openstack
/
devstack
Code Issues Proposed changes

Merge "Set ownership of /etc/pki/<console> files for TLS"

This commit is contained in:
Zuul 2019-03-26 08:07:26 +00:00 committed by Gerrit Code Review
parent 18d1dc99b7 e2853bf2d0
commit 8bdbf85096
2 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
lib/nova
View File

@ -674,6 +674,22 @@ function configure_console_proxies {
sudo mkdir -p /etc/pki/nova-novnc
deploy_int_CA /etc/pki/nova-novnc/ca-cert.pem
deploy_int_cert /etc/pki/nova-novnc/client-cert.pem /etc/pki/nova-novnc/client-key.pem
# OpenSSL 1.1.0 generates the key file with permissions: 600, by
# default, and the deploy_int* methods use 'sudo cp' to copy the
# files, making them owned by root:root.
# Change ownership of everything under /etc/pki/nova-novnc to
# $STACK_USER:$(id -g ${STACK_USER}) so that $STACK_USER can read
# the key file.
sudo chown -R $STACK_USER:$(id -g ${STACK_USER}) /etc/pki/nova-novnc
# This is needed to enable TLS in the proxy itself, example log:
# WebSocket server settings:
# - Listen on 0.0.0.0:6080
# - Flash security policy server
# - Web server (no directory listings). Web root: /usr/share/novnc
# - SSL/TLS support
# - proxying from 0.0.0.0:6080 to None:None
iniset $conf DEFAULT key "/etc/pki/nova-novnc/client-key.pem"
iniset $conf DEFAULT cert "/etc/pki/nova-novnc/client-cert.pem"
fi
fi

8
lib/nova_plugins/functions-libvirt
View File

@ -155,9 +155,15 @@ EOF
echo "vnc_tls_x509_verify = 1" | sudo tee -a $QEMU_CONF
sudo mkdir -p /etc/pki/libvirt-vnc
sudo chown libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
deploy_int_CA /etc/pki/libvirt-vnc/ca-cert.pem
deploy_int_cert /etc/pki/libvirt-vnc/server-cert.pem /etc/pki/libvirt-vnc/server-key.pem
# OpenSSL 1.1.0 generates the key file with permissions: 600, by
# default and the deploy_int* methods use 'sudo cp' to copy the
# files, making them owned by root:root.
# Change ownership of everything under /etc/pki/libvirt-vnc to
# libvirt-qemu:libvirt-qemu so that libvirt-qemu can read the key
# file.
sudo chown -R libvirt-qemu:libvirt-qemu /etc/pki/libvirt-vnc
fi
fi