openstack/openstack-ansible
Code Issues Proposed changes
ba572d1d2e
openstack-ansible/doc/source/install-guide/app-advanced-config-security.rst
Alexandra 46b662dacb [DOCS] Moving the draft install guide to the install-guide folder 
This patch removes the old install guide. It is still accessible
in the Mitaka section.

Change-Id: I47ce62523edd14a1bb20deba3f40e1e0b2df223c
Implements: blueprint osa-install-guide-overhaul
2016-08-31 13:44:55 +01:00

1.7 KiB
Raw Blame History

Security hardening

OpenStack-Ansible automatically applies host security hardening configurations using the openstack-ansible-security role. The role uses a version of the Security Technical Implementation Guide (STIG) that has been adapted for Ubuntu 14.04 and OpenStack.

The role is applicable to physical hosts within an OpenStack-Ansible deployment that are operating as any type of node, infrastructure or compute. By default, the role is enabled. You can disable it by changing a variable within user_variables.yml:

apply_security_hardening: false

When the variable is set to true, the setup-hosts.yml playbook applies the role during deployments.

You can apply security configurations to an existing environment or audit an environment using a playbook supplied with OpenStack-Ansible:

# Perform a quick audit using Ansible's check mode
openstack-ansible --check security-hardening.yml

# Apply security hardening configurations
openstack-ansible security-hardening.yml

Refer to the openstack-ansible-security documentation for more details on the security configurations. Review the Configuration section of the openstack-ansible-security documentation to find out how to fine-tune certain security configurations.