1. Security Tips for OpenStack @NCSA
James Eyrich
Manager
Security Operations and Incident Response

2. Choosing an Image and Managing a Server
Consider choosing an LTS (long term support) image for your server, allows you to keep in service longer.
Out of support Operating Systems should be upgraded or replaced
Run OS update (ie yum) as soon as system is online
Have a maintenance schedule to regularly patch system

3. Server management recommendations
NCSA draft Server Policy:
How Tos:

4. Default Credentials
Many images and services come with well known credentials already configured
Before opening these services to the network change any preconfigured passwords, certificates, keys.
Or when you clone a machine
Examples
Regenerate any SSH, and SSL keys
Root passwords
Database admin passwords
Service account credentials

5. OpenStack Security Groups
OpenStack provided external firewall
Use the No Open Services group until you have SSH locked down. Access via console.
Use the SSH restricted group until you have your services secured and IPtables configured.

7. Security Groups Resources
Further Information about OpenStack Groups
Nebula Admins have asked that Security Groups be used sparingly due to concerns about current way implemented.

8. IPtables and service access restrictions
Use the host based firewall
Restrict access to services based on source and service port
Default block – anything not explicitly allowed is blocked
Service Restrictions
Can also set restrictions via the Service Configurations
TCP wrappers

9. Public IPs - does every VM need one?
Easy way to restrict access is to place the VM on project IP space.
Do back end servers (ie DB) need public IPs?
Private IPs are NATed for Internet Access
Possibly use a hardened bastion host for remote administration
Bastion host – restricted access system strictly used to control remote access

10. NCSA Security Operation and Incident Reponses Team Actions & Response
Activities
Scanning for open ports
SSH Brute Forcing
Response
Ticket
Blackhole Routing -
Shutdown VM