Hey there, I've been looking for some ways to harden the systems that are deployed by os-ansible-deployment (soon to be openstack-ansible?) and I've been using the Center for Internet Security (CIS)[1] benchmarks as a potential pathway for that. There are benchmarks available for various operating systems and applications there.
Many of the items shown there fall into a few different categories: 1) things OSAD should configure 2) things deployers should configure 3) things nobody should configure (they break the deployment, for example) #3 is often quite obvious, but #1 and #2 are a bit more nebulous. For example, I opened a ticket[2] about getting auditd installed by default with openstack-ansible. My gut says that many deployers could use auditd since it collects denials from AppArmor and that can help with troubleshooting broken policies. Also, I opened another ticket[3] for compressing all logs by default. This affects availability (part of the information security CIA triad[4]) in a fairly critical way in the long term. My question is this: How should I go about determining which security changes should go upstream and which should go into documentation as things deployers should do locally? [1] https://benchmarks.cisecurity.org/ [2] https://bugs.launchpad.net/openstack-ansible/+bug/1491915 [3] https://bugs.launchpad.net/openstack-ansible/+bug/1493981 [4] https://en.wikipedia.org/wiki/Information_security#Key_concepts -- Major Hayden __________________________________________________________________________ OpenStack Development Mailing List (not for usage questions) Unsubscribe: openstack-dev-requ...@lists.openstack.org?subject:unsubscribe http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack-dev
