Initial import of openstack-ansible-security role
This role contains around 150 controls from the 270+ controls that exist in the RHEL 6 STIG. New controls are still being added. Implements: blueprint security-hardening Change-Id: I0578f86bf42d55242bc72b97b40a5935a3cb18d6
This commit is contained in:
Major Hayden
parent
74b2aa6d0d
commit
bfcf6c7423
60
.gitignore
vendored
Normal file
60
.gitignore
vendored
Normal file
@ -0,0 +1,60 @@
|
|||||||
|
# Override Files #
|
||||||
|
rpc_deployment/playbooks/lab_plays
|
||||||
|
rpc_deployment/vars/overrides/*.yml
|
||||||
|
|
||||||
|
# Compiled source #
|
||||||
|
###################
|
||||||
|
*.com
|
||||||
|
*.class
|
||||||
|
*.dll
|
||||||
|
*.exe
|
||||||
|
*.o
|
||||||
|
*.so
|
||||||
|
*.pyc
|
||||||
|
build/
|
||||||
|
dist/
|
||||||
|
doc/build/
|
||||||
|
|
||||||
|
# Packages #
|
||||||
|
############
|
||||||
|
# it's better to unpack these files and commit the raw source
|
||||||
|
# git has its own built in compression methods
|
||||||
|
*.7z
|
||||||
|
*.dmg
|
||||||
|
*.gz
|
||||||
|
*.iso
|
||||||
|
*.jar
|
||||||
|
*.rar
|
||||||
|
*.tar
|
||||||
|
*.zip
|
||||||
|
|
||||||
|
# Logs and databases #
|
||||||
|
######################
|
||||||
|
*.log
|
||||||
|
*.sql
|
||||||
|
*.sqlite
|
||||||
|
|
||||||
|
# OS generated files #
|
||||||
|
######################
|
||||||
|
.DS_Store
|
||||||
|
.DS_Store?
|
||||||
|
._*
|
||||||
|
.Spotlight-V100
|
||||||
|
.Trashes
|
||||||
|
.idea
|
||||||
|
.tox
|
||||||
|
*.sublime*
|
||||||
|
*.egg-info
|
||||||
|
Icon?
|
||||||
|
ehthumbs.db
|
||||||
|
Thumbs.db
|
||||||
|
.eggs
|
||||||
|
|
||||||
|
# User driven backup files #
|
||||||
|
############################
|
||||||
|
*.bak
|
||||||
|
|
||||||
|
# Generated by pbr while building docs
|
||||||
|
######################################
|
||||||
|
AUTHORS
|
||||||
|
ChangeLog
|
||||||
202
LICENSE
Normal file
202
LICENSE
Normal file
@ -0,0 +1,202 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright {yyyy} {name of copyright owner}
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
|
||||||
30
README.rst
Normal file
30
README.rst
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
Security hardening for openstack-ansible
|
||||||
|
----------------------------------------
|
||||||
|
|
||||||
|
**--- Currently a work in progress ---**
|
||||||
|
|
||||||
|
Documentation is on `ReadTheDocs`_ temporarily.
|
||||||
|
|
||||||
|
.. _ReadTheDocs: http://openstack-ansible-security.readthedocs.org/en/latest/
|
||||||
|
|
||||||
|
What is this?
|
||||||
|
~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
The goal of this Ansible role is to provide additional security for deployments of openstack-ansible, the OpenStack project which deploys a fully-functional OpenStack environment using Ansible roles. For a more detailed explanation, review the security hardening spec in the section below.
|
||||||
|
|
||||||
|
How do I learn more?
|
||||||
|
~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
* `openstack-ansible`_
|
||||||
|
* `Security hardening spec`_ in openstack-ansible
|
||||||
|
* `RHEL 6 STIG`_ in `STIG Viewer`_
|
||||||
|
|
||||||
|
.. _openstack-ansible: https://github.com/openstack/openstack-ansible
|
||||||
|
.. _Security hardening spec: http://specs.openstack.org/openstack/openstack-ansible-specs/specs/mitaka/security-hardening.html
|
||||||
|
.. _RHEL 6 STIG: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/
|
||||||
|
.. _STIG Viewer: https://www.stigviewer.com
|
||||||
|
|
||||||
|
Questions or comments?
|
||||||
|
~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
|
||||||
|
Join ``#openstack-ansible`` on Freenode or email openstack-dev@lists.openstack.org with the tag ``[openstack-ansible]`` in the subject line.
|
||||||
3
dev-requirements.txt
Normal file
3
dev-requirements.txt
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
ansible-lint
|
||||||
|
oslosphinx>=2.5.0
|
||||||
|
sphinx
|
||||||
195
doc/Makefile
Normal file
195
doc/Makefile
Normal file
@ -0,0 +1,195 @@
|
|||||||
|
# Makefile for Sphinx documentation
|
||||||
|
#
|
||||||
|
|
||||||
|
# You can set these variables from the command line.
|
||||||
|
SPHINXOPTS =
|
||||||
|
SPHINXBUILD = sphinx-build
|
||||||
|
PAPER =
|
||||||
|
BUILDDIR = build
|
||||||
|
|
||||||
|
# User-friendly check for sphinx-build
|
||||||
|
ifeq ($(shell which $(SPHINXBUILD) >/dev/null 2>&1; echo $$?), 1)
|
||||||
|
$(error The '$(SPHINXBUILD)' command was not found. Make sure you have Sphinx installed, then set the SPHINXBUILD environment variable to point to the full path of the '$(SPHINXBUILD)' executable. Alternatively you can add the directory with the executable to your PATH. If you don't have Sphinx installed, grab it from http://sphinx-doc.org/)
|
||||||
|
endif
|
||||||
|
|
||||||
|
# Internal variables.
|
||||||
|
PAPEROPT_a4 = -D latex_paper_size=a4
|
||||||
|
PAPEROPT_letter = -D latex_paper_size=letter
|
||||||
|
ALLSPHINXOPTS = -d $(BUILDDIR)/doctrees $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
|
||||||
|
# the i18n builder cannot share the environment and doctrees with the others
|
||||||
|
I18NSPHINXOPTS = $(PAPEROPT_$(PAPER)) $(SPHINXOPTS) source
|
||||||
|
|
||||||
|
.PHONY: help clean html dirhtml singlehtml pickle json htmlhelp qthelp devhelp epub latex latexpdf text man changes linkcheck doctest coverage gettext
|
||||||
|
|
||||||
|
help:
|
||||||
|
@echo "Please use \`make <target>' where <target> is one of"
|
||||||
|
@echo " html to make standalone HTML files"
|
||||||
|
@echo " dirhtml to make HTML files named index.html in directories"
|
||||||
|
@echo " singlehtml to make a single large HTML file"
|
||||||
|
@echo " pickle to make pickle files"
|
||||||
|
@echo " json to make JSON files"
|
||||||
|
@echo " htmlhelp to make HTML files and a HTML help project"
|
||||||
|
@echo " qthelp to make HTML files and a qthelp project"
|
||||||
|
@echo " applehelp to make an Apple Help Book"
|
||||||
|
@echo " devhelp to make HTML files and a Devhelp project"
|
||||||
|
@echo " epub to make an epub"
|
||||||
|
@echo " latex to make LaTeX files, you can set PAPER=a4 or PAPER=letter"
|
||||||
|
@echo " latexpdf to make LaTeX files and run them through pdflatex"
|
||||||
|
@echo " latexpdfja to make LaTeX files and run them through platex/dvipdfmx"
|
||||||
|
@echo " text to make text files"
|
||||||
|
@echo " man to make manual pages"
|
||||||
|
@echo " texinfo to make Texinfo files"
|
||||||
|
@echo " info to make Texinfo files and run them through makeinfo"
|
||||||
|
@echo " gettext to make PO message catalogs"
|
||||||
|
@echo " changes to make an overview of all changed/added/deprecated items"
|
||||||
|
@echo " xml to make Docutils-native XML files"
|
||||||
|
@echo " pseudoxml to make pseudoxml-XML files for display purposes"
|
||||||
|
@echo " linkcheck to check all external links for integrity"
|
||||||
|
@echo " doctest to run all doctests embedded in the documentation (if enabled)"
|
||||||
|
@echo " coverage to run coverage check of the documentation (if enabled)"
|
||||||
|
|
||||||
|
clean:
|
||||||
|
rm -rf $(BUILDDIR)/*
|
||||||
|
|
||||||
|
html:
|
||||||
|
$(SPHINXBUILD) -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The HTML pages are in $(BUILDDIR)/html."
|
||||||
|
|
||||||
|
dirhtml:
|
||||||
|
$(SPHINXBUILD) -b dirhtml $(ALLSPHINXOPTS) $(BUILDDIR)/dirhtml
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The HTML pages are in $(BUILDDIR)/dirhtml."
|
||||||
|
|
||||||
|
singlehtml:
|
||||||
|
$(SPHINXBUILD) -b singlehtml $(ALLSPHINXOPTS) $(BUILDDIR)/singlehtml
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The HTML page is in $(BUILDDIR)/singlehtml."
|
||||||
|
|
||||||
|
pickle:
|
||||||
|
$(SPHINXBUILD) -b pickle $(ALLSPHINXOPTS) $(BUILDDIR)/pickle
|
||||||
|
@echo
|
||||||
|
@echo "Build finished; now you can process the pickle files."
|
||||||
|
|
||||||
|
json:
|
||||||
|
$(SPHINXBUILD) -b json $(ALLSPHINXOPTS) $(BUILDDIR)/json
|
||||||
|
@echo
|
||||||
|
@echo "Build finished; now you can process the JSON files."
|
||||||
|
|
||||||
|
htmlhelp:
|
||||||
|
$(SPHINXBUILD) -b htmlhelp $(ALLSPHINXOPTS) $(BUILDDIR)/htmlhelp
|
||||||
|
@echo
|
||||||
|
@echo "Build finished; now you can run HTML Help Workshop with the" \
|
||||||
|
".hhp project file in $(BUILDDIR)/htmlhelp."
|
||||||
|
|
||||||
|
qthelp:
|
||||||
|
$(SPHINXBUILD) -b qthelp $(ALLSPHINXOPTS) $(BUILDDIR)/qthelp
|
||||||
|
@echo
|
||||||
|
@echo "Build finished; now you can run "qcollectiongenerator" with the" \
|
||||||
|
".qhcp project file in $(BUILDDIR)/qthelp, like this:"
|
||||||
|
@echo "# qcollectiongenerator $(BUILDDIR)/qthelp/openstack-ansible.qhcp"
|
||||||
|
@echo "To view the help file:"
|
||||||
|
@echo "# assistant -collectionFile $(BUILDDIR)/qthelp/openstack-ansible.qhc"
|
||||||
|
|
||||||
|
applehelp:
|
||||||
|
$(SPHINXBUILD) -b applehelp $(ALLSPHINXOPTS) $(BUILDDIR)/applehelp
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The help book is in $(BUILDDIR)/applehelp."
|
||||||
|
@echo "N.B. You won't be able to view it unless you put it in" \
|
||||||
|
"~/Library/Documentation/Help or install it in your application" \
|
||||||
|
"bundle."
|
||||||
|
|
||||||
|
devhelp:
|
||||||
|
$(SPHINXBUILD) -b devhelp $(ALLSPHINXOPTS) $(BUILDDIR)/devhelp
|
||||||
|
@echo
|
||||||
|
@echo "Build finished."
|
||||||
|
@echo "To view the help file:"
|
||||||
|
@echo "# mkdir -p $$HOME/.local/share/devhelp/openstack-ansible"
|
||||||
|
@echo "# ln -s $(BUILDDIR)/devhelp $$HOME/.local/share/devhelp/openstack-ansible"
|
||||||
|
@echo "# devhelp"
|
||||||
|
|
||||||
|
epub:
|
||||||
|
$(SPHINXBUILD) -b epub $(ALLSPHINXOPTS) $(BUILDDIR)/epub
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The epub file is in $(BUILDDIR)/epub."
|
||||||
|
|
||||||
|
latex:
|
||||||
|
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||||
|
@echo
|
||||||
|
@echo "Build finished; the LaTeX files are in $(BUILDDIR)/latex."
|
||||||
|
@echo "Run \`make' in that directory to run these through (pdf)latex" \
|
||||||
|
"(use \`make latexpdf' here to do that automatically)."
|
||||||
|
|
||||||
|
latexpdf:
|
||||||
|
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||||
|
@echo "Running LaTeX files through pdflatex..."
|
||||||
|
$(MAKE) -C $(BUILDDIR)/latex all-pdf
|
||||||
|
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
|
||||||
|
|
||||||
|
latexpdfja:
|
||||||
|
$(SPHINXBUILD) -b latex $(ALLSPHINXOPTS) $(BUILDDIR)/latex
|
||||||
|
@echo "Running LaTeX files through platex and dvipdfmx..."
|
||||||
|
$(MAKE) -C $(BUILDDIR)/latex all-pdf-ja
|
||||||
|
@echo "pdflatex finished; the PDF files are in $(BUILDDIR)/latex."
|
||||||
|
|
||||||
|
text:
|
||||||
|
$(SPHINXBUILD) -b text $(ALLSPHINXOPTS) $(BUILDDIR)/text
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The text files are in $(BUILDDIR)/text."
|
||||||
|
|
||||||
|
man:
|
||||||
|
$(SPHINXBUILD) -b man $(ALLSPHINXOPTS) $(BUILDDIR)/man
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The manual pages are in $(BUILDDIR)/man."
|
||||||
|
|
||||||
|
texinfo:
|
||||||
|
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The Texinfo files are in $(BUILDDIR)/texinfo."
|
||||||
|
@echo "Run \`make' in that directory to run these through makeinfo" \
|
||||||
|
"(use \`make info' here to do that automatically)."
|
||||||
|
|
||||||
|
info:
|
||||||
|
$(SPHINXBUILD) -b texinfo $(ALLSPHINXOPTS) $(BUILDDIR)/texinfo
|
||||||
|
@echo "Running Texinfo files through makeinfo..."
|
||||||
|
make -C $(BUILDDIR)/texinfo info
|
||||||
|
@echo "makeinfo finished; the Info files are in $(BUILDDIR)/texinfo."
|
||||||
|
|
||||||
|
gettext:
|
||||||
|
$(SPHINXBUILD) -b gettext $(I18NSPHINXOPTS) $(BUILDDIR)/locale
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The message catalogs are in $(BUILDDIR)/locale."
|
||||||
|
|
||||||
|
changes:
|
||||||
|
$(SPHINXBUILD) -b changes $(ALLSPHINXOPTS) $(BUILDDIR)/changes
|
||||||
|
@echo
|
||||||
|
@echo "The overview file is in $(BUILDDIR)/changes."
|
||||||
|
|
||||||
|
linkcheck:
|
||||||
|
$(SPHINXBUILD) -b linkcheck $(ALLSPHINXOPTS) $(BUILDDIR)/linkcheck
|
||||||
|
@echo
|
||||||
|
@echo "Link check complete; look for any errors in the above output " \
|
||||||
|
"or in $(BUILDDIR)/linkcheck/output.txt."
|
||||||
|
|
||||||
|
doctest:
|
||||||
|
$(SPHINXBUILD) -b doctest $(ALLSPHINXOPTS) $(BUILDDIR)/doctest
|
||||||
|
@echo "Testing of doctests in the sources finished, look at the " \
|
||||||
|
"results in $(BUILDDIR)/doctest/output.txt."
|
||||||
|
|
||||||
|
coverage:
|
||||||
|
$(SPHINXBUILD) -b coverage $(ALLSPHINXOPTS) $(BUILDDIR)/coverage
|
||||||
|
@echo "Testing of coverage in the sources finished, look at the " \
|
||||||
|
"results in $(BUILDDIR)/coverage/python.txt."
|
||||||
|
|
||||||
|
xml:
|
||||||
|
$(SPHINXBUILD) -b xml $(ALLSPHINXOPTS) $(BUILDDIR)/xml
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The XML files are in $(BUILDDIR)/xml."
|
||||||
|
|
||||||
|
pseudoxml:
|
||||||
|
$(SPHINXBUILD) -b pseudoxml $(ALLSPHINXOPTS) $(BUILDDIR)/pseudoxml
|
||||||
|
@echo
|
||||||
|
@echo "Build finished. The pseudo-XML files are in $(BUILDDIR)/pseudoxml."
|
||||||
|
|
||||||
|
livehtml: html
|
||||||
|
sphinx-autobuild -b html $(ALLSPHINXOPTS) $(BUILDDIR)/html
|
||||||
0
doc/source/_static/.gitkeep
Normal file
0
doc/source/_static/.gitkeep
Normal file
109
doc/source/_themes/openstack/layout.html
Normal file
109
doc/source/_themes/openstack/layout.html
Normal file
@ -0,0 +1,109 @@
|
|||||||
|
{% extends "basic/layout.html" %}
|
||||||
|
{% set css_files = css_files + ['_static/tweaks.css'] %}
|
||||||
|
|
||||||
|
{% block sidebar2 %}
|
||||||
|
<div class="sphinxsidebar">
|
||||||
|
<div class="sphinxsidebarwrapper">
|
||||||
|
{%- if not embedded %}{% if not theme_nosidebar|tobool %}
|
||||||
|
{%- block sidebarlogo %}
|
||||||
|
{%- if logo %}
|
||||||
|
<p class="logo"><a href="{{ pathto(master_doc) }}">
|
||||||
|
<img class="logo" src="{{ pathto('_static/' + logo, 1) }}" alt="Logo"/>
|
||||||
|
</a></p>
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- block sidebartoc %}
|
||||||
|
{%- if display_toc %}
|
||||||
|
<h3><a href="{{ pathto(master_doc) }}">{{ _('Table Of Contents') }}</a></h3>
|
||||||
|
{{ toc }}
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- block sidebarrel %}
|
||||||
|
{%- if prev %}
|
||||||
|
<h4>{{ _('Previous topic') }}</h4>
|
||||||
|
<p class="topless"><a href="{{ prev.link|e }}"
|
||||||
|
title="{{ _('previous chapter') }}">{{ prev.title }}</a></p>
|
||||||
|
{%- endif %}
|
||||||
|
{%- if next %}
|
||||||
|
<h4>{{ _('Next topic') }}</h4>
|
||||||
|
<p class="topless"><a href="{{ next.link|e }}"
|
||||||
|
title="{{ _('next chapter') }}">{{ next.title }}</a></p>
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- block projectsource %}
|
||||||
|
{%- if cgit_link %}
|
||||||
|
<h3>{{ _('Project Source') }}</h3>
|
||||||
|
<ul class="this-page-menu">
|
||||||
|
<li><a href="{{cgit_link}}"
|
||||||
|
rel="nofollow">{{ _('Project Source') }}</a></li>
|
||||||
|
</ul>
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- block sidebarsourcelink %}
|
||||||
|
{%- if show_source and has_source and sourcename %}
|
||||||
|
<h3>{{ _('This Page') }}</h3>
|
||||||
|
<ul class="this-page-menu">
|
||||||
|
<li><a href="{{ pathto('_sources/' + sourcename, true)|e }}"
|
||||||
|
rel="nofollow">{{ _('Show Source') }}</a></li>
|
||||||
|
</ul>
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- if customsidebar %}
|
||||||
|
{% include customsidebar %}
|
||||||
|
{%- endif %}
|
||||||
|
{%- block sidebarsearch %}
|
||||||
|
{%- if pagename != "search" %}
|
||||||
|
<div id="searchbox" style="display: none">
|
||||||
|
<h3>{{ _('Quick search') }}</h3>
|
||||||
|
<form class="search" action="{{ pathto('search') }}" method="get">
|
||||||
|
<input type="text" name="q" size="18" />
|
||||||
|
<input type="submit" value="{{ _('Go') }}" />
|
||||||
|
<input type="hidden" name="check_keywords" value="yes" />
|
||||||
|
<input type="hidden" name="area" value="default" />
|
||||||
|
</form>
|
||||||
|
<p class="searchtip" style="font-size: 90%">
|
||||||
|
{{ _('Enter search terms or a module, class or function name.') }}
|
||||||
|
</p>
|
||||||
|
</div>
|
||||||
|
<script type="text/javascript">$('#searchbox').show(0);</script>
|
||||||
|
{%- endif %}
|
||||||
|
{%- endblock %}
|
||||||
|
{%- endif %}{% endif %}
|
||||||
|
</div>
|
||||||
|
</div>
|
||||||
|
{% endblock %}
|
||||||
|
|
||||||
|
{% block relbar1 %}{% endblock relbar1 %}
|
||||||
|
|
||||||
|
{% block header %}
|
||||||
|
<div id="header">
|
||||||
|
<h1 id="logo"><a href="http://www.openstack.org/">OpenStack</a></h1>
|
||||||
|
<ul id="navigation">
|
||||||
|
{% block header_navigation %}
|
||||||
|
<li><a href="http://www.openstack.org/" title="Go to the Home page" class="link">Home</a></li>
|
||||||
|
<li><a href="http://www.openstack.org/projects/" title="Go to the OpenStack Projects page">Projects</a></li>
|
||||||
|
<li><a href="http://www.openstack.org/user-stories/" title="Go to the User Stories page" class="link">User Stories</a></li>
|
||||||
|
<li><a href="http://www.openstack.org/community/" title="Go to the Community page" class="link">Community</a></li>
|
||||||
|
<li><a href="http://www.openstack.org/blog/" title="Go to the OpenStack Blog">Blog</a></li>
|
||||||
|
<li><a href="http://wiki.openstack.org/" title="Go to the OpenStack Wiki">Wiki</a></li>
|
||||||
|
<li><a href="http://docs.openstack.org/" title="Go to OpenStack Documentation" class="current">Documentation</a></li>
|
||||||
|
{% endblock %}
|
||||||
|
</ul>
|
||||||
|
</div>
|
||||||
|
{% endblock %}
|
||||||
|
|
||||||
|
{% block footer %}
|
||||||
|
{{ super() }}
|
||||||
|
<script type="text/javascript">
|
||||||
|
var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");
|
||||||
|
document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));
|
||||||
|
</script>
|
||||||
|
<script type="text/javascript">
|
||||||
|
try {
|
||||||
|
//Tracking docs.openstack.org/developer/<projectname> only
|
||||||
|
//The URL is built from the project variable in conf.py
|
||||||
|
var pageTracker = _gat._getTracker("UA-17511903-1");
|
||||||
|
pageTracker._setCookiePath("/developer/{{ project }}");
|
||||||
|
pageTracker._trackPageview();
|
||||||
|
} catch(err) {}</script>
|
||||||
|
{% endblock %}
|
||||||
419
doc/source/_themes/openstack/static/basic.css
Normal file
419
doc/source/_themes/openstack/static/basic.css
Normal file
@ -0,0 +1,419 @@
|
|||||||
|
/**
|
||||||
|
* Sphinx stylesheet -- basic theme
|
||||||
|
* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
*/
|
||||||
|
|
||||||
|
/* -- main layout ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.clearer {
|
||||||
|
clear: both;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- relbar ---------------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.related {
|
||||||
|
font-size: 90%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related h3 {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related ul {
|
||||||
|
margin: 0;
|
||||||
|
padding: 0 0 0 10px;
|
||||||
|
list-style: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related li {
|
||||||
|
display: inline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related li.right {
|
||||||
|
float: right;
|
||||||
|
margin-right: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- sidebar --------------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.sphinxsidebarwrapper {
|
||||||
|
padding: 10px 5px 0 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar {
|
||||||
|
float: left;
|
||||||
|
width: 260px;
|
||||||
|
margin-left: -100%;
|
||||||
|
font-size: 90%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul {
|
||||||
|
list-style: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul ul,
|
||||||
|
div.sphinxsidebar ul.want-points {
|
||||||
|
margin-left: 20px;
|
||||||
|
list-style: square;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul ul {
|
||||||
|
margin-top: 0;
|
||||||
|
margin-bottom: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar form {
|
||||||
|
margin-top: 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar input {
|
||||||
|
border: 1px solid #98dbcc;
|
||||||
|
font-family: sans-serif;
|
||||||
|
font-size: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar span.pre {
|
||||||
|
word-wrap: break-word;
|
||||||
|
}
|
||||||
|
|
||||||
|
img {
|
||||||
|
border: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- search page ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
ul.search {
|
||||||
|
margin: 10px 0 0 20px;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
ul.search li {
|
||||||
|
padding: 5px 0 5px 20px;
|
||||||
|
background-image: url(file.png);
|
||||||
|
background-repeat: no-repeat;
|
||||||
|
background-position: 0 7px;
|
||||||
|
}
|
||||||
|
|
||||||
|
ul.search li a {
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
ul.search li div.context {
|
||||||
|
color: #888;
|
||||||
|
margin: 2px 0 0 30px;
|
||||||
|
text-align: left;
|
||||||
|
}
|
||||||
|
|
||||||
|
ul.keywordmatches li.goodmatch a {
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- index page ------------------------------------------------------------ */
|
||||||
|
|
||||||
|
table.contentstable {
|
||||||
|
width: 90%;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.contentstable p.biglink {
|
||||||
|
line-height: 150%;
|
||||||
|
}
|
||||||
|
|
||||||
|
a.biglink {
|
||||||
|
font-size: 1.3em;
|
||||||
|
}
|
||||||
|
|
||||||
|
span.linkdescr {
|
||||||
|
font-style: italic;
|
||||||
|
padding-top: 5px;
|
||||||
|
font-size: 90%;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- general index --------------------------------------------------------- */
|
||||||
|
|
||||||
|
table.indextable td {
|
||||||
|
text-align: left;
|
||||||
|
vertical-align: top;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.indextable dl, table.indextable dd {
|
||||||
|
margin-top: 0;
|
||||||
|
margin-bottom: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.indextable tr.pcap {
|
||||||
|
height: 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.indextable tr.cap {
|
||||||
|
margin-top: 10px;
|
||||||
|
background-color: #f2f2f2;
|
||||||
|
}
|
||||||
|
|
||||||
|
img.toggler {
|
||||||
|
margin-right: 3px;
|
||||||
|
margin-top: 3px;
|
||||||
|
cursor: pointer;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- general body styles --------------------------------------------------- */
|
||||||
|
|
||||||
|
a.headerlink {
|
||||||
|
visibility: hidden;
|
||||||
|
}
|
||||||
|
|
||||||
|
h1:hover > a.headerlink,
|
||||||
|
h2:hover > a.headerlink,
|
||||||
|
h3:hover > a.headerlink,
|
||||||
|
h4:hover > a.headerlink,
|
||||||
|
h5:hover > a.headerlink,
|
||||||
|
h6:hover > a.headerlink,
|
||||||
|
dt:hover > a.headerlink {
|
||||||
|
visibility: visible;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body p.caption {
|
||||||
|
text-align: inherit;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body td {
|
||||||
|
text-align: left;
|
||||||
|
}
|
||||||
|
|
||||||
|
.field-list ul {
|
||||||
|
padding-left: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.first {
|
||||||
|
}
|
||||||
|
|
||||||
|
p.rubric {
|
||||||
|
margin-top: 30px;
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- sidebars -------------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.sidebar {
|
||||||
|
margin: 0 0 0.5em 1em;
|
||||||
|
border: 1px solid #ddb;
|
||||||
|
padding: 7px 7px 0 7px;
|
||||||
|
background-color: #ffe;
|
||||||
|
width: 40%;
|
||||||
|
float: right;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.sidebar-title {
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- topics ---------------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.topic {
|
||||||
|
border: 1px solid #ccc;
|
||||||
|
padding: 7px 7px 0 7px;
|
||||||
|
margin: 10px 0 10px 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.topic-title {
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-weight: bold;
|
||||||
|
margin-top: 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- admonitions ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
div.admonition {
|
||||||
|
margin-top: 10px;
|
||||||
|
margin-bottom: 10px;
|
||||||
|
padding: 7px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition dt {
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition dl {
|
||||||
|
margin-bottom: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.admonition-title {
|
||||||
|
margin: 0px 10px 5px 0px;
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body p.centered {
|
||||||
|
text-align: center;
|
||||||
|
margin-top: 25px;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- tables ---------------------------------------------------------------- */
|
||||||
|
|
||||||
|
table.docutils {
|
||||||
|
border: 0;
|
||||||
|
border-collapse: collapse;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.docutils td, table.docutils th {
|
||||||
|
padding: 1px 8px 1px 0;
|
||||||
|
border-top: 0;
|
||||||
|
border-left: 0;
|
||||||
|
border-right: 0;
|
||||||
|
border-bottom: 1px solid #aaa;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.field-list td, table.field-list th {
|
||||||
|
border: 0 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.footnote td, table.footnote th {
|
||||||
|
border: 0 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
th {
|
||||||
|
text-align: left;
|
||||||
|
padding-right: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- other body styles ----------------------------------------------------- */
|
||||||
|
|
||||||
|
dl {
|
||||||
|
margin-bottom: 15px;
|
||||||
|
}
|
||||||
|
|
||||||
|
dd p {
|
||||||
|
margin-top: 0px;
|
||||||
|
}
|
||||||
|
|
||||||
|
dd ul, dd table {
|
||||||
|
margin-bottom: 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
dd {
|
||||||
|
margin-top: 3px;
|
||||||
|
margin-bottom: 10px;
|
||||||
|
margin-left: 30px;
|
||||||
|
}
|
||||||
|
|
||||||
|
dt:target, .highlight {
|
||||||
|
background-color: #fbe54e;
|
||||||
|
}
|
||||||
|
|
||||||
|
dl.glossary dt {
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.field-list ul {
|
||||||
|
margin: 0;
|
||||||
|
padding-left: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.field-list p {
|
||||||
|
margin: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
.refcount {
|
||||||
|
color: #060;
|
||||||
|
}
|
||||||
|
|
||||||
|
.optional {
|
||||||
|
font-size: 1.3em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.versionmodified {
|
||||||
|
font-style: italic;
|
||||||
|
}
|
||||||
|
|
||||||
|
.system-message {
|
||||||
|
background-color: #fda;
|
||||||
|
padding: 5px;
|
||||||
|
border: 3px solid red;
|
||||||
|
}
|
||||||
|
|
||||||
|
.footnote:target {
|
||||||
|
background-color: #ffa
|
||||||
|
}
|
||||||
|
|
||||||
|
.line-block {
|
||||||
|
display: block;
|
||||||
|
margin-top: 1em;
|
||||||
|
margin-bottom: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.line-block .line-block {
|
||||||
|
margin-top: 0;
|
||||||
|
margin-bottom: 0;
|
||||||
|
margin-left: 1.5em;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- code displays --------------------------------------------------------- */
|
||||||
|
|
||||||
|
pre {
|
||||||
|
overflow: auto;
|
||||||
|
}
|
||||||
|
|
||||||
|
td.linenos pre {
|
||||||
|
padding: 5px 0px;
|
||||||
|
border: 0;
|
||||||
|
background-color: transparent;
|
||||||
|
color: #aaa;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.highlighttable {
|
||||||
|
margin-left: 0.5em;
|
||||||
|
}
|
||||||
|
|
||||||
|
table.highlighttable td {
|
||||||
|
padding: 0 0.5em 0 0.5em;
|
||||||
|
}
|
||||||
|
|
||||||
|
tt.descname {
|
||||||
|
background-color: transparent;
|
||||||
|
font-weight: bold;
|
||||||
|
font-size: 1.2em;
|
||||||
|
}
|
||||||
|
|
||||||
|
tt.descclassname {
|
||||||
|
background-color: transparent;
|
||||||
|
}
|
||||||
|
|
||||||
|
tt.xref, a tt {
|
||||||
|
background-color: transparent;
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
h1 tt, h2 tt, h3 tt, h4 tt, h5 tt, h6 tt {
|
||||||
|
background-color: transparent;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- math display ---------------------------------------------------------- */
|
||||||
|
|
||||||
|
img.math {
|
||||||
|
vertical-align: middle;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body div.math p {
|
||||||
|
text-align: center;
|
||||||
|
}
|
||||||
|
|
||||||
|
span.eqno {
|
||||||
|
float: right;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- printout stylesheet --------------------------------------------------- */
|
||||||
|
|
||||||
|
@media print {
|
||||||
|
div.document,
|
||||||
|
div.documentwrapper,
|
||||||
|
div.bodywrapper {
|
||||||
|
margin: 0 !important;
|
||||||
|
width: 100%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar,
|
||||||
|
div.related,
|
||||||
|
div.footer,
|
||||||
|
#top-link {
|
||||||
|
display: none;
|
||||||
|
}
|
||||||
|
}
|
||||||
230
doc/source/_themes/openstack/static/default.css
Normal file
230
doc/source/_themes/openstack/static/default.css
Normal file
@ -0,0 +1,230 @@
|
|||||||
|
/**
|
||||||
|
* Sphinx stylesheet -- default theme
|
||||||
|
* ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
||||||
|
*/
|
||||||
|
|
||||||
|
@import url("basic.css");
|
||||||
|
|
||||||
|
/* -- page layout ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
body {
|
||||||
|
font-family: sans-serif;
|
||||||
|
font-size: 100%;
|
||||||
|
background-color: #11303d;
|
||||||
|
color: #000;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.document {
|
||||||
|
background-color: #1c4e63;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.documentwrapper {
|
||||||
|
float: left;
|
||||||
|
width: 100%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.bodywrapper {
|
||||||
|
margin: 0 0 0 230px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body {
|
||||||
|
background-color: #ffffff;
|
||||||
|
color: #000000;
|
||||||
|
padding: 0 20px 30px 20px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.footer {
|
||||||
|
color: #ffffff;
|
||||||
|
width: 100%;
|
||||||
|
padding: 9px 0 9px 0;
|
||||||
|
text-align: center;
|
||||||
|
font-size: 75%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.footer a {
|
||||||
|
color: #ffffff;
|
||||||
|
text-decoration: underline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related {
|
||||||
|
background-color: #133f52;
|
||||||
|
line-height: 30px;
|
||||||
|
color: #ffffff;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related a {
|
||||||
|
color: #ffffff;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar {
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3 {
|
||||||
|
font-family: 'Trebuchet MS', sans-serif;
|
||||||
|
color: #ffffff;
|
||||||
|
font-size: 1.4em;
|
||||||
|
font-weight: normal;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3 a {
|
||||||
|
color: #ffffff;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h4 {
|
||||||
|
font-family: 'Trebuchet MS', sans-serif;
|
||||||
|
color: #ffffff;
|
||||||
|
font-size: 1.3em;
|
||||||
|
font-weight: normal;
|
||||||
|
margin: 5px 0 0 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar p {
|
||||||
|
color: #ffffff;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar p.topless {
|
||||||
|
margin: 5px 10px 10px 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul {
|
||||||
|
margin: 10px;
|
||||||
|
padding: 0;
|
||||||
|
color: #ffffff;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar a {
|
||||||
|
color: #98dbcc;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar input {
|
||||||
|
border: 1px solid #98dbcc;
|
||||||
|
font-family: sans-serif;
|
||||||
|
font-size: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- body styles ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
a {
|
||||||
|
color: #355f7c;
|
||||||
|
text-decoration: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
a:hover {
|
||||||
|
text-decoration: underline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body p, div.body dd, div.body li {
|
||||||
|
text-align: left;
|
||||||
|
line-height: 130%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body h1,
|
||||||
|
div.body h2,
|
||||||
|
div.body h3,
|
||||||
|
div.body h4,
|
||||||
|
div.body h5,
|
||||||
|
div.body h6 {
|
||||||
|
font-family: 'Trebuchet MS', sans-serif;
|
||||||
|
background-color: #f2f2f2;
|
||||||
|
font-weight: normal;
|
||||||
|
color: #20435c;
|
||||||
|
border-bottom: 1px solid #ccc;
|
||||||
|
margin: 20px -20px 10px -20px;
|
||||||
|
padding: 3px 0 3px 10px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body h1 { margin-top: 0; font-size: 200%; }
|
||||||
|
div.body h2 { font-size: 160%; }
|
||||||
|
div.body h3 { font-size: 140%; }
|
||||||
|
div.body h4 { font-size: 120%; }
|
||||||
|
div.body h5 { font-size: 110%; }
|
||||||
|
div.body h6 { font-size: 100%; }
|
||||||
|
|
||||||
|
a.headerlink {
|
||||||
|
color: #c60f0f;
|
||||||
|
font-size: 0.8em;
|
||||||
|
padding: 0 4px 0 4px;
|
||||||
|
text-decoration: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
a.headerlink:hover {
|
||||||
|
background-color: #c60f0f;
|
||||||
|
color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body p, div.body dd, div.body li {
|
||||||
|
text-align: left;
|
||||||
|
line-height: 130%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition p.admonition-title + p {
|
||||||
|
display: inline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition p {
|
||||||
|
margin-bottom: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition pre {
|
||||||
|
margin-bottom: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition ul, div.admonition ol {
|
||||||
|
margin-bottom: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.note {
|
||||||
|
background-color: #eee;
|
||||||
|
border: 1px solid #ccc;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.seealso {
|
||||||
|
background-color: #ffc;
|
||||||
|
border: 1px solid #ff6;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.topic {
|
||||||
|
background-color: #eee;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.warning {
|
||||||
|
background-color: #ffe4e4;
|
||||||
|
border: 1px solid #f66;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.admonition-title {
|
||||||
|
display: inline;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.admonition-title:after {
|
||||||
|
content: ":";
|
||||||
|
}
|
||||||
|
|
||||||
|
pre {
|
||||||
|
padding: 5px;
|
||||||
|
background-color: #eeffcc;
|
||||||
|
color: #333333;
|
||||||
|
line-height: 120%;
|
||||||
|
border: 1px solid #ac9;
|
||||||
|
border-left: none;
|
||||||
|
border-right: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
tt {
|
||||||
|
background-color: #ecf0f3;
|
||||||
|
padding: 0 1px 0 1px;
|
||||||
|
font-size: 0.95em;
|
||||||
|
}
|
||||||
|
|
||||||
|
.warning tt {
|
||||||
|
background: #efc2c2;
|
||||||
|
}
|
||||||
|
|
||||||
|
.note tt {
|
||||||
|
background: #d6d6d6;
|
||||||
|
}
|
||||||
BIN
doc/source/_themes/openstack/static/header-line.gif
Normal file
BIN
doc/source/_themes/openstack/static/header-line.gif
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 48 B |
BIN
doc/source/_themes/openstack/static/header_bg.jpg
Normal file
BIN
doc/source/_themes/openstack/static/header_bg.jpg
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 3.7 KiB |
245
doc/source/_themes/openstack/static/nature.css
Normal file
245
doc/source/_themes/openstack/static/nature.css
Normal file
@ -0,0 +1,245 @@
|
|||||||
|
/*
|
||||||
|
* nature.css_t
|
||||||
|
* ~~~~~~~~~~~~
|
||||||
|
*
|
||||||
|
* Sphinx stylesheet -- nature theme.
|
||||||
|
*
|
||||||
|
* :copyright: Copyright 2007-2011 by the Sphinx team, see AUTHORS.
|
||||||
|
* :license: BSD, see LICENSE for details.
|
||||||
|
*
|
||||||
|
*/
|
||||||
|
|
||||||
|
@import url("basic.css");
|
||||||
|
|
||||||
|
/* -- page layout ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
body {
|
||||||
|
font-family: Arial, sans-serif;
|
||||||
|
font-size: 100%;
|
||||||
|
background-color: #111;
|
||||||
|
color: #555;
|
||||||
|
margin: 0;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.documentwrapper {
|
||||||
|
float: left;
|
||||||
|
width: 100%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.bodywrapper {
|
||||||
|
margin: 0 0 0 {{ theme_sidebarwidth|toint }}px;
|
||||||
|
}
|
||||||
|
|
||||||
|
hr {
|
||||||
|
border: 1px solid #B1B4B6;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.document {
|
||||||
|
background-color: #eee;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body {
|
||||||
|
background-color: #ffffff;
|
||||||
|
color: #3E4349;
|
||||||
|
padding: 0 30px 30px 30px;
|
||||||
|
font-size: 0.9em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.footer {
|
||||||
|
color: #555;
|
||||||
|
width: 100%;
|
||||||
|
padding: 13px 0;
|
||||||
|
text-align: center;
|
||||||
|
font-size: 75%;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.footer a {
|
||||||
|
color: #444;
|
||||||
|
text-decoration: underline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related {
|
||||||
|
background-color: #6BA81E;
|
||||||
|
line-height: 32px;
|
||||||
|
color: #fff;
|
||||||
|
text-shadow: 0px 1px 0 #444;
|
||||||
|
font-size: 0.9em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related a {
|
||||||
|
color: #E2F3CC;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar {
|
||||||
|
font-size: 0.75em;
|
||||||
|
line-height: 1.5em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebarwrapper{
|
||||||
|
padding: 20px 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3,
|
||||||
|
div.sphinxsidebar h4 {
|
||||||
|
font-family: Arial, sans-serif;
|
||||||
|
color: #222;
|
||||||
|
font-size: 1.2em;
|
||||||
|
font-weight: normal;
|
||||||
|
margin: 0;
|
||||||
|
padding: 5px 10px;
|
||||||
|
background-color: #ddd;
|
||||||
|
text-shadow: 1px 1px 0 white
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h4{
|
||||||
|
font-size: 1.1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3 a {
|
||||||
|
color: #444;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
div.sphinxsidebar p {
|
||||||
|
color: #888;
|
||||||
|
padding: 5px 20px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar p.topless {
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul {
|
||||||
|
margin: 10px 20px;
|
||||||
|
padding: 0;
|
||||||
|
color: #000;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar a {
|
||||||
|
color: #444;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar input {
|
||||||
|
border: 1px solid #ccc;
|
||||||
|
font-family: sans-serif;
|
||||||
|
font-size: 1em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar input[type=text]{
|
||||||
|
margin-left: 20px;
|
||||||
|
}
|
||||||
|
|
||||||
|
/* -- body styles ----------------------------------------------------------- */
|
||||||
|
|
||||||
|
a {
|
||||||
|
color: #005B81;
|
||||||
|
text-decoration: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
a:hover {
|
||||||
|
color: #E32E00;
|
||||||
|
text-decoration: underline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body h1,
|
||||||
|
div.body h2,
|
||||||
|
div.body h3,
|
||||||
|
div.body h4,
|
||||||
|
div.body h5,
|
||||||
|
div.body h6 {
|
||||||
|
font-family: Arial, sans-serif;
|
||||||
|
background-color: #BED4EB;
|
||||||
|
font-weight: normal;
|
||||||
|
color: #212224;
|
||||||
|
margin: 30px 0px 10px 0px;
|
||||||
|
padding: 5px 0 5px 10px;
|
||||||
|
text-shadow: 0px 1px 0 white
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body h1 { border-top: 20px solid white; margin-top: 0; font-size: 200%; }
|
||||||
|
div.body h2 { font-size: 150%; background-color: #C8D5E3; }
|
||||||
|
div.body h3 { font-size: 120%; background-color: #D8DEE3; }
|
||||||
|
div.body h4 { font-size: 110%; background-color: #D8DEE3; }
|
||||||
|
div.body h5 { font-size: 100%; background-color: #D8DEE3; }
|
||||||
|
div.body h6 { font-size: 100%; background-color: #D8DEE3; }
|
||||||
|
|
||||||
|
a.headerlink {
|
||||||
|
color: #c60f0f;
|
||||||
|
font-size: 0.8em;
|
||||||
|
padding: 0 4px 0 4px;
|
||||||
|
text-decoration: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
a.headerlink:hover {
|
||||||
|
background-color: #c60f0f;
|
||||||
|
color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body p, div.body dd, div.body li {
|
||||||
|
line-height: 1.5em;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.admonition p.admonition-title + p {
|
||||||
|
display: inline;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.highlight{
|
||||||
|
background-color: white;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.note {
|
||||||
|
background-color: #eee;
|
||||||
|
border: 1px solid #ccc;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.seealso {
|
||||||
|
background-color: #ffc;
|
||||||
|
border: 1px solid #ff6;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.topic {
|
||||||
|
background-color: #eee;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.warning {
|
||||||
|
background-color: #ffe4e4;
|
||||||
|
border: 1px solid #f66;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.admonition-title {
|
||||||
|
display: inline;
|
||||||
|
}
|
||||||
|
|
||||||
|
p.admonition-title:after {
|
||||||
|
content: ":";
|
||||||
|
}
|
||||||
|
|
||||||
|
pre {
|
||||||
|
padding: 10px;
|
||||||
|
background-color: White;
|
||||||
|
color: #222;
|
||||||
|
line-height: 1.2em;
|
||||||
|
border: 1px solid #C6C9CB;
|
||||||
|
font-size: 1.1em;
|
||||||
|
margin: 1.5em 0 1.5em 0;
|
||||||
|
-webkit-box-shadow: 1px 1px 1px #d8d8d8;
|
||||||
|
-moz-box-shadow: 1px 1px 1px #d8d8d8;
|
||||||
|
}
|
||||||
|
|
||||||
|
tt {
|
||||||
|
background-color: #ecf0f3;
|
||||||
|
color: #222;
|
||||||
|
/* padding: 1px 2px; */
|
||||||
|
font-size: 1.1em;
|
||||||
|
font-family: monospace;
|
||||||
|
}
|
||||||
|
|
||||||
|
.viewcode-back {
|
||||||
|
font-family: Arial, sans-serif;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.viewcode-block:target {
|
||||||
|
background-color: #f4debf;
|
||||||
|
border-top: 1px solid #ac9;
|
||||||
|
border-bottom: 1px solid #ac9;
|
||||||
|
}
|
||||||
BIN
doc/source/_themes/openstack/static/openstack_logo.png
Normal file
BIN
doc/source/_themes/openstack/static/openstack_logo.png
Normal file
Binary file not shown.
|
After Width: | Height: | Size: 3.6 KiB |
128
doc/source/_themes/openstack/static/tweaks.css
Normal file
128
doc/source/_themes/openstack/static/tweaks.css
Normal file
@ -0,0 +1,128 @@
|
|||||||
|
body {
|
||||||
|
background: #fff url(../_static/header_bg.jpg) top left no-repeat;
|
||||||
|
}
|
||||||
|
|
||||||
|
#header {
|
||||||
|
width: 950px;
|
||||||
|
margin: 0 auto;
|
||||||
|
height: 102px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#header h1#logo {
|
||||||
|
background: url(../_static/openstack_logo.png) top left no-repeat;
|
||||||
|
display: block;
|
||||||
|
float: left;
|
||||||
|
text-indent: -9999px;
|
||||||
|
width: 175px;
|
||||||
|
height: 55px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#navigation {
|
||||||
|
background: url(../_static/header-line.gif) repeat-x 0 bottom;
|
||||||
|
display: block;
|
||||||
|
float: left;
|
||||||
|
margin: 27px 0 0 25px;
|
||||||
|
padding: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
#navigation li{
|
||||||
|
float: left;
|
||||||
|
display: block;
|
||||||
|
margin-right: 25px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#navigation li a {
|
||||||
|
display: block;
|
||||||
|
font-weight: normal;
|
||||||
|
text-decoration: none;
|
||||||
|
background-position: 50% 0;
|
||||||
|
padding: 20px 0 5px;
|
||||||
|
color: #353535;
|
||||||
|
font-size: 14px;
|
||||||
|
}
|
||||||
|
|
||||||
|
#navigation li a.current, #navigation li a.section {
|
||||||
|
border-bottom: 3px solid #cf2f19;
|
||||||
|
color: #cf2f19;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related {
|
||||||
|
background-color: #cde2f8;
|
||||||
|
border: 1px solid #b0d3f8;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.related a {
|
||||||
|
color: #4078ba;
|
||||||
|
text-shadow: none;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebarwrapper {
|
||||||
|
padding-top: 0;
|
||||||
|
}
|
||||||
|
|
||||||
|
pre {
|
||||||
|
color: #555;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.documentwrapper h1, div.documentwrapper h2, div.documentwrapper h3, div.documentwrapper h4, div.documentwrapper h5, div.documentwrapper h6 {
|
||||||
|
font-family: 'PT Sans', sans-serif !important;
|
||||||
|
color: #264D69;
|
||||||
|
border-bottom: 1px dotted #C5E2EA;
|
||||||
|
padding: 0;
|
||||||
|
background: none;
|
||||||
|
padding-bottom: 5px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.documentwrapper h3 {
|
||||||
|
color: #CF2F19;
|
||||||
|
}
|
||||||
|
|
||||||
|
a.headerlink {
|
||||||
|
color: #fff !important;
|
||||||
|
margin-left: 5px;
|
||||||
|
background: #CF2F19 !important;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.body {
|
||||||
|
margin-top: -25px;
|
||||||
|
margin-left: 260px;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.document {
|
||||||
|
width: 960px;
|
||||||
|
margin: 0 auto;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3.highlighted {
|
||||||
|
background-color: #cf2f19;
|
||||||
|
color: #EEE;
|
||||||
|
text-shadow: 1px 1px 0 #740101;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar h3.highlighted a {
|
||||||
|
color: #EEE;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** provide visual separation for sidebar for increased readability. */
|
||||||
|
div.sphinxsidebar ul li {
|
||||||
|
margin-top: 1em;
|
||||||
|
font-weight: bold;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul li ul li {
|
||||||
|
margin-top: 0;
|
||||||
|
font-weight: normal;
|
||||||
|
}
|
||||||
|
|
||||||
|
/** Provide the sidebar to allow long words to go to the next line
|
||||||
|
making them easier to read.*/
|
||||||
|
div.sphinxsidebar a {
|
||||||
|
display: block;
|
||||||
|
text-indent: -1em;
|
||||||
|
margin-left: 1em;
|
||||||
|
word-wrap: break-word;
|
||||||
|
}
|
||||||
|
|
||||||
|
div.sphinxsidebar ul {
|
||||||
|
margin: 10px 10px;
|
||||||
|
}
|
||||||
7
doc/source/_themes/openstack/theme.conf
Normal file
7
doc/source/_themes/openstack/theme.conf
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
[theme]
|
||||||
|
inherit = basic
|
||||||
|
stylesheet = nature.css
|
||||||
|
pygments_style = tango
|
||||||
|
|
||||||
|
[options]
|
||||||
|
incubating = false
|
||||||
287
doc/source/conf.py
Normal file
287
doc/source/conf.py
Normal file
@ -0,0 +1,287 @@
|
|||||||
|
#!/usr/bin/env python3
|
||||||
|
# -*- coding: utf-8 -*-
|
||||||
|
#
|
||||||
|
# openstack-ansible documentation build configuration file, created by
|
||||||
|
# sphinx-quickstart on Mon Apr 13 20:42:26 2015.
|
||||||
|
#
|
||||||
|
# This file is execfile()d with the current directory set to its
|
||||||
|
# containing dir.
|
||||||
|
#
|
||||||
|
# Note that not all possible configuration values are present in this
|
||||||
|
# autogenerated file.
|
||||||
|
#
|
||||||
|
# All configuration values have a default; values that are commented out
|
||||||
|
# serve to show the default.
|
||||||
|
|
||||||
|
# If extensions (or modules to document with autodoc) are in another directory,
|
||||||
|
# add these directories to sys.path here. If the directory is relative to the
|
||||||
|
# documentation root, use os.path.abspath to make it absolute, like shown here.
|
||||||
|
# sys.path.insert(0, os.path.abspath('.'))
|
||||||
|
|
||||||
|
# -- General configuration ------------------------------------------------
|
||||||
|
|
||||||
|
# If your documentation needs a minimal Sphinx version, state it here.
|
||||||
|
# needs_sphinx = '1.0'
|
||||||
|
|
||||||
|
# Add any Sphinx extension module names here, as strings. They can be
|
||||||
|
# extensions coming with Sphinx (named 'sphinx.ext.*') or your custom
|
||||||
|
# ones.
|
||||||
|
extensions = [
|
||||||
|
'sphinx.ext.autodoc',
|
||||||
|
'oslosphinx'
|
||||||
|
]
|
||||||
|
|
||||||
|
# Add any paths that contain templates here, relative to this directory.
|
||||||
|
templates_path = ['_templates']
|
||||||
|
|
||||||
|
# The suffix(es) of source filenames.
|
||||||
|
# You can specify multiple suffix as a list of string:
|
||||||
|
# source_suffix = ['.rst', '.md']
|
||||||
|
source_suffix = '.rst'
|
||||||
|
|
||||||
|
# The encoding of source files.
|
||||||
|
# source_encoding = 'utf-8-sig'
|
||||||
|
|
||||||
|
# The master toctree document.
|
||||||
|
master_doc = 'index'
|
||||||
|
|
||||||
|
# General information about the project.
|
||||||
|
project = 'openstack-ansible-security'
|
||||||
|
copyright = '2015, openstack-ansible contributors'
|
||||||
|
author = 'openstack-ansible contributors'
|
||||||
|
|
||||||
|
# The version info for the project you're documenting, acts as replacement for
|
||||||
|
# |version| and |release|, also used in various other places throughout the
|
||||||
|
# built documents.
|
||||||
|
#
|
||||||
|
# The short X.Y version.
|
||||||
|
version = 'master'
|
||||||
|
# The full version, including alpha/beta/rc tags.
|
||||||
|
release = 'master'
|
||||||
|
|
||||||
|
# The language for content autogenerated by Sphinx. Refer to documentation
|
||||||
|
# for a list of supported languages.
|
||||||
|
#
|
||||||
|
# This is also used if you do content translation via gettext catalogs.
|
||||||
|
# Usually you set "language" from the command line for these cases.
|
||||||
|
language = None
|
||||||
|
|
||||||
|
# There are two options for replacing |today|: either, you set today to some
|
||||||
|
# non-false value, then it is used:
|
||||||
|
# today = ''
|
||||||
|
# Else, today_fmt is used as the format for a strftime call.
|
||||||
|
# today_fmt = '%B %d, %Y'
|
||||||
|
|
||||||
|
# List of patterns, relative to source directory, that match files and
|
||||||
|
# directories to ignore when looking for source files.
|
||||||
|
exclude_patterns = []
|
||||||
|
|
||||||
|
# The reST default role (used for this markup: `text`) to use for all
|
||||||
|
# documents.
|
||||||
|
# default_role = None
|
||||||
|
|
||||||
|
# If true, '()' will be appended to :func: etc. cross-reference text.
|
||||||
|
# add_function_parentheses = True
|
||||||
|
|
||||||
|
# If true, the current module name will be prepended to all description
|
||||||
|
# unit titles (such as .. function::).
|
||||||
|
# add_module_names = True
|
||||||
|
|
||||||
|
# If true, sectionauthor and moduleauthor directives will be shown in the
|
||||||
|
# output. They are ignored by default.
|
||||||
|
# show_authors = False
|
||||||
|
|
||||||
|
# The name of the Pygments (syntax highlighting) style to use.
|
||||||
|
pygments_style = 'sphinx'
|
||||||
|
|
||||||
|
# A list of ignored prefixes for module index sorting.
|
||||||
|
# modindex_common_prefix = []
|
||||||
|
|
||||||
|
# If true, keep warnings as "system message" paragraphs in the built documents.
|
||||||
|
# keep_warnings = False
|
||||||
|
|
||||||
|
# If true, `todo` and `todoList` produce output, else they produce nothing.
|
||||||
|
todo_include_todos = False
|
||||||
|
|
||||||
|
|
||||||
|
# -- Options for HTML output ----------------------------------------------
|
||||||
|
|
||||||
|
# The theme to use for HTML and HTML Help pages. See the documentation for
|
||||||
|
# a list of builtin themes.
|
||||||
|
html_theme = 'openstack'
|
||||||
|
|
||||||
|
# Theme options are theme-specific and customize the look and feel of a theme
|
||||||
|
# further. For a list of options available for each theme, see the
|
||||||
|
# documentation.
|
||||||
|
# html_theme_options = {}
|
||||||
|
|
||||||
|
# Add any paths that contain custom themes here, relative to this directory.
|
||||||
|
html_theme_path = ['_themes']
|
||||||
|
|
||||||
|
# The name for this set of Sphinx documents. If None, it defaults to
|
||||||
|
# "<project> v<release> documentation".
|
||||||
|
# html_title = None
|
||||||
|
|
||||||
|
# A shorter title for the navigation bar. Default is the same as html_title.
|
||||||
|
# html_short_title = None
|
||||||
|
|
||||||
|
# The name of an image file (relative to this directory) to place at the top
|
||||||
|
# of the sidebar.
|
||||||
|
# html_logo = None
|
||||||
|
|
||||||
|
# The name of an image file (within the static path) to use as favicon of the
|
||||||
|
# docs. This file should be a Windows icon file (.ico) being 16x16 or 32x32
|
||||||
|
# pixels large.
|
||||||
|
# html_favicon = None
|
||||||
|
|
||||||
|
# Add any paths that contain custom static files (such as style sheets) here,
|
||||||
|
# relative to this directory. They are copied after the builtin static files,
|
||||||
|
# so a file named "default.css" will overwrite the builtin "default.css".
|
||||||
|
html_static_path = ['_static']
|
||||||
|
|
||||||
|
# Add any extra paths that contain custom files (such as robots.txt or
|
||||||
|
# .htaccess) here, relative to this directory. These files are copied
|
||||||
|
# directly to the root of the documentation.
|
||||||
|
# html_extra_path = []
|
||||||
|
|
||||||
|
# If not '', a 'Last updated on:' timestamp is inserted at every page bottom,
|
||||||
|
# using the given strftime format.
|
||||||
|
# html_last_updated_fmt = '%b %d, %Y'
|
||||||
|
|
||||||
|
# If true, SmartyPants will be used to convert quotes and dashes to
|
||||||
|
# typographically correct entities.
|
||||||
|
# html_use_smartypants = True
|
||||||
|
|
||||||
|
# Custom sidebar templates, maps document names to template names.
|
||||||
|
# html_sidebars = {}
|
||||||
|
|
||||||
|
# Additional templates that should be rendered to pages, maps page names to
|
||||||
|
# template names.
|
||||||
|
# html_additional_pages = {}
|
||||||
|
|
||||||
|
# If false, no module index is generated.
|
||||||
|
# html_domain_indices = True
|
||||||
|
|
||||||
|
# If false, no index is generated.
|
||||||
|
# html_use_index = True
|
||||||
|
|
||||||
|
# If true, the index is split into individual pages for each letter.
|
||||||
|
# html_split_index = False
|
||||||
|
|
||||||
|
# If true, links to the reST sources are added to the pages.
|
||||||
|
# html_show_sourcelink = True
|
||||||
|
|
||||||
|
# If true, "Created using Sphinx" is shown in the HTML footer. Default is True.
|
||||||
|
# html_show_sphinx = True
|
||||||
|
|
||||||
|
# If true, "(C) Copyright ..." is shown in the HTML footer. Default is True.
|
||||||
|
# html_show_copyright = True
|
||||||
|
|
||||||
|
# If true, an OpenSearch description file will be output, and all pages will
|
||||||
|
# contain a <link> tag referring to it. The value of this option must be the
|
||||||
|
# base URL from which the finished HTML is served.
|
||||||
|
# html_use_opensearch = ''
|
||||||
|
|
||||||
|
# This is the file name suffix for HTML files (e.g. ".xhtml").
|
||||||
|
# html_file_suffix = None
|
||||||
|
|
||||||
|
# Language to be used for generating the HTML full-text search index.
|
||||||
|
# Sphinx supports the following languages:
|
||||||
|
# 'da', 'de', 'en', 'es', 'fi', 'fr', 'h', 'it', 'ja'
|
||||||
|
# 'nl', 'no', 'pt', 'ro', 'r', 'sv', 'tr'
|
||||||
|
# html_search_language = 'en'
|
||||||
|
|
||||||
|
# A dictionary with options for the search language support, empty by default.
|
||||||
|
# Now only 'ja' uses this config value
|
||||||
|
# html_search_options = {'type': 'default'}
|
||||||
|
|
||||||
|
# The name of a javascript file (relative to the configuration directory) that
|
||||||
|
# implements a search results scorer. If empty, the default will be used.
|
||||||
|
# html_search_scorer = 'scorer.js'
|
||||||
|
|
||||||
|
# Output file base name for HTML help builder.
|
||||||
|
htmlhelp_basename = 'openstack-ansibledoc'
|
||||||
|
|
||||||
|
# -- Options for LaTeX output ---------------------------------------------
|
||||||
|
|
||||||
|
latex_elements = {
|
||||||
|
# The paper size ('letterpaper' or 'a4paper').
|
||||||
|
# 'papersize': 'letterpaper',
|
||||||
|
|
||||||
|
# The font size ('10pt', '11pt' or '12pt').
|
||||||
|
# 'pointsize': '10pt',
|
||||||
|
|
||||||
|
# Additional stuff for the LaTeX preamble.
|
||||||
|
# 'preamble': '',
|
||||||
|
|
||||||
|
# Latex figure (float) alignment
|
||||||
|
# 'figure_align': 'htbp',
|
||||||
|
}
|
||||||
|
|
||||||
|
# Grouping the document tree into LaTeX files. List of tuples
|
||||||
|
# (source start file, target name, title,
|
||||||
|
# author, documentclass [howto, manual, or own class]).
|
||||||
|
latex_documents = [
|
||||||
|
(master_doc, 'openstack-ansible.tex',
|
||||||
|
'openstack-ansible Documentation',
|
||||||
|
'openstack-ansible contributors', 'manual'),
|
||||||
|
]
|
||||||
|
|
||||||
|
# The name of an image file (relative to this directory) to place at the top of
|
||||||
|
# the title page.
|
||||||
|
# latex_logo = None
|
||||||
|
|
||||||
|
# For "manual" documents, if this is true, then toplevel headings are parts,
|
||||||
|
# not chapters.
|
||||||
|
# latex_use_parts = False
|
||||||
|
|
||||||
|
# If true, show page references after internal links.
|
||||||
|
# latex_show_pagerefs = False
|
||||||
|
|
||||||
|
# If true, show URL addresses after external links.
|
||||||
|
# latex_show_urls = False
|
||||||
|
|
||||||
|
# Documents to append as an appendix to all manuals.
|
||||||
|
# latex_appendices = []
|
||||||
|
|
||||||
|
# If false, no module index is generated.
|
||||||
|
# latex_domain_indices = True
|
||||||
|
|
||||||
|
|
||||||
|
# -- Options for manual page output ---------------------------------------
|
||||||
|
|
||||||
|
# One entry per manual page. List of tuples
|
||||||
|
# (source start file, name, description, authors, manual section).
|
||||||
|
man_pages = [
|
||||||
|
(master_doc, 'openstack-ansible',
|
||||||
|
'openstack-ansible Documentation',
|
||||||
|
[author], 1)
|
||||||
|
]
|
||||||
|
|
||||||
|
# If true, show URL addresses after external links.
|
||||||
|
# man_show_urls = False
|
||||||
|
|
||||||
|
|
||||||
|
# -- Options for Texinfo output -------------------------------------------
|
||||||
|
|
||||||
|
# Grouping the document tree into Texinfo files. List of tuples
|
||||||
|
# (source start file, target name, title, author,
|
||||||
|
# dir menu entry, description, category)
|
||||||
|
texinfo_documents = [
|
||||||
|
(master_doc, 'openstack-ansible',
|
||||||
|
'openstack-ansible Documentation',
|
||||||
|
author, 'openstack-ansible', 'One line description of project.',
|
||||||
|
'Miscellaneous'),
|
||||||
|
]
|
||||||
|
|
||||||
|
# Documents to append as an appendix to all manuals.
|
||||||
|
# texinfo_appendices = []
|
||||||
|
|
||||||
|
# If false, no module index is generated.
|
||||||
|
# texinfo_domain_indices = True
|
||||||
|
|
||||||
|
# How to display URL addresses: 'footnote', 'no', or 'inline'.
|
||||||
|
# texinfo_show_urls = 'footnote'
|
||||||
|
|
||||||
|
# If true, do not generate a @detailmenu in the "Top" node's menu.
|
||||||
|
# texinfo_no_detailmenu = False
|
||||||
1543
doc/source/configurations-cat1.rst
Normal file
1543
doc/source/configurations-cat1.rst
Normal file
File diff suppressed because it is too large
Load Diff
2194
doc/source/configurations-cat2.rst
Normal file
2194
doc/source/configurations-cat2.rst
Normal file
File diff suppressed because it is too large
Load Diff
267
doc/source/configurations-cat3.rst
Normal file
267
doc/source/configurations-cat3.rst
Normal file
@ -0,0 +1,267 @@
|
|||||||
|
.. include:: <xhtml1-lat1.txt>
|
||||||
|
`Home <index.html>`__ |raquo| Security hardening for openstack-ansible
|
||||||
|
|
||||||
|
Category 3 (High) configurations
|
||||||
|
================================
|
||||||
|
|
||||||
|
.. contents::
|
||||||
|
:depth: 2
|
||||||
|
|
||||||
|
|
||||||
|
V-38653: The snmpd service must not use a default password.
|
||||||
|
-----------------------------------------------------------
|
||||||
|
|
||||||
|
Presence of the default SNMP password enables querying of different system
|
||||||
|
aspects and could result in unauthorized knowledge of the system.
|
||||||
|
|
||||||
|
Details: `V-38653 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38653 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38653
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38653.rst
|
||||||
|
|
||||||
|
V-38666: The system must use and update a DoD-approved virus scan program.
|
||||||
|
--------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Virus scanning software can be used to detect if a system has been compromised
|
||||||
|
by computer viruses, as well as to limit their spread to other systems.
|
||||||
|
|
||||||
|
Details: `V-38666 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38666 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38666
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38666.rst
|
||||||
|
|
||||||
|
V-38668: The x86 Ctrl-Alt-Delete key sequence must be disabled.
|
||||||
|
---------------------------------------------------------------
|
||||||
|
|
||||||
|
A locally logged-in user who presses Ctrl-Alt-Delete, when at the console, can
|
||||||
|
reboot the system. If accidentally pressed, as could happen in the case of
|
||||||
|
mixed OS environment, this can create the risk of short-term loss of
|
||||||
|
availability of systems due to unintentional reboot. In the GNOME graphical
|
||||||
|
environment, risk of unintentional reboot from the Ctrl-Alt-Delete sequence is
|
||||||
|
reduced because the user will be prompted before any action is taken.
|
||||||
|
|
||||||
|
Details: `V-38668 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38668 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38668
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38668.rst
|
||||||
|
|
||||||
|
V-38462: The RPM package management tool must cryptographically verify the authenticity of all software packages during installation.
|
||||||
|
-------------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Ensuring all packages' cryptographic signatures are valid prior to
|
||||||
|
installation ensures the provenance of the software and protects against
|
||||||
|
malicious tampering.
|
||||||
|
|
||||||
|
Details: `V-38462 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38462 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38462
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38462.rst
|
||||||
|
|
||||||
|
V-38497: The system must not have accounts configured with blank or null passwords.
|
||||||
|
-----------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
If an account has an empty password, anyone could log in and run commands with
|
||||||
|
the privileges of that account. Accounts with empty passwords should never be
|
||||||
|
used in operational environments.
|
||||||
|
|
||||||
|
Details: `V-38497 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38497 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38497
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38497.rst
|
||||||
|
|
||||||
|
V-38677: The NFS server must not have the insecure file locking option enabled.
|
||||||
|
-------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Allowing insecure file locking could allow for sensitive data to be viewed or
|
||||||
|
edited by an unauthorized user.
|
||||||
|
|
||||||
|
Details: `V-38677 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38677 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38677
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38677.rst
|
||||||
|
|
||||||
|
V-38476: Vendor-provided cryptographic certificates must be installed to verify the integrity of system software.
|
||||||
|
-----------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
The Red Hat GPG keys are necessary to cryptographically verify packages are
|
||||||
|
from Red Hat.
|
||||||
|
|
||||||
|
Details: `V-38476 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38476 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38476
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38476.rst
|
||||||
|
|
||||||
|
V-38491: There must be no .rhosts or hosts.equiv files on the system.
|
||||||
|
---------------------------------------------------------------------
|
||||||
|
|
||||||
|
Trust files are convenient, but when used in conjunction with the R-services,
|
||||||
|
they can allow unauthenticated access to a system.
|
||||||
|
|
||||||
|
Details: `V-38491 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38491 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38491
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38491.rst
|
||||||
|
|
||||||
|
V-38607: The SSH daemon must be configured to use only the SSHv2 protocol.
|
||||||
|
--------------------------------------------------------------------------
|
||||||
|
|
||||||
|
SSH protocol version 1 suffers from design flaws that result in security
|
||||||
|
vulnerabilities and should not be used.
|
||||||
|
|
||||||
|
Details: `V-38607 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38607 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38607
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38607.rst
|
||||||
|
|
||||||
|
V-38602: The rlogind service must not be running.
|
||||||
|
-------------------------------------------------
|
||||||
|
|
||||||
|
The rlogin service uses unencrypted network communications, which means that
|
||||||
|
data from the login session, including passwords and all other information
|
||||||
|
transmitted during the session, can be stolen by eavesdroppers on the network.
|
||||||
|
|
||||||
|
Details: `V-38602 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38602 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38602
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38602.rst
|
||||||
|
|
||||||
|
V-38594: The rshd service must not be running.
|
||||||
|
----------------------------------------------
|
||||||
|
|
||||||
|
The rsh service uses unencrypted network communications, which means that data
|
||||||
|
from the login session, including passwords and all other information
|
||||||
|
transmitted during the session, can be stolen by eavesdroppers on the network.
|
||||||
|
|
||||||
|
Details: `V-38594 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38594 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38594
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38594.rst
|
||||||
|
|
||||||
|
V-38591: The rsh-server package must not be installed.
|
||||||
|
------------------------------------------------------
|
||||||
|
|
||||||
|
The "rsh-server" package provides several obsolete and insecure network
|
||||||
|
services. Removing it decreases the risk of those services' accidental (or
|
||||||
|
intentional) activation.
|
||||||
|
|
||||||
|
Details: `V-38591 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38591 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38591
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38591.rst
|
||||||
|
|
||||||
|
V-38598: The rexecd service must not be running.
|
||||||
|
------------------------------------------------
|
||||||
|
|
||||||
|
The rexec service uses unencrypted network communications, which means that
|
||||||
|
data from the login session, including passwords and all other information
|
||||||
|
transmitted during the session, can be stolen by eavesdroppers on the network.
|
||||||
|
|
||||||
|
Details: `V-38598 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38598 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38598
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38598.rst
|
||||||
|
|
||||||
|
V-38587: The telnet-server package must not be installed.
|
||||||
|
---------------------------------------------------------
|
||||||
|
|
||||||
|
Removing the "telnet-server" package decreases the risk of the unencrypted
|
||||||
|
telnet service's accidental (or intentional) activation. Mitigation: If the
|
||||||
|
telnet-server package is configured to only allow encrypted sessions, such as
|
||||||
|
with Kerberos or the use of encrypted network tunnels, the risk of exposing
|
||||||
|
sensitive information is mitigated.
|
||||||
|
|
||||||
|
Details: `V-38587 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38587 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38587
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38587.rst
|
||||||
|
|
||||||
|
V-38589: The telnet daemon must not be running.
|
||||||
|
-----------------------------------------------
|
||||||
|
|
||||||
|
The telnet protocol uses unencrypted network communication, which means that
|
||||||
|
data from the login session, including passwords and all other information
|
||||||
|
transmitted during the session, can be stolen by eavesdroppers on the network.
|
||||||
|
The telnet protocol is also subject to man-in-the-middle attacks. Mitigation:
|
||||||
|
If an enabled telnet daemon is configured to only allow encrypted sessions,
|
||||||
|
such as with Kerberos or the use of encrypted network tunnels, the risk of
|
||||||
|
exposing sensitive information is mitigated.
|
||||||
|
|
||||||
|
Details: `V-38589 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38589 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38589
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38589.rst
|
||||||
|
|
||||||
|
V-38701: The TFTP daemon must operate in secure mode which provides access only to a single directory on the host file system.
|
||||||
|
------------------------------------------------------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Using the "-s" option causes the TFTP service to only serve files from the
|
||||||
|
given directory. Serving files from an intentionally specified directory
|
||||||
|
reduces the risk of sharing files which should remain private.
|
||||||
|
|
||||||
|
Details: `V-38701 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38701 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38701
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38701.rst
|
||||||
|
|
||||||
|
V-38614: The SSH daemon must not allow authentication using an empty password.
|
||||||
|
------------------------------------------------------------------------------
|
||||||
|
|
||||||
|
Configuring this setting for the SSH daemon provides additional assurance that
|
||||||
|
remote login via SSH will require a password, even in the event of
|
||||||
|
misconfiguration elsewhere.
|
||||||
|
|
||||||
|
Details: `V-38614 in STIG Viewer`_.
|
||||||
|
|
||||||
|
.. _V-38614 in STIG Viewer: https://www.stigviewer.com/stig/red_hat_enterprise_linux_6/2015-05-26/finding/V-38614
|
||||||
|
|
||||||
|
Developer Notes
|
||||||
|
~~~~~~~~~~~~~~~
|
||||||
|
.. include:: developer-notes/V-38614.rst
|
||||||
12
doc/source/configurations.rst
Normal file
12
doc/source/configurations.rst
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
.. include:: <xhtml1-lat1.txt>
|
||||||
|
`Home <index.html>`__ |raquo| Security hardening for openstack-ansible
|
||||||
|
|
||||||
|
Security hardening configurations
|
||||||
|
=================================
|
||||||
|
|
||||||
|
.. toctree::
|
||||||
|
:maxdepth: 2
|
||||||
|
|
||||||
|
configurations-cat3.rst
|
||||||
|
configurations-cat2.rst
|
||||||
|
configurations-cat1.rst
|
||||||
6
doc/source/developer-notes/V-38437.rst
Normal file
6
doc/source/developer-notes/V-38437.rst
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
If ``autofs`` is installed, it will be disabled by Ansible tasks. To opt-out
|
||||||
|
of this change, adjust the following variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
disable_services['autofs'] = no
|
||||||
8
doc/source/developer-notes/V-38438.rst
Normal file
8
doc/source/developer-notes/V-38438.rst
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Adjusting the bootloader configuration can cause issues with reboots and this
|
||||||
|
work is left up to the deployer. Enabling auditing at boot time is helpful,
|
||||||
|
but the risk may not be worth the change in most environments.
|
||||||
|
|
||||||
|
The ``auditd`` process starts very early during the boot process to catch
|
||||||
|
events already, and this should be sufficient for most environments.
|
||||||
5
doc/source/developer-notes/V-38439.rst
Normal file
5
doc/source/developer-notes/V-38439.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Although adding centralized authentication and carefully managing user
|
||||||
|
accounts is critical for securing any system, that's left up to deployers
|
||||||
|
to handle via their internal business processes.
|
||||||
4
doc/source/developer-notes/V-38443.rst
Normal file
4
doc/source/developer-notes/V-38443.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
The Ansible tasks will ensure that ``/etc/gshadow`` is owned by root. This is
|
||||||
|
the default in Ubuntu 14.04 already, but the tasks will ensure that the
|
||||||
|
permissions match the STIG requirements in case they were changed by other
|
||||||
|
means after the installation of the operating system.
|
||||||
4
doc/source/developer-notes/V-38444.rst
Normal file
4
doc/source/developer-notes/V-38444.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
See V-38551 for additional details. IPv6 configuration and filtering is left
|
||||||
|
up to the deployer.
|
||||||
3
doc/source/developer-notes/V-38445.rst
Normal file
3
doc/source/developer-notes/V-38445.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Although audit log files are owned by the root user and group by default
|
||||||
|
in Ubuntu 14.04, the Ansible task for V-38445 will ensure that they are
|
||||||
|
configured as such.
|
||||||
4
doc/source/developer-notes/V-38446.rst
Normal file
4
doc/source/developer-notes/V-38446.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
Forwarding root's email to another user is highly recommended, but the Ansible
|
||||||
|
tasks won't configure an email address to receive root's email unless that
|
||||||
|
email address is configured. Set ``root_forward_email`` to an email address
|
||||||
|
that is ready to receive root's email.
|
||||||
11
doc/source/developer-notes/V-38447.rst
Normal file
11
doc/source/developer-notes/V-38447.rst
Normal file
@ -0,0 +1,11 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Verifying contents of files installed from packages is more difficult in
|
||||||
|
Ubuntu, mainly due to the lack of an equivalent of ``rpm -V``. The ``debsums``
|
||||||
|
package installs the ``debsums`` command and that can be used to look for
|
||||||
|
files that have changed since the package was installed.
|
||||||
|
|
||||||
|
However, not all packages have MD5 checksums for all files and ``debsums``
|
||||||
|
doesn't do detailed checking like ``rpm``. Deployers are urged to run
|
||||||
|
``debsums -c`` to review changes made to files on their systems. This report
|
||||||
|
takes a long time to run on most systems.
|
||||||
2
doc/source/developer-notes/V-38448.rst
Normal file
2
doc/source/developer-notes/V-38448.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Although the ``/etc/gshadow`` file is group-owned by root by default, the
|
||||||
|
Ansible tasks will ensure that it is configured that way.
|
||||||
2
doc/source/developer-notes/V-38449.rst
Normal file
2
doc/source/developer-notes/V-38449.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
The ``/etc/gshadow`` file's permissions will be changed to ``0000`` to meet
|
||||||
|
the requirements of the STIG.
|
||||||
1
doc/source/developer-notes/V-38450.rst
Normal file
1
doc/source/developer-notes/V-38450.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
The ownership of ``/etc/passwd`` will be changed to root.
|
||||||
1
doc/source/developer-notes/V-38451.rst
Normal file
1
doc/source/developer-notes/V-38451.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
The group ownership for ``/etc/passwd`` will be set to root.
|
||||||
5
doc/source/developer-notes/V-38452.rst
Normal file
5
doc/source/developer-notes/V-38452.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Verifying permissions of installed packages isn't possible in the current
|
||||||
|
version of ``dpkg`` as it is with ``rpm``. This security configuration is
|
||||||
|
skipped.
|
||||||
5
doc/source/developer-notes/V-38453.rst
Normal file
5
doc/source/developer-notes/V-38453.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Verifying ownership of installed packages isn't possible in the current
|
||||||
|
version of ``dpkg`` as it is with ``rpm``. This security configuration is
|
||||||
|
skipped.
|
||||||
6
doc/source/developer-notes/V-38454.rst
Normal file
6
doc/source/developer-notes/V-38454.rst
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Verifying ownership of installed packages isn't possible in the current
|
||||||
|
version of ``dpkg`` as it is with ``rpm``. This security configuration is
|
||||||
|
skipped.
|
||||||
|
|
||||||
8
doc/source/developer-notes/V-38455.rst
Normal file
8
doc/source/developer-notes/V-38455.rst
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Configuring another mount for ``/tmp`` can disrupt a running system and this
|
||||||
|
configuration is skipped.
|
||||||
|
|
||||||
|
However, deployers are strongly urged to consider creating a separate
|
||||||
|
partition and/or LVM logical volume for ``/tmp`` during installation of the OS
|
||||||
|
if possible.
|
||||||
9
doc/source/developer-notes/V-38456.rst
Normal file
9
doc/source/developer-notes/V-38456.rst
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Configuring another mount for ``/var`` can disrupt a running system and this
|
||||||
|
configuration is skipped.
|
||||||
|
|
||||||
|
However, deployers are strongly urged to consider creating a separate
|
||||||
|
partition and/or LVM logical volume for ``/var`` during installation of the OS
|
||||||
|
if possible.
|
||||||
|
|
||||||
1
doc/source/developer-notes/V-38457.rst
Normal file
1
doc/source/developer-notes/V-38457.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
The permissions for ``/etc/passwd`` will be set to ``0644``.
|
||||||
1
doc/source/developer-notes/V-38459.rst
Normal file
1
doc/source/developer-notes/V-38459.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
The tasks in file_perms.yml will ensure that "/etc/group" is owned by the root account.
|
||||||
4
doc/source/developer-notes/V-38460.rst
Normal file
4
doc/source/developer-notes/V-38460.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
The Ansible tasks will chek for ``all_squash`` in ``/etc/exports`` (if it is
|
||||||
|
present). If found, a warning message will be printed. No configuration
|
||||||
|
changes will be made since neither Ubuntu or openstack-ansible configures
|
||||||
|
the NFS server by default.
|
||||||
2
doc/source/developer-notes/V-38461.rst
Normal file
2
doc/source/developer-notes/V-38461.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Ubuntu sets the mode of ``/etc/group`` to ``0644`` by default and the Ansible
|
||||||
|
task will ensure that it is current set to those permissions.
|
||||||
9
doc/source/developer-notes/V-38462.rst
Normal file
9
doc/source/developer-notes/V-38462.rst
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
Ubuntu checks packages against GPG signatures by default. It can be turned
|
||||||
|
off for all package installations by a setting in /etc/apt/apt.conf.d/ and we
|
||||||
|
search for that in the Ansible task. A warning is printed if the
|
||||||
|
``AllowUnauthenticated`` configuration option is present in the apt
|
||||||
|
configuration directories.
|
||||||
|
|
||||||
|
Please note that users can pass an argument on the apt command line
|
||||||
|
to bypass the checks as well, but that's outside the scope of this check
|
||||||
|
and remediation.
|
||||||
8
doc/source/developer-notes/V-38463.rst
Normal file
8
doc/source/developer-notes/V-38463.rst
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Configuring a separate partition for ``/var/log`` is currently left up to the
|
||||||
|
deployer. There are security and operational benefits that come from the
|
||||||
|
change, but it must be done when the system is initially installed.
|
||||||
|
|
||||||
|
Deployers are urged to consider making a separate partition for ``/var/log``
|
||||||
|
during OS installation.
|
||||||
16
doc/source/developer-notes/V-38464.rst
Normal file
16
doc/source/developer-notes/V-38464.rst
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
Ubuntu's default for ``disk_error_action`` is ``SUSPEND``, which actually
|
||||||
|
only suspends audit logging. That could be a security issue, so ``SYSLOG``
|
||||||
|
is recommended and is set by default be openstack-ansible-security. There
|
||||||
|
are additional options available, like ``EXEC``, ``SINGLE`` or ``HALT``.
|
||||||
|
|
||||||
|
To configure a different ``disk_error_action``, set the following Ansible
|
||||||
|
variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
disk_error_action = SYSLOG
|
||||||
|
|
||||||
|
For details on available settings and what they do, run ``man auditd.conf``.
|
||||||
|
Some options can cause the host to go offline until the issue is fixed.
|
||||||
|
Deployers are urged to **carefully read the auditd documentation** prior to
|
||||||
|
changing the ``disk_error_action`` setting from the default.
|
||||||
5
doc/source/developer-notes/V-38465.rst
Normal file
5
doc/source/developer-notes/V-38465.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Ubuntu 14.04 sets library files to have ``0755`` (or more restrictive)
|
||||||
|
permissions by default. Deployers are urged to review the permissions
|
||||||
|
of libraries regularly to ensure the system hasn't been altered.
|
||||||
5
doc/source/developer-notes/V-38466.rst
Normal file
5
doc/source/developer-notes/V-38466.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
As with V-38465, Ubuntu sets the ownership of library files to root by
|
||||||
|
default. Deployers are urged to configure monitoring for changes to these
|
||||||
|
files.
|
||||||
4
doc/source/developer-notes/V-38467.rst
Normal file
4
doc/source/developer-notes/V-38467.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Storing audit logs on a separate partition is recommended, but this change
|
||||||
|
is left up to deployers to configure during the installation of the OS.
|
||||||
19
doc/source/developer-notes/V-38468.rst
Normal file
19
doc/source/developer-notes/V-38468.rst
Normal file
@ -0,0 +1,19 @@
|
|||||||
|
Ubuntu's default for ``disk_full_action`` is ``SUSPEND``, which actually
|
||||||
|
only suspends audit logging. That could be a security issue, so ``SYSLOG``
|
||||||
|
is recommended and is set by default be openstack-ansible-security. If syslog
|
||||||
|
messages are being sent to remote servers, these log messages should alert
|
||||||
|
an administrator about the disk being full. There are additional options
|
||||||
|
available, like ``EXEC``, ``SINGLE`` or ``HALT``.
|
||||||
|
|
||||||
|
To configure a different ``disk_full_action``, set the following Ansible
|
||||||
|
variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
disk_full_action = SYSLOG
|
||||||
|
|
||||||
|
For details on available settings and what they do, run ``man auditd.conf``.
|
||||||
|
Some options can cause the host to go offline until the issue is fixed.
|
||||||
|
Deployers are urged to **carefully read the auditd documentation** prior to
|
||||||
|
changing the ``disk_full_action`` setting from the default.
|
||||||
|
|
||||||
5
doc/source/developer-notes/V-38469.rst
Normal file
5
doc/source/developer-notes/V-38469.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Ubuntu sets the permissions for system commands to ``0755`` or less already.
|
||||||
|
Deployers are urged to review these permissions for changes over time as they
|
||||||
|
can be a sign of a compromise.
|
||||||
18
doc/source/developer-notes/V-38470.rst
Normal file
18
doc/source/developer-notes/V-38470.rst
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
Ubuntu's default for ``space_left_action`` is ``SUSPEND``, which actually
|
||||||
|
only suspends audit logging. That could be a security issue, so ``SYSLOG``
|
||||||
|
is recommended and is set by default be openstack-ansible-security. If syslog
|
||||||
|
messages are being sent to remote servers, these log messages should alert
|
||||||
|
an administrator about the disk being almost full. There are additional options
|
||||||
|
available, like ``EXEC``, ``SINGLE`` or ``HALT``.
|
||||||
|
|
||||||
|
To configure a different ``space_left_action``, set the following Ansible
|
||||||
|
variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
space_left_action = SYSLOG
|
||||||
|
|
||||||
|
For details on available settings and what they do, run ``man auditd.conf``.
|
||||||
|
Some options can cause the host to go offline until the issue is fixed.
|
||||||
|
Deployers are urged to **carefully read the auditd documentation** prior to
|
||||||
|
changing the ``space_left_action`` setting from the default.
|
||||||
4
doc/source/developer-notes/V-38471.rst
Normal file
4
doc/source/developer-notes/V-38471.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
An Ansible task will adjust ``active`` from `no` to `yes` in
|
||||||
|
``/etc/audisp/plugins.d/syslog.conf`` so that auditd records are forwarded to
|
||||||
|
syslog automatically. The auditd daemon will be restarted if the configuration
|
||||||
|
file is changed.
|
||||||
5
doc/source/developer-notes/V-38472.rst
Normal file
5
doc/source/developer-notes/V-38472.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Ubuntu sets system commands to be owned by root by default Deployers are
|
||||||
|
urged to review ownership changes via auditd rules to ensure system
|
||||||
|
commands haven't changed ownership over time.
|
||||||
4
doc/source/developer-notes/V-38473.rst
Normal file
4
doc/source/developer-notes/V-38473.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Creating ``/home`` on a different partition is highly recommended but it is
|
||||||
|
left to deployers to configure during the installation of the OS.
|
||||||
4
doc/source/developer-notes/V-38474.rst
Normal file
4
doc/source/developer-notes/V-38474.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
The openstack-ansible roles don't install X by default, so there is no
|
||||||
|
graphical desktop to configure.
|
||||||
12
doc/source/developer-notes/V-38475.rst
Normal file
12
doc/source/developer-notes/V-38475.rst
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
**Configuration required**
|
||||||
|
|
||||||
|
Ubuntu 14.04 does not set a password length requirement by default. The STIG
|
||||||
|
recommends passwords to be a minimum of 14 characters in length. To apply this
|
||||||
|
setting, set the following Ansible variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
password_minimum_length: 14
|
||||||
|
|
||||||
|
Deployers are urged to avoid the use of passwords and rely upon SSH keys if
|
||||||
|
possible.
|
||||||
21
doc/source/developer-notes/V-38476.rst
Normal file
21
doc/source/developer-notes/V-38476.rst
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
The STIG talks about yum having the RHN GPG keys installed, but this
|
||||||
|
requirement has been adapted to check for the Ubuntu signing keys normally
|
||||||
|
present in Ubuntu 14.04.
|
||||||
|
|
||||||
|
See ``tasks/apt.yml`` for more details::
|
||||||
|
|
||||||
|
# apt-key list
|
||||||
|
/etc/apt/trusted.gpg
|
||||||
|
--------------------
|
||||||
|
pub 1024D/437D05B5 2004-09-12
|
||||||
|
uid Ubuntu Archive Automatic Signing Key <ftpmaster@ubuntu.com>
|
||||||
|
sub 2048g/79164387 2004-09-12
|
||||||
|
|
||||||
|
pub 1024D/FBB75451 2004-12-30
|
||||||
|
uid Ubuntu CD Image Automatic Signing Key <cdimage@ubuntu.com>
|
||||||
|
|
||||||
|
pub 4096R/C0B21F32 2012-05-11
|
||||||
|
uid Ubuntu Archive Automatic Signing Key (2012) <ftpmaster@ubuntu.com>
|
||||||
|
|
||||||
|
pub 4096R/EFE21092 2012-05-11
|
||||||
|
uid Ubuntu CD Image Automatic Signing Key (2012) <cdimage@ubuntu.com>
|
||||||
10
doc/source/developer-notes/V-38477.rst
Normal file
10
doc/source/developer-notes/V-38477.rst
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
**Configuration required**
|
||||||
|
|
||||||
|
Ubuntu doesn't set a limitation on how frequently uses can change passwords.
|
||||||
|
However, the STIG recommends setting a limit of one password change per day.
|
||||||
|
|
||||||
|
To enable this configuration, use this Ansible variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
password_minimum_days: 14
|
||||||
4
doc/source/developer-notes/V-38478.rst
Normal file
4
doc/source/developer-notes/V-38478.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Ubuntu doesn't use the Red Hat Network Service, so this requirement doesn't
|
||||||
|
apply.
|
||||||
12
doc/source/developer-notes/V-38479.rst
Normal file
12
doc/source/developer-notes/V-38479.rst
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
**Configuration required**
|
||||||
|
|
||||||
|
Ubuntu doesn't set a limitation on the age of passwords.
|
||||||
|
However, the STIG recommends setting a limit of 60 days before a password must
|
||||||
|
be changed.
|
||||||
|
|
||||||
|
To enable this configuration, use this Ansible variable:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
password_maximum_days: 60
|
||||||
|
|
||||||
10
doc/source/developer-notes/V-38480.rst
Normal file
10
doc/source/developer-notes/V-38480.rst
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
**Configuration required**
|
||||||
|
|
||||||
|
After enabling password age limits in V-38479, be sure to configure
|
||||||
|
warnings for users so they know when their password is approaching expiration.
|
||||||
|
STIG's recommendation is seven days prior to the expiration. Use an Ansible
|
||||||
|
variable to configure the warning:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
password_warn_age: 7
|
||||||
10
doc/source/developer-notes/V-38481.rst
Normal file
10
doc/source/developer-notes/V-38481.rst
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Operating system patching is left up to the deployer to configure based on
|
||||||
|
their business requirements and toleration for risk. Enabling automated
|
||||||
|
updates in Ubuntu can be done with changes to the apt configuration.
|
||||||
|
|
||||||
|
Ubuntu's documentation on `automatic updates`_ covers a few options for
|
||||||
|
configuring apt.
|
||||||
|
|
||||||
|
.. _automatic_updates: https://help.ubuntu.com/lts/serverguide/automatic-updates.html
|
||||||
10
doc/source/developer-notes/V-38482.rst
Normal file
10
doc/source/developer-notes/V-38482.rst
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Password complexity requirements are left up to the deployer. Deployers are
|
||||||
|
urged to rely on SSH keys as often as possible to avoid problems with
|
||||||
|
passwords.
|
||||||
|
|
||||||
|
Review the pam_cracklib documentation by running ``man pam_cracklib`` or
|
||||||
|
read the `detailed documentation from Hal Pomeranz`_.
|
||||||
|
|
||||||
|
.. _detailed documentation from Hal Pomeranz: http://www.deer-run.com/~hal/sysadmin/pam_cracklib.html
|
||||||
3
doc/source/developer-notes/V-38483.rst
Normal file
3
doc/source/developer-notes/V-38483.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
The Ansible task for V-38462 already checks for apt configurations that would
|
||||||
|
disable any GPG checks when installing packages. However, it's possible for
|
||||||
|
the root user to override these configurations via command line parameters.
|
||||||
3
doc/source/developer-notes/V-38484.rst
Normal file
3
doc/source/developer-notes/V-38484.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Ubuntu 14.04 already enables the display of the last successful login for a
|
||||||
|
user immediately after login. An Ansible task ensures this setting is
|
||||||
|
applied and restarts the ssh daemon if necessary.
|
||||||
5
doc/source/developer-notes/V-38486.rst
Normal file
5
doc/source/developer-notes/V-38486.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
System backups are left to the deployer to configure. Deployers are stringly
|
||||||
|
urged to maintain backups of each system, including log files and critical
|
||||||
|
configuration information.
|
||||||
3
doc/source/developer-notes/V-38487.rst
Normal file
3
doc/source/developer-notes/V-38487.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
The Ansible task for V-38462 already checks for apt configurations that would
|
||||||
|
disable any GPG checks when installing packages. However, it's possible for
|
||||||
|
the root user to override these configurations via command line parameters.
|
||||||
5
doc/source/developer-notes/V-38488.rst
Normal file
5
doc/source/developer-notes/V-38488.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
System backups are left to the deployer to configure. Deployers are stringly
|
||||||
|
urged to maintain backups of each system, including log files and critical
|
||||||
|
configuration information.
|
||||||
1
doc/source/developer-notes/V-38489.rst
Normal file
1
doc/source/developer-notes/V-38489.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
The ``aide`` package will be installed by Ansible tasks.
|
||||||
9
doc/source/developer-notes/V-38490.rst
Normal file
9
doc/source/developer-notes/V-38490.rst
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Disabling the ``usb-storage`` module can add extra security, but it's not
|
||||||
|
necessary on most systems. To disable the ``usb-storage`` module on hosts,
|
||||||
|
set ``disable_usb_storage`` to ``yes``:
|
||||||
|
|
||||||
|
.. code-block:: yaml
|
||||||
|
|
||||||
|
disable_usb_storage: yes
|
||||||
4
doc/source/developer-notes/V-38491.rst
Normal file
4
doc/source/developer-notes/V-38491.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
The Ansible task will check for the presence of ``/etc/hosts.equiv`` and
|
||||||
|
``/root/.rhosts``. Both of those files could potentially be used with ``rsh``
|
||||||
|
for host access, but ``rshd`` is not installed by default with Ubuntu 14.04
|
||||||
|
or openstack-ansible.
|
||||||
2
doc/source/developer-notes/V-38492.rst
Normal file
2
doc/source/developer-notes/V-38492.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
The virtual consoles mentioned in V-38492 aren't used in Ubuntu 14.04 by
|
||||||
|
default.
|
||||||
3
doc/source/developer-notes/V-38493.rst
Normal file
3
doc/source/developer-notes/V-38493.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Ubuntu 14.04 sets the mode of ``/var/log/audit/`` to ``0750`` by default. The
|
||||||
|
Ansible task for this requirement ensures that the mode is ``0750`` (which
|
||||||
|
is more strict than the STIG requirement).
|
||||||
7
doc/source/developer-notes/V-38494.rst
Normal file
7
doc/source/developer-notes/V-38494.rst
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Removing serial consoles from ``/etc/securetty`` can make troubleshooting
|
||||||
|
a server extremely difficult. Deployers are urged to use strong physical
|
||||||
|
security practices to prevent unauthorized users from gaining physical access
|
||||||
|
to critical hosts. In addition, out-of-band systems that allow for serial
|
||||||
|
over LAN access should also be heavily secured.
|
||||||
2
doc/source/developer-notes/V-38495.rst
Normal file
2
doc/source/developer-notes/V-38495.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
The Ansible tasks will ensure that files in ``/var/log/audit`` are owned
|
||||||
|
by the root user.
|
||||||
5
doc/source/developer-notes/V-38497.rst
Normal file
5
doc/source/developer-notes/V-38497.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
Making adjustments to PAM configuration can be **very dangerous** for a
|
||||||
|
production system, so the Ansible task runs a check for text matching
|
||||||
|
``nullok`` in ``/etc/pam.d/common-auth`` (different than
|
||||||
|
``/etc/pam.d/system-auth`` found in RHEL 6) and prints a warning if it is
|
||||||
|
found.
|
||||||
2
doc/source/developer-notes/V-38499.rst
Normal file
2
doc/source/developer-notes/V-38499.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
The Ansible task will search for password hashes in ``/etc/passwd`` using
|
||||||
|
awk and report a failure if any are found.
|
||||||
1
doc/source/developer-notes/V-38522.rst
Normal file
1
doc/source/developer-notes/V-38522.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
Rules are added for auditing changes to system time made via ``settimeofday``.
|
||||||
1
doc/source/developer-notes/V-38525.rst
Normal file
1
doc/source/developer-notes/V-38525.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
Rules are added for auditing changes to system time done via ``stime``.
|
||||||
2
doc/source/developer-notes/V-38527.rst
Normal file
2
doc/source/developer-notes/V-38527.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing changes to system time done via
|
||||||
|
``clock_settime``.
|
||||||
2
doc/source/developer-notes/V-38530.rst
Normal file
2
doc/source/developer-notes/V-38530.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added to auditd to log all attempts to change the system time using
|
||||||
|
``/etc/localtime``.
|
||||||
3
doc/source/developer-notes/V-38531.rst
Normal file
3
doc/source/developer-notes/V-38531.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
The audit rules from V-38534 already cover all account modifications.
|
||||||
3
doc/source/developer-notes/V-38534.rst
Normal file
3
doc/source/developer-notes/V-38534.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Audit rules are added in a task so that any events associated with
|
||||||
|
account modifications are logged. The new audit rule will be loaded immediately
|
||||||
|
with ``augenrules --load``.
|
||||||
3
doc/source/developer-notes/V-38536.rst
Normal file
3
doc/source/developer-notes/V-38536.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
The audit rules from V-38534 already cover all account modifications.
|
||||||
3
doc/source/developer-notes/V-38538.rst
Normal file
3
doc/source/developer-notes/V-38538.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
The audit rules from V-38534 already cover all account modifications.
|
||||||
3
doc/source/developer-notes/V-38540.rst
Normal file
3
doc/source/developer-notes/V-38540.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Rules are added for auditing network configuration changes. The path to
|
||||||
|
Ubuntu's standard network configuration location has replaced the path
|
||||||
|
to Red Hat's default network configuration location.
|
||||||
5
doc/source/developer-notes/V-38541.rst
Normal file
5
doc/source/developer-notes/V-38541.rst
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
The RHEL 6 STIG requires that changes to SELinux policies and configuration are
|
||||||
|
audited. However, Ubuntu's preference for Mandatory Access Control (MAC) is
|
||||||
|
AppArmor and openstack-ansible configures AppArmor by default.
|
||||||
|
|
||||||
|
This requirement has been modified to fit AppArmor on an Ubuntu system.
|
||||||
2
doc/source/developer-notes/V-38547.rst
Normal file
2
doc/source/developer-notes/V-38547.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditd to log discretionary access control permission
|
||||||
|
changes done with fchmod.
|
||||||
2
doc/source/developer-notes/V-38550.rst
Normal file
2
doc/source/developer-notes/V-38550.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes made via
|
||||||
|
fchmodat.
|
||||||
18
doc/source/developer-notes/V-38551.rst
Normal file
18
doc/source/developer-notes/V-38551.rst
Normal file
@ -0,0 +1,18 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Filtering IPv6 traffic is left up to the deployer to implement. The
|
||||||
|
openstack-ansible roles don't configure IPv6 (at this time) and adding
|
||||||
|
persistent ip6tables rules could harm a running system.
|
||||||
|
|
||||||
|
However, deployers are strongly recommended to implement IPv6 filtering at the
|
||||||
|
edges of the network via network devices. In addition, deployers should be
|
||||||
|
aware that link-local IPv6 addresses are configured automatcally by the system
|
||||||
|
and those addresses could open up new network paths for future attacks.
|
||||||
|
|
||||||
|
For example, if IPv4 access was tightly controlled and segmented, hosts and/or
|
||||||
|
containers could possibly communicate across these boundaries using IPv6
|
||||||
|
link-local addresses. For more detailed information on this security topic,
|
||||||
|
review Cisco's documentation titled `IPv6 Security Brief`_ that is available
|
||||||
|
on their website.
|
||||||
|
|
||||||
|
.. _IPv6 Security Brief: http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enterprise-ipv6-solution/white_paper_c11-678658.html
|
||||||
2
doc/source/developer-notes/V-38552.rst
Normal file
2
doc/source/developer-notes/V-38552.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes
|
||||||
|
made by fchown.
|
||||||
2
doc/source/developer-notes/V-38556.rst
Normal file
2
doc/source/developer-notes/V-38556.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes made
|
||||||
|
by fremovexattr.
|
||||||
2
doc/source/developer-notes/V-38557.rst
Normal file
2
doc/source/developer-notes/V-38557.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes made via
|
||||||
|
``fsetxattr``.
|
||||||
2
doc/source/developer-notes/V-38558.rst
Normal file
2
doc/source/developer-notes/V-38558.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes made via
|
||||||
|
``lchown``.
|
||||||
2
doc/source/developer-notes/V-38559.rst
Normal file
2
doc/source/developer-notes/V-38559.rst
Normal file
@ -0,0 +1,2 @@
|
|||||||
|
Rules are added for auditing discretionary access control changes made via
|
||||||
|
``lremovexattr``.
|
||||||
3
doc/source/developer-notes/V-38561.rst
Normal file
3
doc/source/developer-notes/V-38561.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Rules are added to auditd to log all DAC modifications using `lsetxattr`_.
|
||||||
|
|
||||||
|
.. _lsetxattr: http://linux.die.net/man/2/lsetxattr
|
||||||
3
doc/source/developer-notes/V-38563.rst
Normal file
3
doc/source/developer-notes/V-38563.rst
Normal file
@ -0,0 +1,3 @@
|
|||||||
|
Audit rules are added in a task so that any events associated with the
|
||||||
|
discretionary access controls (DAC) permission modifications are logged.
|
||||||
|
The new audit rule will be loaded immediately with ``augenrules --load``.
|
||||||
4
doc/source/developer-notes/V-38565.rst
Normal file
4
doc/source/developer-notes/V-38565.rst
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
Rules are added so that all permission modifications made via `setxattr`_ are
|
||||||
|
logged.
|
||||||
|
|
||||||
|
.. _setxattr: http://man7.org/linux/man-pages/man2/setxattr.2.html
|
||||||
1
doc/source/developer-notes/V-38566.rst
Normal file
1
doc/source/developer-notes/V-38566.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
Rules are added for auditd to log failed access attempts to files and programs.
|
||||||
6
doc/source/developer-notes/V-38567.rst
Normal file
6
doc/source/developer-notes/V-38567.rst
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
**Exception**
|
||||||
|
|
||||||
|
Keeping the list of setuid/setgid applications up to date and adding the paths
|
||||||
|
to those files within the ``audit.rules`` file is challenging. Deployers are
|
||||||
|
urged to use setuid/setgid sparingly and carefully monitor all applications
|
||||||
|
with those permissions set.
|
||||||
1
doc/source/developer-notes/V-38568.rst
Normal file
1
doc/source/developer-notes/V-38568.rst
Normal file
@ -0,0 +1 @@
|
|||||||
|
Rules are added for auditd to log successful filesystem mounts.
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue
Block a user