OpenStack安全策略提升案例

使用OpenStack私有云平台，通过提供的相关软件包，安装必要组件，将私有云平台的访问策略从http提升至https。

controller：

安装相关软件包
[root@controller ~]# yum install -y mod_wsgi httpd mod_ssl 
[root@controller ~]# grep -Ev '^$|^#' /etc/httpd/conf.d/ssl.conf 
Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>                 
以上文件不用编辑，不查看也可以
编辑如下的文件

[root@controller ~]# vi /etc/openstack-dashboard/local_settings 
CSRF_COOKIE_SECURE = True     取消注释
SESSION_COOKIE_SECURE = True   取消注释
USE_SSL = True   添加该行
SESSION_COOKIE_HTTPONLY = True   添加该行

然后重启HTTP服务以及memcached服务
[root@controller ~]# systemctl restart httpd       
[root@controller ~]# systemctl restart memcached