You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Richard Fuchs 92dccb4b10 TT#55162 add ngcp-admin group ... according to security framework spec 5.5.4 Allow r/w access /etc/ngcp-config/config.yml for users in security domain ngcp-admin This file contains operational configuration data of the NGCP system. Reading and editing it is part of day-to-day operations. As such it has to be read- and writable by users in security domain ngcp-admin. It is also readable by users of any other security domain. This file is also read by many NGCP processes. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chgrp ngcp-admin /etc/ngcp-config/config.yml Security domain: ngcp-admin User ownership: root Group ownership: ngcp-admin File permissions: 664 IMPACT: Configuration data can be edited by all users in group ngcp-admin, the sipwise user, and user root. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this does not pose a security risk. However, write access to configuration data in this file will be denied to named users. 5.5.5 Allow r/w access to /etc/ngcp-config/network.yml for users in security domain ngcp-admin This file contains information about the network configuration of the NGCP cluster. This information should not frequently change. Nevertheless, this file and its content is meant for the operator and as such is read- and writable by users in security domain ngcp-admin. It is also readable by users of any other security domain. This file is also read by many NGCP processes. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chgrp ngcp-admin /etc/ngcp-config/network.yml Security domain: ngcp-admin User ownership: root Group ownership: ngcp-admin File permissions: 664 IMPACT: Configuration data can be edited by all users in group ngcp-admin, the sipwise user, and user root. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this does not pose a security risk. However, write access to configuration data in this file will be denied to named users. 5.5.6 Restrict access to /etc/ngcp-config/constants.yml to users in security domain root This file contains values set during the initialization of the NGCP system. It contains passwords used by different NGCP functions to connect to other secured subsystems (e.g. DB or lawful intercept). As such the file has a high security impact and is read- and writeable to users of security domain root only. The current default setup of the NGCP does not implement permissions as required by tightened user security. Required permission settings have to be applied manually issuing command: chmod 600 /etc/ngcp-config/constants.yml Security domain: root User ownership: root Group ownership: root File permissions: 600 IMPACT: Data in this configuration file are usually entered once during commissioning of the platform. Only users root or sipwise can edit or read this file. The customer’s named users have no access to this data. If for some reason (e.g. after upgrade) the proposed settings are reverted to default settings, this poses a security risk as credentials used internally may be leaked to unprivileged users. Change-Id: I49a2994a227b9c296966c805c9370ae3b067de12		7 years ago
..
apply	TT#44969 Extract git status check to common function (for further refactoring)	7 years ago
build	TT#55162 add ngcp-admin group	7 years ago
check	TT#58205 Fix misc typos	7 years ago
clean	TT#44969 Extract git status check to common function (for further refactoring)	7 years ago
commit	TT#47373 Remove path hardcoding for hooks handling	7 years ago
decrypt	TT#22411 Fix spelling mistakes/typos	8 years ago
del	TT#17650 Switch to use YAML::XS instead of YAML::Tiny	9 years ago
diff	TT#15824 Update code based on comments from previous code review	9 years ago
encrypt	TT#37257 encrypt: clean glusterfs data in new data storage '/ngcp-data/glusterfs/'	7 years ago
etckeeper	TT#44969 Extract git status check to common function (for further refactoring)	7 years ago
initialise	TT#47956 Subtract HA repo setup from 'initialise' into 'init-shared'	7 years ago
log	MT#17219 Use $@ instead of $* when we need to preserve argument grouping	10 years ago
patch	TT#50100 scripts/patch: preserve file permissions when creating customtt	7 years ago
services	TT#58703 services: Start sysctl services before monit and ha.d	7 years ago
set	TT#44516 Fix quoting logic for script 'set' for values like '10G'	7 years ago
show	TT#15824 Fix shellcheck warnings	9 years ago
status	TT#44969 Extract git status check to common function (for further refactoring)	7 years ago
values	TT#37401 Use Unix sockets to avoid relying on hostnames for localhost/loopback	8 years ago