What Can Talk To What on the OpenStack Message Broker

If a hypervisor is compromised, the Nova Compute instance running on that node is also compromised. If the compute instance is compromised, then its access to the Message Queue has to be considered tainted as well. What degree of risk does this pose?

I mention the compute node, but really, any service that has access to the broker is a vector for attack. This includes any third party application that listens for, say, Keystone notifications for audit purposes.

At the bottom of this article I have posted an inventory from a recent Tripleo deployment. There are a lot of exchanges and queus, and reading through them is informative.

What we need is a table showing who can read from and who can write to each of these elements.

My first hack at an ACL approach:

  • The default rule should be “read only”.
  • If a service is responsible for creating an exchange or a queue, it should get write access.
  • Beyond that, that service should grant explicit write granted to specific services for a given queue/exchange.

What is the start state?

$ sudo rabbitmqctl list_users
Listing users ...
guest	[administrator]
...done.
$ sudo rabbitmqctl list_permissions
Listing permissions in vhost "/" ...
guest	.*	.*	.*
...done.

So, by default, all the services connect as the same user, and have full permissions to read and write on everything.

I will state that only the Keystone server should be able to write to the keystone topic, and, by default, only Ceilometer should be reading from it.


$ sudo rabbitmqctl list_exchanges
Listing exchanges ...
	direct
amq.direct	direct
amq.fanout	fanout
amq.headers	headers
amq.match	headers
amq.rabbitmq.log	topic
amq.rabbitmq.trace	topic
amq.topic	topic
ceilometer	topic
central	topic
cert_fanout	fanout
cinder	topic
cinder-scheduler_fanout	fanout
cinder-volume_fanout	fanout
compute_fanout	fanout
conductor_fanout	fanout
consoleauth_fanout	fanout
dhcp_agent_fanout	fanout
engine_fanout	fanout
glance	topic
heat	topic
heat-engine-listener_fanout	fanout
ironic	topic
keystone	topic
l3_agent_fanout	fanout
magnetodb	topic
magnum	topic
neutron	topic
neutron-vo-QosPolicy-1.0_fanout	fanout
nova	topic
openstack	topic
q-agent-notifier-dvr-update_fanout	fanout
q-agent-notifier-network-update_fanout	fanout
q-agent-notifier-port-delete_fanout	fanout
q-agent-notifier-port-update_fanout	fanout
q-agent-notifier-security_group-update_fanout	fanout
q-agent-notifier-tunnel-delete_fanout	fanout
q-agent-notifier-tunnel-update_fanout	fanout
q-l3-plugin_fanout	fanout
q-plugin_fanout	fanout
q-reports-plugin_fanout	fanout
reply_1cbc785538484554850f69dda902c537	direct
reply_748d4640dbab4284bae19fe086af14e8	direct
reply_ab42e35c548d48b48c9ba0fc3ac93ec7	direct
reply_b37538409ae84436804ccd1b1c0a3bdd	direct
reply_c6bebd23c7e24a5c9a06730b42d317cf	direct
reply_f34034fd84e347e8b6aeedc49f97282d	direct
sahara	topic
sahara-ops_fanout	fanout
scheduler_fanout	fanout
swift	topic
trove	topic
zaqar	topic
...done.

Here are the Queues

$ sudo rabbitmqctl list_queues
Listing queues ...
cert	0
cert.overcloud-controller-0.localdomain	0
cert_fanout_c8d9d81c87d84e728cb498a0d434c825	0
cinder-scheduler	0
cinder-scheduler.hostgroup	0
cinder-scheduler_fanout_7969a98120ca4f2097af3ade0ba159ef	0
cinder-volume	0
cinder-volume.hostgroup@tripleo_iscsi	0
cinder-volume_fanout_1520069c024c4c6490fdbb6f336819cc	0
compute	0
compute.overcloud-novacompute-0.localdomain	0
compute_fanout_7dc21bc0422b4d4c9addb151e9e2d8ba	0
conductor	0
conductor.overcloud-controller-0.localdomain	0
conductor_fanout_9f3ff7a1e8b146fc9b5dccb1aa80f119	0
consoleauth	0
consoleauth.overcloud-controller-0.localdomain	0
consoleauth_fanout_4b36518037784e7aad7ce7049b89d089	0
dhcp_agent	0
dhcp_agent.overcloud-controller-0.localdomain	0
dhcp_agent_fanout_8776747599464cc3b80a56b731841fd7	0
engine	0
engine.overcloud-controller-0.localdomain	0
engine_fanout_1030eeeec4644022b5a9f7259f7e0018	0
engine_fanout_2ffb137908934072af6a15d3a6b9e616	0
engine_fanout_bac7897eb7ac43f0a561a0c12c408e26	0
engine_fanout_f439912a1d80484ea38ab784a95fb656	0
heat-engine-listener	0
heat-engine-listener.31d42df9-f64f-451d-b9d6-7ef46229c929	0
heat-engine-listener.8730caa4-4104-4d71-bcc1-08ae17a41420	0
heat-engine-listener.b1dd3b6e-d085-4005-a4c9-a29b6f91c3f6	0
heat-engine-listener.ea60f788-af0c-49be-9325-8cefe60cc53a	0
heat-engine-listener_fanout_3b2879946f754cd9bd4becc6b8448071	0
heat-engine-listener_fanout_725990e3081f4ddc839a1bbf78520873	0
heat-engine-listener_fanout_aa1ec5483825470797e11b73cddaf223	0
heat-engine-listener_fanout_cb251c73b0f64d64ac3e38b529e1de30	0
l3_agent	0
l3_agent.overcloud-controller-0.localdomain	0
l3_agent_fanout_83ec229461dd4bd68d4e0debc7f9a39d	0
metering.sample	0
neutron-vo-QosPolicy-1.0	0
neutron-vo-QosPolicy-1.0.overcloud-controller-0.localdomain	0
neutron-vo-QosPolicy-1.0.overcloud-novacompute-0.localdomain	0
neutron-vo-QosPolicy-1.0_fanout_5f54eaed13cb47da8d80b82223f87e47	0
neutron-vo-QosPolicy-1.0_fanout_f57c66031cb4437ea75a23ec1698b287	0
notifications.info	0
notifications.sample	0
q-agent-notifier-dvr-update	0
q-agent-notifier-dvr-update.overcloud-controller-0.localdomain	0
q-agent-notifier-dvr-update.overcloud-novacompute-0.localdomain	0
q-agent-notifier-dvr-update_fanout_33c92818f86644899082458f893c6157	0
q-agent-notifier-dvr-update_fanout_82d2beb050dc4dde956a86cc6e2e5562	0
q-agent-notifier-network-update	0
q-agent-notifier-network-update.overcloud-controller-0.localdomain	0
q-agent-notifier-network-update.overcloud-novacompute-0.localdomain	0
q-agent-notifier-network-update_fanout_0ef20a72234a45718ece2328d230e2c6	0
q-agent-notifier-network-update_fanout_737fb57587f3453cb14d41b01c5fcdcc	0
q-agent-notifier-port-delete	0
q-agent-notifier-port-delete.overcloud-controller-0.localdomain	0
q-agent-notifier-port-delete.overcloud-novacompute-0.localdomain	0
q-agent-notifier-port-delete_fanout_03a026eb000c4efd89e15dc7834b8fdd	0
q-agent-notifier-port-delete_fanout_acd74597e74041abace267f898a2ce31	0
q-agent-notifier-port-update	0
q-agent-notifier-port-update.overcloud-controller-0.localdomain	0
q-agent-notifier-port-update.overcloud-novacompute-0.localdomain	0
q-agent-notifier-port-update_fanout_28a72273f7234c3b9c4cb4d4f64854c1	0
q-agent-notifier-port-update_fanout_b8ccb7d92aa64bfb9106ecd10c59cfea	0
q-agent-notifier-security_group-update	0
q-agent-notifier-security_group-update.overcloud-controller-0.localdomain	0
q-agent-notifier-security_group-update.overcloud-novacompute-0.localdomain	0
q-agent-notifier-security_group-update_fanout_008a11d67bc54f12bce4a03387a64000	0
q-agent-notifier-security_group-update_fanout_a9f578980b6f4c1ca65629e887bff76e	0
q-agent-notifier-tunnel-delete	0
q-agent-notifier-tunnel-delete.overcloud-controller-0.localdomain	0
q-agent-notifier-tunnel-delete.overcloud-novacompute-0.localdomain	0
q-agent-notifier-tunnel-delete_fanout_1769bab276d44b34a6db34498db522c8	0
q-agent-notifier-tunnel-delete_fanout_cb6f4fd56c8f40b9b2f3b0a6484b70ad	0
q-agent-notifier-tunnel-update	0
q-agent-notifier-tunnel-update.overcloud-controller-0.localdomain	0
q-agent-notifier-tunnel-update.overcloud-novacompute-0.localdomain	0
q-agent-notifier-tunnel-update_fanout_47164fceef534b298b8ea4ee34f9282b	0
q-agent-notifier-tunnel-update_fanout_be1a1e9cc37c4f94921131c3346eed48	0
q-l3-plugin	0
q-l3-plugin.overcloud-controller-0.localdomain	0
q-l3-plugin_fanout_bf639b0aebe6466dba97fb88151ee8b7	0
q-l3-plugin_fanout_eeac107aa8374f87afbddbf6aafcd65c	0
q-plugin	0
q-plugin.overcloud-controller-0.localdomain	0
q-plugin_fanout_38617a666c6c46fd91c6eada520f0303	0
q-reports-plugin	0
q-reports-plugin.overcloud-controller-0.localdomain	0
q-reports-plugin_fanout_4feee95d061f40b2906c22268c79a626	0
q-reports-plugin_fanout_c6123bf05ab24ddaa12adca88b920215	0
reply_1cbc785538484554850f69dda902c537	0
reply_748d4640dbab4284bae19fe086af14e8	0
reply_ab42e35c548d48b48c9ba0fc3ac93ec7	0
reply_b37538409ae84436804ccd1b1c0a3bdd	0
reply_c6bebd23c7e24a5c9a06730b42d317cf	0
reply_f34034fd84e347e8b6aeedc49f97282d	0
sahara-ops	0
sahara-ops.2baf790d-3cfe-42b7-b8bf-49611ecc9639	0
sahara-ops_fanout_91b35b7138284165b4f274f5221d6d89	0
scheduler	0
scheduler.overcloud-controller-0.localdomain	0
scheduler_fanout_0888632b036840849e04edc68d4df200	0
...done.


Leave a Reply

Your email address will not be published. Required fields are marked *