18:01:22 <bdpayne> #startmeeting OpenStack Security Group 18:01:23 <openstack> Meeting started Thu Dec 12 18:01:22 2013 UTC and is due to finish in 60 minutes. The chair is bdpayne. Information about MeetBot at http://wiki.debian.org/MeetBot. 18:01:24 <openstack> Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 18:01:26 <openstack> The meeting name has been set to 'openstack_security_group' 18:01:26 <bknudson> hi 18:01:36 <bdpayne> #topic Rollcall 18:01:43 <bknudson> present 18:01:45 <bdpayne> Hi everyone, please checkin if you're here for the OSSG meeting 18:01:51 <hyakuhei> Good morning/afternoon/evening from Rob @ HP 18:02:05 <sriramhere> morning 18:02:09 <tristanC> Hello folks! 18:02:30 <nkinder> o/ 18:02:51 <bdpayne> excellent, looks like we have a nice group 18:02:58 <bdpayne> #topic Agenda 18:03:06 <malini1> good morning, back from all my travels 18:03:07 <paulmo> Paul Montgomery here a bit late 18:03:27 <bdpayne> So for today I wanted to mention one thing that I've just started working on (a new wiki page) 18:03:32 <bdpayne> Anything else people want to discuss? 18:03:55 <hyakuhei> OSSNs at some point 18:04:03 <bdpayne> ok, noted on OSSNs 18:04:05 <sriramhere> I wanted to update on the meeting with OSSG editors 18:04:12 <bdpayne> sounds good 18:04:32 <bdpayne> ok, so we'll just take these from top to bottom 18:04:38 <nkinder> bdpayne: I'm also working on a new wiki page for OSSNs 18:04:45 <bdpayne> #topic Wiki Pages 18:04:55 <bdpayne> nkinder you have the link? 18:05:09 <nkinder> bdpayne: https://wiki.openstack.org/wiki/Security_Notes 18:05:17 <bdpayne> excellent 18:05:23 <nkinder> I only have one OSSN posted thus far, but I'm going through all of the older ones 18:05:39 <bdpayne> So I wanted to mention that I have just started putting together a wiki page to list the various projects people in OSSG are working on 18:05:42 <bdpayne> https://wiki.openstack.org/wiki/Security/Projects 18:05:55 <bdpayne> I listed the book editors as an example 18:06:05 <bdpayne> But would like to see this filled out with other security projects 18:06:13 <bdpayne> I know there are many, so I'll go back and check my notes 18:06:21 <bdpayne> My goal is for this to serve 2 purposes 18:06:40 <bdpayne> 1) To help advertise the work that's happening and perhaps draw in more people to participate 18:06:56 <bdpayne> 2) To bring these efforts more formally into the group 18:07:06 <hyakuhei> I like it, nkinder shouldn't take long to add in the other OSSNs :) 18:07:14 <bdpayne> On (2), I'll be aiming to have the project leads checkin at this meeting from time to time 18:07:26 <hyakuhei> Obvious things would be the VMT involvement (which needs to be pushed) 18:07:29 <hyakuhei> and the threat analysis work 18:07:38 <bdpayne> yeah 18:07:54 <bdpayne> so, I encourage anyone in OSSG to edit this page and add in other projects 18:08:03 <bdpayne> try to use the same template that I've put together 18:08:09 <bdpayne> just to keep it looking clean 18:08:21 <bdpayne> any thoughts / questions on that? 18:08:26 <hyakuhei> Looks good thus far 18:08:36 <nkinder> yeah, sounds like a good idea 18:08:40 <sriramhere> bryan - just to be clear, this will be the landing projects for all the little projects OSSG is involved 18:08:55 <sriramhere> like editing, OSSN, threat analysis etc 18:08:55 <bdpayne> landing page, yeah 18:09:00 <bknudson> a project I've been thinking about is a tempest scenario test that configures the system securely 18:09:01 <bdpayne> exactly 18:09:08 <nkinder> We should add a link from the OSSG team page on launchpad 18:09:28 <bdpayne> yeah, once this is fillout out some more, I'd like to link to it from a variety of places 18:09:29 <sriramhere> OSSG page already exists rr? 18:09:45 <sriramhere> https://launchpad.net/~openstack-ossg 18:09:46 <hyakuhei> bknudson: A secure distribution? 18:10:22 <hyakuhei> sriramhere: yeah but putting it on the wiki is a better idea imho 18:10:24 <bknudson> hyakuhei: not sure what would be the way to do it, but I think tempest uses devstack... so it would involve making sure devstack can configure system 18:10:56 <tristanC> +1 for a landing page, it's isn't easy to understand what is the OSSG (beside the launchpad page) 18:10:58 <bknudson> configure a system with SSL everywhere. 18:11:03 <sriramhere> sorry, i mistook that you wanted a new opage in launchpad 18:11:14 <nkinder> bdpayne: I'll work on filling in the cross-project security guidelines placeholder 18:11:36 <bdpayne> nkinder great, thanks 18:11:51 <bdpayne> #topic OSSNs 18:11:53 <hyakuhei> bknudson: For that to be a useful project you really need a lot of moving pieces that aren't part of the standard distro (like a CA) I think perhaps looking at releasing hardened chef recipies or something might actually have move value 18:11:57 <hyakuhei> Right 18:12:03 <hyakuhei> We have two open OSSNs 18:12:10 <hyakuhei> sriramhere and nkinder assigned 18:12:24 <hyakuhei> Neither have drafts yet, guys is there anything you need? 18:12:32 <hyakuhei> Editing / Research etc? 18:12:41 <nkinder> hyakuhei: yeah, I just grabbed that Keystone one the other day. I need to start researching it. 18:12:59 <nkinder> hyakuhei: I was wrapping up the glance one I sent out yesterday first. 18:13:05 <bdpayne> Just a comment on the OSSNs... 18:13:08 <hyakuhei> ok cool, if you need help feel free to post on the OSSG ML. 18:13:15 <bdpayne> I think that running the drafts by the PTLs should be the policy 18:13:22 <nkinder> bdpayne: +1 18:13:31 <bdpayne> We got some very good feedback by doing that with the Glance one 18:13:38 <hyakuhei> Makes sense 18:13:39 <bdpayne> and it's just good politics too 18:13:42 <nkinder> bdpayne: I want to document a list of how to write a OSSN on the wiki 18:13:43 <hyakuhei> +1 18:13:54 <sriramhere> no, i will work on sending the draft for review before next meeting. Fallen back due to thanksgiving break 18:13:55 <nkinder> So template, where to publish, who to contact for reviews 18:14:04 <hyakuhei> sriramhere: great :) 18:14:12 <hyakuhei> bdpayne: I'll take that action 18:14:16 <bdpayne> cool 18:14:17 <nkinder> I think a review by PTL and one peer from OSSG is a good idea. 18:14:24 <bdpayne> yeah 18:14:31 <hyakuhei> I've been thinking do we want some sort of numbering for them too? 18:14:42 <nkinder> hyakuhei: Yes, agreed 18:14:47 <nkinder> hyakuhei: even date based 18:14:48 <sriramhere> numbering? you mean +1 -1? 18:14:55 <sriramhere> or order? 18:14:58 <hyakuhei> No I mean OSSN-2013-22... 18:15:04 <bdpayne> like the CVE numbering scheme? 18:15:10 <hyakuhei> Yeah 18:15:11 <sriramhere> ok, good 18:15:13 <nkinder> sriramhere: VMT numbers OSSA's IIRC 18:15:19 <hyakuhei> indeed they do 18:15:29 <nkinder> Yeah, we should be in-line with what they do 18:15:37 <hyakuhei> Ok so I think we can keep on top of this as a manual process for now 18:15:47 <nkinder> I think this is important if we start publishing using a structured format like CVRF as well. 18:15:59 <hyakuhei> I'll continue to 'manage' the OSSNs, help where editing etc is required and I'll get that wiki page thrown together 18:16:22 <nkinder> hyakuhei: should we retroactively number the previous OSSNs? 18:16:38 <hyakuhei> nkinder: yeah. I'm not sure a structured format is as important for OSSN vs OSSA but I have no objection to adopting it either 18:16:56 <sriramhere> bug ids wont suffice for now? 18:17:00 <hyakuhei> nkinder: Probably. However, as we're about to go into 2013, we've got a natural brake line 18:17:19 <bdpayne> I think using a common structured format for both OSSN and OSSA would be useful 18:17:27 <hyakuhei> sriramhere: Having an ID makes it easier when people start discussing which OSSNs apply where. 18:17:38 <hyakuhei> Thinking ahead to when we have one per week (potentially) 18:17:52 <hyakuhei> bdpayne: yeah, I've got no big objection to using CVRF 18:17:56 <nkinder> bdpayne: It would also allow us to generate the other published formats (wiki, e-mail, etc.) 18:18:00 <sriramhere> ok coo. just it is 2014 not 2013 :) 18:18:04 <hyakuhei> pffft 18:18:08 <hyakuhei> off by ones happen! 18:18:18 <bdpayne> still 2013 where I'm sitting :-) 18:18:32 <hyakuhei> ok cool, so what did I just agree to do. 18:18:44 <hyakuhei> I'll put together a wiki page, describing how I think the process should look in the future 18:18:49 <bdpayne> #action hyakuhei to fix everything 18:18:49 <hyakuhei> and we can go over it next week 18:18:56 <hyakuhei> including numbering and format etc 18:18:57 <bdpayne> :-) 18:19:04 <hyakuhei> wow, just like being at work 18:19:06 <bdpayne> yeah, that sounds reasonable 18:19:13 <nkinder> hyakuhei: let me know if you want a review or any help on it before then 18:19:22 <hyakuhei> Cheers :) 18:19:33 <bdpayne> #topic Book Editors 18:19:57 <bdpayne> sriramhere you wanted to discuss this? 18:20:03 <sriramhere> update: David Mortman, Bryan and Myself synced up earlier this week on what are the steps here 18:20:22 <hyakuhei> I've done a bunch of editing and I'd like to do more. I just need to get better at wranging my inbox to see when things come up. 18:20:39 <sriramhere> Once Ben is back from conference next week, we are going to start diving up to start style/ grammatical fixes first 18:20:59 <sriramhere> we will firs come up with a plan/ schedule and publish it to the team and go from there 18:21:12 <sriramhere> hoping to get hold of Ben before next thurs 18:21:18 <hyakuhei> Seems reasonable. I wonder how much technical-proof readers charge. 18:21:19 <bdpayne> So we do have this team of three editors to help drive the effort... but anyone is welcome to continue making contributions 18:21:41 <hyakuhei> oh, teams! I like teams, they feel so inclusive! 18:21:54 <sriramhere> rob - you are on fire tooday! 18:22:00 <bdpayne> hyakuhei I could actually find out the answer to that question (cost for technical editors) 18:22:06 <bdpayne> but does anyone actually have $$ for that? 18:22:09 * hyakuhei has had a long week 18:22:31 <hyakuhei> bdpayne: depends on the cost, it's worth having some idea of the cost 18:22:46 <sriramhere> i thought thtat was a fun question - 18:22:54 <hyakuhei> because, if we're collectively burning FTE that could be more easily purchased by someone else... 18:23:04 <sriramhere> i have some friends in publishing (non--tech) industry 18:23:10 <sriramhere> can find out. 18:23:18 <bdpayne> I'll explore too 18:23:33 <bdpayne> #topic Open Discussion 18:23:36 <sriramhere> as of now, it was volunteer/ interest 18:23:44 <bdpayne> Anything else people would like to discuss today? 18:23:54 <paulmo> I had a few quick things 18:23:57 <sriramhere> who runs http://www.secstack.com/? 18:24:36 <paulmo> I'm not sure if anyone has seen these automated database exploitation tools but they may be useful in OpenStack: https://github.com/tcstool/NoSQLMap and http://sqlmap.org/ 18:25:00 <bdpayne> Worth mentioning that Barbican is trying to get incubated http://lists.openstack.org/pipermail/openstack-dev/2013-December/020830.html 18:25:09 <hyakuhei> sriramhere: Matt Joyce 18:25:24 <sriramhere> thanks Rob 18:25:32 <bknudson> does anyone here know of a good static analysis tool for python? 18:25:46 <hyakuhei> Such things do not really exist... 18:25:50 <paulmo> I think pylint is about as good as it gets from what I've found 18:25:51 <hyakuhei> Fortify has _some_ support 18:25:55 <bknudson> hyakuhei: that is my guess 18:25:58 <clarkb> bknudson: yes, there is one laying around that I was playing with recently 18:26:06 <clarkb> now I have to find it and remember what it was called 18:26:07 <nkinder> I've also been doing a lot of review on the KDS side of things for Keystone. 18:26:26 <bknudson> There's a tool called RATS that we (IBM) ran recently 18:26:29 <hyakuhei> but applying SA to a language like Python is always going to be tricky, there are some interesting, if immature, DA projects though - making use of various introspection capabilities 18:26:36 <bdpayne> nkinder good to know on the KDS stuff 18:26:37 <bknudson> and we wound up opening a few bugs 18:26:39 <hyakuhei> bknudson: any good? 18:26:40 <bdpayne> they need eyes there! 18:26:46 <bknudson> hyakuhei: I was not impressed. 18:26:49 <hyakuhei> KDS is scary looking 18:26:56 <hyakuhei> I've asked Jeff to have a look into it 18:27:04 <nkinder> bdpayne: I've been looking at the API side of things mostly at this point. 18:27:14 <clarkb> bknudson: https://pypi.python.org/pypi/radon 18:27:15 <hyakuhei> nkinder: makes sense 18:27:23 <nkinder> hyakuhei: ok, I have a pretty good understanding of the approach, so I can help answer any questions. 18:27:40 <bknudson> clarkb: thanks! 18:27:49 <hyakuhei> Goes without saying but if anyone needs compute resource to run tools like this, I'll hook you up on the HP Cloud. 18:27:54 <morganfainberg> clarkb, Oh nice! ++ on the thanks. 18:28:26 <bdpayne> ok, I think that about wraps it up for today 18:28:33 <tristanC> also, I didn't introduced myself, I joined the OSSG group today so hi folks :) 18:28:38 <hyakuhei> Nicely timed meeting, thanks bdpayne 18:28:44 <hyakuhei> Welcome tristanC ! 18:28:50 <bdpayne> oh welcome! 18:28:50 <sriramhere> hi tristan 18:28:55 <bdpayne> brief intro tristanC? 18:28:59 <hyakuhei> Good meeting to attend! 18:29:01 <tristanC> thanks, nice to meet you 18:29:16 <nkinder> tristanC: welcome! 18:29:25 <tristanC> I work at eNovance, and I should specialise on open stack security matters 18:29:35 <bdpayne> great, glad to have you on board 18:29:40 <hyakuhei> +1 18:29:53 <sriramhere> +1 18:29:53 <bdpayne> perhaps chat on the ML about your interests so we can help you find ways to get involved 18:30:21 <bdpayne> ok, thanks all... have a good week 18:30:24 <bdpayne> #endmeeting