Disable trace for all containers running httpd

Trace method is enabled in default for httpd. There is security risk
with trace enabled. So disable it in default. more info please check[0].

[0] https://security.stackexchange.com/a/7711

Change-Id: I4496a6d058d88e1abfb210085f189e7a610e0362
Closes-Bug: #1705160
This commit is contained in:
Jeffrey Zhang 2017-07-19 10:52:41 +08:00
parent 4d38340623
commit f5dd178fc5
9 changed files with 18 additions and 0 deletions
ansible/roles
aodh/templates
cinder/templates
freezer/templates
gnocchi/templates
horizon/templates
keystone/templates
nova/templates
panko/templates
zun/templates

@ -1,6 +1,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ aodh_api_port }}
TraceEnable off
<VirtualHost *:{{ aodh_api_port }}>
## Vhost docroot

@ -1,6 +1,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ cinder_api_port }}
TraceEnable off
<VirtualHost *:{{ cinder_api_port }}>
WSGIDaemonProcess cinder-api processes={{ openstack_service_workers }} threads=1 user=cinder group=cinder display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup cinder-api

@ -2,6 +2,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ freezer_api_port }}
TraceEnable off
<VirtualHost *:{{ freezer_api_port }}>
WSGIDaemonProcess freezer-api processes={{ openstack_service_workers }} threads=1 user=freezer display-name=%{GROUP}
WSGIProcessGroup freezer-api

@ -2,6 +2,8 @@
{% set wsgi_path = '/usr/bin' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
Listen {{ api_interface_address }}:{{ gnocchi_api_port }}
TraceEnable off
<VirtualHost *:{{ gnocchi_api_port }}>
ErrorLog "/var/log/kolla/gnocchi/gnocchi-api-error.log"

@ -1,6 +1,8 @@
{% set python_path = '/usr/share/openstack-dashboard' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ horizon_port }}
TraceEnable off
<VirtualHost *:{{ horizon_port }}>
LogLevel warn
ErrorLog /var/log/kolla/horizon/horizon.log

@ -3,6 +3,8 @@
Listen {{ api_interface_address }}:{{ keystone_public_port }}
Listen {{ api_interface_address }}:{{ keystone_admin_port }}
TraceEnable off
<VirtualHost *:{{ keystone_public_port }}>
WSGIDaemonProcess keystone-public processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup keystone-public

@ -3,6 +3,8 @@
{% set wsgi_directory = '/usr/bin' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
Listen {{ api_interface_address }}:{{ placement_api_port }}
TraceEnable off
<VirtualHost *:{{ placement_api_port }}>
WSGIDaemonProcess placement-api processes={{ openstack_service_workers }} threads=1 user=nova group=nova display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup placement-api

@ -1,6 +1,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ panko_api_port }}
TraceEnable off
<VirtualHost *:{{ panko_api_port }}>
ErrorLog "/var/log/kolla/panko/panko-api-error.log"

@ -1,6 +1,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ zun_api_port }}
TraceEnable off
<VirtualHost *:{{ zun_api_port }}>
## Vhost docroot