OpenStack安全配置指南：从身份认证到数据保护

一、安全架构概述

1.1 OpenStack安全层次

OpenStack安全分为多个层次：

二、身份认证安全

2.1 Keystone安全配置

# /etc/keystone/keystone.conf

[token]
provider = fernet  # 推荐使用Fernet
expiration = 3600  # 令牌有效期

[credential]
provider = fernet
key_repository = /etc/keystone/credential-keys/

[fernet_tokens]
key_repository = /etc/keystone/fernet-keys/

2.2 密码策略

# 配置密码复杂度
# /etc/keystone/keystone.conf
[identity]
password_hash_algorithm = bcrypt
password_hash_rounds = 12

# 用户密码过期
openstack user password expire admin

2.3 Fernet密钥轮换

# 手动轮换密钥
keystone-manage fernet_rotate

# 设置定时任务
# crontab -e
0 2 * * * keystone-manage fernet_rotate

三、RBAC权限控制

3.1 默认角色

3.2 自定义角色

# 创建角色
openstack role create project-admin
openstack role create readonly

# 分配角色
openstack role add --project production --user alice project-admin

# 查看权限
openstack role list --project production --user alice

3.3 Policy配置

# /etc/nova/policy.json
{
    "admin_or_owner": "rule:admin_required or project_id:%(project_id)s",
    "default": "rule:admin_or_owner",

    "compute:create": "rule:admin_or_owner",
    "compute:get_all": "rule:admin_or_owner",
    "compute:delete": "rule:admin_or_owner",

    "network:create": "rule:admin_only",
    "network:delete": "rule:admin_only"
}

四、网络安全

4.1 安全组最佳实践

# 创建严格的安全组规则
# 只允许必要端口
openstack security group rule create --protocol tcp \
  --dst-port 22 \
  --remote-ip 0.0.0.0/0 \
  ssh-group

# 禁止所有入站
openstack security group rule create --protocol icmp \
  --remote-ip 0.0.0.0/0 \
  --action deny \
  default

4.2 网络隔离

# 创建项目专用网络
openstack network create --project  private-network

# 配置网络ACL
neutron firewall-policy-create --firewall-rules  my-policy

五、API安全

5.1 HTTPS配置

# Apache SSL配置

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/server.crt
    SSLCertificateKeyFile /etc/ssl/private/server.key
    SSLCACertificateFile /etc/ssl/certs/ca.crt

    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder on
    SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384

5.2 API限流

# /etc/keystone/keystone.conf
[DEFAULT]
max_request_body_size = 114688

[oslo.limit]
# 配置API限流

六、审计与监控

6.1 审计日志

# 启用审计日志
# /etc/keystone/keystone.conf
[audit]
enabled = true
middleware_notifications_path = /var/log/keystone/audit.log

# 查看审计日志
tail -f /var/log/keystone/audit.log

6.2 安全监控

# 监控异常登录
grep "Authentication failed" /var/log/keystone/keystone.log

# 监控异常API调用
grep "403" /var/log/apache2/keystone-access.log

# 检查未授权访问
grep "401" /var/log/neutron/neutron-server.log

七、安全最佳实践清单

7.1 必需配置

• [ ] 使用Fernet Token
• [ ] 启用HTTPS
• [ ] 配置密码策略
• [ ] 启用审计日志
• [ ] 定期轮换密钥

7.2 推荐配置

• [ ] 启用两因素认证
• [ ] 配置网络隔离
• [ ] 启用API限流
• [ ] 定期安全扫描
• [ ] 配置入侵检测

7.3 禁止配置

• [ ] 禁用admin用户
• [ ] 使用默认密码
• [ ] 开放所有端口
• [ ] 禁用SSL/TLS
• [ ] 关闭日志记录

八、常见安全事件处理

8.1 密码泄露应对

# 1. 禁用受影响用户
openstack user disable compromised-user

# 2. 撤销所有Token
keystone-manage token_flush

# 3. 重置用户密码
openstack user password set --password-prompt compromised-user

# 4. 检查审计日志
grep "compromised-user" /var/log/keystone/audit.log

8.2 异常访问处理

# 1. 检查异常IP
grep "Failed authentication" /var/log/keystone/keystone.log

# 2. 封锁可疑IP
iptables -A INPUT -s  -j DROP

# 3. 检查受影响资源
openstack server list --all-projects

九、总结

本文详细介绍了OpenStack的安全配置最佳实践。

核心要点：

下篇预告： 《OpenStack监控与日志管理》

cnbugsai

打赏 海报 链接