18:00:15 <bdpayne> #startmeeting OpenStack Security Group 18:00:16 <openstack> Meeting started Thu Jul 11 18:00:15 2013 UTC. The chair is bdpayne. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:00:17 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:00:19 <openstack> The meeting name has been set to 'openstack_security_group' 18:00:29 <bdpayne> good morning security group 18:00:40 <nicolae__> Good evening :-) 18:00:45 <bdpayne> :-) 18:01:02 <bdpayne> we've taken a few weeks off here, and I'm hoping to ramp things up again 18:01:10 <bdpayne> so lots to discuss today 18:01:21 <bdpayne> first, who do we have in the meeting? 18:01:30 <bdpayne> Bryan from Nebula here 18:01:31 <rlp> Good Afternoon 18:01:36 <rlp> Randy Perryman from Dell 18:02:04 <bdpayne> hi randy 18:02:08 <nicolae__> Nicolae, sics 18:02:29 <bdpayne> ok, great 18:02:37 <bdpayne> I'm sure others will join in as we go along too 18:02:43 <bdpayne> #topic Annoucements 18:03:16 <bdpayne> First, I wanted to make sure that everyone is aware of the mailing list 18:03:17 <bdpayne> http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-security 18:03:45 <bdpayne> This is where security related announcements go, along with notifications about OpenStack bugs that need security team review 18:04:00 <bdpayne> also a fine place for security discussion 18:04:12 <bdpayne> I'd encourage everyone in OSSG to join that list 18:04:58 <bdpayne> Also, Rob put together the initial pieces for a security wiki web page 18:04:59 <bdpayne> https://wiki.openstack.org/wiki/Security 18:05:14 <rlp> ty 18:05:34 <bdpayne> I'd like to build this out to be a nice landing page for people interested in openstack security 18:06:00 <bdpayne> and then perhaps have a subpage that is full of suggestions for people wanted to get involved in OSSG 18:06:17 <bdpayne> nicolae__ said he could help with this 18:06:20 <bdpayne> right? :-) 18:07:06 <bdpayne> #action nicolae__ to help fill out the wiki pages 18:07:07 <nicolae__> Right :) 18:07:34 <bdpayne> #topic Security Guide 18:08:03 <bdpayne> If you haven't heard the news yet, the security guide book sprint was a big success 18:08:05 <bdpayne> http://docs.openstack.org/sec/ 18:08:28 <bdpayne> We'll be getting a pdf and html up there shortly 18:08:39 <rlp> thanks 18:08:48 <rlp> I just saw this and now to read... 18:08:53 <bdpayne> This was really a huge effort by a great team of people 18:09:00 <bdpayne> I think it's a great first cut 18:09:08 <bdpayne> But there's plenty of places where it can be improved 18:09:28 <bdpayne> So I would encourage others to contribute back to the guide… anything from grammatical edits to new chapters 18:09:30 <bdpayne> https://github.com/openstack/openstack-manuals/tree/master/doc/src/docbkx/openstack-security-guide 18:09:49 <bdpayne> ^^ The book is in docbook source and held in that github repo ^^ 18:09:50 <uvirtbot> bdpayne: Error: "^" is not a valid command. 18:09:59 <bdpayne> sorry about that bot 18:10:23 <bdpayne> any questions about the book? 18:11:32 <bdpayne> ok, I'll push ahead 18:11:44 <bdpayne> #topic Reviewing open security issues 18:11:56 <bdpayne> So there's a lot of code that needs security reviews 18:12:06 <bdpayne> The mailing list is a great way to get plugged into this 18:12:43 <bdpayne> But I wanted to call to the attention of the group here some specific itema 18:12:49 <bdpayne> s/itema/items/ 18:13:08 <bdpayne> the APL team (who couldn't make the meeting today) have done a lot of work on Volume encryption 18:13:14 <bdpayne> and this work is ready for review now 18:13:28 <bdpayne> unfortunately, they haven't been getting as many eyes as they would like 18:13:36 <bdpayne> https://review.openstack.org/#/c/30973/ 18:13:42 <bdpayne> https://review.openstack.org/#/c/30974/ 18:13:47 <bdpayne> https://review.openstack.org/#/c/30976/ 18:13:51 <bdpayne> There's the links 18:14:04 <bdpayne> I would encourage people to spend some time reviewing those 18:15:03 <bdpayne> You can find other things that need review by checking the security mailing list archives and/or by search the various projects for security tags 18:15:23 <bdpayne> list archives are here http://lists.openstack.org/pipermail/openstack-security/ 18:15:48 <bdpayne> security tagged items look like: https://bugs.launchpad.net/keystone/+bugs?field.tag=security 18:15:57 <bdpayne> similar link for other projects 18:16:10 <bdpayne> for example 18:16:12 <bdpayne> https://bugs.launchpad.net/keystone/+bugs?field.tag=security 18:16:43 <bdpayne> for OSSG members that want to get involved with code-level contributions, this is a great place to get started 18:17:05 <bdpayne> any questions about these? 18:17:44 <bdpayne> you guys are quiet today :-) 18:17:53 <bdpayne> ok, pushing forward 18:17:53 <rlp> :) 18:18:14 <bdpayne> #topic Ongoing security projects 18:18:29 <bdpayne> There's a few ongoing projects to mention 18:18:45 <bdpayne> Unfortunately, the people with knowledge on the current status aren't here today 18:19:05 <bdpayne> There's the volume encryption work that I mentioned above 18:19:12 <bdpayne> There's also work on a key manager 18:19:41 <malini1> Greetings, sorry to join late 18:19:47 <bdpayne> contacts for the key manager work include Jerret Raim (Rackspace) and malini1 18:20:03 <bdpayne> nice timing malini1 :-) care to give an update on the key manager work? 18:20:55 <malini1> going well, very few bugs left 18:21:04 <bdpayne> on track for H? 18:21:11 <malini1> the thing that concerns me more is no reviews of the volume encryption patches 18:21:11 <bdpayne> need any review eyes or ?? 18:21:24 <bdpayne> fair… so let's focus resources there 18:21:37 <malini1> absolutely need review eyes, those are languishing and they are the proof of the pudding 18:21:56 <bdpayne> sounds good 18:22:11 <malini1> there are 3 a-- all by joel C 18:22:22 <bdpayne> yeah, I've got links above 18:22:29 <bdpayne> so they will be in the meeting transcripts 18:22:53 <malini1> :-) 18:23:00 <bdpayne> other thing worth mentioning in ongoing work is something that came out of the book sprint 18:23:17 <bdpayne> while writing the book, the team captured a variety of security shortcomings in openstack 18:23:42 <bdpayne> I'll be working with the book sprint team to triage these and figure out how to handle each one 18:24:02 <bdpayne> These will end up as a collection of blueprints, bugs, security notes, etc 18:24:09 <malini1> and a thought on libvirt connection, there is readonly mode which does not need credentials and one which needs credentials 18:24:13 <bdpayne> so be watching here for updates on those in the coming weeks 18:24:29 <malini1> it can be a pain to prompt and provide, but should this be something that is enforced 18:24:50 <bdpayne> malini1 perhaps a worthwhile OSSN? 18:25:02 <bdpayne> would you like to work with Rob on that? 18:25:03 <malini1> a use case of libvirt connection is to obtain stats on cpu usage 18:25:12 <malini1> sure 18:26:45 <bdpayne> #action malini1 to work with Rob on OSSN for libvirt authentication best practices 18:27:08 <bdpayne> #action bdpayne to work with book sprint team to push out security issues identified during the sprint 18:27:19 <bdpayne> #topic Open Discussion 18:27:29 <bdpayne> that's all I have for today… anything else that people would like to discuss? 18:27:35 <malini1> BTW -- there is a pitch for geo tagging in NIST .. something to watch 18:27:46 <bdpayne> link? 18:27:50 <malini1> one second 18:28:03 <malini1> http://csrc.nist.gov/groups/SMA/forum/documents/april2013presentations/forum_april_11_2013_bartock.pdf http://csrc.nist.gov/publications/drafts/ir7904/draft_nistir_7904.pdf 18:28:16 <malini1> it is all fluffy right now, nothing implemented 18:28:24 <bdpayne> interesting 18:28:26 <bdpayne> what's the goal there? 18:28:33 <bdpayne> to know where the cloud resources are located? 18:28:33 <malini1> basically folks want to control where their payload runs, where their data is stored to meet 18:28:38 <malini1> regulation requirements 18:28:46 <bdpayne> makes sense 18:28:59 <malini1> to truely now where machien is located needs GPS (which will not work in a bunker somewhere) 18:29:14 <malini1> also those GPS co-ordinates have to be mapped to a country 18:29:42 <malini1> and sub-area (say embassy in a foreign land or in international airspace or waters) which maynot be an issue 18:29:46 <malini1> for data center 18:30:20 <malini1> and all server chips today do not have GPS while phones etc do 18:30:34 <malini1> may have to trust admin who deploys machine 18:30:42 <bdpayne> ok, thanks for the pointer 18:30:47 <bdpayne> that all we have time for today 18:30:50 <malini1> to certify where it is located, and sign it 18:30:58 <nicolae__> There were some research publications on this topic too, don't have the links right now, can send them if interested 18:31:11 <malini1> please do, thanks 18:31:14 <bdpayne> sure, perhaps start a thread on the securty mailing list 18:31:23 <nicolae__> Ok, will do 18:31:27 <bdpayne> thanks 18:31:36 <bdpayne> have a great week everyone 18:31:40 <malini1> bye 18:31:41 <bdpayne> #endmeeting