Red Hat Training

A Red Hat training course is available for Red Hat OpenStack Platform

附录 F. 增强安全性

以下章节提供了一些增强 undercloud 安全性的建议。

F.1. 更改 HAProxy 使用的 SSL/TLS 密码和规则

如果您在 undercloud 中启用了 SSL/TLS(请参阅第 4.6 节 “Director 配置参数”),则可能需要增强 HAProxy 配置所采用的 SSL/TLS 密码和规则。此操作可以帮助避免 SSL/TLS 漏洞,例如 POODLE 漏洞

使用 hieradata_override undercloud 配置选项,设置下列 hieradata:

tripleo::haproxy::ssl_cipher_suite
HAProxy 中使用的密码套件。
tripleo::haproxy::ssl_options
HAProxy 中使用的 SSL/TLS 规则。

例如,您可能需要使用下列密码和规则:

  • 密码:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
  • 规则:no-sslv3 no-tls-tickets

创建一个包含以下内容的 hieradata 覆盖文件 (haproxy-hiera-overrides.yaml):

tripleo::haproxy::ssl_cipher_suite: ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
tripleo::haproxy::ssl_options: no-sslv3 no-tls-tickets
注意

密码集合是一个连续行。

设置 undercloud.conf 文件中的 hieradata_override 参数,以便使用在运行 openstack undercloud install 之前创建的 hieradata 覆盖文件:

[DEFAULT]
...
hieradata_override = haproxy-hiera-overrides.yaml
...