08.md

date	draft	weight	title
2016-05-09	false	08	Lab 08 - Security Groups

Mon	Mon	Mon	Mon	Tue	Tue	Tue	Tue	Wed	Wed	Wed	Thur	Thur	Thur	Thur
00	01	02	03	04	05	06	07		09	10	11	12	13	14

Lab Duration: 30 minutes

Lab Objective

The objective of this lab is to understand how security groups work. A common issue with OpenStack is failing to set appropriate security group(s) when launching an instance. As a result, the user is unable to contact the instance on the network. The security groups are sets of IP filter rules that are applied to the instance's networking.

Security Groups are also project specific, and project members can edit the default rules for their group and add new rules sets. All projects have a "default" security group, which is applied to instances that have no other security group defined. Unless changed, this security group denies all incoming traffic. If you've tried to connect to an instance in the past, this is likely one of the reasons you were unsuccessful.

1. Creating Security Groups at the CLI

1. SSH to your controller as root, then source the keystonerc_chestercopperpot permissions file.

   [root@controller ] # source keystonerc_chestercopperpot

   [root@controller ~(keystone_chestercopperpot)]#
   

2. Examine the current security group rules available to the vault-tek project (the project to which chestercopperpot belongs)

   [root@controller ~(keystone_chestercopperpot)]# nova secgroup-list

   +--------------------------------------+---------+------------------------+
   | Id                                   | Name    | Description            |
   +--------------------------------------+---------+------------------------+
   | ccaf984f-f819-4aa6-943c-360d2f41ee97 | default | Default security group |
   +--------------------------------------+---------+------------------------+
   

• Note that only a single security group will exist, which is named default.

3. We need to create a few basic security group rules which we can apply to our instances. The group that is about to be created is called "http-ssh"

   [root@controller ~(keystone_chestercopperpot)]# nova secgroup-create http-ssh "Allowing http and ssh traffic"

   +--------------------------------------+----------+-------------------------------+
   | Id                                   | Name     | Description                   |
   +--------------------------------------+----------+-------------------------------+
   | 0b79a2b0-ef2e-44de-a215-0c74759bbf0c | http-ssh | Allowing http and ssh traffic |
   +--------------------------------------+----------+-------------------------------+
   

4. Create an exception for TCP traffic coming to and from port 80 via any IP address

   [root@controller ~(keystone_chestercopperpot)]# nova secgroup-add-rule http-ssh tcp 80 80 0.0.0.0/0

   +-------------+-----------+---------+-----------+--------------+
   | IP Protocol | From Port | To Port | IP Range  | Source Group |
   +-------------+-----------+---------+-----------+--------------+
   | tcp         | 80        | 80      | 0.0.0.0/0 |              |
   +-------------+-----------+---------+-----------+--------------+
   

5. Create an exception for TCP traffic coming to and from port 22 via any IP address

   [root@controller ~(keystone_chestercopperpot)]# nova secgroup-add-rule http-ssh tcp 22 22 0.0.0.0/0

   +-------------+-----------+---------+-----------+--------------+
   | IP Protocol | From Port | To Port | IP Range  | Source Group |
   +-------------+-----------+---------+-----------+--------------+
   | tcp         | 22        | 22      | 0.0.0.0/0 |              |
   +-------------+-----------+---------+-----------+--------------+
   

6. Review the rules that we just created for http-ssh security group

   [root@controller ~(keystone_chestercopperpot)]# nova secgroup-list-rules http-ssh

   +-------------+-----------+---------+-----------+--------------+
   | IP Protocol | From Port | To Port | IP Range  | Source Group |
   +-------------+-----------+---------+-----------+--------------+
   | tcp         | 80        | 80      | 0.0.0.0/0 |              |
   | tcp         | 22        | 22      | 0.0.0.0/0 |              |
   +-------------+-----------+---------+-----------+--------------+
   

• Good job! Now the vault-tek project could apply the http-ssh rule set to a launched instance (we'll do this soon), but for now, continue on...

7. Log into Horizon as chestercopperpot / fa5tpa55w0rd, and navigate to the following location:

• Navigate to: Project > Compute > Access & Security
• Can chestercopperpot see the new http-ssh rule? Why or why not?

8. Log into Horizon as admin, and navigate to the following location:

• Navigate to: Project > Compute > Access & Security
• Can admin see the new http-ssh rule? Why or why not?

9. Log into Horizon as aliceanderson / fa5tpa55w0rd, and navigate to the following location:

• Navigate to: Project > Compute > Access & Security
• Can aliceanderson see the new http-ssh rule? Why or why not?

2. Creating Security Groups at Horizon

1. While still logged in as aliceanderson, let's use Horizon to create a new security group rule for the tenant (project) to which aliceanderson belongs.

2. Within Horizon, navigate to: Project > Compute > Access & Security

3. In the Security Group tab, find the button +Create Security Group

• If you are unsure of where to click, see the screenshot below.

  

4. A window should pop-up titled, "Create Security Group", fill this screen out as follows:

   Name: http-ssh
   Description: Allows http and ssh access
   After filling out the pop-up window, click on the Create Security Group button.
   If you are unsure of where to click, see the screenshot below.

   

5. You should be looking at a page that includes the newly created rule, click on the "Manage Rules" button.

• If you are unsure of where to click, see the screenshot below.

  

6. You're now looking at the list of IP permissions currently applied. Click the "+Add Rule" button.

• If you are unsure of where to click, see the screenshot below.

  

7. Our first rule we create will be for SSH access. Fill out the windows as follows:

   Rule: SSH (choose from dropdown menu)
   Remote: CIDR
   CIDR: 0.0.0.0/0
   

• Click on "Add" button when complete

• If you're unsure of how to properly set up the security group rule, reference the screen shot below.

  

8. Repeat step 6, once again, click on the "+Add Rule" button

9. Our second rule we create will be for HTTP access. Fill out the windows as follows:

   Rule: HTTP (choose from dropdown menu)
   Remote: CIDR
   CIDR: 0.0.0.0/0
   

• Click on "Add" button when complete

• If you're unsure of how to properly set up the security group rule, reference the screen shot below.

  

10. After pressing the "Add button", your screen should look like the following:

    

11. Click on the "Access & Security" link on the left.

    

12. If you see the new security group listed here, then you have completed this lab! We will need this Security Group when we launch an instance in the next lab.