Statistics
| Branch: | Tag: | Revision:

root / SECURITY @ 4a72cc75

History | View | Annotate | Download (3.1 kB)

1 28cc354f Iustin Pop
Security in Ganeti
2 28cc354f Iustin Pop
~~~~~~~~~~~~~~~~~~
3 28cc354f Iustin Pop
4 28cc354f Iustin Pop
Ganeti was developed to run on internal, trusted systems. As such, the
5 28cc354f Iustin Pop
security model is all-or-nothing.
6 28cc354f Iustin Pop
7 28cc354f Iustin Pop
All the Ganeti code runs as root, because all the operations that Ganeti
8 28cc354f Iustin Pop
is doing require privileges: creating logical volumes, md arrays,
9 28cc354f Iustin Pop
starting instances, etc. Running as root does not mean setuid, but that
10 28cc354f Iustin Pop
you need to be root to run the cluster commands.
11 28cc354f Iustin Pop
12 28cc354f Iustin Pop
Host issues
13 28cc354f Iustin Pop
-----------
14 28cc354f Iustin Pop
15 28cc354f Iustin Pop
For a host on which the Ganeti software has been installed but which has
16 28cc354f Iustin Pop
not been joined in a cluster, there are no changes to the system.
17 28cc354f Iustin Pop
18 28cc354f Iustin Pop
For a host that has been joined to the cluster, there are very important
19 28cc354f Iustin Pop
changes:
20 28cc354f Iustin Pop
  - the host will have its ssh host key replaced with the one of the
21 28cc354f Iustin Pop
    cluster (which is the one the initial node had at the cluster
22 28cc354f Iustin Pop
    creation)
23 28cc354f Iustin Pop
  - root will have added to its authorized_keys file a public key which
24 28cc354f Iustin Pop
    grants access to all other nodes in the cluster, and furthermore it
25 28cc354f Iustin Pop
    will also get the private part of this key, which will allow it to
26 28cc354f Iustin Pop
    login to the other nodes in the cluster (its previous private key
27 28cc354f Iustin Pop
    will be backed up)
28 28cc354f Iustin Pop
  - the Ganeti node daemon will accept RPC requests from any host which
29 28cc354f Iustin Pop
    has the cluster shared secret, and the operations it will do as a
30 28cc354f Iustin Pop
    result of these requests are:
31 28cc354f Iustin Pop
      - running commands under the /etc/ganeti/hooks directory
32 28cc354f Iustin Pop
      - creating DRBD disks between it and the IP it has been told
33 28cc354f Iustin Pop
      - overwrite a defined list of files on the host
34 28cc354f Iustin Pop
35 28cc354f Iustin Pop
As you can see, as soon as a node is joined, it becomes equal to all
36 28cc354f Iustin Pop
other nodes in the cluster, and the security of the cluster is
37 28cc354f Iustin Pop
determined by the weakest node.
38 28cc354f Iustin Pop
39 28cc354f Iustin Pop
Note that only the ssh key will allow other machines to run random
40 28cc354f Iustin Pop
commands on this node; the RPC method will run only:
41 28cc354f Iustin Pop
  - well defined commands to create, remove, activate logical volumes,
42 28cc354f Iustin Pop
    DRBD disks, md arrays, start/stop instances, etc;
43 28cc354f Iustin Pop
  - run ssh commands on other nodes in the cluster, again well-defined
44 28cc354f Iustin Pop
  - scripts under the /etc/ganeti/hooks directory
45 28cc354f Iustin Pop
46 28cc354f Iustin Pop
It is therefore important to make sure that the contents of the
47 28cc354f Iustin Pop
/etc/ganeti/hooks directory is supervised and only trusted sources can
48 28cc354f Iustin Pop
populate it.
49 28cc354f Iustin Pop
50 28cc354f Iustin Pop
Cluster issues
51 28cc354f Iustin Pop
--------------
52 28cc354f Iustin Pop
53 28cc354f Iustin Pop
As told above, there are multiple ways of communication between cluster
54 28cc354f Iustin Pop
nodes:
55 28cc354f Iustin Pop
  - ssh-based, for high-volume traffic (image dumps) or for low-level
56 28cc354f Iustin Pop
    command (restart the Ganeti node daemon)
57 28cc354f Iustin Pop
  - python-twisted based, for the usual operation
58 28cc354f Iustin Pop
  - DRBD traffic, for real-time disk replication traffic
59 28cc354f Iustin Pop
60 28cc354f Iustin Pop
The ssh traffic is protected (after the initial login to a new node) by
61 28cc354f Iustin Pop
the cluster-wide shared ssh key.
62 28cc354f Iustin Pop
63 28cc354f Iustin Pop
The python-twisted traffic is secured by SSL and two pre-conditions: the
64 28cc354f Iustin Pop
client will refuse to connect to servers which don't have the
65 28cc354f Iustin Pop
cluster-wide shared SSL certificate, and server will not allow clients
66 28cc354f Iustin Pop
which don't have the cluster-wide shared secret.
67 28cc354f Iustin Pop
68 28cc354f Iustin Pop
The DRBD traffic is not protected by anything, as the version of DRBD we
69 28cc354f Iustin Pop
require (0.7) does not have any protections. It's therefore recommended
70 28cc354f Iustin Pop
to implement host-level firewalling or to use a separate range of IP
71 28cc354f Iustin Pop
addresses for the DRBD traffic (this is supported in Ganeti) which is
72 28cc354f Iustin Pop
not routed outside the cluster.