Storage : Improve security

[davidfischer-ch]

Tasks

• Think about NATing and multiple environments setup
• Update GlusterFS IP addresses white list by oscied-storage relation hooks
• Test access restriction

  Dev

• Convert Bash hooks library to Python
• Add auth_ips to config.yaml + config-changed trigger
• Implement relation_auth_ips <-> (file) for oscied-storage relation hooks

  Remarks

Any unit can read/write any file in volume :

• Create separate volumes ?
• Handle POSIX rights / ACLs, act as user xyz ?
• Encryption of Archives (?)
• Web UI mount the storage, maybe we should avoid that ?

[bramtul]

Perhaps VPN connections between local and private sites/nodes?

Several nodes, depending on availability of hardware, are installed at various partner sites. These local nodes are directly connected through Ethernet. Each local site is interconnected with other sites through an openVPN configuration, i.e., Ethernet frames are tunneled via the public Internet. (text copy from: http://www.psirp.org/files/Deliverables/FP7-INFSO-ICT-216173-PSIRP-D5.5_FinalPlanUsingKnowledge.pdf)

[davidfischer-ch]

Sure, it is a good idea !

I will open another ticket and create another branch to isolate source-code modifications for the integration of OpenVPN into charms hooks.

[davidfischer-ch]

Some links:

• http://gluster.org/community/documentation/index.php/Gluster_3.1:_Setting_Volume_Options
• http://gluster.org/community/documentation/index.php/GlusterFS_Technical_FAQ
• http://how-to.linuxcareer.com/configuration-of-high-availability-storage-server-using-glusterfs
• http://www.howtoforge.com/creating-an-nfs-like-standalone-storage-server-with-glusterfs-3.2.x-on-ubuntu-11.10

[davidfischer-ch]

The allowed IP addresses list update algorithm is here, a live-test is needed.