Security Tasks

• 1: Configure SSL
• 1.1: Configure and Enable SSL for the Management Console
• 1.2: Configure and Enable SSL for the UFS
• 2: Change Multicast Address
• 3: Configure Replay Protection
• 4: Configure Session Timeouts
• 5: Configure STS Actions
• 6: Configure the Firewall
• 7: Reserve Ports
• 8: Synchronize Components

1 - Configure SSL

Configure SSL

In order to connect to Eucalyptus using SSL, you must have a valid certificate for the User-Facing Services (UFS).

1.1 - Configure and Enable SSL for the Management Console

You can use secure HTTP for your console.To run your console over Secure HTTP:

Install nginx on your console server with the following command: yum install nginx Overwrite the default nginx.conf file with the template provided in /usr/share/doc/eucaconsole-/nginx.conf. cp /usr/share/doc/eucaconsole-/nginx.conf /etc/nginx/nginx.conf Uncomment the ’listen’ directive and uncomment/modify the SSL certificate paths in /etc/nginx/nginx.conf (search for “SSL configuration”). For example:

# SSL configuration
listen 443 ssl;
# ssl_certificate /path/to/ssl/pem_file;
# EXAMPLE:
ssl_certificate /etc/eucaconsole/console.crt;
# ssl_certificate_key /path/to/ssl/certificate_key;
# EXAMPLE: 
ssl_certificate_key /etc/eucaconsole/console.key;
# end of SSL configuration

session.secure = true
sslcert=/etc/eucaconsole/eucalyptus.com.chained.crt
sslkey=/etc/eucaconsole/eucalyptus.com.key

1.2 - Configure and Enable SSL for the UFS

This topic details tasks to configure SSL/TLS for the User-Facing Services (UFS)

If you have more than one host (other than node controllers), note the following:

• The keystore must be updated on each host running the eucalyptus-cloud service
• The [key_alias] must be the same on each host
• Use a wildcard certificate (i.e. *.<system.dns.dnsdomain>), since UFS is responsible for all service API endpoints

Create a Keystore

Eucalyptus uses a PKCS12-format keystore. If you are using a certificate signed by a trusted root CA, perform the following steps.

Enter the following command to convert your trusted certificate and key into an appropriate format:

openssl pkcs12 -export -in [YOURCERT.crt] -inkey [YOURKEY.key] \
  -out tmp.p12 -name [key_alias]

Save a backup of the Eucalyptus keystore, at /var/lib/eucalyptus/keys/euca.p12 . Import your keystore into the Eucalyptus keystore on the UFS:

keytool -importkeystore -srckeystore tmp.p12 -srcstoretype pkcs12 \
  -srcstorepass [export_password] -destkeystore /var/lib/eucalyptus/keys/euca.p12 \
  -deststoretype pkcs12 -deststorepass eucalyptus -alias [key_alias] -destkeypass eucalyptus

Enable the UFS to Use the Keystore

To enable the UFS to use the keystore, perform the following steps in the CLC because the UFS gets all its configuration information from the CLC. Run the following commands on the CLC:

euctl bootstrap.webservices.ssl.server_alias=[key_alias]

Optional: Redirect Requests to use Port 443

To allow user facing services requests on port 443 instead of the default 8773, run the following commands on the CLC:

euctl bootstrap.webservices.port=443

2 - Change Multicast Address

This topic describes how to change your multicast address for group membership.By default, Eucalyptus uses the multicast address 239.193.7.3 for group membership. Most data centers limit multicast address communication for security measures. We recommend that you use addresses in the administratively-scoped multicast address range.

To change the multicast address for group membership Stop all services, starting from the CC, SC, Walrus, then CLC. For example:

systemctl stop eucalyptus-cluster.service
systemctl stop eucalyptus-cloud.service

Change the eucalyptus.conf on the CC, modifying the CLOUD_OPTS parameter to the new IP address:

CLOUD_OPTS="--mcast-addr=228.7.7.3"

systemctl start eucalyptus-cloud.service
systemctl start eucalyptus-cluster.service

Verify that the configured multicast address is being used via netstat:

netstat -nulp

Postrequisites

• Check the firewall after changing the multicast address. See for more information.

3 - Configure Replay Protection

You can configure replay detection in Java components (which includes the CLC, UFS, OSG, Walrus, and SC) to allow replays of the same message for a set time period.

euctl bootstrap.webservices.replay_skew_window_sec=[new_value_in_seconds]

If you set this property to 0 , Eucalyptus will not allow any message replays. This setting provides the best protection against message replay attacks.

If you set this property to any value greater than 15 minutes plus the values of ws.clock_skew_sec (that is, to a value >= 920 sec in the default installation), Eucalyptus disables replay detection completely.

When checking message timestamps for expiration, Eucalyptus allows up to 20 seconds of clock drift between the machines. This is a default setting. You can change this value for the Java components at runtime by setting the bootstrap.webservices.clock_skew_sec property as follows:

euctl bootstrap.webservices.clock_skew_sec=[new_value_in_seconds]

4 - Configure Session Timeouts

To set the session timeouts in the Management Console:

Modify the session.timeout and session.cookie_expires entries in the [app:main] section of the configuration file. The session.timeout value defines the number of seconds before an idle session is timed out. The session.cookie_expires is the maximum length that any session can be active before being timed out. All values are in seconds:

session.timeout=1800



session.cookie_expires=43200

5 - Configure STS Actions

The Security Token Service (STS) allows you to enable or disable specific token actions.By default, the enabled actions list is empty. However, this means that all actions are enabled. To disable actions, list each action in the disabledactions property. To enable specific actions, list them in the enabledactions property.

# euctl tokens
PROPERTY	tokens.disabledactions	{}
PROPERTY	tokens.enabledactions	{}

The values for each property are case-insensitive, space or comma-separated lists of token service actions. If an action is in the disable list it will not be permitted. Eucalyptus returns an HTTP status 503 and the code ServiceUnavailable .

If the enable list is not empty, Eucalyptus only permits the actions specifically listed.

For more information about STS, go to STS section of the AWS CLI Reference .

6 - Configure the Firewall

Restricting Network Access

This section provides basic guidance on setting up a firewall around your Eucalyptus components. It is not intended to be exhaustive.

On the Cloud Controller (CLC), Walrus, and Storage Controller (SC), allow for the following jGroups traffic:

• TCP connections between CLC, user-facing services (UFS), object storage gateway (OSG), Walrus, and SC on port 8779 (or the first available port in range 8779-8849)

• UDP connections between CLC, UFS, OSG, Walrus, and SC on port 7500

• Multicast connections between CLC and UFS, OSG, Walrus, and SC to IP 239.193.7.3 on UDP port 8773 On the UFS, allow the following connections:

• TCP connections from end-users and instances on ports 8773

• End-user and instance connections to DNS ports On the CLC, allow the following connections:

• TCP connections from UFS, CC and Eucalyptus instances (public IPs) on port 8773 (for metadata service)

• TCP connections from UFS, OSG, Walrus, and SC on port 8777 On the CC, make sure that all firewall rules are compatible with the dynamic changes performed by Eucalyptus, described in the section below. Also allow the following connections:

• TCP connections from CLC on port 8774 On OSG, allow the following connections:

• TCP connections from end-users and instances on port 8773

• TCP connections from SC and NC on port 8773 On Walrus, allow the following connections:

• TCP connections from OSG on port 8773 On the SC, allow the following connections:

• TCP connections from CLC and NC on TCP port 8773

• TCP connections from NC on TCP port 3260, if tgt (iSCSI open source target) is used for EBS in DAS or Overlay modes On the NC, allow the following connections:

• TCP connections from CC on port 8775

• TCP connections from other NCs on port 16514

• DHCP traffic forwarding to VMs

• Traffic forwarding to and from instances’ private IP addresses

7 - Reserve Ports

8 - Synchronize Components

To synchronize your Eucalyptus component machines with an NTP server, perform the following tasks.

Enter the following command on a machine hosting a Eucalyptus component:

# ntpdate pool.ntp.org
# systemctl start ntpd.service
# systemctl enable ntpd.service
# ps ax | grep ntp
# hwclock --systohc  

Repeat for each machine hosting a Eucalyptus component.