Skip to content

Commit 6457ee8

Browse files
committed
Added security and openstack
1 parent 2e63e72 commit 6457ee8

2 files changed

Lines changed: 162 additions & 4 deletions

File tree

docs/openstack.md

Lines changed: 148 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -108,4 +108,151 @@ The Virtual Private Network-as-a-Service (VPNaaS) is a neutron extension that in
108108
The Load-Balancer-as-a-Service (LBaaS) API provisions and configures load balancers. The reference implementation is based on the HAProxy software load balancer.
109109

110110
- FwaaS
111-
The Firewall-as-a-Service (FWaaS) API is an experimental API that enables early adopters and vendors to test their networking implementations.
111+
The Firewall-as-a-Service (FWaaS) API is an experimental API that enables early adopters and vendors to test their networking implementations.
112+
113+
114+
## QA
115+
116+
2. Describe OpenStack.
117+
Most multinational organizations define OpenStack as the future of Cloud Computing. The Internet and large volumes of data together have instigated the purpose of cloud computing, and OpenStack is one such platform to create and handle massive groups of virtual machines through a Graphical User Interface. It is a set of efficient software tools to manage private and public cloud computing platforms.
118+
Openstack is free, open-source software and works similar to Linux.
119+
120+
3. Explain the benefits of using OpenStack Cloud.
121+
Openstack is useful in developing any software-as-a-service (SAAS) applications, for new developments or to improve existing solutions.
122+
123+
Can serve as a strong foundation to deliver self-service storage to IT users.
124+
Can deliver on-demand objective or block storage with higher scalability and easy-to-handle storage at lower costs.
125+
Most enterprises can save bigger on licensing fees by switching virtual machines running on VMware to OpenStack.
126+
127+
4. What are the key components of OpenStack?
128+
- Horizon: the only GUI in OpenStack; the first component administrators see and get an idea of the current operations in the cloud.
129+
130+
- Nova: chief computing engine to handle multiple virtual machines and computing tasks
131+
132+
- Swift: reliable and robust storage system for files and objects helping developers to refer to a unique identifier and Openstack decides where to store the info.
133+
134+
- Cinder: similar to traditional computer storage system, it is a block storage system in OpenStack for accessing files at faster speed.
135+
136+
- Neutron: ensures efficient connectivity between components during deployment.
137+
138+
- Keystone: a central identity list of all OpenStack cloud users and provides various mapping techniques to access methods against Keystone.
139+
140+
- Glance: image service provider where images are the virtual copies of hard disks. Allows using the images as templates during deployment of new instances.
141+
142+
- Ceilometer: component providing billings services and other telemetry services to cloud users. Maintains an account of component system usage by each user.
143+
144+
- Heat (Orchestration Engine): Allows developers to orchestrate/illustrate and store the cloud application requirements and resources needed in a file, thereby maintaining the cloud infrastructure.
145+
146+
5. What storage types are allowed by OpenStack Compute?
147+
OpenStack Cloud Operating system supports two types of storage:
148+
Persistent Storage: Persistent and independent of any particular instance, created by users. This further includes three storages:
149+
150+
- Object storage: to access binary objects through the REST API.
151+
- Block storage: offers access-to-block storage devices by affixing volumes their current VM instances.
152+
- Shared File System storage: provides a set of services to manage multiple files together for storage and exchange with multiple users at one time.
153+
- Ephemeral Storage: Referring to a single instance. As the name suggests, these storage options are temporary and short-lived and disappear once the VM is terminated.Interested in a high-paying career in Cloud Computing?
154+
155+
6. Define ‘users,’ ‘role’ and ‘tenant’ in OpenStack.
156+
Users can be members of multiple projects
157+
Tenant is a group of users and an alternative term for Project/accounts where projects are organizational units in cloud processing
158+
Role is the position to which a user is mapped (the authorization level). Roles are usually assigned to project-user duos.
159+
160+
7. Define Identity Service in OpenStack.
161+
Keystone is the most important and preferred Identity Service in OpenStack and executes the complete OpenStack Identity API. The Keystone Identity Service is responsible for user management and service catalog. In user management, it tracks users and their permissions while Service Catalog offers a list of services available with their API. The former provides authentication credential details of users, tenants and roles.
162+
Internal services like Token and Policy are also part of Keystone Identity
163+
164+
8. Define the Networking Managers in OpenStack Cloud.
165+
Flat Network Manager: This places all VMs on a single network utilizing the same subnet and bridge as created by the administrator. Thus, all VMs share the same network that can be interconnected and are known to have Flat Network Manager.
166+
167+
Flat DHCP Network Manager: Much similar to the above except that the IP addresses to VM are assigned via DHCP (Dynamic Host Configuration Protocol).
168+
VLAN: Unlike the single network concept, VLAN facilitates more secure and separate network to VMs. It has a physical switch to offer separate virtual network and separate IP range and bridge for each tenant. This is indeed most preferable choice for multi-tenant/project environment.
169+
170+
9. Name the commands used to pause and un-pause(resume) an instance
171+
$ novaunpause INSTANCE_NAME
172+
$ nova pause INSTANCE_NAME
173+
174+
10. List the storage locations for VM images in OpenStack
175+
• OpenStack Object Storage
176+
• Filesystem
177+
• S3
178+
• HTTP
179+
• RBD or Rados Block Device
180+
• GridFSMaster Openstack from industry experts.
181+
182+
11. What is Token?
183+
Token is a type of authentication similar to password-based validation. A token gets generated once the user inserts the credentials and authenticates as a Keystone user. The token can then be used to access OpenStack services without any revalidation. It is interesting to note that a token is active for a limited period and must be renewed after regular intervals.
184+
To create a token, users first need to authenticate their Keystone credentials.
185+
186+
12. What is OpenStack Python SDK?
187+
Python SDK (Software Development Kit) helps users to write applications for performing automation tasks in Python by calling Python objects. It provides a platform to work with multiple OpenStack services at one place. It consists of language bindings to access OpenStack clouds, complete API reference, easy interaction with REST API and sample code for initial applications.
188+
189+
13. Describe the function of Filter Scheduler.
190+
The Filter Scheduler facilitates filtering and weighting to notify where a new instance can be created. It supports working with Compute Nodes. Filter Scheduler firstly creates an unfiltered dictionary of hosts and then filter them using related properties and makes the final selection of hosts for the number of instances as needed.
191+
192+
14. Define the Networking option in OpenStack.
193+
AvalabilityZoneFilter: filters hosts by their availability zone.
194+
CapacityFilter: filtering based on volume host’s capacity consumption
195+
DifferentBackendFilter: Scheduling volumes to a different back-end
196+
DriverFilter: filters based on ‘filter function’ and ‘metrics’
197+
InstanceLocalityFilter
198+
JSONFIlter
199+
RetryFilter: Filter the previously attempted hosts
200+
SameBackendFilterMost in-depth, industry-led curriculum in Openstack.
201+
Check the Openstack Course Details now!
202+
203+
15. List down the Networking hardware in OpenStack.
204+
Networks
205+
Routers
206+
Subnets
207+
Ports Vendor Plugins
208+
16. Define Hypervisor
209+
For all cloud computing paltforms, Hypervisor is a term to define virtual machine monitor (VMM) including hardware, software and firmware components running on a virtual machine. Host machine is the one having hypervisor with one or more virtual machines.
210+
OpenStack Compute allows multiple hypervisors. There are functionalities to choose one among them for a specific purpose.
211+
212+
17. List down the type of Hypervisors supported by OpenStack.
213+
KVM (Kernel-based Virtual machine)
214+
LXC: Linux Containers having Linux-based VMs
215+
QEMU: Quick EMUlator used for development purposes
216+
UML: User Mode Linux used for development purposes
217+
VMware vSphere: VMware-based Linux and Windows via vCenter server connection.
218+
Hyper-V: Server virtualization with Microsoft’s Hyper-V
219+
18. Explain in brief the modular architecture of OpenStack.
220+
The three important components of OpenStack modular architecture are:
221+
222+
OpenStack Compute: For managing large networks on the virtual machine
223+
Image Service: The delivery service provides discovery and registration for virtual disk images
224+
OpenStack Object Storage: A storage system that provides support for both block storage and object storage
225+
19. What command manages floating IP addresses in OpenStack
226+
nova floating-ip-*
227+
228+
20. Define bare-metal node.
229+
Bare-metal node grants access to control bare-metal driver that handles the provisioning of OpenStack Compute physical hardware utilizing the standard cloud APIs and tools like Heat. It is generally used for single tenant clouds like high-performance cluster computing. For using the bare-metal driver, a network interface must be created with the bare-metal node inserted into it. Afterwards, users can launch an instance from the node. Users can also list and delete bare-metal nodes by removing the associated network instances
230+
231+
21. List down the components of OpenStack Compute
232+
Nova (Compute) Cloud comprises following components:
233+
234+
API server
235+
Message Queue (Rabbit-MQ Server)
236+
Compute Workers (Nova-Compute)
237+
Network controller (Nova-Network)
238+
Volume Worker
239+
Scheduler
240+
22. Define the role of API Server.
241+
It provides an interface for the external world to interact with the cloud infrastructure.
242+
243+
23. List the commands to generate Key pairs.
244+
ssh-keygen
245+
cd .ssh
246+
nova keypair-add –pub_key id_rsa.pub mykey
247+
248+
24. Define Flavor
249+
Flavors are virtual hardware templates present in OpenStack, which define the memory sizes of RAM, hard disk, etc. Flavors illustrate a number of parameters like ID, Name, Memory_MB, Disk and others, giving a choice of Virtual Machine to the user just like having a physical server. OpenStack dashboard also allows users to modify a flavor by deleting the existing one and creating a new with the similar name and parameters.
250+
251+
25. How to create a user in OpenStack?
252+
sudo nova-manage user create user-name
253+
254+
26. How to assign a project/tenant to a user?
255+
By using the command sudo nova-manage user create user-name
256+
257+
27. Can we see the list of roles and associated IDs in OpenStack environment?
258+
Yes, by using keystone role-list

docs/security.md

Lines changed: 14 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,23 @@
1818
- Cross-site scripting works by manipulating a vulnerable web site so that it returns malicious JavaScript to users.
1919
- When the malicious code executes inside a victim's browser, the attacker can fully compromise their interaction with the application.
2020

21-
4. What is SQL injection (SQLi)?
21+
4. What are the types of XSS attacks?
22+
23+
There are three main types of XSS attacks. These are:
24+
25+
* Reflected XSS, where the malicious script comes from the current HTTP request.
26+
* Stored XSS, where the malicious script comes from the website's database.
27+
* DOM-based XSS, where the vulnerability exists in client-side code rather than server-side code.
28+
29+
30+
5. What is SQL injection (SQLi)?
2231

2332
- SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
2433
- It generally allows an attacker to view data that they are not normally able to retrieve. This might include data belonging to other users, or any other data that the application itself is able to access.
2534
- In many cases, an attacker can modify or delete this data, causing persistent changes to the application's content or behavior.
2635
- In some situations, an attacker can escalate an SQL injection attack to compromise the underlying server or other back-end infrastructure, or perform a denial-of-service attack.
2736

28-
5. What is CSRF?
37+
6. What is CSRF?
2938

3039
- Cross-site request forgery (also known as CSRF) is a web security vulnerability that allows an attacker to induce users to perform actions that they do not intend to perform.
3140
- It allows an attacker to partly circumvent the same origin policy, which is designed to prevent different websites from interfering with each other.
@@ -41,4 +50,6 @@ A6:2017 - Security Misconfiguration
4150
A7:2017 - Cross-Site Scripting (XSS)
4251
A8:2017 - Insecure Deserialization
4352
A9:2017 - Using Components with Known Vulnerabilities
44-
A10:2017 - Insufficient Logging & Monitoring
53+
A10:2017 - Insufficient Logging & Monitoring
54+
55+

0 commit comments

Comments
 (0)