Page History

Connected Vehicle Blueprint

Thor Chin

Tao Wang

CVB_Akraino_R4_blueprint_Datasheet

Form uploaded

Scheduled for API subcommittee review 21 Dec 2020

Waiting for re-uploaded API info form with PaaS API info

Reviewed by API subcommittee, PaaS APIs are subset of TARS APIs

Accepted

https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/cvb/

https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/cvb/

01 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

01 Dec 2020 

Lynis: 

1. Performing test ID AUTH-9229 (Check password hashing methods)

You are using SHA512 hashing which is good, however, it appears the number of rounds for password hashing is still set to default at 5000.  This value must be set higher, 65536.  Below is additional information on this topic:

The rounds=N option helps to improve key strengthening. The number of rounds has a larger impact on security than the selection of a hash function. For example, rounds=65536 means that an attacker has to compute 65536 hashes for each password he tests against the hash in your /etc/shadow. Therefore the attacker will be delayed by a factor of 65536. This also means that your computer must compute 65536 hashes every time you log in, but even on slow computers that takes less than 1 second. If you do not use the rounds option, then glibc will default to 5000 rounds for SHA-512. Additionally, the default value for the rounds option can be found in sha512-crypt.c.

Open /etc/pam.d/passwd with a text editor and add the rounds option at the end of of the uncommented line. After applying this change the line should look like this:

password       required       pam_unix.so sha512 shadow nullok rounds=65536

 After you change the number of rounds you will need to expire the existing passwords to encrypt using the new values.

  2.  Test: Check if one or more compilers can be found on the system

Reason: Our core components of BP are needing more than one compiler and fixing them can break our dependencies.

Since this BP is requesting a maturity review all compilers must be removed prior to using the system in production.  Are there components that require compilers in the completed production release code?

Exceptions approved shown at:

Release 4 Vuls Exception

Kube-Hunter:  Exception granted:  K8s not used by this BP.

IEC Type 4: AR/VR oriented Edge Stack for Integrated Edge Cloud (IEC) Blueprint Family

Bart Dong

Thor Chin

IEC-Type4 Release 4 datasheet.docx

Form uploaded

Scheduled for API subcommittee review 21 Dec 2020

Waiting for re-uploaded API info form with PaaS API info 

Reviewed by API subcommittee, PaaS APIs are subset of TARS APIs

Accepted

https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/iec-type4/

https://nexus.akraino.org/content/sites/logs/parserlabs/r4/jobs/iec-type4/

01 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

04 Jan 2021 

Lynis: 

1.  Performing test ID AUTH-9229 (Check password hashing methods)

You are using SHA512 hashing which is good, however, it appears the number of rounds for password hashing is still set to default at 5000.  This value must be set higher, 65536.  Below is additional information on this topic:

The rounds=N option helps to improve key strengthening. The number of rounds has a larger impact on security than the selection of a hash function. For example, rounds=65536 means that an attacker has to compute 65536 hashes for each password he tests against the hash in your /etc/shadow. Therefore the attacker will be delayed by a factor of 65536. This also means that your computer must compute 65536 hashes every time you log in, but even on slow computers that takes less than 1 second. If you do not use the rounds option, then glibc will default to 5000 rounds for SHA-512. Additionally, the default value for the rounds option can be found in sha512-crypt.c.

Open /etc/pam.d/passwd with a text editor and add the rounds option at the end of of the uncommented line. After applying this change the line should look like this:

password       required       pam_unix.so sha512 shadow nullok rounds=65536

 After you change the number of rounds you will need to expire the existing passwords to encrypt using the new values.

  2.  Test: Check if one or more compilers can be found on the system

Reason: Our core components of BP are needing more than one compiler and fixing them can break our dependencies.

Since this BP is requesting a maturity review all compilers must be removed prior to using the system in production.  Are there components that require compilers in the completed production release code?

Exceptions approved shown at:

Release 4 Vuls Exception

Kube-Hunter:  Exception granted:  K8s not used by this BP.

Radio Edge Cloud (REC)

Paul Carver

REC_Akraino R4 blueprint Datasheet.docx

https://nexus.akraino.org/content/sites/logs/att/job/Bluval_Logs/results-11-27-2020.tar

02 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

02 Dec 2020 

Lynis:   -ISSUES that MUST be fixed for Maturity or a more specific exception reason needs to be provided:

1. Performing test ID AUTH-9229 (Check password hashing methods)
2. Test: Checking SHA_CRYPT_MIN_ROUNDS option in /etc/login.defs
3. Performing test ID USB-2000 (Check USB authorizations)
4. Performing test ID USB-3000 (Check for presence of USBGuard)
5. Test: Checking ClientAliveInterval in /tmp/lynis.ZotHQ7RQAj
6. Test: Checking MaxAuthTries in /tmp/lynis.ZotHQ7RQAj
7. Test: Checking MaxSessions in /tmp/lynis.ZotHQ7RQAj
8. Test: Checking Port in /tmp/lynis.ZotHQ7RQAj
9. Test: Checking TCPKeepAlive in /tmp/lynis.ZotHQ7RQAj
10. Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)
11. sysctl key kernel.kptr_restrict has a different value than expected in scan profile. Expected=2, Real=0
12. sysctl key kernel.sysrq has a different value than expected in scan profile. Expected=0, Real=16
13. sysctl key kernel.yama.ptrace_scope has a different value than expected in scan profile. Expected=1 2 3, Real=0
14. sysctl key net.ipv4.conf.all.forwarding has a different value than expected in scan profile. Expected=0, Real=1
15. sysctl key net.ipv6.conf.all.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1
16. sysctl key net.ipv6.conf.default.accept_redirects has a different value than expected in scan profile. Expected=0, Real=1
17. Performing test ID HRDN-7220 (Check if one or more compilers are installed)

Kube-Hunter: Does not appear to have run correctly - question sent to BP owner

ICN - Integrated Cloud-Native Family

Kuralamudhan Ramakrishnan

ICN_ MICN_Akraino_R4_blueprint_Datasheet.docx

https://nexus.akraino.org/content/sites/logs/intel/bluval_results/icn/master/20201210-010310/

ICN R4 Test Document#BluValTesting

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception

Lynis:  Accepted with exceptions shown at:

Release 4 Lynis Exceptions

k8s/conformance:

• Sonobuoy v0.16.1 does not support Kubernetes 1.18.9.  ICN PTL reported this on https://wiki.akraino.org/display/AK/Akraino+BluVal+Exception+Request

Kube-Hunter:  Accepted

• The logs show the run with the aquasec/kube-hunter:edge image to fix the CAP_NET_RAW inside a pod issue

ELIOT IoT Gateway Blueprint

khemendra kumar

Form uploaded

Reviewed by API subcommittee 11 Dec 2020 

Accepted

07 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception

Lynis: Accepted with exceptions shown at:

Release 4 Lynis Exceptions

Kube-Hunter:  Accepted with exceptions shown at:

Release 4 Kube-Hunter Exceptions

ELIOT SD-WAN/WAN Edge/uCPE Blueprint

khemendra kumar

Form uploaded

Reviewed by API subcommittee 11 Dec 2020 

Accepted

07 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception

Lynis: Accepted with exceptions shown at:

Release 4 Lynis Exceptions

Kube-Hunter:  Accepted with exceptions shown at:

Release 4 Kube-Hunter Exceptions

Network Cloud and TF (Tungsten Fabric) Integration Project

Sukhdev Kapur

Form uploaded

Scheduled for API subcommittee review 18 Dec 2020 

Accepted

https://nexus.akraino.org/content/sites/logs/juniper/validation/

KNI Provider access edge

Ricardo Noriega

Akraino R4 blueprint Datasheet_ KNI PAE.odt

12 Jan 2021 

Vuls:  Accepted with exception.  The KNI Provider Access Edge blueprint uses OpenShift as its k8s distribution, which is deployed on Red Hat CoreOS, an immutable OS that is not supported by Vuls.

https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_pae/os/vuls/log.html.gz

Lynis:

https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_pae/os/lynis/log.html.gz

ISSUES that MUST be fixed or a more specific exception reason needs to be provided:

1.  Test: Checking PASS_MAX_DAYS option in /etc/login.defs
2. Performing test ID AUTH-9328 (Default umask values)
3. Performing test ID SSH-7440 (Check OpenSSH option: AllowUsers and AllowGroups)
4. sysctl key kernel.dmesg_restrict contains equal expected and current value (1)
5. sysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)

Exceptions can be granted for the issues listed in the link below, but should also be corrected for this release if possible.  The issues listed in exceptions must be fixed prior to maturity.

Release 4 Lynis Exceptions

Kube-Hunter: 

https://nexus.akraino.org/content/sites/logs/redhat-kni/bluval_results_pae/k8s/kube-hunter/log.html.gz

Failed:  The vulnerabilities listed in the kube-hunter cluster.log and pod.log files must be remediated or a reason for an exception for each vulnerability provided to the security team.

KNI Industrial Edge

Ricardo Noriega

Akraino R4 blueprint Datasheet_ KNI IE.odt

The AI Edge: School/Education Video Security Monitoring

Hechun Zhang

AIEdge_Akraino R4 blueprint Datasheet.docx

The AI Edge: Intelligent Vehicle-Infrastructure Cooperation System(I-VICS)

Hechun Zhang

IEC Type 3: Android cloud native applications on Arm servers in edge for Integrated Edge Cloud (IEC) Blueprint Family

hanyu ding

IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint Family

yihui wang

IEC Release3-SmartNIC datasheet.docx

Form uploaded

Scheduled for API subcommittee review 21 Dec 2020

Accepted

Enterprise Applications on Lightweight 5G Telco Edge

Gaurav Agrawal

EALTEdge Rel 4 Datasheet

https://nexus.akraino.org/content/sites/logs/huawei/blueprints/ealt-edge/job/ealt-edge-bluval-daily-master/251/results/

Akraino CVE Vulnerability Exception Request

08 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

Lynis: Accepted with exceptions shown at:

Release 4 Lynis Exceptions

Kube-Hunter:  Accepted with exceptions shown at:

Release 4 Kube-Hunter Exceptions

Public Cloud Edge Interface (PCEI) Blueprint

Oleg Berzin

Form uploaded 4Jan

Scheduled for API subcommittee review 08 Jan 2021 

For R4, third-party location API provided as an example in PCEI architecture diagrams. For R5 they expect PCEI APIs to be exported

Accepted

11 Jan 2021 

Vuls:

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

08 Jan 2021 vuls.log included in the new logs (V2)

Lynis:

ISSUES that MUST be fixed or a more specific exception reason needs to be provided:

1. Performing test ID AUTH-9328 (Default umask values)
2. sysctl key net.ipv4.conf.default.accept_source_route contains equal expected and current value (0)

Exceptions can be granted for the issues listed in the link below, but should also be corrected for this release if possible.  The issues listed in exceptions must be fixed prior to maturity.

Release 4 Lynis Exceptions

Kube-Hunter:

Failed:  The vulnerabilities listed in the kube-hunter cluster.log and pod.log files must be remediated or a reason for an exception for each vulnerability provided to the security team.

The AI Edge: Federated ML application at edge

Julie Han 

https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/results/

https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/lynis_fixed/

08 Dec 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

15 Dec 2020 

Lynis:  Accepted with exceptions shown at:

Release 4 Lynis Exceptions

https://nexus.akraino.org/content/sites/logs/webank/job/FL_SCAN/lynis_fixed2/

Kube-Hunter:  Exception granted:  K8s not used by this BP.

KubeEdge Edge Service Blueprint

Yin Ding

18 Nov 2020 

Vuls:  Accepted with exceptions shown at:

Release 4 Vuls Exception Request

20 Nov 2020 

Lynis:  Accepted

Kube-Hunter: Exception granted:  KubeEdge node is not on same subnet as the cloud node.  Communication occurs through the websocket endpoint, so kube-hunter can't be used.

Private LTE/5G ICN Blueprint

Prem Sankar G

IoT Workloads at the Smart Device Edge - Predictive Maintenance (with a Thermal Imaging Camera, vibration sensors, etc.)

V S

Aaron Williams

Predictive_maintenance_Akraino.docx

Form uploaded

Reviewed by API subcommittee 11 Dec 2020 , waiting for revised API info form to be uploaded

2nd revision of form uploaded 18 Dec 2020  by V S

Final review by API subcommittee set for 08 Jan 2021