openstack/security-doc
Code Issues Proposed changes

Merge "Add a glossary link to 'Nginx's"

Browse Source
This commit is contained in:
Jenkins
2016-09-09 17:21:07 +00:00
committed by Gerrit Code Review
parent 75ee55040d c7ddd52fd9
commit 1e0e77d363
6 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
security-guide/source/api-endpoints/api-endpoint-configuration-recommendations.rst
View File

@@ -151,5 +151,5 @@ It is key that the operator carefully plans and considers the individual
performance needs of users and services within their OpenStack cloud when performance needs of users and services within their OpenStack cloud when
configuring and implementing any rate limiting functionality. configuring and implementing any rate limiting functionality.
Common solutions for providing rate-limiting are Nginx, HAProxy, OpenRepose, or Common solutions for providing rate-limiting are :term:`Nginx`, HAProxy,
Apache Modules such as mod_ratelimit, mod_qos, or mod_security. OpenRepose, or Apache Modules such as mod_ratelimit, mod_qos, or mod_security.

4
security-guide/source/api-endpoints/case-studies.rst
View File

@@ -39,8 +39,8 @@ Bob's public cloud
~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~
Bob must also protect the access to the public and private endpoints, so Bob must also protect the access to the public and private endpoints, so
he elects to use the more lightweight Nginx web server on both public he elects to use the more lightweight :term:`Nginx` web server on both public
and internal services. On the public services, he has configured Nginx and internal services. On the public services, he has configured :term:`Nginx`
for high availability and has installed the certificate key files with for high availability and has installed the certificate key files with
certificates signed by a well-known Certificate Authority. He has used certificates signed by a well-known Certificate Authority. He has used
his organization's self-signed CA to sign certificates in the internal his organization's self-signed CA to sign certificates in the internal

6
security-guide/source/dashboard/case-studies.rst
View File

@@ -43,17 +43,17 @@ Bob's public cloud
Bob expects the dashboard to be one of the main methods of interaction Bob expects the dashboard to be one of the main methods of interaction
users will have with their cloud, and as such he deploys the latest users will have with their cloud, and as such he deploys the latest
version of Nginx that has integrated active-passive high-availability version of :term:`Nginx` that has integrated active-passive high-availability
based on keepalived. He makes sure that his networking configuration is based on keepalived. He makes sure that his networking configuration is
configured to handle VRRP (used by keepalived), sets unique values configured to handle VRRP (used by keepalived), sets unique values
for the `virtual_router_id` in the Nginx configuration file, determines for the `virtual_router_id` in the :term:`Nginx` configuration file, determines
which instance will start as master, and upates the proper values for which instance will start as master, and upates the proper values for
the `unicast_src_ip` and `unicast_peer` setttings. He makes sure that the `unicast_src_ip` and `unicast_peer` setttings. He makes sure that
both instances have their own copy of the configuration file and the both instances have their own copy of the configuration file and the
`chk_nginx_service` script is configured to ensure the instances are `chk_nginx_service` script is configured to ensure the instances are
validating the local node's priority. validating the local node's priority.
Bob then enables HSTS by adding a new response header in the Nginx Bob then enables HSTS by adding a new response header in the :term:`Nginx`
server block, substituting applicable values for <NAME> and <TIME>: server block, substituting applicable values for <NAME> and <TIME>:
.. code:: console .. code:: console

6
security-guide/source/dashboard/domains-dashboard-upgrades-basic-web-server-configuration.rst
View File

@@ -42,11 +42,11 @@ Basic web server configuration
The dashboard should be deployed as a Web Services Gateway The dashboard should be deployed as a Web Services Gateway
Interface (WSGI) application behind an HTTPS proxy such as Interface (WSGI) application behind an HTTPS proxy such as
Apache or Nginx. If Apache is not already in use, we recommend Apache or :term:`Nginx`. If Apache is not already in use, we recommend
Nginx since it is lightweight and easier to configure :term:`Nginx` since it is lightweight and easier to configure
correctly. correctly.
When using Nginx, we recommend When using :term:`Nginx`, we recommend
`gunicorn <http://docs.gunicorn.org/en/latest/deploy.html>`_ `gunicorn <http://docs.gunicorn.org/en/latest/deploy.html>`_
as the WSGI host with an appropriate number as the WSGI host with an appropriate number
of synchronous workers. When using Apache, we recommend of synchronous workers. When using Apache, we recommend

2
security-guide/source/dashboard/front-end-caching-session-back-end.rst
View File

@@ -10,7 +10,7 @@ dashboard. The dashboard is rendering dynamic content resulting
directly from OpenStack API requests and front-end caching layers directly from OpenStack API requests and front-end caching layers
such as varnish can prevent the correct content from being such as varnish can prevent the correct content from being
displayed. In Django, static media is directly served from Apache displayed. In Django, static media is directly served from Apache
or Nginx and already benefits from web host caching. or :term:`Nginx` and already benefits from web host caching.
Session back end Session back end
~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~

4
security-guide/source/secure-communication/tls-proxies-and-http-services.rst
View File

@@ -212,7 +212,7 @@ However, it is not provided by default.
Nginx Nginx
----- -----
This Nginx example requires TLS v1.1 or v1.2 for maximum security. The This :term:`Nginx` example requires TLS v1.1 or v1.2 for maximum security. The
``ssl_ciphers`` line can be tweaked based on your needs, however this ``ssl_ciphers`` line can be tweaked based on your needs, however this
is a reasonable starting place. is a reasonable starting place.
The default configuration file is ``/etc/nginx/nginx.conf``. The default configuration file is ``/etc/nginx/nginx.conf``.
@@ -324,7 +324,7 @@ Configuring TLS servers for perfect forward secrecy requires
careful planning around key size, session IDs, and session careful planning around key size, session IDs, and session
tickets. In addition, for multi-server deployments, shared tickets. In addition, for multi-server deployments, shared
state is also an important consideration. The example state is also an important consideration. The example
configurations for Apache and Nginx above disable the session configurations for Apache and :term:`Nginx` above disable the session
tickets options to help mitigate some of these concerns. tickets options to help mitigate some of these concerns.
Real-world deployments may desire to enable this feature for Real-world deployments may desire to enable this feature for
improved performance. This can be done securely, but would improved performance. This can be done securely, but would