15:06:48 #startmeeting Security Analysis Team, Introductory meeting. 15:06:48 Meeting started Fri May 2 15:06:48 2014 UTC. The chair is icbts. Information about MeetBot at http://ci.openstack.org/meetbot.html. 15:06:48 Useful Commands: #action #agreed #help #info #idea #link #topic #startvote. 15:06:48 The meeting name has been set to 'security_analysis_team__introductory_meeting_' 15:07:20 #info attendees introducing theirselves, and back grounds 15:07:36 tykeal: thank you 15:12:01 #link https://wiki.opendaylight.org/view/CrossProject:OpenDaylight_Security_Analysis 15:13:39 #info when to discuss meeting with TSC regarding team activities 15:15:24 #info 1. Document current security status 15:18:23 #info Platform Integrity. Develop recommendations for adding security to build process 15:18:53 #info discussed adding signatures/digests to release artifacts 15:19:53 #info Jamie - add documentation to wiki regarding how projects use pgp to sign releases - Can ODL adopt a similar procedure? 15:20:23 #info Access between public and private build server for releases 15:22:16 #info Is pgp worth it? Is signed releases going to help? 15:22:34 #info log access to release system 15:22:48 #info Whom built release and when 15:23:36 #info OSGI Container Security: what kind of security exists with in the framework 15:27:49 #info Use OSGi spec level security. Currently ODL uses Equinox and Virgo, we should explore what security mechanism/best practices these frameworks recomment 15:28:22 #info Cluster Protocol: Ensure cluster protocol and communication is secure + recommendations 15:29:21 #info infinband vs akka ? 15:30:23 #info Need to develop expertise in this protocol area, and investigate security areas 15:30:51 #info OSGi Container Security: authorizing machine users 15:31:10 #info How do we handle machine access? 15:31:37 #info authorizing additions to container 15:33:13 #info Investigate deployment security - whom may install into container 15:33:41 #info authorized access to container, can they do deployment 15:33:54 #info security concern regarding hot deployment folder 15:34:32 #info Jamie - investigate, what does each OSGi implementaion provide regarding security 15:34:43 info ie: Equinox vs Felix 15:34:52 #info ie.Equinox vs Felix 15:36:09 #info Susanta - investigate more into Cluster Protocol 15:36:44 #info Current status and recommendations 15:37:10 #info Existing Security in North Bound and South Bound APIs 15:37:45 #link https://docs.google.com/presentation/d/1df-GMYVe1zGEU6DgKzFQ3xeceicqcGNRRsT5l5QNd_E/edit?pli=1#slide=id.g26bf015a9_2_42 15:38:42 #info Discussing what documentation exists for securing components of ODL 15:39:33 #info Create central page for locating all documenation regarding securing ODL — possibly a table with component — pages 15:41:18 #info Need to review projects for current security docs 15:41:59 #info Mike — DFA 15:42:38 #info Neutron — ? 15:42:59 #info VTN Coordinator — ? 15:44:23 icbts: is there a meeting now ? :) 15:44:27 can u pass on the link 15:44:41 Madhu: which link? 15:44:57 is there a webex ? or is it irc meeting only 15:44:59 Madhu: https://www.google.com/url?q=https%3A%2F%2Fcisco.webex.com%2Fcisco%2Fj.php%3FMTID%3Dme0417dbc1b8e015866cc7c754ab1b456&usd=2&usg=AFQjCNEgnqAWd_hRN7l4gZLkiFXDrIO-pA 15:45:34 #info attendees picking portions of ODL to review 15:46:00 #info Recommendations — trusted key storage location 15:46:27 Madhu: that link work for you? 15:47:16 I need to head to lecture, until next time! 15:47:59 Madhu: we’re tracking minutes at least :) 15:48:14 icbts: thanks a ton sir 15:49:17 #info Returning to discussion of authorization to install bundles 15:50:09 Madhu: please feel free to add info :) 15:50:26 #info permissions in osgi : http://securesoftwaredev.com/2012/11/19/permissions-in-osgi/ 15:52:04 #info Certificate Authroties : discussion of what is available 15:55:16 #info Application Authorization 15:56:28 #info document RBAC on controller? 15:57:35 #info IPv4 / IPv6 15:57:55 #info Access Authorization 15:59:58 #info Madhu, current situation vs what we could have in place 16:00:36 #info Application Authorization needs App Sandboxing 16:02:15 #info Java Core Permissions will help with App Sandboxing 16:03:37 #info Java sandboxing with Policy privileges in SecurityManager : http://securesoftwaredev.com/2012/11/12/sandboxing-java-code/ 16:04:07 #info http://log.illsley.org/2010/11/29/osgi-java-security-manager-and-keeping-things-simple/ 16:05:07 #info http://www.osgi.org/wiki/uploads/CommunityEvent2008/24_JahnGumbel.pdf 16:06:55 #info What can we use from OSGi framework & Java security 16:09:54 #info Securing the deploy folder (out side of scope, but should be reviewed) 16:10:29 #info App Sand boxing, access to resource 16:10:51 #info Arash, Madhu - sandbox 16:11:38 #info Wojciech - concern over overlapping reviews 16:14:08 #info Sandboxing: collect information on subject 16:16:17 #info Controller Device Boot Strap, Authentication Authoriazation 16:16:41 #info Arash, discussing his thoughts on wiki page 16:16:44 #link https://wiki.opendaylight.org/view/CrossProject:OpenDaylight_Security_Analysis 16:17:08 #link https://wiki.opendaylight.org/view/CrossProject:OpenDaylight_Security_Analysis#OpenDaylight_Controller_Security 16:23:20 #info Arash requests comments on his notes 16:23:47 Madhu: I need to drop off the call, can you continue the notes? 16:24:03 icbts: thanks and i will. 16:24:09 Madhu: thank you :) 16:24:18 #chair 16:24:31 icbts: do u know how to take the chair ? 16:25:36 #chair madhu 16:25:36 Current chairs: icbts madhu 16:25:51 icbts: thanks 16:25:55 Madhu: Thanks again 16:26:15 * icbts Great getting to meet you all, I’ll read the notes after wards :) 16:26:39 #question why is there a need for #6 mention of Firewall 16:32:01 Guys... not to in anyway discourage the discussion around AAA stuff, but rather to make sure that no two groups working on stuff are unware of each other... I wanted to point you to: https://wiki.opendaylight.org/view/Project_Proposals:AAA_Service 16:32:07 #info on Vulnerability analysis there are available tools which can be used 16:32:34 edwarnicke: yes thanks. we are discussing about that 16:32:41 Excellent :) 16:32:59 edwarnicke: but we need to make sure the AAA service scope is clearly understood 16:33:19 anyways. the scope portion of AAA project can improve. 16:37:26 #action controller to device security needs to be reviewed and worked on 16:39:51 #info thank you Jamie for taking awesome notes :) 16:40:12 #info plan is to make the security analysis meeting recurring 8.30am PT 16:40:55 Meenakshi: no problem - at the end of the call be sure to issue the endmeeting command 16:41:07 then grab the link and add to the team wiki page 16:42:24 #endmeeting