[Openstack] [OpenStack] [Keystone] Is it possible to cache ec2 credentials?

2017-01-19 Thread Alexandr Porunov
Hello, I want to use ec2 credentials. But I don't know about it's route of validating. Is it much slower than tokens validation? I don't know exactly what is the route of ec2 validation but here is what I think: 1) Service node accept a request with ec2 credentials. 2) Service asks Keystone to c

Re: [Openstack] [OpenStack] VM start up with no route rules

2017-01-19 Thread Eugen Block
Does your VM's interface also have DHCP enabled? If it's configured to have a static address, it won't be changed by dhcp. Have you used the image outside of heat and did it work with dhcp for a single VM? Zitat von "Xu, Rongjie (Nokia - CN/Hangzhou)" : Hi, I am launch a heat stack on top

Re: [Openstack] [openstack-dev] [OSSN-0074] Nova metadata service should not be used for sensitive information

2017-01-19 Thread Jeremy Stanley
On 2017-01-19 09:34:21 -0500 (-0500), Steve Gordon wrote: [...] > Does this configuration directive provide any mitigation for this > issue?: > > "use_forwarded_for = False (BoolOpt) Treat X-Forwarded-For > as the canonical remote address. Only enable this if you have a > sanitizing proxy.

Re: [Openstack] [OSSN-0074] Nova metadata service should not be used for sensitive information

2017-01-19 Thread Steve Gordon
- Original Message - > From: "Luke Hinds" > To: openstack@lists.openstack.org, openstack-...@lists.openstack.org > Sent: Monday, December 19, 2016 4:26:24 AM > Subject: [Openstack] [OSSN-0074] Nova metadata service should not be used for > sensitive information > > OpenStack Security Not

Re: [Openstack] How to troubleshoot Security Group rules

2017-01-19 Thread Vimal Kumar
Hi, Is the rules implemented in the iptables of the node (I am running all-in-one, LinuxBridge setup), or is it implemented in the iptables of a separate network namespace? On Thu, Jan 19, 2017 at 1:27 PM, Melvin Hillsman wrote: > If you are running an all-in-one/single node deployment, your se