yahoo-eng-team team mailing list archive

[Thierry Carrez <thierry.carrez+lp@xxxxxxxxx>]

** Changed in: nova
       Status: Triaged => Won't Fix

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1236125

Title:
  PowerVM driver ignores host keys

Status in OpenStack Compute (Nova):
  Won't Fix

Bug description:
  Nova's PowerVM driver is currently set to AutoAdd any host key over
  SSH.  As per the SSH protocol, host key fingerprints should be
  verified either by comparing with known hosts (like through a
  known_hosts file) or having a person verify its the host they wish to
  connect with.

  In particular,
  https://github.com/openstack/nova/blob/master/nova/virt/powervm/common.py
  uses paramiko.AutoAddPolicy() which will automatically accept any host key.  Doing so allows Nova to be susceptible to a man-in-the-middle.

  There should instead be an option in nova.conf to specify a
  known_hosts file and the paramiko policy to use.  That way someone
  could set the policy to Reject and specify a file with known_hosts
  which are acceptable.  Communication therefore would never occur to
  unknown hosts and allow a potential release of a user/pwd.

To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1236125/+subscriptions