Xen has the ability to attach virtual trusted platform modules (vTPMs) to guest VMs: http://wiki.xenproject.org/wiki/Virtual_Trusted_Platform_Module_(vTPM). I would like to know if there is any Openstack integration for this feature - can managed VM for instance be provisioned vTPMs?
I saw something similar for Hyper-V here:
http://specs.openstack.org/openstack/nova-specs/specs/mitaka/approved/hyper-v-vtpm-devices.html
OpenStack provides the following as part of Cloud tenant threat mitigation:
Use separated clouds for tenants, if necessary.
Use storage encryption per VM or per tenant.
OpenStack Nova has a Trusted Filter for Filter Scheduler to schedule workloads to trusted resources only (trusted computing pools), so workloads not requiring trusted execution can be scheduled on any node, depending on utilization, while workloads with a trusted execution requirement will be scheduled only to trusted nodes.
With the following process:
Before you can run OpenStack with XenServer, you must install the hypervisor on an appropriate server .
Xen is a type 1 hypervisor: When your server starts, Xen is the first software that runs. Consequently, you must install XenServer before you install the operating system where you want to run OpenStack code. You then install nova-compute into a dedicated virtual machine on the host.
While XAPI is the preferred mechanism for supporting XenServer (and its deprecated sibling XCP), most existing Xen Project integration with OpenStack is done through libvirt below.
compute_driver = libvirt.LibvirtDriver
[libvirt]
virt_type = xen
Hardware TPM is also supported:
Our solution essentially mimics how one may download software and compute its SHA-256 hash and compare against its advertised SHA-256 hash to determine its legitimacy. It involves using Intel TXT, which is composed of hardware, software, and firmware. The hardware, attached to the platform, called the Trusted Platform Module (TPM)[3], provides the hardware root of trust. Firmware on the TPM is used to compute secure hashes and save the secure hashes to a set of registers called Platform Configuration Registers (PCRs), with different registers containing different measurements. Other components are Intel virtualization technology, signed code modules, and a trusted boot loader called TBOOT1. Essentially the BIOS, option ROM, and kernel/Ramdisk are all measured in the various PCRs. From a bare metal trust standpoint, we are interested in PCRs 0-7(BIOS, option ROM). The kernel/Ramdisk measurements would depend on the image the tenant seeks to launch on their bare metal instance. PCR value testing is provided by an Open Attestation service, OAT[2]. Additional details in references.
with these security considerations:
At the time of this writing, very few clouds are using secure boot technologies in a production environment. As a result, these technologies are still somewhat immature. We recommend planning carefully in terms of hardware selection. For example, ensure that you have a TPM and Intel TXT support. Then verify how the node hardware vendor populates the PCR values. For example, which values will be available for validation. Typically the PCR values listed under the software context in the table above are the ones that a cloud architect has direct control over. But even these may change as the software in the cloud is upgraded. Configuration management should be linked into the PCR policy engine to ensure that the validation is always up to date.
References
Tighten the security of your OpenStack Clouds - OpenStack Superuser
Xen, XAPI, XenServer - OpenStack Configuration Reference - kilo
XenServer - OpenStack
XenServer/XenAndXenServer - OpenStack
XenAPI Specific Bugs : OpenStack Compute (nova)
OpenStack - Xen
Xen via Libvirt - OpenStack Configuration Reference - liberty
Hypervisors - OpenStack Configuration Reference - kilo
OpenStack Docs: Overview of nova.conf
OpenStack Docs: nova.conf - configuration options
OpenStack Docs: Telemetry configuration options
Configure APIs - OpenStack Configuration Reference - kilo
OpenStack Docs: Glossary
Bare-metal-trust - OpenStack
Baremetal driver - OpenStack Configuration Reference - juno
OpenStack Docs: Integrity life-cycle
Current Series Release Notes — Nova Release Notes 16.0.0.0b3.dev171 documentation
Enhanced-Platform-Awareness-OVF-Meta-Data-Import - OpenStack
Example nova.conf configuration files - OpenStack Configuration Reference - kilo
Chapter 7. Configuring a Basic Overcloud using Pre-Provisioned Nodes - Red Hat Customer Portal
Feature Support Matrix — nova 16.0.0.0b3.dev171 documentation
Trusted Computing for Infrastructure (pdf)
What is Hyper.sh | Hyper.sh User Guide
Xen TPM Manager
Supporting Open Source Software Development in SSOs/SDOs
Xen Cloud Platform Virtual
Machine Installation Guide (pdf)
OpenStack Docs: Security hardening
policy.json - OpenStack Configuration Reference - kilo
Appendix B. Firewalls and default ports - OpenStack Configuration Reference - kilo
New, updated and deprecated options in Kilo for Orchestration - OpenStack Configuration Reference - kilo
Related
Is it possible to obtaining a licensed developer certificate for signing security-reviewed, community-developed open source SGX software binary in production mode, and publish it on open source repository like apt or rpm?
I just asked Intel SGX team, they said only verified vendors are able to obtain a certificate and run in production mode. It just like Apple’s App Store, no open source code allowed, right?
Well, it's possible, but it's a quite complicated task,
You will need to register yourself or your organization as an ISV with Intel, which is not an easy task, i.e. one of the requisites for the Remote Attestation is Mutual TLS, therefore and in order to get it working you need a Certificate which must be publicly available on an URL you control, so trust can be established between Intel and your server.
I know that vmware's Vsphere VM's can be encrypted using a KMS server but can the actual drive which vsphere is hosted on be encrypted? In Microsoft the hyper-visor host can be encrypted if bit-locker is enabled.
Not explicitly. You can, however, use Secure Boot to ensure that only signed code is ran: https://blogs.vmware.com/vsphere/2017/05/secure-boot-esxi-6-5-hypervisor-assurance.html
Based on Kyle Rudy's vmware link the following is good to note:
https://blogs.vmware.com/vsphere/2017/05/secure-boot-esxi-6-5-hypervisor-assurance.html
TPM and TXT
The question always comes up in customer conversations of “Does this require TPM or TXT??”. The answer is no. They are mutually exclusive. Secure Boot for ESXi is purely a function of the UEFI firmware and the validation of cryptographically signed code. Period.
Note that TPM 1.2 and TPM 2.0 are two vastly different implementations. They are not backwards compatible. There is support, via 3rd parties like HyTrust, for TPM 1.2 in ESXi 6.5.
TPM 2.0 is not supported in 6.5.
Standard BIOS firmware vs UEFI firmware
Typically, switching your hosts from their standard (legacy) BIOS firmware to UEFI firmware in some operating systems will cause issues. With ESXi, you can switch with no modification to ESXi. If you have installed 6.5 using standard BIOS and you want to try out Secure Boot then in the host firmware you can switch and ESXi will come up.
I want to change the root filesystem CentOs 6 to Btrfs filesystem.
My solution is to export virtual machine from localhost to GCE, I know the documentation to this job, but I have doubts how does work the process the import of boot disk images (You can import boot disk images from your physical datacenters, from virtual machines on your local workstation, or from virtual machines that run on another cloud platform. )
My question is relation to documenation of https://cloud.google.com/compute/docs/images:
Notable differences from standard CentOS images
Google Compute Engine-provided CentOS images contain the following differences from standard CentOS images:
All packages are updated to the date of the image and the image will reflect the latest CentOS point release.
Google Cloud repositories are enabled to install packages from the Linux Guest Environment for Google Compute Engine.
Google CloudSDK is installed.
IPv6 is disabled as it is not yet supported on Compute Engine.
The eth0 MTU is set to 1460.
DHCP is set to retry every 10 seconds instead of 5 minutes.
The DHCP client is set to persistent mode instead of oneshot.
......
......
......
So my question is, ¿when I imported a boot disk CentOs from my computer to GCE, does GCE apply all this parameters to my boot disk CentOs, so To be compatible with the standard settings of google image CentOs?
If this does not, then:
¿How can i proceed?
I find the solution:
There is a free service that helps with VM migrations but is limited to some OS. CentOS 6.0 is included but I am not sure if it supports the file system you are looking for.
If you cannot use the migration service and you do not want to use the public images provided by Google, then you must take care of the bootloader and all OS configuration you mentioned. You might also want to have a look to this link, in public Google images some daemons are installed by default. They add GCE functionality like syncing the accounts used in your project with the VMs.
Background:
I have developed a software which runs on Linux and I distribute licenses for it to work.
For Linux installations I am using system UUID and my license is based on that.
For installing on various Cloud setups, I am packaging the OS with my software and providing to the User. User deploys it and requests license based on UUIDs shown in my software.
Issue:
When User deploys each instance, in few Cloud setups, UUIDs are same for different VM instances on same physical machine.
This causes a problem for license.
Solution:
What I have planned to do is simple: when OS boots up first time call uuidgen and generate UUID and store it to a file. After that for next reboot I will take it from this file so UUID will be same for the machine.
Questions on above solution:
1
uuidgen with random option calculates uuid by utilizing /dev/random
In a VM setup since there is no direct hardware access for generating this random seed, can /dev/random value possibly be same in different VM instances? which means uuidgen will operate on same seed?
2
if UUID generated in two different linux systems by uuidgen during first time bootup are same because the random seed was not good enough, then the next UUID generated will also be same in those Linux systems?
i.e.
While booting up, uuidgen is called and produces a UUID1 in VM1. Say it is same as UUID2 when uuidgen was called in another VM instance VM2.
If uuidgen is called again for next UUID in VM1, will it be again same if called in VM2?
Thank you.
The most probable thing to investigate is if the customer has generated those VM images from a common one, in which the uuid has already been generated. Having the lenght a uuid has, it's most improbable that you produce a colission of uuids.
By the way, requiring your software to depend on the uuid stored in a file allows your customer to clone your VM after your software has been installed, and all licenses validated by cloning.
If you want to protect your software licenses on VMs, you'll have to do some connecting to a license server and do some public key signing feature to validate licenses.
The main problem is that two cloned images from a virtual machine are exactly equal (hardware and software) and as so, can run the same software without having any difference from the point in time they where cloned.
Constraints:
My application requires SSE4.2 instruction set.
I am using packer.io to provision my Windows Azure VM (OpenLogic 6.5 OS.)
Windows Azure returns an AMD-processor-backed-VM about 15% of the time. The rest of the time - they are Intel-processor-based. AMD processors do not support SSE4.2, but they do support SSE4a. So, my application is terminated with SIGILL on AMD processors.
Questions:
Can I request specific architecture (Intel CPU) when Packer
provisions a VM? I know that instance types >= A8 come only with Intel processors, but they are more expensive, and I would not want to use them for development.
If Packer cannot do it, what are the other options
(Powershell, ect...) that would give me this functionality?
Thank you.
Answering my own question. Azure does not provide a way to request processor type. The only way to ensure Intel processor is to not use A-series machines (as confirmed by a MSFT representative.) Thus, no tool can do it.