* Security Working Group meeting - Wednesday September 18 @ 2019-09-17 23:32 Joseph Reynolds 2019-09-18 20:51 ` Joseph Reynolds 0 siblings, 1 reply; 5+ messages in thread From: Joseph Reynolds @ 2019-09-17 23:32 UTC (permalink / raw) To: openbmc This is a reminder of the OpenBMC Security Working Group meeting scheduled for this Wednesday September 18 at 10:00am PDT. Current topics: - Development work: 1. IPMI authority question - https://lists.ozlabs.org/pipermail/openbmc/2019-August/017905.html 2. Multiple admin security question - https://lists.ozlabs.org/pipermail/openbmc/2019-August/017910.html - OCP Secure Firmware Development Best Practices (goo.gl/uEoAh4) - Expired password design Access, agenda, and notes are in the wiki: https://github.com/openbmc/openbmc/wiki/Security-working-group - Joseph ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Security Working Group meeting - Wednesday September 18 2019-09-17 23:32 Security Working Group meeting - Wednesday September 18 Joseph Reynolds @ 2019-09-18 20:51 ` Joseph Reynolds 0 siblings, 0 replies; 5+ messages in thread From: Joseph Reynolds @ 2019-09-18 20:51 UTC (permalink / raw) To: openbmc On 9/17/19 6:32 PM, Joseph Reynolds wrote: > This is a reminder of the OpenBMC Security Working Group meeting > scheduled for this Wednesday September 18 at 10:00am PDT. > > Current topics: > - Development work: > 1. IPMI authority question - > https://lists.ozlabs.org/pipermail/openbmc/2019-August/017905.html > 2. Multiple admin security question - > https://lists.ozlabs.org/pipermail/openbmc/2019-August/017910.html > - OCP Secure Firmware Development Best Practices (goo.gl/uEoAh4) > - Expired password design Thanks to everyone who attended the meeting. The minutes are in the link below. Click the link, then click "Meeting Minutes". Highlights: - We discussed the design and implementation of IPMI authority Role=admin access. - We discussed the expired password design, including interfaces that will be able to change the password. - We briefly reviewed the existence of the OpenBMC network threat model and the overall BMC threat model currently in review. - We glanced at the mutual TLS (mTLS) reviews in progress - We discussed the desire and plans to deprecate out-of-band IPMI network access to the BMC. I'll send an email with more on this topic. - We discussed emerging firmware recommendations such as the "CSIS Secure Firmware Development Best Practices" and how we would use those recommendations. - Joseph > > Access, agenda, and notes are in the wiki: > https://github.com/openbmc/openbmc/wiki/Security-working-group > > - Joseph ^ permalink raw reply [flat|nested] 5+ messages in thread
* Security Working Group meeting - Wednesday September 18 @ 2021-08-18 13:54 Joseph Reynolds 2021-08-18 17:33 ` Patrick Williams 0 siblings, 1 reply; 5+ messages in thread From: Joseph Reynolds @ 2021-08-18 13:54 UTC (permalink / raw) To: openbmc This is a reminder of the OpenBMC Security Working Group meeting scheduled for this Wednesday September 18 at 10:00am PDT. We'll discuss the following items on the agenda <https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI/edit>, and anything else that comes up: 1. Wholesale changes to bitbake recipes were made. See https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u <https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u> My non-specific security concern (Joseph) is accidentally mis-configuring something with these changes. 2. Gerrit review - The BMCWeb session idle timeout changed to 30 minutes (was 60): https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/45658 <https://gerrit.openbmc-project.xyz/c/openbmc/bmcweb/+/45658> 3. Yocto is planning a security configuration guide. See https://bugzilla.yoctoproject.org/show_bug.cgi?id=14509 <https://bugzilla.yoctoproject.org/show_bug.cgi?id=14509> Access, agenda and notes are in the wiki: https://github.com/openbmc/openbmc/wiki/Security-working-group <https://github.com/openbmc/openbmc/wiki/Security-working-group> - Joseph ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Security Working Group meeting - Wednesday September 18 2021-08-18 13:54 Joseph Reynolds @ 2021-08-18 17:33 ` Patrick Williams 2021-08-18 19:12 ` Joseph Reynolds 0 siblings, 1 reply; 5+ messages in thread From: Patrick Williams @ 2021-08-18 17:33 UTC (permalink / raw) To: Joseph Reynolds; +Cc: openbmc [-- Attachment #1: Type: text/plain, Size: 524 bytes --] On Wed, Aug 18, 2021 at 08:54:52AM -0500, Joseph Reynolds wrote: > 1. Wholesale changes to bitbake recipes were made. See > https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u > <https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u> My > non-specific security concern (Joseph) is accidentally mis-configuring > something with these changes. How do we ensure that any configuration you want to ensure is done, security-wise, is covered by tests going forward? -- Patrick Williams [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 833 bytes --] ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: Security Working Group meeting - Wednesday September 18 2021-08-18 17:33 ` Patrick Williams @ 2021-08-18 19:12 ` Joseph Reynolds 0 siblings, 0 replies; 5+ messages in thread From: Joseph Reynolds @ 2021-08-18 19:12 UTC (permalink / raw) To: Patrick Williams; +Cc: openbmc On 8/18/21 12:33 PM, Patrick Williams wrote: > On Wed, Aug 18, 2021 at 08:54:52AM -0500, Joseph Reynolds wrote: > >> 1. Wholesale changes to bitbake recipes were made. See >> https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u >> <https://lore.kernel.org/openbmc/YQ1FD5q8KbhbXVBK@heinlein/T/#u> My >> non-specific security concern (Joseph) is accidentally mis-configuring >> something with these changes. > How do we ensure that any configuration you want to ensure is done, > security-wise, is covered by tests going forward? Here are my ideas: For build-time configurations, I suggest documenting all important configuration settings. Each item to include (links to) description of what the configuration setting controls, considerations for selecting the appropriate setting, and which recipe to append. Then add links to test cases. Examples: - For example, if out-of-band/network IPMI is configured out of the image, have a test case to determine that UDP port 623 is unresponsive and PATCH /redfish/v1/SessionService {"IPMI": {"ServiceEnabled": true}} fails and has no effect. - On the other hand, if out-of-band/network IPMI is configured into the image but disabled by default, have a test case to determine that UDP port 623 is unresponsive and PATCH /redfish/v1/SessionService {"IPMI": {"ServiceEnabled": true}} succeeds, and makes port 623 active, etc. These test cases are necessarily specific to a specific configuration, so they are not all appropriate to run. That is, we can have a test case for each configuration setting, and configure them into or out-of the test suite as needed. Specifically, the person responsible for configuring their downstream firmware image must also work to configure the appropriate tests to be run. (Example: if you configure IPMI out of the image, configure your test suite to (a) remove tests for IPMI function, and (b) add tests to ensure IPMI is not present.) I would be happy add test case links to the OpenBMC configuration wiki: https://github.com/openbmc/openbmc/wiki/Configuration-guide Joseph ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-08-18 19:13 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-09-17 23:32 Security Working Group meeting - Wednesday September 18 Joseph Reynolds 2019-09-18 20:51 ` Joseph Reynolds 2021-08-18 13:54 Joseph Reynolds 2021-08-18 17:33 ` Patrick Williams 2021-08-18 19:12 ` Joseph Reynolds
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).