Alright this is my buddy measure Hayden's coming up here may just gonna talk about
something that's when all of our minds security he's going to teach us how to
automate security using Ansible are y'all ready for this
there it is now some love y'all give it up for major Hayden alright can you hear me in the back alright cool
so many as major work for Rackspace I work in our Rackspace private cloud group
so I work on clouds that we deploy in a customer data center in our own data
centers wherever they need to be and what I'm going to be talking about today is
some of the work we've been doing in the community and have a little bit of a
call to action at the end to get involved if you do development with
Ansible or if somebody on your team does and feel free to come up here if y'all
want to don't be afraid I don't bite and I don't spit very much either so as i said
im a principal architect at Rackspace been there since about 2006
I've been working with the OpenStack sense 2012 and in been a member of the Fedora community since
2011 and so the agenda today is pretty simple
we're going to talk about is the security tug of war that we have within
all of our companies were also going to do is talk about a concept called
meeting halfway which how many people in here have ever worked in corporate
security department or information security anything like that at sea or
some people afraid to raise hands on the back I know how that feels so I worked
on both sides and so meeting halfway can kind of be one of those fun things and
then finally as I said I have an appeal call to action to get involved in the
community and get involved in our project and so to kick it off I'll start
with something I think we all can agree upon and that's that information
security is difficult it's difficult because the technology we use is complex if
you think about traditional environments where you just had one server doing one
thing that's pretty complex now when you have sixty p.m. they're all doing
different things for different parts your company on the same server that
becomes very complex and security out some other issues to around culture we
constantly fight culture battles within our company of how much security do we
want and how much do we not want but in the end every company we want to create
just enough security that creates value for our customers we want customers to
trust the product
to trust they can put their data in the product the trust that they know that
product is going to be available for you and if not there's a plan to get it
available again but on the flip side of that we want to avoid all those changes
that caused drag and disruption those things that kind of show up and disrupt
your workflow the things that make you have to log into something differently
things that make you have to operate a cloud differently
those things are really annoying and is anybody who's worked in information
security will know if the auditors aren't happy nobody's happy so if your
employees love your security and your information security folks love the
security but auditors don't like it it's a long day when they show up and they
start looking at your processes and they want to see what they look like they
if they don't see what they want it kind of derails everyones day week month
year so the big question is how do we make valuable security changes without
disruption and keep the auditors happy and so our answer to that is make
security automatic I know that sounds very easy but what we're looking to do
is make security into something that you forget about you run it it's there it's
the basics you're done and so that's what we did as part of the OpenStack
Ansible community we said how do we add a layer of security for every single host
to wear it people didn't have to think about it and maybe it's something you
can apply to an OpenStack environment or maybe it's something you can apply if
you have a LAMP stack running on a server in your datacenter you could use
the same role and so when things get complex and the going gets tough the
tough people adopt standards so you may have heard certain standards like ISO or
missed 853 or bigger Center for Internet Security or sans things like that people
go backwards and adopt those standards and set that bottom layer and say look
this is our security standard later this is something we don't you know we don't
argue about this only agree upon that important and we grow from there and you
kind of raise that bar and so a lesson that I had to learn the hard way when I
worked on corporate security department is that people really have to feel that
security is something they're part of not something being done to them how
many times have people raise your hand if you ever felt like you had security
done to you it so if you flew here through the airport you felt like
security
was done to you that's a pretty good example I always enjoy that myself but
people need to feel like they have a say in it they need to know the value behind
it
they need to know what they're getting out of it with the tradeoffs are all
that kind of thing so as an example of this if you talk to developers in your
own company or people who are deploying applications here is two options the
first one as if you have the information security folks show up and say this as
developers you don't know how to secure systems properly will tell you what to
do and you must have it done within three months and you don't you can't
take credit card how does that feel as a deployer that feel terrible that this this is
the logic that I used to get my five-year-old son to go to bed when he
won't go to bed
this doesn't work very well in a large company but as an alternative you can
say something like since you use Ansible we wrote some automation that fits
in your existing deployment method won't disrupt your production environments can
we work with you to test it this month and look at the difference in the language in there
is someone is recognized what people are using to deploy something and said hey
look we built something that will cause you to least pain possible and give you
some value and we want to work with you to test it and so that's where this role
that we created this automated security for OpenStack got started so we thought
about five things as we start to build this we need to make it easy to
implement simple to maintain and has to be non-disruptive to existing cloud I
don't think any of us would like to hear of the corporate security team came and
said okay I'm gonna come secure your machines and in the whole crowd goes
down during the process that be the last time there ever invited to a meeting
ever again and also need to be effective against attacks and has to be open and
transparent if it's not open and transparent people don't believe in the
value they don't understand why it's there and so also our friends in the
payment card industry also requires standards and a lot of our customers have
to deal with this and you have to deploy these standards that our industry accepted
you have to prove that they're deployed and then when the auditor show up you
have to show them the policy and you have shown them the technology that says
you're doing it and so this role helps you do that so they get started we had
to pick the right standard so some of these standards are as long as novels
anybody here read ISO 27000-2 or 27000-1 cover to cover I saw some blank stares
feel it's it's rough it covers everything from human resources
to computers to how you deal with people getting in the front door of your
facility it's great content but it's not specific and then also very few directly
apply to a bunch to you can find a whole bunch of examples of things that have
applied a rail or suza or something like that but getting it to apply 2012 is a
little bit difficult and some a very restrictive licenses we had somewhere we
asked to use the product we asked to build something based on it and they
said you can't unless you pay us money and we say well how much money and they
said never mind you just can't so we got in some very tricky situations so what
we settled on was the Defense Information Systems agency publishes the
security technical implementation guide and this guide contains over 200 changes
that you make in your environment to provide that base level of security and
I'll go through a list of those here in a second
the great thing about it out in the public domain it's very very specific to
what you need to do on different hosts whether it's Linux Windows you know Java
systems anything like that and it covers the most critical security domains so
everything from how you boot the system how you log into it how you do with all
permissions how you monitor for file changes and all the way down to system
call auditing and so a lot of people forget about auditing if you use red had you
probably know audit to use hanging out there in the background
this is the thing that will tell you if someone is rapidly trying to access
files and directories that they're not supposed to do to access so what you can
do is take those logs pipe into some kind of event system maybe a sim and
alert on that and so if all of a sudden you see fifty thousand denied file
accesses in two minutes then you know maybe that's a time to go in an
environment find out what's going on so really what we did to simplify this down
even further we took a detour stick for real six and analyzed it I don't know if
that's a word but imma go ahead and use it but we turned into an small roles and
tasks and then what we said was which one of these is going to cause a problem
with an OpenStack deployment so some of them in their say disable ipv6 on your
entire environment does anybody use ipv6 and here I do my open to that
environment if I turned it off I have some problems so something like that we
turn off other things was disabled forwarding on bridges
that but also is pretty terrible in a virtualized environment so we took those
things out and then finally we translate it for about two so there's something
that don't directly translate so you in RedHat you have young and fun to your
apt and then there's other subtle differences of what packages are
available where packages are available so how many people have used ansible at
some point a small set so I'll just covered super briefly so if you've ever
used anything like puppet show called stag maybe cfengine hopefully not it's a
configuration management and deployment framework the really nice thing about ansible
compared to some of the others is that it's written only in Python it's
very easy to read the source and also you don't have to install an agent on
the other side you don't have to go and install a whole slew of packages and
libraries and everything on the other side i needz python Python SSH you're
done and if you're deploying an OpenStack environment without Python
I'm not really sure how that's possible and so OpenStack Ansible is a project
that we started at Rackspace and gave to the community and now we're working with
the community to improve it and when it does it gives you a production ready
OpenStack cloud by breaking out all the little pieces like you know Keystone
Nova and all that into a very very easy deployment mechanism where you can pick
and choose what you want where you want it how you want it deployed and upgrades
and everything are very easy and so what we did was create a security hardening
rolls if you're not familiar with an Ansible role it's just a group of
things that you want done to a server and you package them together into a
role so they can travel together and be applied together so there is two main
components one side is actual role itself the actual things that you want
to do to the server and the other half of it is the documentation that comes
with it because when the auditor show up they want to be able to see the policy
and they want to be able to see the implementation and so they're really
nice thing is is that both of those are included inside the role and it's all go
into a minute there's also an auditing capabilities as well as well as you can
use so as I said before if it applies over 200 security configurations in 90
seconds after the first time you run it only take about 30 seconds to run so if
you make any quick changes or or make any configuration adjustment
it only takes about 30 seconds to get back going when the harder show up and
you run in check mode to be done in less than 60 seconds they'll have complete
output that you can give to them give them the documentation and then show
them what you're applying and as I said it has a built in auditing mode and it's
meant to be non-disruptive so we run this we run this role in the OpenStack
Ansible testing jobs like the gate jobs this has probably run in the gate maybe
I don't know how many thousands of times in the past three or four months so it's
it's been run in very heavily tested and some large environments and so the value
of the documentation is that you actually get an explanation of what came
from the Stig so what are the Stig ask you to change so for this example right
here and says you may have operating system accounts on your machine that are
not locked so these are system users this is not users like you and I would
have on the system will search through and find any of these user accounts which
should not be there an allergy to it and there's a link that takes you to stick
viewer which is a very colorful be easy to read way to understand that that
particular component and then finally at the end we put a bunch of notes for
deployers but the great thing is these notes are great for auditors too so
we'll let you know and say hey we may have turned this off by the fault is it
derails in OpenStack environment and so when your order says why are you not
applying its control you can actually show them what we've written and say
this is an exception for us because if we did this we can't run open to that
cloud and then also the documentation will reference a lot of configuration
that you can change so there's certain requirements that are set by the sig for
your SSH server for example like how long someone can have an active
connection before the connection gets cut or if the root user can login
directly and so those things are all configurable so if in your environment
you login directly as root which you can come talk to me afterwards not give you
a hundred reasons why you shouldn't have that enable you can set that in here and
the great thing is to is that you can go and customize this for your particular
environment so if you actually want a range this down if you want to make it
to where if a connection last longer than 60 seconds and its idle kill it
you can go in make that as well and then you can show it to the auditor and the
configuration is fairly straightforward simple answerable variables
some of them are truthful yes no and then there's a little bit of
documentation right above it inside the configuration and also refer to the
V number you see their links you back to the Stig you can go straight
back to the Stig and go find out where that was in there and get some more
detail on it and so as you see right here at the bottom it may be hard to see
a little bit of my chart if you see if you flip that acetate from it rude login
to know and rerun the role it will go back and change the SSH configuration
for you and if you flip it to yes re-run the the roll it will go and change the
configuration for you and then some other ones all of the billions are kept
together so all the configuration for audit D is all in one place and you can
pick and choose what you want to turn on and turn off and as you can see on the right
there's the V numbers straight back to the stig and understand what you're
getting at what you're not getting when you turn it on and all and so some of
these we've turned off for you by default because they will pressure
system to a halt so if you're in a very special environment where that doesn't
hurt you you can go in turn those things on it so to start to wrap up everyone
asked me at some point so how do I get this magical thing so first off if
you're already using OpenStack Ansible in the community you could just flip the
apply security hardening very true and deploy that's it you're done seriously about two minutes and
you're out the door and it's available in Liberty Mitaka in Newton in Mitaka in
Newton is already enabled for you by the fault you have to turn it off if you
don't want it and liberty you have to turn it on and if your Rackspace private
cloud customer is coming in 12.2 I've been told I'm not allowed to give
dates so I'll just leave it as it is there and then if you don't use it to
one of those things you can actually use this with any other a Ubuntu 14.04
service that you have in your environment if its running a LAMP stack
that's totally fine if its running a big java app that's totally fine you can go in
there running with that and so we have documentation will tell you exactly how
to implement that into other playbooks that you might have and so the road
ahead for us as we want support for Ubuntu16.04 which just came out and we also want
to support CentOS 7 as well we have a request for that and then the new RHEL 7
guidelines are coming out
I don't know how many other familiar with systemd but that's a new thing now
it's very exciting so we want to get that in there we want to have a little
bit better reporting so it's even easier for you to have that conversation with
your auditors and also you as an employer can go and show to your upper
level folks and say hey look look at how we're improving look at the security
controls we have now that we didn't have before and then finally we want to get
to the point where we can go through certain OpenStack services and alert you
to bed configurations so if you have something you know set up in a way that
is not recommended we'll alert you to it and give you a better recommendation so
that's on the road ahead so if you wanna get involved we have the OpenStack Ansible
Developer Summit going on the rest of today Thursday and Friday we had a full
room in there earlier with people from some very large organizations that I did
not know we're using it we're also on IRC and pound openstack Ansible we're
always in there we've got folks from Australia Europe and USA so you ask a
question there's almost guaranteed to be somebody in there is some time of day
depending on how much coffee they've had in course you can send something mailing
list as well we have links here is a little bit long but the slides will be
available for those links are documentation in the actual source code
itself and so that that's it for me if you have any questions I'll be glad to
answer them any questions out there for major any questions any questions does this
sound useful to y'all interested in downloading using this very cool stuff
if you have questions you can ask him now you can catch up with major right
after the session are finding an IRC alright I appreciate it y'all thanks so much
for being a very attentive audience thank you major