Insecure defaults for `openstack security group rule create`

[Nick Griffiths]

It's really easy to open up access to anyone by mistake. If you supply no options when creating a new rule, it defaults to allowing access to all ports to any remote host.

I'm not sure what the right fix is, but I would expect that sort of permissive access to be a bit harder to create.

# allow anyone to access any tcp port - so simple!
$ openstack security group rule create default
+-------------------+--------------------------------------+
| Field | Value |
+-------------------+--------------------------------------+
| created_at | None |
| description | None |
| direction | ingress |
| ether_type | IPv4 |
| id | 7d481fad-9b57-4e71-9d63-fbba895e1a6c |
| name | None |
| port_range_max | None |
| port_range_min | None |
| project_id | c6f313e10752449ea9b70acfba353c80 |
| protocol | tcp |
| remote_group_id | None |
| remote_ip_prefix | 0.0.0.0/0 |
| revision_number | None |
| security_group_id | a5fbd65f-e4da-47d3-90cb-8dfc81eccd66 |
| updated_at | None |
+-------------------+--------------------------------------+

[Dean Troyer (dtroyer)]

(assuming this refers to a Neutron cloud)

OSC sets no default values for security group rule create, if you do not include it on the command line we do not pass it to Neutron, so any values assumed are being set in Neutron itself.

Your example shows no ports being allowed, again from a user standpoint I would expect this rule to produce no results. If it allows all TCP traffic it is due to how Neutron handles defaults for API arguments that are not present.

[Reedip (reedip-banerjee-deactivatedaccount)]

This is as per design . Please see the help of the same CLI [1].
Besides, it is not that the user cannot change or provide their own options.

[1]: http://paste.openstack.org/show/611476/

[Launchpad Janitor (janitor)]

[Expired for neutron because there has been no activity for 60 days.]