Following on from The Hooded Apache, I thought it was about time to cover Nginx configuration.

Nginx is not exempt from security issues, and as with apache certain versions can vulnerable to a specific attack, as such the first line of defense is you hide your nginx version.

This can be done via:

1
2
3
4

server {
    server_tokens off;
    ...
}

This changes the put from

1

Server: nginx/1.0.12

To

1

Server: nginx

You could if you are so inclined change the server string in the c code itself

src/http/ngx_http_header_filter_module.c

...
static char ngx_http_server_string[] = "Server: my_modified_server" CRLF;
static char ngx_http_server_full_string[] = "Server: my_modified_server/release_version" CRLF;
...

To err is human …

Sometimes standard responses can be used for service fingerprinting as such error documents could still give away your running server version even if you were to edit the header code as per above, again this could be done by modifying the C code to only return “” for each error page, in which case you will need to edit

src/http/ngx_http_special_response.c

...
static char ngx_http_error_301_page[] = "";

I’m not going to list all of them you should get the idea from the exmaple above; however this is not really required, you can also swap out the default error pages with standard configuration.

1

error_page 404 = /path/to/custom/404.html;

A strong Front …

Nginx ofetn gets used to proxy other services, as such you could be revealing the backend technologies in use due to the backend server sending headers such as X-Powered-By.

This where in your proxy configure options you can have nginx intercept and remove the headers being sent by the backend.

1

proxy_hide_headers X-Powered-By;

In this post I will cover growing the file system of a guest instance when running KVM linux.

For this you will require the following Packages:

1. libguestfs-tools
2. guestfish

Shutdown the instance

In order to grow the disk we must virsh shutdown the instance, this can be achieved using a simple virsh shutdown instance_name, try to avoid running a virsh destroy as we want a clean filesystem to avoid issues in the resize.

Get current image information

After the image has shutdown we can now go ahead and get some information on the disk configuration:

1
2
3
4
5
6

virt-filesystems --long --parts --blkdevs -h -a centos_centos6.qcow2

Name       Type       Size  Parent
/dev/sda1  partition  200M  /dev/sda
/dev/sda2  partition  9.8G  /dev/sda
/dev/sda   device     10G   -

As can be seen here there is a single 10GB virtual disk residing on /dev/sda

virt-rezise

We must then create a destination disk image, of the required total size

1

qemu-img create -f qcow2 outfile 150G

I have opted to use the –expand flag, if this is not specified a new partition is created to ocupy the free space, refer to man virt-resize for more advanced options such as splitting the freespace to grow existing partitions (i.e. expand the boot partition +100M)

1

virt-resize --expand /dev/sda2 original.qcow2 outfile.qcow2

Go make a coffee as this step will take a while to complete.

Finishing up

If you were to start the instance back up now using outfile.qcow2 as the disk image, you would find the OS reports the original disk size, this is due to the LVM configuration which we can not change “online” (unless of course you are changing a partition that can be unmounted, not the case here).

We will use guestfish to complete the process.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

guestfish --rw -a outfile.qcow2

Welcome to guestfish, the libguestfs filesystem interactive shell for
editing virtual machine filesystems.

Type: 'help' for help on commands
      'man' to read the manual
      'quit' to quit the shell

><fs> run
><fs> list-filesystems
/dev/vda1: ext4
/dev/VolGroup00/LogVol00: ext4
/dev/VolGroup00/LogVol01: swap
><fs> lvresize-free /dev/VolGroup00/LogVol00 100
><fs> resize2fs /dev/VolGroup00/LogVol00
><fs> e2fsck-f /dev/VolGroup00/LogVol00
><fs> exit

virt-df -h outfile.qcow2
Filesystem                                Size       Used  Available  Use%
centos_el6_php53_lap:/dev/sda1            194M        52M       132M   27%
centos_el6_php53_lap:/dev/VolGroup00/LogVol00
                                          146G       1.1G       137G    1%

Your lvm configuration may differ change the above according to the output from list-filesystems.

Note: I run e2fsck-f as a precaution, this is not a required step though I highly recomend doing this.

Now finally swap out the images (or update the libvirt xml file, it’s up to you)

1
2
3

mv ./original.qcow2 ./original.bak
mv ./outfile.qcow2 ./original.qcow2
virsh start instance_name

If you instance starts successfully and all your data is intact the original.bak can be safely removed.

Earlier in the month I made reference in my Google+ posting that I had begun prototyping a pentesting “drop box” using the (Raspberry Pi)[https://www.raspberrypi.org] as the brains.

This is now 19 days since, and I realised I had not gotten around to writing a blog post on the project.

The Problem

The general public are unaware just how much data they send/receive at any given time; especially if said person has a “smart phone” the wealth of personal data a person carries around in their pocket can be staggering; more so that they have absolutely no clue how bad that can potentially be.

Want to carry out a little experiment?

1. Gather some none netsec aware people
2. How many of them can tell you right now without looking, if their phones wifi is enabled?
3. How many can do the same for bluetooth?
4. Without giving details, how many have passwords / bank details / something that shoudln’t be on their phone; on their phone?

You’ll be concerned with the results (unless you have somehow found a random grouping of people completely aware of their phones function and content at all times …).

Bridging the gap

In my experience no matter how you phrase it; for the general end consumer any conversation on netsec is met with indifference mainly due to a lack of understanding which is frustrating to say the least.

However you can can two directions in this situation berate the stupid luser; or you can attempt to educate them, and to that effect the most successfull method is something visual, in the form of a practical demonstration of the point you are trying to get across.

Why? It removes the need for the end consumer to attempt to mentally visualise what you are describing; all puns aside this makes it far easier for the end consumer to understand.

Education, got it … so why the pi?

Simple really, inexpensive 600MHZ arm processor that can boot linux and run from a battery pack.

The peak consumption I read somewhere is around 700ma, the battery pack in question is a 5000maH which asusming we see a 60% return on a full charge equestes to roughly 4.5hrs run time total.

1. Low power consumption
2. Easily portable
3. Relativly inexpensive
4. Runs linux

The Concept

I’d like to assume if you are reading this, you have at least a basic knowledge of netsec so at this point the post becomes less end user friendly …

1. Jassegar - utilizing jassegar to masquerade as a trusted ap, and route traffic through ethernet / usb 3g dongle. a. Desposable - setup and go, access data over 3g connection via a reverse tunnel; remote wipe / destruction.
2. Karma - I don’t know much about the karma quite, it appears this can be used for much the same as jassegar.

Couple the above with airdrop-ng for active denial of all wifi in the area, and suddenly every smart phone / laptop in the area is routing via the pwnberry pi and NO ONE is the wiser.

Proof or STFU

Whilst I don’t have a working demo at this time, perhaps some photos of the “build” would suffice?

Running left to right:

1. SD Card
2. 5000maH usb battery
3. Bottom of the “weather proof box”
4. Raspberry PI
5. ALFA awus036nh

All boxed in the “Premium” container, aka rubber sealed tupperware of doom …

To come …

I’m trying out different distributions to achieve this, pwnpi is looking promising at the moment.

As always time is limited so it’s on an as / when basis.

Yeh yeh … so it is true I have some quite vocal opinions, on all this cloud marketing fluff.

That said it has some great potential, if you’ve been following my open source contributions and posts you’ll known I have an special affinity for Openstack, Aeolus, and of course Opennebula.

As such I’ve taken to jumping in “feet first”, what better way eh?

Last October I was fortunate enough to attend the Openstack training in London, hosted by Rackspace, recently I now have a full openstack deployment running on fedora 17 on my laptop for prototyping, and testing (I have of course been bugreporting to redhat bugzilla! and I encourage you to do the same!).

I met some great people on the course last October, which unfortunatly I’ve only managed to keep in contact with a few of (if you’re reading this and were there get in contact!).

I have some upstream commits for: EPEL Openstack, libcloud, aeolus, boxgrinder … and I’ve gotten to a point this year where I can reflect, and make a post to that effect.

In short I have one problem with the cloud, and that’s the marketing; let me explain why, marketing is driven to make sales, it does not care about the education of the end user as to the product they are paying for, (and frankly hearing my parents / clients ask “Can’t you just use the cloud?” makes me want to break out the beating stick of education, more for the marketing people I belive in making a solution right for the indvidual not for the bottom line…), as I’ve come to know more on the systems involved it’s a revolution, now calm down and let me explain.

Yes the cloud is simply virtualization if you break it down into it’s rawest form, and that has been around for decades … but what “the cloud” is doing despite the marketing fluff, is comoditizing the technology and plating it firmly in the hands of users who have little to no technical background or knowlege, why is this a revolution?

Inherently a person who is somewhat intellegent is curious, curiosity (Despite killing the cat, though if my neighbours cat craps in my garden again it may well be my boot and not the curioisity) leads to discovery, this inturn leads to understanding; putting something so powerful so simply within reach of those who do not understand the technology both increases it’s proftiablity and should said end user persue their curosity they will learn.

Right so education for the massses, what’s next hugging trees? Not quiet the you may be missing the point, what’s better than an educated client someone who knows what they want and the potential technologies to achieve it as apposed to the uneducated who take the line of “it can’t be that hard all you do is sit there and tap the keyboard all day”.

There is a very real gap in understanding between the end user, and the Sysadmin/Devops supporting it, the cloud may well help to bridge the gap between the technology and the user, such as Devops bridges the gap between operations and the developer.

So, pulling this back to the original point of this blog, I appear to have gone off at a tangent.

1. I’ve conveted Wordpress -> Jekyll + Octopress
2. I’ve worked on the Rakefile to push differing assets to cloudfiles/
3. I am now just waiting on clouddns to allow CNAME records for the main domain, then …
4. blog.oneiroi.co.uk will exist purely in cdn.

With any luck I will be the first but this is reliant on the dns options becomming available, please comment and let me know your thoughts!

In this post I follow on from Setting up Nova and Glance, and now moving installing and Integrating keystone. I’d first like to give credit to IBM developerWorks the guys in #openstack @ freenode IRC, and Psycle Interactive without whom I would not of been able to complete this write up.

Please be aware the following applies to 2011.3 ONLY! (Diablo Final) the configuration to come in Essex is far simpler, if when reading this post your packages are 2012.X you have just installed essex and this is not relevant, anyway here we go …

1

yum install openstack-keystone

Keystone itself has it’s own tirade of concepts to get to grips with … tenant, user, role, service, token etc … I’m not going to go into detail on those concetps, for that Please see the documentation.

Configuring mySQL

First thing I am going to do is change from sqlite to mySQL connection, this involves editing line 54 of /etc/keystone/keystone.conf

1

sql_connection = mysql://keystone:keystone@localhost/keystone

Ignoring the default_store configuration at the top of the file, as this states sqllite, from what I can tell this simply instructs keystone to use the sqlAlchemy driver, which we just updated to point to mySQL.

Now like glance we need to restart keystone for the database to be populated.

1

service openstack-keystone restart

Now run keystone-manage with no args if you see

1
2
3

File "/usr/lib/python2.6/site-packages/keystone/manage/__init__.py", line 283, in main
    raise exc
sqlalchemy.exc.OperationalError: (OperationalError) (1044, "Access denied for user 'keystone'@'localhost' to database 'keystone'") None None

Review your keystone.conf file and ensure your mySQL credentials are correct, once done start keystone again.

Initial Credentials

Now we need to create an admin Tenant, and add an admin user to this tenancy.

1
2
3
4
5
6
7
8
9
10

keystone-manage tenant add adminTenant
SUCCESS: Tenant adminTenant created.
keystone-manage user add adminUser <password>
SUCCESS: User adminUser created.
keystone-manage role add Admin
SUCCESS: Role Admin created successfully.
keystone-manage role grant Admin adminUser
SUCCESS: Granted Admin the adminUser role on None.
keystone-manage role grant Admin adminUser adminTenant
SUCCESS: Granted Admin the adminUser role on adminTenant.

Ok so we have just:

1. setup a tenant named adminTenant.
2. setup a user named adminUser and specified their password.
3. created an admin role.
4. assigned the adminUser to the Admin role.
5. granted adminUser the Admin role to the adminTenant

Note: the outputs are a little confusion on the role assignments…

“Granted Admin the adminUser role on adminTenant”,

it appears the string output has the arguments in the wrong order here it should read:

“Granted adminUser the Admin role on adminTenant”.

I have however verified the mySQL data and can see the roles being correctly assigned.

Also the output from

1
2

keystone-manage role grant help
Missing arguments: role grant 'role' 'user' 'tenant (optional)'

Confirms the arguments are being entered in the correct order.

i.e.

mysql> select * from user_roles;
+----+---------+---------+-----------+
| id | user_id | role_id | tenant_id |
+----+---------+---------+-----------+
|  1 |       1 |       1 |      NULL |
|  2 |       1 |       1 |         1 |
+----+---------+---------+-----------+
2 rows in set (0.00 sec)

Now we need to configure keystone to recognise these new admin roles.

Lines 41 and 44:

1
2

keystone-admin-role = Admin
keystone-service-admin-role = KeystoneServiceAdmin

Edit these to reflect your Admin role accordingly and then restart openstack-keystone The above shows seperate roles for general and service admin, in my case I set these to the same role, it is of course entirely up to you and your delegation setup. If you choose to retain the KeystoneServiceAdmin delegation you will need to setup the role as per the Admin role above and run through the grants accordingly.

Setting up the Service token and service definitions

1
2

keystone-manage token add 999888777666 adminUser adminTenant 2012-12-23T00:00
SUCCESS: Token 999888777666 created.

If instead you get an error:

1
2
3
4
5
6
7
8

ERROR: 'NoneType' object has no attribute 'id'
2012-04-23 12:27:29    ERROR [root] 'NoneType' object has no attribute 'id'
Traceback (most recent call last):
  File "/usr/bin/keystone-manage", line 16, in <module>
    keystone.manage.main()
  File "/usr/lib/python2.6/site-packages/keystone/manage/__init__.py", line 283, in main
    raise exc
AttributeError: 'NoneType' object has no attribute 'id'

check your have correctly entered adminUser adminTenant (or the details you have entered) including correct capitilization.

1
2
3
4
5
6

keystone-manage service add nova compute "Openstack Compute Service"
SUCCESS: Service nova created successfully.
keystone-manage service add glance image "Openstack Image Service"
SUCCESS: Service glance created successfully.
keystone-manage service add keystone identity "Openstack Image Service"
SUCCESS: Service keystone created successfully.

Defining endPoints

Nova Here I managed to confuse myself, so let me be clear, this needs the nova_api service ip, not each compute node, meaning you only need one endpoint.

1
2

keystone-manage endpointTemplates add regionOne nova https://<nova_api_ip>:8774/v1.1/%tenant_id% https://<nova_api_ip>:8774/v1.1/%tenant_id% https://<nova_api_ip>:8774/v1.1/%tenant_id% 1 1
SUCCESS: Created EndpointTemplates for nova pointing to https://<nova_api_ip>:8774/v1.1/%tenant_id%

The 3 URL arguments are for publicURL, internalURL, adminURL (No idea if that is the order).

Glance

1
2

keystone-manage endpointTemplates add regionOne nova https://<glance_ip>:9292/v1 https://<nova_api_ip>:9292/v1 https://<nova_api_ip>:9292/v1 1 1
SUCCESS: Created EndpointTemplates for glance pointing to https://<glance_ip>:9292/v1

Keystone

1
2

keystone-manage endpointTemplates add pi-whc keystone https://<keystone_ip>:5000/v2.0 https://<keystone_ip>:5000/v2.0 https://<keystone_ip>:5000/v2.0 1 1
SUCCESS: Created EndpointTemplates for keystone pointing to https://<keystone_ip>:5000/v2.0.

Configuring Nova

Now we have keystone setup we need to configure nova to use keystone for authentication, by editing /etc/nova/api-paste.ini. Now there are seveal edits required, as such what follows are snippets of those changes.

EC2 Section modification

line 22 and 27 ([pipeline:ec2cloud] and [pipeline:ec2admin] sections).

1

pipeline = logrequest totoken authtoken keystonecontext ec2noauth cloudrequest authorizer ec2executor

New section for EC2 (in my config lines 60-61)

1
2

[filter:totoken]
paste.filter_factory = keystone.middleware.ec2_token:EC2Token.factory

Openstack section modification

Modification to [pipeline:openstackapi10] and [pipeline:openstackapi11] sections.

1
2
3
4
5

[pipeline:openstackapi10]
pipeline = faultwrap authtoken keystonecontext ratelimit extensions osapiapp10

[pipeline:openstackapi11]
pipeline = faultwrap authtoken keystonecontext ratelimit extensions osapiapp11

Shared section addition

We now need to add a complete new subsection to the .ini file

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

##########
# Shared #
##########

[filter:keystonecontext]
paste.filter_factory = keystone.middleware.nova_keystone_context:NovaKeystoneContext.factory

[filter:authtoken]
paste.filter_factory = keystone.middleware.auth_token:filter_factory
service_protocol = http
service_host = <keystone_ip>
service_port = 5000
auth_host = <keystone_ip>
auth_port = 35357
auth_protocol = http
auth_uri = https://<keystone_ip>:5000/
admin_token = 999888777666

NOTE: you will want to change this to https, but I will not be covering https configuration in this post.

Check that your configuration is working:

1

curl -d '{"auth": {"tenantName": "adminTenant", "passwordCredentials":{"username": "adminUser", "password": "password"}}}' -H "Content-type: application/json" https://<keystone_ip>:35357/v2.0/tokens | python -mjson.tool

Now restart openstack-nova-api

1

service openstack-nova-api restart

Verifying nova keystone integration

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

nova --debug --username=adminUser --apikey=<password> --url=https://<keystone_ip>:5000/v2.0 --version=1.1 list
connect: (<keystone_ip>, 5000)
send: 'POST /tokens HTTP/1.1\r\nHost: <keystone_ip>:5000\r\nContent-Length: 69\r\ncontent-type: application/json\r\naccept-encoding: gzip, deflate\r\nuser-agent: python-novaclient\r\n\r\n'
send: '{"passwordCredentials": {"username": "adminUser", "password": "<password>"}}'
reply: 'HTTP/1.1 400 Bad Request\r\n'
header: Content-Type: application/json; charset=UTF-8
header: Content-Length: 60
header: Date: Mon, 23 Apr 2012 14:16:13 GMT
Traceback (most recent call last):
  File "/usr/bin/nova", line 9, in <module>
    load_entry_point('python-novaclient==2.6.1', 'console_scripts', 'nova')()
  File "/usr/lib/python2.6/site-packages/novaclient/shell.py", line 209, in main
    OpenStackComputeShell().main(sys.argv[1:])
  File "/usr/lib/python2.6/site-packages/novaclient/shell.py", line 166, in main
    self.cs.authenticate()
  File "/usr/lib/python2.6/site-packages/novaclient/v1_1/client.py", line 54, in authenticate
    self.client.authenticate()
  File "/usr/lib/python2.6/site-packages/novaclient/client.py", line 140, in authenticate
    auth_url = self._v2_auth(auth_url)
  File "/usr/lib/python2.6/site-packages/novaclient/client.py", line 180, in _v2_auth
    resp, body = self.request(token_url, "POST", body=body)
  File "/usr/lib/python2.6/site-packages/novaclient/client.py", line 87, in request
    raise exceptions.from_response(resp, body)
novaclient.exceptions.BadRequest: Expecting auth (HTTP 400)

Don’t PANIC! it seems there was never a 2011.3 build for python-novaclient, as such we can “cheat” a little, and use 2012.1-1

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

rpm -Uvh https://pbrady.fedorapeople.org/openstack-el6/python-novaclient-2012.1-1.el6.noarch.rpm
nova --debug --os_username=adminUser --os_password=<password> --os_tenant_name=adminTenant --os_auth_url=https://<keystone_ip>:5000/v2.0/ usage-list
connect: (<keystone_ip>, 5000)
send: 'POST /v2.0/tokens HTTP/1.1\r\nHost: <keystone_ip>:5000\r\nContent-Length: 110\r\ncontent-type: application/json\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
send: '{"auth": {"tenantName": "adminTenant", "passwordCredentials": {"username": "adminUser", "password": "psycle"}}}'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json; charset=UTF-8
header: Content-Length: 924
header: Date: Mon, 23 Apr 2012 15:14:00 GMT
connect: (<nova_ip>, 8774)
send: u'GET /v1.1/1/os-simple-tenant-usage?start=2012-03-26T16:14:00.749451&end=2012-04-24T16:14:00.749491&detailed=1 HTTP/1.1\r\nHost: <keystone_ip>:8774\r\nx-auth-project-id: adminTenant\r\nx-auth-token: 999888777666\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json
header: Content-Length: 21
header: Date: Mon, 23 Apr 2012 15:14:00 GMT
Usage from 2012-03-26 to 2012-04-24:
+-----------+-----------+--------------+-----------+---------------+
| Tenant ID | Instances | RAM MB-Hours | CPU Hours | Disk GB-Hours |
+-----------+-----------+--------------+-----------+---------------+
+-----------+-----------+--------------+-----------+---------------+

You can also follow diablo more closely by using griddynamics’ rpm package

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

rpm -e --nodeps python-novavclient
rpm -Uvh https://yum.griddynamics.net/yum/diablo/python-novaclient-2011.3-b2489.noarch.rpm
nova --debug --username adminUser --password <password> --tenant_name adminTenant --auth_url https://<keystone_ip>:5000/v2.0/ usage-list
connect: (<keystone_ip>, 5000)
send: 'POST /v2.0/tokens HTTP/1.1\r\nHost: <keystone_ip>:5000\r\nContent-Length: 110\r\ncontent-type: application/json\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
send: '{"auth": {"tenantName": "adminTenant", "passwordCredentials": {"username": "adminUser", "password": "<password>"}}}'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json; charset=UTF-8
header: Content-Length: 924
header: Date: Mon, 23 Apr 2012 15:27:01 GMT
connect: (<nova_ip>, 8774)
send: u'GET /v1.1/1/os-simple-tenant-usage?start=2012-03-26T16:27:01.859467&end=2012-04-24T16:27:01.859524&detailed=1 HTTP/1.1\r\nHost: <keystone_ip>:8774\r\nx-auth-project-id: adminTenant\r\nx-auth-token: 999888777666\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json
header: Content-Length: 21
header: Date: Mon, 23 Apr 2012 15:27:01 GMT
Usage from 2012-03-26 to 2012-04-24:
+-----------+-----------+--------------+-----------+---------------+
| Tenant ID | Instances | RAM MB-Hours | CPU Hours | Disk GB-Hours |
+-----------+-----------+--------------+-----------+---------------+
+-----------+-----------+--------------+-----------+---------------+

BE WARNED

Most of the other commands for myself are presently returning 404 / 500 errors, with the Essex Release Impending the current EPEL advice seems to be to use Essex, I will update as/when I can with futher information on these issues.

For instance on a: flavor-create a 500 error is encountered with the following logged in api.log

1
2
3

...
(nova.api.openstack): TRACE: AttributeError: 'ControllerV11' object has no attribute 'create'
...

Configuring Glance

Modify /etc/glance/glance-api.conf

Comment out line 138 and uncomment 140

1
2
3
4

[pipeline:glance-api]
#pipeline = versionnegotiation context apiv1app
# NOTE: use the following pipeline for keystone
pipeline = versionnegotiation authtoken auth-context apiv1app

Modify lines 165-174 accordingly

1
2
3
4
5
6
7
8
9
10

[filter:authtoken]
paste.filter_factory = keystone.middleware.auth_token:filter_factory
service_protocol = http
service_host = <keystone_ip>
service_port = 5000
auth_host = <keystone_ip>
auth_port = 35357
auth_protocol = http
auth_uri = https://<keystone_ip>:5000/
admin_token = 999888777666

now edit /etc/glance/glance-registry.conf and again comment out the current pipline= line and uncomment the keystone line.

1
2
3
4

[pipeline:glance-registry]
#pipeline = context registryapp
# NOTE: use the following pipeline for keystone
pipeline = authtoken auth-context registryapp

Update the authtoken filter accordingly

1
2
3
4
5
6
7
8
9
10

[filter:authtoken]
paste.filter_factory = keystone.middleware.auth_token:filter_factory
service_protocol = http
service_host = <keystone_ip>
service_port = 5000
auth_host = <keystone_ip>
auth_port = 35357
auth_protocol = http
auth_uri = https://<keystone_ip>:5000/
admin_token = 999888777666

Restart glance

1
2
3
4
5

for i in api registry; do service openstack-glance-$i restart; done
Stopping openstack-glance-api:                             [  OK  ]
Starting openstack-glance-api:                             [  OK  ]
Stopping openstack-glance-registry:                        [  OK  ]
Starting openstack-glance-registry:                        [  OK  ]

testing Keystone

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

nova --debug --username adminUser --password <password> --tenant_name adminTenant --auth_url https://<keystone_ip>:5000/v2.0/ image-list
connect: (<keystone_ip>, 5000)
send: 'POST /v2.0/tokens HTTP/1.1\r\nHost: <keystone_ip>:5000\r\nContent-Length: 110\r\ncontent-type: application/json\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
send: '{"auth": {"tenantName": "adminTenant", "passwordCredentials": {"username": "adminUser", "password": "<password>"}}}'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json; charset=UTF-8
header: Content-Length: 924
header: Date: Mon, 23 Apr 2012 15:48:56 GMT
connect: (<nova_ip>, 8774)
send: u'GET /v1.1/1/images/detail HTTP/1.1\r\nHost: <keystone_ip>:8774\r\nx-auth-project-id: adminTenant\r\nx-auth-token: 999888777666\r\naccept-encoding: gzip, deflate\r\naccept: application/json\r\nuser-agent: python-novaclient\r\n\r\n'
reply: 'HTTP/1.1 200 OK\r\n'
header: Content-Type: application/json
header: Content-Length: 14
header: Date: Mon, 23 Apr 2012 15:48:56 GMT
+----+------+--------+--------+
| ID | Name | Status | Server |
+----+------+--------+--------+
+----+------+--------+--------+

More to follow soon as I work through these issues, and later move onto 2012.X (Essex)