Red Hat Training

A Red Hat training course is available for Red Hat OpenStack Platform

Chapter 12. Security Enhancements

The following sections provide some suggestions to harden the security of your overcloud.

12.1. Managing the Overcloud Firewall

Each of the core OpenStack Platform services contains firewall rules in their respective composable service templates. This automatically creates a default set of firewall rules for each overcloud node.

The overcloud Heat templates contain a set of parameters to help with additional firewall management:

Defines whether to automatically manage the firewall rules. Set to true to allow Puppet to automatically configure the firewall on each node. Set to false if you want to manually manage the firewall. The default is true.
Defines whether to purge the default Linux firewall rules before configuring new ones. The default is false.

If ManageFirewall is set to true, you can create additional firewall rules on deployment. Set the tripleo::firewall::firewall_rules hieradata using a configuration hook (see Section 4.5, “Puppet: Customizing Hieradata for Roles”) in an environment file for your overcloud. This hieradata is a hash containing the firewall rule names and their respective parameters as keys, all of which are optional:

The port associated to the rule.
The destination port associated to the rule.
The source port associated to the rule.
The protocol associated to the rule. Defaults to tcp.
The action policy associated to the rule. Defaults to accept.
The chain to jump to. If present, it overrides action.
An Array of states associated to the rule. Defaults to ['NEW'].
The source IP address associated to the rule.
The network interface associated to the rule.
The chain associated to the rule. Defaults to INPUT.
The destination CIDR associated to the rule.

The following example demonstrates the syntax of the firewall rule format:

    '300 allow custom application 1':
      port: 999
      proto: udp
      action: accept
    '301 allow custom application 2':
      port: 8081
      proto: tcp
      action: accept

This applies two additional firewall rules to all nodes through ExtraConfig.


Each rule name becomes the comment for the respective iptables rule. Note also each rule name starts with a three-digit prefix to help Puppet order all defined rules in the final iptables file. The default OpenStack Platform rules use prefixes in the 000 to 200 range.

12.2. Changing the Simple Network Management Protocol (SNMP) Community String

The director provides a default read-only SNMP configuration for your overcloud. It is advisable to change the SNMP community string to mitigate the risk of unauthorized users learning about your network devices.

Set the following hieradata using the ExtraConfig hook in an environment file for your overcloud:

The IPv4 read-only SNMP community string. The default value is public.
The IPv6 read-only SNMP community string. The default value is public.

For example:

    snmp::ro_community: mysecurestring
    snmp::ro_community6: myv6securestring

This changes the read-only SNMP community string on all nodes.

12.3. Changing the SSL/TLS Cipher and Rules for HAProxy

If you enabled SSL/TLS in the overcloud (see Chapter 9, Enabling SSL/TLS on the Overcloud), you might want to harden the SSL/TLS ciphers and rules used with the HAProxy configuration. This helps avoid SSL/TLS vulnerabilities, such as the POODLE vulnerability.

Set the following hieradata using the ExtraConfig hook in an environment file for your overcloud:

The cipher suite to use in HAProxy.
The SSL/TLS rules to use in HAProxy.

For example, you might aim to use the following cipher and rules:

  • Rules: no-sslv3 no-tls-tickets

Create an environment file with the following content:

    tripleo::haproxy::ssl_options: no-sslv3 no-tls-tickets

The cipher collection is one continuous line.

Include this environment file with your overcloud creation.