Security Documentation for Horizon

[Jesse Pretorius]

Horizon's documentation doesn't contain much in terms of guidelines for securing a deployment.

The following should be documented somewhere:

When implementing Horizon for public usage, with the website served through HTTPS, the following recommendations apply.

In the Apache global configuration ensure that the following directive is configured to prevent the server from sharing its name, version and any other information that could be used for an attack:

ServerSignature Off

In the Apache global configuration ensure that the following directive is configured to prevent cross-site tracing [1]:

TraceEnable Off

In the Apache virtual host configuration:

1) Ensure that the "Indexes" option is not included in the Options directive.
2) Protect the server from BEAST attacks [2] by implementing the following options:

  SSLHonorCipherOrder on
  SSLProtocol -ALL +SSLv3 +TLSv1
  SSLCipherSuite RC4-SHA:RC4:HIGH:!MD5:!aNULL:!EDH:!ADH:!AESGCM:!AES

In local_settings.py, implement the following settings in order to help protect the cookies from cross-site scripting [3]:

CSRF_COOKIE_SECURE = True
SESSION_COOKIE_SECURE = True
SESSION_COOKIE_HTTPONLY = True

Note that the CSRF_COOKIE_SECURE option is only available from Django 1.4 and will therefore not work for most packaged Essex deployments.

Also, since a recent patch [4], you can disable browser autocompletion [5] for the authentication form by changing the 'password_autocomplete' attribute to 'off' in horizon/conf/default.py.

[1] http://www.kb.cert.org/vuls/id/867593
[2] http://en.wikipedia.org/wiki/Transport_Layer_Security#BEAST_attack
[3] https://www.owasp.org/index.php/HttpOnly
[4] https://review.openstack.org/21349
[5] https://wiki.mozilla.org/The_autocomplete_attribute_and_web_documents_using_XHTML

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/21868

[Jesse Pretorius (jesse-pretorius)]

I propose this for inclusion in grizzly-3.

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/21868
Committed: http://github.com/openstack/horizon/commit/c70ceb75f28dbc71018a2c8126272b693744efc9
Submitter: Jenkins
Branch: master

commit c70ceb75f28dbc71018a2c8126272b693744efc9
Author: Jesse Pretorius <email address hidden>
Date: Wed Feb 13 13:07:21 2013 +0200

    Add recommendations for secure deployments

    To deployment doc: Adds recommendations to secure cookies from cross site scripting and mentions how to disable browser autocompletion on the authentication form.

    To local_settings.py.example: Adds commented lines showing the CSRF_COOKIE_SECURE and SESSION_COOKIE_SECURE settings and recommending that the lines are uncommented if Horizon is being served through HTTPS.

    Change-Id: I0e2516c9c16622561a9b7955aa4b9db87a8410ee
    Fixes: bug #1118194

[Tom Fifield (fifieldt)]

This is fixed by http://docs.openstack.org/security-guide/content/dashboard.html