DescriptionYurii Prokulevych
2015-08-06 13:11:08 UTC
Description of problem:
Mongodb instances running at overcloud can be accessed by anyone who knows their ips and access to dbs is not restricted.
mongo --host 192.0.2.22
MongoDB shell version: 2.6.9
connecting to: 192.0.2.22:27017/test
Server has startup warnings:
2015-08-06T05:50:02.820-0400 [initandlisten]
2015-08-06T05:50:02.820-0400 [initandlisten] ** WARNING: Readahead for /var/lib/mongodb is set to 4096KB
2015-08-06T05:50:02.820-0400 [initandlisten] ** We suggest setting it to 256KB (512 sectors) or less
2015-08-06T05:50:02.820-0400 [initandlisten] ** http://dochub.mongodb.org/core/readahead
tripleo:PRIMARY> use ceilometer
switched to db ceilometer
tripleo:PRIMARY> db.getUsers()
[ ]
tripleo:PRIMARY> show collections
alarm
alarm_history
event
meter
resource
system.indexes
tripleo:PRIMARY>
---
grep '^connection' /etc/ceilometer/ceilometer.conf
connection=mongodb://192.0.2.22:27017,192.0.2.19:27017,192.0.2.21:27017/ceilometer?replicaSet=tripleo
Version-Release number of selected component (if applicable):
=======
openstack-heat-api-cfn-2015.1.0-5.el7ost.noarch
openstack-heat-api-cloudwatch-2015.1.0-5.el7ost.noarch
python-heatclient-0.6.0-1.el7ost.noarch
heat-cfntools-1.2.8-2.el7.noarch
openstack-heat-templates-0-0.6.20150605git.el7ost.noarch
openstack-tripleo-heat-templates-0.8.6-45.el7ost.noarch
openstack-heat-engine-2015.1.0-5.el7ost.noarch
openstack-heat-api-2015.1.0-5.el7ost.noarch
openstack-heat-common-2015.1.0-5.el7ost.noarch
openstack-ceilometer-notification-2015.1.0-10.el7ost.noarch
openstack-ceilometer-alarm-2015.1.0-10.el7ost.noarch
openstack-ceilometer-common-2015.1.0-10.el7ost.noarch
python-ceilometerclient-1.0.13-1.el7ost.noarch
openstack-ceilometer-collector-2015.1.0-10.el7ost.noarch
openstack-ceilometer-api-2015.1.0-10.el7ost.noarch
openstack-ceilometer-central-2015.1.0-10.el7ost.noarch
python-ceilometer-2015.1.0-10.el7ost.noarch
Expected results:
===
Mongodb instances are configured with dedicated ceilometer user,
'connection' option from ceilometer.conf updated respectively:
conncection=mongodb://ceilometer:<PASSWORD>@192.0.2.22:27017,192.0.2.19:27017,192.0.2.21:27017/ceilometer?replicaSet=tripleo
The OpenShift 7 installer doesn't yet allow easy setup or authentication for ceilometer/mongodb. However the standard production install process (Network ISO) does allow the creation of an isolated network, which would prevent exploitation of this issue. The other installation methods (e.g. non Network ISO) are not intended for production use but instead for testing/proof of concept/etc. As such this issue is considered a security hardening issue and not a security vulnerability, so a CVE will not be assigned and the full security process will not be needed.
Leaving this issue open as per mburns so they can track it and deal with it.