...
No. | Project Name | TSC Subgroup Release Status | Is this your first release | Going for Maturity Review? | CD Logs URL to be used for review (Column filled in by PTLs) | Link to executive one pager (editable doc format) (Column filled in by PTLs) | API Info Reporting Review (Column filled in by API Subcommittee) (note for PTLs – go here for steps to fill in project API info form) | BluVal Certification | Security Certification Provide link to Vuls, Lynis, and Kube-Hunter logs below. Pass/Fail Criteria: Steps To Implement Security Scan Requirements Exception requests should be filed at: https://wiki.akraino.org/display/AK/Akraino+CVE+Vulnerability+Exception+Request | Upstream Review (Column filled by Upstream Subcommittee and PTLs) (note PTL can go to Release Upstream Compliance to find details) | Date ready for TSC review (Column filled in by PTLs) | TSC Review Date (Column filled in by TSC) |
---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | scheduled at | N | Y | https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/cvb/ | Form uploaded Scheduled for API subcommittee review | https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/cvb/
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request
Lynis: Failed - errors sent to BP owner
You are using SHA512 hashing which is good, however, it appears the number of rounds for password hashing is still set to default at 5000. This value must be set higher, 65536. Below is additional information on this topic: The rounds=N option helps to improve key strengthening. The number of rounds has a larger impact on security than the selection of a hash function. For example, rounds=65536 means that an attacker has to compute 65536 hashes for each password he tests against the hash in your /etc/shadow. Therefore the attacker will be delayed by a factor of 65536. This also means that your computer must compute 65536 hashes every time you log in, but even on slow computers that takes less than 1 second. If you do not use the rounds option, then glibc will default to 5000 rounds for SHA-512. Additionally, the default value for the rounds option can be found in sha512-crypt.c. Open /etc/pam.d/passwd with a text editor and add the rounds option at the end of of the uncommented line. After applying this change the line should look like this: password required pam_unix.so sha512 shadow nullok rounds=65536 After you change the number of rounds you will need to expire the existing passwords to encrypt using the new values. 2. Test: Check if one or more compilers can be found on the system Reason: Our core components of BP are needing more than one compiler and fixing them can break our dependencies. Since this BP is requesting a maturity review all compilers must be removed prior to using the system in production. Are there components that require compilers in the completed production release code? Exceptions approved shown at: Kube-Hunter: Exception granted: K8s not used by this BP. | Yes | 12/01 | ||||
2 | scheduled at | N | Y | https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/iec-type4/ | Form uploaded Scheduled for API subcommittee review | https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/iec-type4/
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request
Lynis:
You are using SHA512 hashing which is good, however, it appears the number of rounds for password hashing is still set to default at 5000. This value must be set higher, 65536. Below is additional information on this topic: The rounds=N option helps to improve key strengthening. The number of rounds has a larger impact on security than the selection of a hash function. For example, rounds=65536 means that an attacker has to compute 65536 hashes for each password he tests against the hash in your /etc/shadow. Therefore the attacker will be delayed by a factor of 65536. This also means that your computer must compute 65536 hashes every time you log in, but even on slow computers that takes less than 1 second. If you do not use the rounds option, then glibc will default to 5000 rounds for SHA-512. Additionally, the default value for the rounds option can be found in sha512-crypt.c. Open /etc/pam.d/passwd with a text editor and add the rounds option at the end of of the uncommented line. After applying this change the line should look like this: password required pam_unix.so sha512 shadow nullok rounds=65536 After you change the number of rounds you will need to expire the existing passwords to encrypt using the new values. 2. Test: Check if one or more compilers can be found on the system Reason: Our core components of BP are needing more than one compiler and fixing them can break our dependencies. Since this BP is requesting a maturity review all compilers must be removed prior to using the system in production. Are there components that require compilers in the completed production release code? Exceptions approved shown at: Kube-Hunter: Exception granted: K8s not used by this BP. | Yes | 12/01 | ||||
3 | Scheduled at Release 4 Review 2020-12-01 (Tues) 7 am Pacific | N | Mature | https://nexus.akraino.org/content/sites/logs/att/job/Install_REC_on_OpenEdge1/ | Form uploaded Reviewed by API subcommittee Accepted | https://nexus.akraino.org/content/sites/logs/att/job/Bluval_Logs/results-11-27-2020.tar | https://nexus.akraino.org/content/sites/logs/att/job/Bluval_Logs/results-11-27-2020.tar
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request
Lynis: - errors sent to BP owner Kube-Hunter: Does not appear to have run correctly - question sent to BP owner | Yes | 12/01 | |||
4 | Scheduled at | N | N | ICN Master Baremetal Deployment Verifier | Form uploaded Reviewed by API subcommittee Accepted | https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20201210-010310/. | https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20201210-010310/ ICN R4 Test Document#BluValTesting Vuls: Accepted with exceptions shown at: Lynis: Accepted with exceptions shown at: k8s/conformance:
Kube-Hunter: Accepted
| Yes | 12/10 | 12/16 | ||
5 | scheduled at | N | N | ELIOT R4 IOT-Gateway Datasheet | Form uploaded Reviewed by API subcommittee Accepted | vuls exceptions Akraino CVE Vulnerability Exception Request |
Vuls: Accepted with exceptions shown at: Lynis: Accepted with exceptions shown at: Kube-Hunter: Accepted with exceptions shown at: | Yes | 12/08 | |||
6 | scheduled at | N | N | https://nexus.akraino.org/content/sites/logs/huawei/blueprints/uCPE/job/eliot-uCPE-deploy-k8s-centos-virtual-daily-master/545/ | ELIOT R4 - SD-WAN / WAN Edge / uCPE Data Sheet | Form uploaded Reviewed by API subcommittee Accepted | vuls exceptions Akraino CVE Vulnerability Exception Request |
Vuls: Accepted with exceptions shown at: Lynis: Accepted with exceptions shown at: Kube-Hunter: Accepted with exceptions shown at: | Yes | 12/08 | ||
7 | Scheduled at Release 4 Review 2020-12-09 (Wed) 7:30am | N | Not Applicable | https://nexus.akraino.org/content/sites/logs/juniper/job/NC-Tungsten_Fabric/40/ https://nexus.akraino.org/content/sites/logs/juniper/validation-results/ | Form uploaded Scheduled for API subcommittee review Accepted | Y |
Vuls: Need to provide vuls.log
Lynis: ISSUES that MUST be fixed or a more specific exception reason needs to be provided:
Following compilers found:
Kube-Hunter: In review Sukhdev Kapur has requested that the Release 3 exceptions be provided for Release 4 | Yes | 12/09 | 12/09 | ||
8 | Scheduled at | N | N | AWS footprint: GCP footprint: | Form uploaded Reviewed by API subcommittee Accepted | https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_pae/ | Yes | 12/09 | 12/09 | |||
9 | Slides for KNI blueprints review: | Scheduled at | Y | N | Mgmt Hub logs: IE logs: | Form uploaded Reviewed by API subcommittee Accepted | https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_ie/ | Vuls: https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_ie/os/vuls/log.html.gz Lynis: https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_ie/os/lynis/log.html.gz Kube-Hunter: | Yes | |||
10 | Y | N | https://nexus.akraino.org/content/sites/logs/micromec | Akraino R3 MicroMEC blueprint datasheet.docx | Form uploaded | N/A | ||||||
11 | N | Y | https://nexus.akraino.org/content/sites/logs/baidu/job/aiedge-otestack-master-deploy/ https://nexus.akraino.org/content/sites/logs/baidu/job/aiedge-otestack-master-validation/ | N/A | 06/02 | |||||||
12 | Y | N | ||||||||||
13 | Y | N | https://nexus.akraino.org/content/sites/logs/tencent/job/5g-mec-cloud-gaming-CD/15/ | 5G MEC Rel 3 Datasheet | Form uploaded | N/A | 06/03 | |||||
14 | N | N | https://nexus.akraino.org/content/sites/logs/ampere/job/akraino_arm_anbox_test/6/ | 01/15 | ||||||||
15 | Scheduled at | N | N | https://nexus.akraino.org/content/sites/logs/bytedance/job/run-install-bluefield-fs/ https://nexus.akraino.org/content/sites/logs/bytedance/job/run-install-ovs-dpdk/ | Form uploaded Scheduled for API subcommittee review | Release document is still for R3 | 06/04 | |||||
16 | scheduled at | N | N | https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/ | Form uploaded Reviewed by API subcommittee Accepted | Vuls Exception Akraino CVE Vulnerability Exception Request | Akraino CVE Vulnerability Exception Request
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request Lynis: Accepted with exceptions shown at: Kube-Hunter: Accepted with exceptions shown at: updated results link - 09-dec | Yes | 12/10 | |||
17 | Scheduled at TSC 2021-1-14 (Thurs) 7 am Pacific PCEI Time Slot 7:30-8:00 am Pacific | Y | https://nexus.akraino.org/content/sites/logs/cmti/job/pcei-daily/ | PCEI R4 Datasheet | https://nexus.akraino.org/content/sites/logs/pcei/job/v0/results/ | 01/14/21 | ||||||
18 | Scheduled at | Y | N | https://nexus.akraino.org/content/sites/logs/webank/job/ | Federated ML application at edge R4 Datasheet | Form uploaded Reviewed by API subcommittee Accepted | N/A | https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/results/ https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/lynis_fixed/
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request
Lynis: Accepted with exceptions shown at: https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/lynis_fixed2/ Kube-Hunter: Exception granted: K8s not used by this BP. | Yes | 12/08 | ||
19 | Scheduled at Release 4 Review 2020-11-17 (Tue) 7 am Pacific | Y | N | https://nexus.akraino.org/content/sites/logs/futurewei/kubeedgees/ | Form uploaded Reviewed by API subcommittee Accepted | Yes https://nexus.akraino.org/content/sites/logs/futurewei/kubeedgees/58/results/ |
Vuls: Accepted with exceptions shown at: Release 4 Vuls Exception Request
Lynis: Accepted Kube-Hunter: Exception granted: KubeEdge node is not on same subnet as the cloud node. Communication occurs through the websocket endpoint, so kube-hunter can't be used. | Yes | 11/17 | |||
20 | Y | |||||||||||
21 | Scheduled at Release 4 Review 2020-12-09 | Y | N | https://nexus.akraino.org/content/sites/logs/ai_solutions/job/Eden-flir/ | Form uploaded Reviewed by API subcommittee , waiting for revised API info form to be uploaded 2nd revision of form uploaded by V S | 12/09 |
...