Skip to content

Commit ecc5ecf

Browse files
KamiKami
committed
Add some security notes to docs, fix up typos and formatting.
1 parent cc402bb commit ecc5ecf

4 files changed

Lines changed: 77 additions & 10 deletions

File tree

‎docs/source/install/common/security_notes.rst‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
By default when dependent services such as MongoDB, RabbitMQ and PostgreSQL are installed, they
2+
have authentication disabled or use a default static password. As such, after you install those
3+
services you should configure them and enable authentication with a strong randomly generated
4+
passwords.
5+
6+
Configuring authorization and passwords for those services is out of the scope of this documents,
7+
but for more information you can refer to the links below.
8+
9+
* MongoDB - https://docs.mongodb.com/manual/tutorial/enable-authentication/, https://docs.mongodb.com/manual/core/authorization/
10+
* RabbitMQ - https://www.rabbitmq.com/authentication.html
11+
* PostgreSQL - https://www.postgresql.org/docs/9.4/static/auth-methods.html
12+
13+
After you enable authentication for those components, you will also need to configure StackStorm
14+
services so they can talk to them.
15+
16+
This means editing editing the following configuration file options:
17+
18+
1. StackStorm config - ``/etc/st2/st2.conf``
19+
20+
* ``database.username`` - MongoDB database username.
21+
* ``database.password`` - MongoDB database password.
22+
* ``messaging.url`` - RabbitMQ transport url (``amqp://<username>:<password>@<hostname>:5672``)
23+
24+
2. Mistral config - ``/etc/mistral/mistral.conf``
25+
26+
* ``database.connection`` - PostgreSQL database connection string (``postgresql://<username>:<password>@<hostname>/mistral``)
27+
* ``transport_url`` - RabbitMQ transport url (``rabbit://<username>:<password>@<hostname>:5672``)
28+
29+
In addition to that, you are strongly encouraged to follow other best practices for running network
30+
services:
31+
32+
* Ensure communication between services is encrypted an enable SSL / TLS for all the services -
33+
MongoDB, RabbitMQ, PostgreSQL.
34+
* Configure services to only listen on localhost and where needed, also internal IP address. There
35+
is usually no need for most services which are used by |st2| (MongoDB, RabbitMQ, PostgreSQL) to
36+
be available to the public and listen on an external (public) IP address.
37+
* Configure firewall and set up a whitelist. You should set up a firewall and only allow services
38+
and users which need access to the services to be able to access them. API and auth service
39+
usually need to be accessible to your users, but other dependent services such as MongoDB,
40+
RabbitMQ and PostgreSQL aren't and shouldn't be directly accessible to the users should be
41+
locked down and only StackStorm components should be allowed to talk to them.
42+
* Where possible and available, you should also utilize additional network based isolation and
43+
security features such as VLANs.
44+
45+
Steps mentioned above are especially important for distributed production deployments where |st2|
46+
components are running on multiple servers.

‎docs/source/install/deb.rst‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -289,8 +289,14 @@ If you already run a Hubot instance, you only have to install the `hubot-stackst
289289

290290
* That's it! Go to your Chat room and begin ChatOpsing. Read more in the :doc:`/chatops/index` section.
291291

292+
A note on security
293+
------------------
294+
295+
.. include:: common/security_notes.rst
296+
292297
Upgrade to Brocade Workflow Composer
293-
-------------------------------------
298+
------------------------------------
299+
294300
Brocade Workflow Composer is deployed as an addition on top of StackStorm. You will need an active
295301
Brocade Workflow Composer subscription, and a license key to access Brocade Workflow Composer repositories.
296302
To add your license key, replace ``${BWC_LICENSE_KEY}`` in the command below with the key you received when

‎docs/source/install/rhel6.rst‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ the :doc:`Reference deployment </install/overview>`.
1212

1313
System Requirements
1414
-------------------
15+
1516
Please check :doc:`supported versions and system requirements <system_requirements>`.
1617

1718
Minimal installation
@@ -111,7 +112,7 @@ Install MongoDB, RabbitMQ, and PostgreSQL.
111112
112113
113114
Setup repositories
114-
~~~~~~~~~~~~~~~~~~~
115+
~~~~~~~~~~~~~~~~~~
115116

116117
The following script will detect your platform and architecture and setup the repo accordingly. It'll also install the GPG key for repo signing.
117118

@@ -120,7 +121,7 @@ The following script will detect your platform and architecture and setup the re
120121
curl -s https://packagecloud.io/install/repositories/StackStorm/stable/script.rpm.sh | sudo bash
121122
122123
Install |st2| components
123-
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
124+
~~~~~~~~~~~~~~~~~~~~~~~~
124125

125126
.. code-block:: bash
126127
@@ -235,10 +236,11 @@ To set up authentication with File Based provider:
235236
# Check that it works
236237
st2 action list
237238
238-
Check out :doc:`/reference/cli` to learn convinient ways to authenticate via CLI.
239+
Check out :doc:`/reference/cli` to learn convenient ways to authenticate via CLI.
239240

240241
Install WebUI and setup SSL termination
241242
---------------------------------------
243+
242244
`NGINX <http://nginx.org/>`_ is used to serve WebUI static files, redirect HTTP to HTTPS,
243245
provide SSL termination for HTTPS, and reverse-proxy st2auth and st2api API endpoints.
244246
To set it up: install `st2web` and `nginx`, generate certificates or place your existing
@@ -304,7 +306,6 @@ For example, to see the endpoint for getting actions, invoke
304306
305307
st2 --debug action list
306308
307-
308309
Setup ChatOps
309310
-------------
310311

@@ -359,8 +360,14 @@ If you already run Hubot instance, you only have to install the `hubot-stackstor
359360

360361
* That's it! Go to your Chat room and begin ChatOps-ing. Read more in the :doc:`/chatops/index` section.
361362

363+
A note on security
364+
------------------
365+
366+
.. include:: common/security_notes.rst
367+
362368
Upgrade to Brocade Workflow Composer
363-
-------------------------------------
369+
------------------------------------
370+
364371
Brocade Workflow Composer is deployed as an addition on top of StackStorm. You will need an active
365372
Brocade Workflow Composer subscription, and a license key to access Brocade Workflow Composer repositories.
366373
To add your license key, replace ``${BWC_LICENSE_KEY}`` in the command below with the key you received when

‎docs/source/install/rhel7.rst‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ the :doc:`Reference deployment </install/overview>`.
1212

1313
System Requirements
1414
-------------------
15+
1516
Please check :doc:`supported versions and system requirements <system_requirements>`.
1617

1718
Minimal installation
@@ -91,7 +92,7 @@ Install MongoDB, RabbitMQ, and PostgreSQL.
9192
sudo systemctl enable postgresql
9293
9394
Setup repositories
94-
~~~~~~~~~~~~~~~~~~~
95+
~~~~~~~~~~~~~~~~~~
9596

9697
The following script will detect your platform and architecture and setup the repo accordingly. It'll also install the GPG key for repo signing.
9798

@@ -100,7 +101,7 @@ The following script will detect your platform and architecture and setup the re
100101
curl -s https://packagecloud.io/install/repositories/StackStorm/stable/script.rpm.sh | sudo bash
101102
102103
Install |st2| components
103-
~~~~~~~~~~~~~~~~~~~~~~~~~
104+
~~~~~~~~~~~~~~~~~~~~~~~~
104105

105106
.. code-block:: bash
106107
@@ -120,6 +121,7 @@ Setup Mistral Database
120121

121122
Configure SSH and SUDO
122123
~~~~~~~~~~~~~~~~~~~~~~
124+
123125
To run local and remote shell actions, |st2| uses a special system user (default ``stanley``).
124126
For remote Linux actions, SSH is used. It is advised to configure identity file based SSH access on all remote hosts. We also recommend configuring SSH access to localhost for running examples and testing.
125127

@@ -206,10 +208,11 @@ To set up authentication with File Based provider:
206208
# Check that it works
207209
st2 action list
208210
209-
Check out :doc:`/reference/cli` to learn convinient ways to authenticate via CLI.
211+
Check out :doc:`/reference/cli` to learn convenient ways to authenticate via CLI.
210212

211213
Install WebUI and setup SSL termination
212214
---------------------------------------
215+
213216
`NGINX <http://nginx.org/>`_ is used to serve WebUI static files, redirect HTTP to HTTPS,
214217
provide SSL termination for HTTPS, and reverse-proxy st2auth and st2api API endpoints.
215218
To set it up: install `st2web` and `nginx`, generate certificates or place your existing
@@ -274,7 +277,6 @@ For example, to see the endpoint for getting actions, invoke
274277
275278
st2 --debug action list
276279
277-
278280
Setup ChatOps
279281
-------------
280282

@@ -328,8 +330,14 @@ If you already run Hubot instance, you only have to install the `hubot-stackstor
328330

329331
* That's it! Go to your Chat room and begin ChatOps-ing. Read more in the :doc:`/chatops/index` section.
330332

333+
A note on security
334+
------------------
335+
336+
.. include:: common/security_notes.rst
337+
331338
Upgrade to Brocade Workflow Composer
332339
------------------------------------
340+
333341
Brocade Workflow Composer is deployed as an addition on top of StackStorm. You will need an active
334342
Brocade Workflow Composer subscription, and a license key to access Brocade Workflow Composer repositories.
335343
To add your license key, replace ``${BWC_LICENSE_KEY}`` in the command below with the key you received when

0 commit comments

Comments
 (0)