puppet-tripleo/spec
Oliver Walsh fd20b306b0 Restrict nova migration ssh tunnel
This change enhances the security of the migration ssh tunnel:
- The ssh authorized_keys file is only writeable by root.
- Creates a new user for migration instead of using root/nova.
- Disables SSH forwarding for this user.
- Optionally restricts the networks that this user can connect from.
- Uses an ssh wrapper command to whitelist the commands that this user can run
  over ssh.

Requires the openstack-nova-migration package from
https://review.rdoproject.org/r/6327

bp tripleo-cold-migration

Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293
(cherry picked from commit f8ca94a5b7)
2017-06-01 18:33:46 +00:00
..
acceptance/nodesets Initial msync run for all Puppet OpenStack modules 2015-08-18 14:30:54 +02:00
classes Restrict nova migration ssh tunnel 2017-06-01 18:33:46 +00:00
defines Call VF configuration from udev rules 2016-11-11 10:02:42 -03:30
fixtures Restrict nova migration ssh tunnel 2017-06-01 18:33:46 +00:00
functions Make sure we bind the rabbit inter-cluster to a specific interface 2017-01-20 08:41:22 +01:00
unit Configure the numvfs for SRIOV interfaces 2016-08-29 19:41:35 +05:30
shared_examples.rb Add basic structure for a Puppet module 2015-02-02 11:39:21 -05:00
spec_helper.rb Add aodh profile rspec testing 2016-09-30 15:12:05 -06:00
spec_helper_acceptance.rb Initial msync run for all Puppet OpenStack modules 2015-08-18 14:30:54 +02:00