Skip to content
Snippets Groups Projects
Commit f5dd178f authored by Jeffrey Zhang's avatar Jeffrey Zhang
Browse files

Disable trace for all containers running httpd

Trace method is enabled in default for httpd. There is security risk
with trace enabled. So disable it in default. more info please check[0].

[0] https://security.stackexchange.com/a/7711

Change-Id: I4496a6d058d88e1abfb210085f189e7a610e0362
Closes-Bug: #1705160
parent 4d383406
No related branches found
No related tags found
No related merge requests found
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ aodh_api_port }}
TraceEnable off
<VirtualHost *:{{ aodh_api_port }}>
## Vhost docroot
......
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ cinder_api_port }}
TraceEnable off
<VirtualHost *:{{ cinder_api_port }}>
WSGIDaemonProcess cinder-api processes={{ openstack_service_workers }} threads=1 user=cinder group=cinder display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup cinder-api
......
......@@ -2,6 +2,8 @@
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ freezer_api_port }}
TraceEnable off
<VirtualHost *:{{ freezer_api_port }}>
WSGIDaemonProcess freezer-api processes={{ openstack_service_workers }} threads=1 user=freezer display-name=%{GROUP}
WSGIProcessGroup freezer-api
......
......@@ -2,6 +2,8 @@
{% set wsgi_path = '/usr/bin' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
Listen {{ api_interface_address }}:{{ gnocchi_api_port }}
TraceEnable off
<VirtualHost *:{{ gnocchi_api_port }}>
ErrorLog "/var/log/kolla/gnocchi/gnocchi-api-error.log"
......
{% set python_path = '/usr/share/openstack-dashboard' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ horizon_port }}
TraceEnable off
<VirtualHost *:{{ horizon_port }}>
LogLevel warn
ErrorLog /var/log/kolla/horizon/horizon.log
......
......@@ -3,6 +3,8 @@
Listen {{ api_interface_address }}:{{ keystone_public_port }}
Listen {{ api_interface_address }}:{{ keystone_admin_port }}
TraceEnable off
<VirtualHost *:{{ keystone_public_port }}>
WSGIDaemonProcess keystone-public processes={{ openstack_service_workers }} threads=1 user=keystone group=keystone display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup keystone-public
......
......@@ -3,6 +3,8 @@
{% set wsgi_directory = '/usr/bin' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/bin' %}
Listen {{ api_interface_address }}:{{ placement_api_port }}
TraceEnable off
<VirtualHost *:{{ placement_api_port }}>
WSGIDaemonProcess placement-api processes={{ openstack_service_workers }} threads=1 user=nova group=nova display-name=%{GROUP} python-path={{ python_path }}
WSGIProcessGroup placement-api
......
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ panko_api_port }}
TraceEnable off
<VirtualHost *:{{ panko_api_port }}>
ErrorLog "/var/log/kolla/panko/panko-api-error.log"
......
{% set python_path = '/usr/lib/python2.7/site-packages' if kolla_install_type == 'binary' else '/var/lib/kolla/venv/lib/python2.7/site-packages' %}
Listen {{ api_interface_address }}:{{ zun_api_port }}
TraceEnable off
<VirtualHost *:{{ zun_api_port }}>
## Vhost docroot
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment