64b6c9261e
Current folder name New folder name Book title ---------------------------------------------------------- basic-install DELETE cli-guide DELETE common common NEW admin-guide-cloud Cloud Administrators Guide docbkx-example DELETE openstack-block-storage-admin DELETE openstack-compute-admin DELETE openstack-config config-reference OpenStack Configuration Reference openstack-ha high-availability-guide OpenStack High Availabilty Guide openstack-image image-guide OpenStack Virtual Machine Image Guide openstack-install install-guide OpenStack Installation Guide openstack-network-connectivity-admin admin-guide-network OpenStack Networking Administration Guide openstack-object-storage-admin DELETE openstack-security security-guide OpenStack Security Guide openstack-training training-guide OpenStack Training Guide openstack-user user-guide OpenStack End User Guide openstack-user-admin user-guide-admin OpenStack Admin User Guide glossary NEW OpenStack Glossary bug: #1220407 Change-Id: Id5ffc774b966ba7b9a591743a877aa10ab3094c7 author: diane fleming
62 lines
6.0 KiB
XML
62 lines
6.0 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
||
<chapter xmlns:xi="http://www.w3.org/2001/XInclude" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns="http://docbook.org/ns/docbook" xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="ch034_tenant-secure-networking-best-practices"><?dbhtml stop-chunking?>
|
||
<title>Networking Services Security Best Practices</title>
|
||
<para>This section discusses OpenStack Networking configuration best practices as they apply to tenant network security within your OpenStack deployment.</para>
|
||
<section xml:id="ch034_tenant-secure-networking-best-practices-idp44592">
|
||
<title>Tenant Network Services Workflow</title>
|
||
<para>OpenStack Networking provides users real self services of network resources and configurations. It is important that Cloud Architects and Operators evaluate the their design use cases in providing users the ability to create, update, and destroy available network resources.</para>
|
||
</section>
|
||
<section xml:id="ch034_tenant-secure-networking-best-practices-idp46080">
|
||
<title>Networking Resource Policy Engine</title>
|
||
<para>A policy engine and its configuration file, <emphasis>policy.json</emphasis>, within OpenStack Networking provides a method to provide finer grained authorization of users on tenant networking methods and objects. It is important that cloud architects and operators evaluate their design and use cases in providing users and tenants the ability to create, update, and destroy available network resources as it has a tangible effect on tenant network availability, network security, and overall OpenStack security. For a more detail explanation of OpenStack Networking policy definition, please refer to the <link xlink:href="http://docs.openstack.org/trunk/openstack-network/admin/content/ch_auth.html">Authentication and Authorization chapter</link> in the <citetitle>OpenStack Networking Administration Guide</citetitle>.</para>
|
||
<address>It is important to review the default networking resource policy and modify the policy appropriately for your security posture.</address>
|
||
<para>If your deployment of OpenStack provides multiple external access points into different security domains it is important that you limit the tenant's ability to attach multiple vNICs to multiple external access points -- this would bridge these security domains and could lead to unforseen security compromise. It is possible mitigate this risk by utilizing the host aggregates functionality provided by OpenStack Compute or through splitting the tenant VMs into multiple tenant projects with different virtual network configurations.</para>
|
||
</section>
|
||
<section xml:id="ch034_tenant-secure-networking-best-practices-idp51440">
|
||
<title>Security Groups</title>
|
||
<para>The OpenStack Networking Service provides security group functionality using a mechanism that is more flexible and powerful than the security group capabilities built into OpenStack Compute. Thus, when using OpenStack Networking, <emphasis>nova.conf</emphasis> should always disable built-in security groups and proxy all security group calls to the OpenStack Networking API. Failure to do so will result in conflicting security policies being simultaneously applied by both services. To proxy security groups to OpenStack Networking, use the following configuration values:</para>
|
||
<itemizedlist><listitem>
|
||
<para>firewall_driver : must be set to 'nova.virt.firewall.NoopFirewallDriver' so that <systemitem class="service">nova-compute</systemitem> does not perform iptables-based filtering itself.</para>
|
||
</listitem>
|
||
<listitem>
|
||
<para>security_group_api : must be set to 'neutron' so that all security group requests are proxied to the OpenStack Network Service.</para>
|
||
</listitem>
|
||
</itemizedlist>
|
||
<para>Security groups and security group rules allow administrators and tenants the ability to specify the type of traffic and direction (ingress/egress) that is allowed to pass through a virtual interface port. A security group is a container for security group rules. When a virtual interface port is created in OpenStack Networking it is associated with a security group. If a security group is not specified, the port will be associated with a 'default' security group. By default this group will drop all ingress traffic and allow all egress. Rules can be added to this group in order to change the behaviour.</para>
|
||
<para>When using the security group API through OpenStack Compute, security groups are applied to all virtual interface ports on an instance. The reason for this is that OpenStack Compute security group APIs are instance based and not virtual interface port based as OpenStack Networking.</para>
|
||
</section>
|
||
<section xml:id="ch034_tenant-secure-networking-best-practices-idp58016">
|
||
<title>Quotas</title>
|
||
<para>Quotas provide the ability to limit the number of network resources available to tenants. You can enforce default quotas for all tenants.</para>
|
||
<screen>
|
||
/etc/neutron/neutron.conf
|
||
[QUOTAS]
|
||
# resource name(s) that are supported in quota features
|
||
quota_items = network,subnet,port
|
||
|
||
# default number of resource allowed per tenant, minus for unlimited
|
||
#default_quota = -1
|
||
|
||
# number of networks allowed per tenant, and minus means unlimited
|
||
quota_network = 10
|
||
|
||
# number of subnets allowed per tenant, and minus means unlimited
|
||
quota_subnet = 10
|
||
|
||
# number of ports allowed per tenant, and minus means unlimited
|
||
quota_port = 50
|
||
|
||
# number of security groups allowed per tenant, and minus means unlimited
|
||
quota_security_group = 10
|
||
|
||
# number of security group rules allowed per tenant, and minus means unlimited
|
||
quota_security_group_rule = 100
|
||
|
||
# default driver to use for quota checks
|
||
quota_driver = neutron.quota.ConfDriver</screen>
|
||
<para>OpenStack Networking also supports per-tenant quotas limit via a quota extension API. To enable per-tenant quotas, you need to set <literal>quota_driver</literal> in <literal>neutron.conf</literal>.</para>
|
||
<screen>
|
||
quota_driver = neutron.db.quota_db.DbQuotaDriver</screen>
|
||
</section>
|
||
</chapter>
|