swift charm sets up unrestricted read/write access to swift storage via rsync

[James Troup]

Swift relies on rsync for replication; unfortunately the charm sets up
rsync on each storage node with unrestricted read/write access to the
swift data for anyone who can see port 873.

Worse, even if you have a dedicated/locked down storage network,
there's no support in the charm for configuring rsync to listen
on/only accept connections from that network for the swift modules.

At an absolute minimum, the swift-storage charm needs to support for
limiting rsync connections to swift modules by IP address.

Building on that, it would also be very useful if the charm could use
its knowledge the other swift nodes to lock down rsync to just other
swift nodes. This would help people who (perhaps not of their own
volition) are running in a 'single flat network'.

And (if upstream supports this) it would be even better if the swift
modules in rsync could be protected by a password.

(Obviously that's still less than ideal as rsync + passwords isn't
 awesome unless you trust your network, but I think fixing that is
 probably out of scope of the charm and more of a swift upstream bug.)

[David Ames (thedac)]

Please note if iptables is used net.nf_conttrack_max must be updated from its default of 65k.

/etc/sysctl.d/50-max-conntrack.conf:
net.nf_conntrack_max = 2097152