Re: [Openstack] [OSSG] Security Note: Selecting LXC as Nova Virtualization Driver can lead to data compromise.

2013-03-15 Thread Bryan D. Payne
> Where/when was this wording discussed though ? It was discussed at the meetings on Jan 24, Jan 31, and Feb 7. > may be a good place for ad-hoc discussions around an issue, I don't really > think it is a good forum for reviewing of these final notices prior to an The notes are also tracked thro

Re: [Openstack] [OSSG] Security Note: Selecting LXC as Nova Virtualization Driver can lead to data compromise.

2013-03-15 Thread Bryan D. Payne
>> The quality of container isolation in LXC heavily depends on implementation. >> While >> pure LXC is generally well-isolated through various mechanisms (for example >> AppArmor >> in Ubuntu), LXC through libvirt is not. A guest who operates within one >> container is >> able to affect another

Re: [Openstack] Handling of adminPass is arguably broken (essex)

2012-11-01 Thread Bryan D. Payne
> The best idea I've heard for a secure windows password > is the following: > > a) put a public key on the instance via metadata or config drive (for ease of > use this could actually just be the ssh public key you normally use for > logging into the vm). > b) have a daemon in the windows instan

Re: [Openstack] Fwd: [openstack-dev] [keystone] Tokens representing authorization to projects/tenants in the Keystone V3 API

2012-10-23 Thread Bryan D. Payne
I wanted to throw in my two cents here. I generally agree with the notion that we should have the ability to issue tokens with different scopes. And that this will become increasingly useful down the road as we seek to provide finer grained access control for each user. Having said this, I do hav

Re: [Openstack] Encrypted virtual machines

2012-04-26 Thread Bryan D. Payne
> Data left on broken disks would be unreadable. --> You don't have to worry > about data destruction before selling/throwing out your disks. I can certainly see the goal here. But this may be harder than you think. For example, if you encrypt the disk image, then launch the VM, are you sure tha