Skip to content

Commit d5b74c6

Browse files
Abhishek Chandasmoser
Abhishek Chanda
and
smoser
committed
Take an optional rabbit user name as input
Newer versions of rabbitmq (3.3 and later) do not allow the 'guest' user to access on non-local interfaces. - Added a new config RABBIT_USERID which defaults to stackrabbit - Invoked config scripts using that variable Adopted from: https://review.openstack.org/#/c/107779/ Change-Id: I43a231c9611b4cc2e390b603aa3bfb49c915bdc5 Closes-Bug: #1343354 Co-Authored-By: Scott Moser <smoser@ubuntu.com>
1 parent 1fc6e18 commit d5b74c6

5 files changed

Lines changed: 31 additions & 5 deletions

File tree

‎lib/keystone‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -214,6 +214,7 @@ function configure_keystone {
214214

215215
# Configure rabbitmq credentials
216216
if is_service_enabled rabbit; then
217+
iniset $KEYSTONE_CONF DEFAULT rabbit_userid $RABBIT_USERID
217218
iniset $KEYSTONE_CONF DEFAULT rabbit_password $RABBIT_PASSWORD
218219
iniset $KEYSTONE_CONF DEFAULT rabbit_host $RABBIT_HOST
219220
fi

‎lib/nova‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -587,8 +587,8 @@ function init_nova_cells {
587587
fi
588588

589589
$NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF db sync
590-
$NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=guest --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
591-
$NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=guest --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
590+
$NOVA_BIN_DIR/nova-manage --config-file $NOVA_CELLS_CONF cell create --name=region --cell_type=parent --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=/ --woffset=0 --wscale=1
591+
$NOVA_BIN_DIR/nova-manage cell create --name=child --cell_type=child --username=$RABBIT_USERID --hostname=$RABBIT_HOST --port=5672 --password=$RABBIT_PASSWORD --virtual_host=child_cell --woffset=0 --wscale=1
592592
fi
593593
}
594594

‎lib/rpc_backend‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
# Dependencies:
88
#
99
# - ``functions`` file
10-
# - ``RABBIT_{HOST|PASSWORD}`` must be defined when RabbitMQ is used
10+
# - ``RABBIT_{HOST|PASSWORD|USERID}`` must be defined when RabbitMQ is used
1111
# - ``RPC_MESSAGING_PROTOCOL`` option for configuring the messaging protocol
1212

1313
# ``stack.sh`` calls the entry points in this order:
@@ -68,6 +68,9 @@ function check_rpc_backend {
6868
function cleanup_rpc_backend {
6969
if is_service_enabled rabbit; then
7070
# Obliterate rabbitmq-server
71+
if [ -n "$RABBIT_USERID" ]; then
72+
sudo rabbitmqctl delete_user "$RABBIT_USERID"
73+
fi
7174
uninstall_package rabbitmq-server
7275
sudo killall epmd || sudo killall -9 epmd
7376
if is_ubuntu; then
@@ -180,15 +183,16 @@ function restart_rpc_backend {
180183
# service is not started by default
181184
restart_service rabbitmq-server
182185
fi
186+
rabbit_setuser "$RABBIT_USERID" "$RABBIT_PASSWORD"
183187
# change the rabbit password since the default is "guest"
184-
sudo rabbitmqctl change_password guest $RABBIT_PASSWORD && break
188+
sudo rabbitmqctl change_password $RABBIT_USERID $RABBIT_PASSWORD && break
185189
[[ $i -eq "10" ]] && die $LINENO "Failed to set rabbitmq password"
186190
done
187191
if is_service_enabled n-cell; then
188192
# Add partitioned access for the child cell
189193
if [ -z `sudo rabbitmqctl list_vhosts | grep child_cell` ]; then
190194
sudo rabbitmqctl add_vhost child_cell
191-
sudo rabbitmqctl set_permissions -p child_cell guest ".*" ".*" ".*"
195+
sudo rabbitmqctl set_permissions -p child_cell $RABBIT_USERID ".*" ".*" ".*"
192196
fi
193197
fi
194198
elif is_service_enabled qpid; then
@@ -225,6 +229,7 @@ function iniset_rpc_backend {
225229
iniset $file $section rpc_backend ${package}.openstack.common.rpc.impl_kombu
226230
iniset $file $section rabbit_hosts $RABBIT_HOST
227231
iniset $file $section rabbit_password $RABBIT_PASSWORD
232+
iniset $file $section rabbit_userid $RABBIT_USERID
228233
fi
229234
}
230235

@@ -239,6 +244,21 @@ function qpid_is_supported {
239244
( ! is_suse )
240245
}
241246

247+
function rabbit_setuser {
248+
local user="$1" pass="$2" found="" out=""
249+
out=$(sudo rabbitmqctl list_users) ||
250+
{ echo "failed to list users" 1>&2; return 1; }
251+
found=$(echo "$out" | awk '$1 == user { print $1 }' "user=$user")
252+
if [ "$found" = "$user" ]; then
253+
sudo rabbitmqctl change_password "$user" "$pass" ||
254+
{ echo "failed changing pass for '$user'" 1>&2; return 1; }
255+
else
256+
sudo rabbitmqctl add_user "$user" "$pass" ||
257+
{ echo "failed changing pass for $user"; return 1; }
258+
fi
259+
sudo rabbitmqctl set_permissions "$user" ".*" ".*" ".*"
260+
}
261+
242262
# Set up the various configuration files used by the qpidd broker
243263
function _configure_qpid {
244264

‎lib/trove‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ function configure_trove {
134134
rm -f $TROVE_CONF_DIR/trove-taskmanager.conf
135135
rm -f $TROVE_CONF_DIR/trove-conductor.conf
136136

137+
iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
137138
iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_password $RABBIT_PASSWORD
138139
iniset $TROVE_CONF_DIR/trove.conf DEFAULT sql_connection `database_connection_url trove`
139140
iniset $TROVE_CONF_DIR/trove.conf DEFAULT default_datastore $TROVE_DATASTORE_TYPE
@@ -145,6 +146,7 @@ function configure_trove {
145146
if is_service_enabled tr-tmgr; then
146147
TROVE_AUTH_ENDPOINT=$KEYSTONE_AUTH_URI/v$IDENTITY_API_VERSION
147148

149+
iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
148150
iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT rabbit_password $RABBIT_PASSWORD
149151
iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT sql_connection `database_connection_url trove`
150152
iniset $TROVE_CONF_DIR/trove-taskmanager.conf DEFAULT taskmanager_manager trove.taskmanager.manager.Manager
@@ -157,6 +159,7 @@ function configure_trove {
157159

158160
# (Re)create trove conductor conf file if needed
159161
if is_service_enabled tr-cond; then
162+
iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
160163
iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT rabbit_password $RABBIT_PASSWORD
161164
iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT sql_connection `database_connection_url trove`
162165
iniset $TROVE_CONF_DIR/trove-conductor.conf DEFAULT nova_proxy_admin_user radmin
@@ -168,6 +171,7 @@ function configure_trove {
168171
fi
169172

170173
# Set up Guest Agent conf
174+
iniset $TROVE_CONF_DIR/trove.conf DEFAULT rabbit_userid $RABBIT_USERID
171175
iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_host $TROVE_HOST_GATEWAY
172176
iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT rabbit_password $RABBIT_PASSWORD
173177
iniset $TROVE_CONF_DIR/trove-guestagent.conf DEFAULT nova_proxy_admin_user radmin

‎stack.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -643,6 +643,7 @@ initialize_database_backends && echo "Using $DATABASE_TYPE database backend" ||
643643

644644
# Rabbit connection info
645645
if is_service_enabled rabbit; then
646+
RABBIT_USERID=${RABBIT_USERID:-stackrabbit}
646647
RABBIT_HOST=${RABBIT_HOST:-$SERVICE_HOST}
647648
read_password RABBIT_PASSWORD "ENTER A PASSWORD TO USE FOR RABBIT."
648649
fi

0 commit comments

Comments
 (0)