18:00:39 <bdpayne> #startmeeting OpenStack Security Group 18:00:39 <openstack> Meeting started Thu Apr 24 18:00:39 2014 UTC and is due to finish in 60 minutes. The chair is bdpayne. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:40 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:00:43 <openstack> The meeting name has been set to 'openstack_security_group' 18:00:47 <bdpayne> greetings everyone 18:00:51 <ScottCarlsonPP> Hello 18:00:54 <bknudson> bdpayne: hi 18:01:01 <bdpayne> #topic Rollcall 18:01:03 <shohel02> hi 18:01:07 <nkinder> hi all 18:01:07 <bknudson> hi 18:01:08 <paulmo> Paul Montgomery 18:01:08 <torandu> part 18:01:09 <malini1> hello! 18:01:22 <ScottCarlsonPP> Scott @ PayPal 18:01:23 * hyakuhei here :D 18:01:32 <hyakuhei> Hey malini1 ! 18:01:47 <bdpayne> hi everyone, thanks for joining today 18:01:48 <jasonhullinger> and here 18:01:51 <bdpayne> #topic Agenda 18:02:04 <bdpayne> Anything that people would like to add to the agenda today? 18:02:04 <hgedikli> here 18:02:12 <chair6> howdy 18:02:13 <natedmac> her 18:02:15 <natedmac> here* 18:02:38 <hyakuhei> Busy one today. I don't have much to update - other than I'm working on an update to the guide 18:02:57 <bdpayne> I can provide a brief status update on the book 18:02:57 <hyakuhei> Has anything happened in the threat analysis this week? 18:03:07 <shohel02> yes, 18:03:22 <bdpayne> ok, so we can talk about the threat analysis work too 18:03:28 <shohel02> we had a new template, not much outside 18:03:35 <bdpayne> and we should do a review of open OSSNs 18:03:51 <bdpayne> anything else? 18:03:57 <CristianF> Hi Everybody 18:04:08 <bdpayne> ok, let's dive in 18:04:19 <bdpayne> #topic Book updates 18:04:32 <bdpayne> So I've started coordinating the book update efforts 18:04:44 <hyakuhei> Cool! Man it hurts to edit this xml. 18:04:44 <bdpayne> Right now I'm taking a little time to assess what needs to happen 18:04:56 <bdpayne> If anyone has specific asks, please let me know 18:04:59 <bknudson> it shouldn't be painful to write docs 18:05:03 <bdpayne> either here, or just by email 18:05:08 <bknudson> is it the tool? 18:05:22 <bdpayne> The xml isn't bad... he just likes to complain ;-) 18:05:26 <hyakuhei> So there's probably a good tool to use but editing the files directly... 18:05:36 <hyakuhei> Hurts my (small) brain. 18:05:37 <bdpayne> it is all in docbook 18:05:40 <nkinder> ...speaking of XML, I do want to talk about OSSN format 18:05:46 <ScottCarlsonPP> @bdpayne we'd like to start to provide enterprise guidance around PCI and compliance, should we consider that part of the book or separate white paperish thing. 18:05:48 <bdpayne> sure, we can talk OSSN in a few 18:06:11 <bdpayne> ScottCarlsonPP that would be a nice addition to the compliance section of the book 18:06:24 <malini1> bdpayne: need to make references to the glossay in the book text 18:06:36 <bdpayne> perhaps you can send me an email to coordinate moving ahead on that contribution? 18:07:00 <bdpayne> #action references the references in the book 18:07:00 <ScottCarlsonPP> bdpayne will do 18:07:27 <hyakuhei> ScottCarlsonPP: There's plenty that can be added to the existing compliance section too, especially around PCI 18:07:30 <bdpayne> #action ScottCarlsonPP to contact bdpayne about compliance updates in the book (PCI and enterprise compliance) 18:07:47 <bdpayne> #action bdpayne to review state of glossary and references in the book 18:08:10 <malini1> what is everyone's feeling around: http://summit.openstack.org/cfp/details/8, "signing messages" to improve security of the rpc 18:08:16 <bdpayne> hyakuhei did you mention you have a book update that you're working on? 18:08:34 <bdpayne> malini1 let's discuss that at the end 18:08:46 <bdpayne> I'd like to keep us focused on the current agenda item atm 18:09:10 <malini1> :-) yes 18:09:12 <hyakuhei> yeah just this https://bugs.launchpad.net/openstack-manuals/+bug/1311204 18:09:13 <uvirtbot> Launchpad bug 1311204 in openstack-manuals "Security Guide should discuss KSM impact" [High,Triaged] 18:09:39 <bdpayne> ah fantastic 18:09:46 <bdpayne> let me know when you are ready for reviews there 18:10:01 <hyakuhei> Will do, it'll need a few iterations of review, the writing is pretty crappy 18:10:01 <bdpayne> #action hyakuhei is working on https://bugs.launchpad.net/openstack-manuals/+bug/1311204 18:10:20 <bdpayne> np 18:10:25 <bdpayne> any other book discussion today? 18:10:36 <nkinder> my OSSN format stuff fits in with the book 18:10:45 <bdpayne> #topic Moving to OSSN 18:10:55 <bdpayne> ok, let's cover some OSSN stuff 18:11:05 <nkinder> I've been playing around with the best way to get the OSSNs to be published in an appendix of the book 18:11:32 <nkinder> This is going to require docbook XML, and that may just be the right format to write and commit them in 18:11:49 <bdpayne> perhaps 18:12:01 <bdpayne> certainly the easiest 18:12:06 <nkinder> There is a docbook "article" type, and I've manually converted one note to try it out 18:12:13 <nkinder> not the easiest for sure 18:12:14 <bdpayne> otherwise, we could translate from a slightly less structured format into docbook 18:12:21 <nkinder> ...but, we need to have ways to translate 18:12:38 <bdpayne> if we play it right, the docbook could then be converted into all of the formats that we need / want 18:12:38 <nkinder> we can use RST and translate to XML possibly too 18:12:39 <shohel02> nkinder: OSSN currently in markdown format , it should be easy to covert docbook? 18:12:47 <bknudson> nkinder: can you post the docbook example somewhere? 18:12:54 <bknudson> e.g., gerrit 18:13:08 <bdpayne> http://johnmacfarlane.net/pandoc/ 18:13:20 <bdpayne> ^^ converts from docbook to markdown and back again 18:13:21 <nkinder> bknudson: I haven't yet, but I can. I was still hashing through details with anne 18:13:39 <nkinder> bdpayne: ok, I'll take a look at that. I would prefer to edit in markdown or RST or something other than XML 18:13:56 <bdpayne> so I would say either switch to docbook or explore tools to automate the conversion from markdown... if the later then we should validate that conversion using gerrit 18:14:04 <nkinder> the gate jobs can then ensure that convert properly, and publishing can convert and publish 18:14:14 <bdpayne> nkinder, yes I agree and I think that sticking with markdown is a good idea 18:14:20 <bdpayne> exactly 18:14:44 <bdpayne> #action nkinder to explore conversion from markdown to docbook using the gate jobs 18:14:46 <nkinder> I'll continue to hash out the right docbook end result with anne, then will figure out how we can translate 18:14:52 <shohel02> thats would be great 18:14:57 <bdpayne> so getting it in docbook is step1 18:15:07 <bdpayne> any thoughts on how to go from there to actually having it in the book appendix? 18:15:15 <nkinder> If we auto publish to the book, do we even need to publish on the wiki? 18:15:16 <shohel02> i am currently coverting doc and xls to markdown format 18:15:37 <nkinder> bdpayne: well, that's part of what I'm discussing with Anne. There are ways to do an include, but we need to hash out the details. 18:15:39 <bdpayne> I think that putting it on the wiki is handy 18:16:00 <bdpayne> but we should balance that against the amount of manual work 18:16:03 <nkinder> but the docs are on the wiki too 18:16:11 <bdpayne> ideally, I'd like an approved OSSN to auto publish to all the right places 18:16:32 <malini1> +1 to also have on wiki instead of having to download full book 18:16:33 <nkinder> We would have to see what sort of auto wiki publishing is available. Next steps after the book. 18:16:37 <bdpayne> right but I'm not sure if people will look into the back of the book to find an OSSN 18:16:55 <nkinder> We still need to e-mail them out regardless 18:17:12 <bdpayne> #action nkinder to continue to explore right path for integration of OSSNs into book appendix 18:17:13 <bknudson> hopefully there's a docbook rendering to text 18:17:31 <bdpayne> we render to html and to pdf by default 18:17:40 <bdpayne> but docbook can render to lots of different formats 18:17:48 <nkinder> bknudson: or markdown to text if we write in markdown 18:17:57 <nkinder> ok, I have lots to explore here :) 18:18:01 <bdpayne> indeed 18:18:05 <bdpayne> thanks for taking this on nkinder 18:18:08 <nkinder> sure 18:18:16 <bdpayne> are there any open OSSNs at this point? 18:18:18 <hyakuhei> +1 - very useful 18:18:21 <nkinder> There are 2 18:18:39 <nkinder> one is owned by hyakuhei, the other has someone who was interested and then disappeared 18:18:42 <bdpayne> https://bugs.launchpad.net/ossn 18:19:01 <bdpayne> so which one needs an owner? 18:19:18 <nkinder> So one is up for grabs if anyone is interested - https://bugs.launchpad.net/ossn/+bug/1260679 18:19:21 <uvirtbot> Launchpad bug 1260679 in cinder "Multiple drivers set insecure file permissions" [High,In progress] 18:19:35 <nkinder> It's a pretty easy one I think 18:19:49 <nkinder> any takers? 18:20:08 <malini1> if easy, i shall take! 18:20:10 <bdpayne> is everyone familiar with what is involved here? 18:20:16 <bdpayne> ok, thanks malini1 18:20:24 <nkinder> malini: thanks! 18:20:30 <bdpayne> fwiw, writing an OSSN is pretty easy and we have gentle reviewers ;-) 18:20:36 <bdpayne> it's a great way to get involved 18:20:38 <hyakuhei> We could possibly do with a mini version of the 'GerritWorkflow' page 18:20:40 <malini1> :-) 18:20:50 <nkinder> malini1: I can help through the process if needed. Just let me know. 18:21:17 <bdpayne> #action malini1 to work on https://bugs.launchpad.net/ossn/+bug/1260679 18:21:18 <uvirtbot> Launchpad bug 1260679 in cinder "Multiple drivers set insecure file permissions" [High,In progress] 18:21:27 <malini1> thanks nkinder! 18:21:34 <bdpayne> ok anything else for OSSNs? 18:21:49 <bdpayne> #topic Threat analysis update 18:22:01 <bdpayne> shohel02 could you provide an update for us? 18:22:19 <shohel02> Yes, i have started to covert doc and XLS format to markdown format 18:22:40 <shohel02> we think its an issue for reviewing and tracking 18:22:44 <bdpayne> excellent 18:22:52 <bdpayne> you may find that tool I linked earlier to be useful too 18:22:53 <shohel02> https://github.com/shohel02/OpenStack_Threat_Modelling/blob/master/Project_ThreatAnalysis_ComponentName_Number.md 18:23:00 <shohel02> here is some sample 18:23:15 <shohel02> https://github.com/shohel02/OpenStack_Threat_Modelling/blob/master/keystone/Formatted_Output/Keystone_ThreatAnalysis_TokenProvider_2.9.md 18:23:32 <shohel02> https://github.com/shohel02/OpenStack_Threat_Modelling/blob/master/keystone/Formatted_Output/Keystone_ThreatAnalysis_HighLevel.md 18:24:01 <bdpayne> excellent 18:24:16 <shohel02> Another thing is david,HP and our threat analysis involved people are planning to go through the threat process again 18:24:29 <shohel02> that would be good reivew 18:24:33 <bdpayne> sounds good 18:24:37 <bdpayne> any other next steps? 18:24:48 <bdpayne> or areas where you need help from the group? 18:25:02 <nkinder> bknudson: has anyone on the keystone core side been reviewing the threat analysis? 18:25:04 <shohel02> One of the step is after markdown complete help is required from keystone developers 18:25:30 <nkinder> shohel02: just for review, or anything else in particular? 18:25:31 <bknudson> nkinder: I believe I mentioned the auth_token threat analysis at the keystone meeting once 18:25:32 <shohel02> here we need help 18:26:04 <shohel02> thanks.. 18:26:15 <bdpayne> yeah, it would be great to get someone(s) from keystone core to be involved 18:26:22 <bdpayne> to make sure that the ideas are represented accurately 18:26:27 <shohel02> yes 18:26:32 <bdpayne> and to perhaps just open a communication channel 18:26:44 <nkinder> ok, so a review at first, but I expect that some proposed improvements can come out of the analysis as well 18:27:00 <shohel02> i think OSSG people can also review the threats and docs 18:27:02 <bknudson> I'm hoping things will settle down here soon so I can get more involved in security work 18:27:13 <bdpayne> yeah, and also to help keep the proposed improvements as things that are doable 18:27:17 <morganfainberg> bknudson, I'm in the same boat. 18:27:24 <nkinder> I think everyone is :) 18:27:30 <bdpayne> heh 18:27:40 <bdpayne> ok, thanks for the update shohel02 18:27:42 <nkinder> I can help review too since I've been developing more on keystone too 18:27:46 <bdpayne> anything else on threat analysis? 18:27:48 * morganfainberg is in-fact here, just quiet. 18:27:52 <shohel02> thats great 18:28:06 <shohel02> thats all 18:28:09 <bdpayne> #topic Open Discussion 18:28:20 <bdpayne> malini1 asked about http://summit.openstack.org/cfp/details/8 18:28:27 <bdpayne> perhaps we start there 18:28:36 <nkinder> I'm pretty familiar with that effort 18:28:42 <bdpayne> I know that this and related issues have come around at each summit for the past several 18:28:53 <nkinder> malini1: Was there something in particular you wanted to know? 18:29:00 <malini1> Earlier there was a kerberos like effort from Simo but this is lighter weight 18:29:33 <malini1> and in conjunction with us keeping certs in barbican, thius is lighter weight 18:29:37 <bdpayne> at a high level, this sounds good but it is all in the details for stuff like this 18:29:46 <bdpayne> I'd like to attend this session and learn more 18:29:59 <hyakuhei> Kinda feels like PGP re-invented with x509 18:30:07 <hyakuhei> central registry etc. 18:30:12 <nkinder> here's some background... 18:30:26 <nkinder> The Kite project is the first step, which uses symmetric crypto 18:30:54 <nkinder> lots of low-level detail is here - https://wiki.openstack.org/wiki/MessageSecurity 18:31:05 <bknudson> is kite planned for juno? 18:31:23 <nkinder> bknudson: it's going into barbican, but my guess is that it will be at a POC level for Juno 18:31:24 <bknudson> going to be part of identity or barbican? 18:31:38 <nkinder> it will require changes on the oslo.messaging side to use it 18:31:58 <nkinder> it has some caveats for group messaging though, which is where PKI might help out 18:32:17 <nkinder> I covered this pretty well in the API doc for Kite/KDS 18:32:58 * bdpayne notes the time, but doesn't believe the meeting room is in use for another 30 min... 18:32:58 <nkinder> I have some slides and diagrams on how it works that might be of interest to folks too 18:33:20 <bdpayne> nkinder I'd certainly be interested 18:33:21 <bdpayne> :-) 18:33:29 <malini1> +1 for slides 18:33:30 <nkinder> ok, let me dig up the API doc 18:33:33 <bdpayne> perhaps you can send something out to the ML 18:33:37 <nkinder> will do 18:33:41 <hyakuhei> Yes please. 18:33:47 <shohel02> me too 18:33:48 <nkinder> warning that it's a lot of slides as it was made for an in-person preso 18:33:49 <bknudson> looked like the conference would have rooms for each project -- is there one for security? 18:33:57 <nkinder> so the diagrams are useful, but the words are sparse 18:34:00 <bdpayne> security won't have a room 18:34:10 <nkinder> who here is going to be at the summit? 18:34:10 <bdpayne> but we do have a session in the cross project room 18:34:12 <bknudson> hang out in identity room 18:34:26 <nkinder> Maybe I can present it to OSSG folks outside of a session 18:34:27 <bdpayne> I tend to hang out with Keystone and, these days, Barbican 18:34:37 <bdpayne> o/ I will be at the summit 18:34:41 <hyakuhei> nkinder: yeah something like that might work 18:34:43 <elo> I have a topic that I would like to bring up 18:34:53 * ScottCarlsonPP is at summit. doing a presentation PayPal and "is your cloud compliant" 18:35:01 <shohel02> will be in the summit 18:35:03 <bdpayne> elo go for it 18:35:16 <malini1> malini at summit too 18:35:26 <elo> are we aware of the open policy framework being worked on called Congress 18:35:37 <elo> I'll be at he Summitt 18:35:38 <bdpayne> #action bdpayne to schedule an OSSG meetup at the summit 18:35:55 <bdpayne> I am not aware of Congress 18:36:37 <bdpayne> https://wiki.openstack.org/wiki/Congress 18:36:40 <elo> it's still in the early stage and some of the developers are trying to get people more involved to get it to incubation status 18:37:08 <elo> it is provide policy as a service across different cloud services 18:37:16 <elo> https://wiki.openstack.org/wiki/Congress 18:37:29 <bdpayne> who is driving this effor? 18:37:35 <malini1> elo -- would that mean policy move out of keystone? 18:37:38 <bdpayne> s/effor/effort/ 18:37:39 <elo> Peter Ballard 18:38:00 <nkinder> policy is sort of out of keystone AFAIK 18:38:16 <nkinder> keystone defines roles and policy for keystone, but everyone else has their own policy.json, right> 18:38:18 <shohel02> policy in OSLO 18:38:18 <bknudson> the policy code was moved to oslo 18:38:24 <elo> and a few other developers at VMware.. and a few other developers at other companies 18:38:30 <malini1> soemthing coming up in barbican is control access at the level of each key on the basis of domain/project/user 18:38:36 <bknudson> every project has their own policy.json 18:39:02 <elo> it seems that policy is in each project and there isn't a common broker… we should look into this a little more 18:39:15 <elo> https://wiki.openstack.org/wiki/Congress 18:39:31 <nkinder> elo: it's an interesting effort, but it's going to take buy-in from all of the projects 18:39:34 <bdpayne> so is this for the control plane or for the guests? 18:39:51 <bdpayne> oh, and getting this stuff right is... hard 18:39:55 <nkinder> very 18:40:14 <nkinder> also, does every service have to go to congress to check policy every time? 18:40:35 <nkinder> if so, it becomes a bottleneck. So in comes caching, etc. 18:40:40 <ScottCarlsonPP> no, services have to send lobbyists to congress on their behalf. 18:40:45 <elo> LOL 18:41:04 <malini1> :-D 18:41:04 <bdpayne> ha 18:41:27 <elo> its very open and flexible, so it really is how things are configured to leverage it… 18:41:34 <bdpayne> so, interesting project with lots of open questions 18:41:48 <bdpayne> could be interesting to chat to the people working with this at the summit 18:41:53 <elo> correct… i just want to make sure people are aware of it on this list. 18:41:57 <bdpayne> yeah, thanks 18:42:03 <elo> there will be an unconference on it I know 18:42:08 <bdpayne> ahh, handy 18:42:16 <nkinder> One more thing on the secure messaging topic. The API doc I mentioned is here - https://github.com/stackforge/kite/blob/master/doc/source/api/v1.rst 18:42:29 <ScottCarlsonPP> this sounds like something that needs to have terms defined very succinctly. there's a lot of definitions of this stuff out there. scares me a bit that implementation directives won't match between plugins 18:42:36 <nkinder> The beginning covers the use-case and how things work pretty well, so it's good reading if you want to know more about it. 18:42:51 <nkinder> ...of course I'm biased since I wrote a good chunk of it :) 18:44:31 <bdpayne> cool, I'll check it out 18:44:33 <CristianF> @nkinder there are several models in Congress: proactive, reactive, interactive, so once policies are set congress may act proactively, react to request from other modules, or work on behalf of additional admin decisions 18:44:36 <bdpayne> any other business ? 18:44:42 <bknudson> is secure messaging more than using SSL for qpid/kombu/whatever? 18:45:03 <nkinder> bknudson: yes, absolutely 18:45:26 <nkinder> bknudson: SSL is for encryptin gthe communication with the broker 18:45:36 <nkinder> the broker can then read (and modify) the message contents 18:45:50 <nkinder> secure messaging means the sender encrypts/signs for the recipient(s) 18:46:03 <nkinder> the broker does not need to be trusted, and it can't tamper with the message contents 18:46:34 <nkinder> bknudson: I'll send out my slides. I have nice diagrams that show the difference between broker SSL/TLS and what Kite does 18:46:34 <bdpayne> let's taking the PKI for messaging discussion to the mailing list 18:46:39 <hyakuhei> which of course means you need to know the current keys for the destination 18:46:48 <bdpayne> I think that it will be of broad interest 18:46:54 <bdpayne> and we should probably wrap things up here 18:46:59 <nkinder> hyakuhei: short lived tickets... That's where Kite comes in 18:47:05 <nkinder> ok, enough here. :) 18:47:05 <bknudson> nkinder: slides would be great. thanks 18:47:12 <bdpayne> thanks everyone 18:47:17 <nkinder> thanks all! 18:47:21 <bdpayne> #endmeeting