Remove login shell and unneeded openstack users from the host

[Ghada Khalil]

Brief Description
-----------------
This bug tracks some cleanup required related to openstack login shells and users:
- Update containerized rabbitmq user to use /usr/sbin/nologin
- Update host keystone user to use /usr/sbin/nologin
- Remove heat/rabbitmq/ceilometer from the host user/passwd file

Although there is currently no functional impact to the current config, the recommended changes promote better security practices.

Severity
--------
Minor - no system impact. This is just a security precaution

Steps to Reproduce
------------------
- Check the login shell set for the openstack users, both containerized and on the host. The shell should be set to nologin
- Check that no unneeded openstack users are configured on the host

Expected Behavior
------------------
- The shell for all openstack users is set to /usr/sbin/nologin
- The openstack users defined on the host are: keystone and horizon as these are the only openstack services running outside of containers

Actual Behavior
----------------
- The shell for containerized rabbitmq is set to /bin/sh instead of /usr/sbin/nologin
- The shell for host keystone is set to /bin/sh instead of /usr/sbin/nologin
- There are openstack users defined on the host which are unneeded: heat, rabbitmq, ceilometer

Reproducibility
---------------
Reproducible

System Configuration
--------------------
Any

Branch/Pull Time/Commit
-----------------------
Any recent stx load

Last Pass
---------
N/A

Timestamp/Logs
--------------
N/A

Test Activity
-------------
Other - opened based on discussion with Andy Ning

[Andy (andy.wrs)]

After some investigation and tests, the following service users are considered safe to be removed:
murano
rabbitmq
glance
cinder
nfv
heat
panko
gnocchi
aodh
magnum

And the following host users' login shell can be disabled with "/sbin/nologin":
ceilometer
keystone

Some of openstack services have privileged containers (ceilometer, ironic, libvirt, neutron and nova) that have almost the same privilege as processes running on bare metal, and have access and can manipulate host resources (including users and groups). Their service users on host are risky to remove. One example is "neutron" where neutron-ovs-agent-init container has reference to host user "neotron" as following:

controller-0:/scratch/apps/stx-openstack/1.0-17-centos-stable-versioned/charts/# docker logs k8s_neutron-ovs-agent-init_neutron-ovs-agent-controller-0-dec13249-jpmt9_openstack_61d1de52-afc9-11e9-b90c-90e2ba508e90_35
+ chown neutron: /run/openvswitch/db.sock
chown: invalid spec: 'neutron:'

If host user "neutron" doesn't exist, neutron-ovs-agent-init will fail and cause all pods depend on it to also fail.

So the following service users (group) will be kept:
neutron
ceilometer
ironic
nova
libvirt (it's a group not a user)

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.opendev.org/673552

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/673552
Committed: https://git.openstack.org/cgit/starlingx/integ/commit/?id=bcad30be63c0726f15acce818eb86eabf8be728d
Submitter: Zuul
Branch: master

commit bcad30be63c0726f15acce818eb86eabf8be728d
Author: Andy Ning <email address hidden>
Date: Tue Jul 30 12:07:12 2019 -0400

    Remove login shell and unneeded openstack users

    To enhance system security, the following unused openstack users
    are removed from host:
    murano
    rabbitmq
    glance
    cinder
    nfv
    heat
    panko
    gnocchi
    aodh
    magnum

    And the following openstack users' login shell are disabled:
    ceilometer
    keystone

    Change-Id: Ie6a0937f9194e24ce188403561f87c2069747ccd
    Closes-Bug: 1837446
    Signed-off-by: Andy Ning <email address hidden>