
| unrahul | and github.com/openstack/syntrobos-openstack-payloads* | 21:59 |
| unrahul | it would be under github.com/openstack/syntribos-openstack-templates | 21:59 |
| dotplus | that makes more sense, I assumed it was a typo:) | 21:59 |
| unrahul | +1 :) | 22:00 |
| dotplus | since syntribos doesn't actually know anything about the endpoint except what the payload/templates "teach" it, I need to ensure that I point syntribos at say, nova specific payloads/templates when I'm testing nova? or does it somehow work out how to ignore data for cinder/glance/whatever when testing nove? | 22:01 |
| mdong | the former, nothing in syntribos stops you from pointing glance payloads at nova endpoints | 22:03 |
| *** bpokorny has joined #openstack-security | 22:04 | |
| *** bpokorny has quit IRC | 22:04 | |
| dotplus | put more succintly: do I need to set templates=openstack-templates-master/templates/nova or just to openstack-templates-master/templates/ ? | 22:04 |
| *** bpokorny has joined #openstack-security | 22:04 | |
| dotplus | I haven't even looked at payloads/templates and don't really know what the distinction it. I mean, I get that they are "data required to attack API endpoints", but that's about it | 22:05 |
| *** bpokorny has quit IRC | 22:09 | |
| mdong | if you’re just testing nova, it would be templates=openstack-templates-master/templates/nova | 22:10 |
| dotplus | got it. I was planning on having a separate config-file for each endpoint and running separate scans as individual Jenkins jobs | 22:11 |
| mdong | template are basically HTTP requests for an API endpoint, the payload is what syntribos injects into the the request | 22:11 |
| *** bpokorny has joined #openstack-security | 22:16 | |
| *** cleong has quit IRC | 22:18 | |
| *** jamielennox|away is now known as jamielennox | 22:22 | |
| *** edtubill has joined #openstack-security | 22:23 | |
| *** mvaldes has quit IRC | 22:36 | |
| *** elmiko is now known as _elmiko | 22:37 | |
| *** bpokorny has quit IRC | 22:41 | |
| *** bpokorny has joined #openstack-security | 22:42 | |
| *** bpokorny has quit IRC | 22:47 | |
| *** edtubill has quit IRC | 22:47 | |
| *** dave-mccowan has quit IRC | 22:55 | |
| *** xin9972 has quit IRC | 23:04 | |
| *** dave-mccowan has joined #openstack-security | 23:16 | |
| *** lamt has quit IRC | 23:23 | |
| *** hongbin has quit IRC | 23:26 | |
| *** diazjf has quit IRC | 23:29 | |
| ccneill | some light reading for a Friday: dozens of appsec security resources :) https://github.com/cneill/appsec-resources | 23:34 |
| *** bpokorny has joined #openstack-security | 23:41 | |
| *** ccneill has quit IRC | 23:51 | |
| *** ccneill has joined #openstack-security | 23:52 | |
| *** ccneill has quit IRC | 23:57 | |
Generated by irclog2html.py 2.14.0 by Marius Gedminas - find it at mg.pov.lt!