CSS Corp Open Source Services

[OpenStack Beginner’s Guide for Ubuntu 11.04] Security

leave a comment »

Openstack provides ingress filtering for the instances based on the concept of security groups. OpenStack accomplishes ingress filtering by creating suitable IP Tables rules. A Security Group is a named set of rules that get applied to the incoming packets for the instances. You can specify a security group while launching an instance. Each security group can have multiple rules associated with it. Each rule specifies the source IP/network, protocol type, destination ports etc. Any packet matching these parameters specified in a rule is allowed in. Rest of the packets are blocked.

A security group that does not have any rules associated with it causes blocking of all incoming traffic. The mechanism only provides ingress filtering and does not provide any egress filtering. As a result all outbound traffic is allowed. If you need to implement egress filtering, you will need to implement that inside the instance using a firewall.

Tools like Hybridfox let you manage security groups and also let you specify a security group while launching an instance. You can also use command line tools from euca2ools package such as euca-authorize for this purpose.

Here are a few euca commands to manage security groups. Like in our earlier chapters, the project name is “proj”

Create a security group named “myservers”.

euca-add-group -d "my servers" myservers

Add a rule to the security group “myservers” allowing icmp and tcp traffic from

euca-authorize -P tcp -s -p 22 myservers
euca-authorize -P icmp -s -t -1:-1 myservers

For a Windows instance, add a rule to accept incoming RDP connections

euca-authorize -P tcp -s -p 3389 myservers

Rules can be viewed with euca-describe-groups command:

$ euca−describe−groups
GROUP    proj   myservers    my servers
PERMISSION    proj    myservers    ALLOWS    tcp    22    22    FROM    CIDR
PERMISSION    proj   myservers    ALLOWS    icmp    -1    -1    FROM    CIDR
PERMISSION    proj    myservers    ALLOWS    tcp    3389   3389    FROM    CIDR

Remove the rule for ssh traffic from the source ip from the security group “myservers”

euca-revoke -P tcp -s -p 22 myservers

Delete the security group “myservers”

euca−delete−group myservers

Launch an instance associated with the security group “myservers”.

euca−run−instances emi−XXXXXXXX −k mykey −g myservers

When you do not specify a security group, the instance gets associated with an inbuilt security group called “default”. The rules for this security group can also be modified using euca-add, euca-revoke commands.

Security Groups can also be viewed and manipulated using tools like HybridFox.  A screenshot of listing of security groups in HybridFox is below:


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: