Re: Hardening access to metadata in OpenStack instances
Hi
On Tue, Sep 02, 2025 at 09:36:15AM +0200, Thomas Goirand wrote:
> Under "normal" circumstances, anyone has access to a VM's metadata. It'd be
> nice to restrict access to it for only the VM (ie: do not accept forwarding)
> and only from root. This could be done this way:
Why is this a problem? What information does the metadata service
provide?
> iptables -A FORWARD -d 169.254.169.254/32 \
> -j REJECT --reject-with icmp-port-unreachable
> iptables -A OUTPUT -d 169.254.169.254/32 \
> -m owner ! --uid-owner 0 -j REJECT \
> --reject-with icmp-port-unreachable
>
> Would the team agree to add this by default?
How would that integrate with user config? The packet filter is a
global resource. Also how do you intend to handle the incompatibility
between nft and iptables?
> Your thoughts?
Don't provide network services that you don't want someone to use.
Bastian
--
Virtue is a relative term.
-- Spock, "Friday's Child", stardate 3499.1
Reply to: