You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "myskov (via GitHub)" <gi...@apache.org> on 2023/03/10 09:24:48 UTC
[GitHub] [ozone] myskov opened a new pull request, #4372: HDDS-8132. [Design] Secure S3 keys management
myskov opened a new pull request, #4372:
URL: https://github.com/apache/ozone/pull/4372
## What changes were proposed in this pull request?
While attempting to get Ozone to production, we found several security flaws regarding S3 auth.
Some of them we have already done ([HDDS-7191](https://issues.apache.org/jira/browse/HDDS-7191), [HDDS-7815](https://issues.apache.org/jira/browse/HDDS-7815)), some of them are in progress ([HDDS-8050](https://issues.apache.org/jira/browse/HDDS-8050),[HDDS-7814](https://issues.apache.org/jira/browse/HDDS-7814)), and some are to be implemented.
This document shares our vision of improving Ozone S3 security, the current and the upcoming work.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-8132
## How was this patch tested?
```
cd hadoop-hdds/docs
hugo serve
firefox http://localhost:1313
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] ashishkumar50 commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "ashishkumar50 (via GitHub)" <gi...@apache.org>.
ashishkumar50 commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1199571110
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,37 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+We intend to extend Ozone S3 secret key management:
+* Support centralized remote S3 secret storage.
+* Implement S3 gateway endpoint to provide get s3 secret and secret renewal.
Review Comment:
@adoroszlai, Yes It is fine.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1140847312
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
Review Comment:
_Add what is to be done:_
Extend Ozone S3 secret key management to support centralized remote S3 secret storage. To add TTL to secrets. To also implement S3 gateway endpoint to provide get s3 secret and secret renewal.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1150253750
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
>On om start, the om initiates a call to the (external) secret store interface to load all keys into cache?
yes
>Does the design propose to extend the s3g and add an endpoint or to create a separate s3 secret server endpoint with its own config (ozone.s3.secret...). ?
Suggested solution is to extend s3g.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1497039734
@neils-dev @prashantpogde could you please have a look at the PR?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] kerneltime commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "kerneltime (via GitHub)" <gi...@apache.org>.
kerneltime commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1466458405
cc @Pochatkin
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1138658282
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
Review Comment:
@SaketaChalamchala yes it is
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] SaketaChalamchala commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "SaketaChalamchala (via GitHub)" <gi...@apache.org>.
SaketaChalamchala commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1137513222
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
Review Comment:
Just clarifying, a patch is available for remote S3 storage but, the implementation of HTTP endpoint for S3 secret retrieval is in progress correct?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1173084403
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,34 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+* Extend Ozone S3 secret key management to support centralized remote S3 secret storage
Review Comment:
@neils-dev done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] kerneltime commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "kerneltime (via GitHub)" <gi...@apache.org>.
kerneltime commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1466494745
cc @tanvipenumudy @SaketaChalamchala can you please take a look?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] adoroszlai commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1199005983
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,37 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+We intend to extend Ozone S3 secret key management:
+* Support centralized remote S3 secret storage.
+* Implement S3 gateway endpoint to provide get s3 secret and secret renewal.
Review Comment:
```suggestion
* Implement S3 gateway endpoint for getting, renewing and revoking secrets.
```
@ashishkumar50 @myskov please take a look at the suggested wording. If it's OK, we can merge the PR after making this change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] ashishkumar50 commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "ashishkumar50 (via GitHub)" <gi...@apache.org>.
ashishkumar50 commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1173623495
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,37 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+We intend to extend Ozone S3 secret key management:
+* Support centralized remote S3 secret storage.
+* Implement S3 gateway endpoint to provide get s3 secret and secret renewal.
Review Comment:
S3 gateway endpoint we are adding even for revoke secret as well in HDDS-8050. We can add here along with get s3 secret, revoke secret.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1173084128
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
@neils-dev I added API spec to the document
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,34 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+* Extend Ozone S3 secret key management to support centralized remote S3 secret storage
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1160317967
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
> providing the REST API
Apis, GET / POST parameters and responses / payload - Can we define these for the get secret and secret renewal an include them in the doc?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] adoroszlai commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1555764557
Thanks @myskov, @Pochatkin for the design doc. Thanks @ashishkumar50, @neils-dev, @SaketaChalamchala for the reviews.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1160306569
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,34 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implementing
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+* Extend Ozone S3 secret key management to support centralized remote S3 secret storage
Review Comment:
Thanks @myskov. Can reword to, "We intend to extend Ozone S3 ...
Implement S3 gatewary endpoint ...
_And_ to add TTL to secrets.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] SaketaChalamchala commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "SaketaChalamchala (via GitHub)" <gi...@apache.org>.
SaketaChalamchala commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1139293106
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
Review Comment:
Should we change the status to implementing then?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1140847389
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
In the design doc,
`Section 1. Store Secrets in remote storage`
last sentence, does loading all keys in ozone manager imply all keys are loaded to the proposed om cache for s3 secrets? On om start, the om initiates a call to the (external) secret store interface to load all keys into cache?
`Section 2. Endpoint for key generation (renewal)`
Does the design propose to extend the s3g and add an endpoint or to create a separate s3 secret server endpoint with its own config (ozone.s3.secret...). ?
`Section 3. Add key expiration`
For key generation and renewal sharing the same gateway, defining and providing the REST API would be helpful.
What about key rotation? Is there a provision for this? Is it key generation with TTL, on s3g error retrying the s3 secret get to rotate?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1495762919
@prashantpogde please have a look at the PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] SaketaChalamchala commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "SaketaChalamchala (via GitHub)" <gi...@apache.org>.
SaketaChalamchala commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1494661753
Thanks for the updates @myskov. LGTM.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1140847389
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
In the design doc,
`Section 1. Store Secrets in remote storage`
last sentence, does loading all keys in ozone manager imply all keys are loaded to the proposed om cache for s3 secrets? On om start, the om initiates a call to the (external) secret store interface to load all keys into cache?
`Section 2. Endpoint for key generation (renewal)`
Does the design propose to extend the s3g and add an endpoint or to create a separate s3 secret server endpoint with its own config (ozone.s3.secret...). ?
`Section 3. Add key expiration`
For key generation and renewal sharing the same gateway, defining and providing the REST API would be helpful.
What about key rotation? Is there a provision for this? Is it key generation with TTL, on s3g error retrying the s3 secret get to renew?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] adoroszlai merged pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "adoroszlai (via GitHub)" <gi...@apache.org>.
adoroszlai merged PR #4372:
URL: https://github.com/apache/ozone/pull/4372
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1150253750
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
>On om start, the om initiates a call to the (external) secret store interface to load all keys into cache?
yes
>Does the design propose to extend the s3g and add an endpoint or to create a separate s3 secret server endpoint with its own config (ozone.s3.secret...). ?
Suggested solution is to extend s3g.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1150255590
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
Review Comment:
done
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
Review Comment:
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1490016598
please take a loook @SaketaChalamchala @neils-dev
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] myskov commented on pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "myskov (via GitHub)" <gi...@apache.org>.
myskov commented on PR #4372:
URL: https://github.com/apache/ozone/pull/4372#issuecomment-1494047774
Could you please have a look at the PR @neils-dev @adoroszlai ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
[GitHub] [ozone] neils-dev commented on a diff in pull request #4372: HDDS-8132. [Design] Secure S3 keys management
Posted by "neils-dev (via GitHub)" <gi...@apache.org>.
neils-dev commented on code in PR #4372:
URL: https://github.com/apache/ozone/pull/4372#discussion_r1140847389
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
+There are problems related to the current S3 keys management:
+* Storing keys as plain text in Ozone Manager rocksdb is insecure. An ozone administrator can easily impersonate any user by recovering his keys from rocksdb.
+* The only way for a user to generate keys is to have SSH access to the Ozone cluster. Security policies can also prohibit this.
+* Keys revocation process is manual which leads to security issues.
+
+This document proposes solutions to the above issues.
+
+# Link
+
+https://issues.apache.org/jira/secure/attachment/13056235/Secure%20S3%20keys%20management.pdf
Review Comment:
In the design doc,
`Section 1. Store Secrets in remote storage`
last sentence, does loading all keys in ozone manager imply all keys are loaded to the proposed om cache for s3 secrets? On om start, the om initiates a call to the (external) secret store interface to load all keys into cache?
`Section 2. Endpoint for key generation (renewal)`
Does the design propose to extend the s3g and add an endpoint or to create a separate s3 secret server endpoint with its own config (ozone.s3.secret...). ?
`Section 3. Add key expiration`
For key generation and renewal sharing the same gateway, defining and providing the REST API would be helpful.
What about key renewal? Is there a provision for this? Is it key generation with TTL, on s3g error retrying the s3 secret get to renew?
##########
hadoop-hdds/docs/content/design/secure-s3.md:
##########
@@ -0,0 +1,32 @@
+---
+title: Secure S3 keys management
+summary: Improving security regarding s3 keys management
+date: 2023-03-10
+jira: HDDS-8132
+status: implemented
+author: Maksim Myskov, Mikhail Pochatkin
+---
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+# Abstract
+
Review Comment:
_Add what is to be done:_
Extend Ozone S3 secret key management to support centralized remote S3 secret storage. To add TTL to secrets. To also implement S3 gateway endpoint to provide get s3 secret and secret rotataion.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org