-
Notifications
You must be signed in to change notification settings - Fork 21
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Secure Connections Standard #548
base: main
Are you sure you want to change the base?
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nice first draft - I have a few questions inline
@markus-hentsch I have general remark: Because TLS configuration and security is a moving target, have you considered to base the recommended configuration on one of the profiles offered by Mozilla SSL? For example, the "intermediate" profile, see https://ssl-config.mozilla.org/ and https://wiki.mozilla.org/Security/Server_Side_TLS. (AFAIK, these can be checked with |
lol, I had the same idea and actually checked our haproxy TLS implementation, seems there is some opportunity to do some hardening there:
|
working on a fix for upstream: https://bugs.launchpad.net/kolla-ansible/+bug/2060787 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just some minor cosmetic changes:
- Is prefer to write Cloud Service Provider instead of CSP, as "CSP" is not an official abbreviation
- I do not like writing "SCS proposes..", "SCS decides...". AFAIK, SCS stands for Sovereign Cloud Stack, which is a Software Stack, which cannot decide something. I prefer to write "SCS project" or "SCS community"
But again. This is just cosmetics.
I adjusted the SCS references. I left "CSP" as-is and added a glossary instead, like I did with some other standards. We seem to use CSP a lot in other standards so I'd like to stay consistent. The glossary at the top should introduce the abbreviation sufficiently now. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Overall I think this is a good starting point. We need something for the manual audits, but this may something to discuss in the standards SIG or in the IAM and Security Meeting
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks for all the work done so far on this.
Unfortunately I think there's still some work left to do.
Thanks.
Updated standard and test script to use the Mozilla TLS "intermediate" preset now. |
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
b60a38e
to
d166e7e
Compare
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
- version: v5 | ||
standards: | ||
- name: Secure Connections | ||
url: https://raw.githubusercontent.com/SovereignCloudStack/standards/main/Standards/scs-01XX-v1-secure-connections.md |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
TODO: URL needs update as soon as number is stable
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
I updated the standard and removed the concrete config options from the RabbitMQ and Apache Kafka sections. Config snippets like these are hard to keep up-to-date in a standard. I placed links to documentation there instead. |
@artificial-intelligence this is still marked as "requested changes" by you. Was there anything left from your review that I didn't address yet? |
Signed-off-by: Markus Hentsch <markus.hentsch@cloudandheat.com>
Closes #547