fd20b306b0
This change enhances the security of the migration ssh tunnel:
- The ssh authorized_keys file is only writeable by root.
- Creates a new user for migration instead of using root/nova.
- Disables SSH forwarding for this user.
- Optionally restricts the networks that this user can connect from.
- Uses an ssh wrapper command to whitelist the commands that this user can run
over ssh.
Requires the openstack-nova-migration package from
https://review.rdoproject.org/r/6327
bp tripleo-cold-migration
Change-Id: Idb56acd1e1ecb5a5fd4d942969be428cc9cbe293
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| default.yaml | ||
| step1.yaml | ||
| step2.yaml | ||
| step3.yaml | ||
| step4.yaml | ||
| step5.yaml | ||
| step6.yaml | ||