DOCSLIB.ORG

Red Hat Enterprise Linux Openstack Platform 7 Bare Metal Provisioning

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Red Hat Enterprise Linux Openstack Platform 7 Bare Metal Provisioning Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning 安装、配置和使用 Bare Metal Provisioning（Ironic） OpenStack Team Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning 安装、配置和使用 Bare Metal Provisioning（Ironic） OpenStack Team [email protected] 法律通告 Copyright © 2017 Red Hat, Inc. The text of and illustrations in this document are licensed by Red Hat under a Creative Commons Attribution–Share Alike 3.0 Unported license ("CC-BY-SA"). An explanation of CC-BY-SA is available at http://creativecommons.org/licenses/by-sa/3.0/ . In accordance with CC-BY-SA, if you distribute this document or an adaptation of it, you must provide the URL for the original version. Red Hat, as the licensor of this document, waives the right to enforce, and agrees not to assert, Section 4d of CC-BY-SA to the fullest extent permitted by applicable law. Red Hat, Red Hat Enterprise Linux, the Shadowman logo, JBoss, OpenShift, Fedora, the Infinity logo, and RHCE are trademarks of Red Hat, Inc., registered in the United States and other countries. Linux ® is the registered trademark of Linus Torvalds in the United States and other countries. Java ® is a registered trademark of Oracle and/or its affiliates. XFS ® is a trademark of Silicon Graphics International Corp. or its subsidiaries in the United States and/or other countries. MySQL ® is a registered trademark of MySQL AB in the United States, the European Union and other countries. Node.js ® is an official trademark of Joyent. Red Hat Software Collections is not formally related to or endorsed by the official Joyent Node.js open source or commercial project. The OpenStack ® Word Mark and OpenStack logo are either registered trademarks/service marks or trademarks/service marks of the OpenStack Foundation, in the United States and other countries and are used with the OpenStack Foundation's permission. We are not affiliated with, endorsed or sponsored by the OpenStack Foundation, or the OpenStack community. All other trademarks are the property of their respective owners. 摘要 本文档介绍了在一个 Red Hat Enterprise Linux OpenStack Platform 环境的 Overcloud 中安装、配置 和使用 Bare Metal Provisioning 的方法。 目录 目录 序. 言. .3 . 第. .1 . 章. .安 . 装. 和. .配 . .置 . O. .P .E .N . S. T. .A .C . K. .B . A. .R .E . .M . E. T. A. .L . P. .R .O . V. I.S . I.O . N. I.N . G. （. I.R . O. .N .I C. .） . .4 . 1.1. 配置要求 4 1.1.1. Bare Metal Provisioning 安装的假设条件 4 1.1.2. Bare Metal Provisioning 的硬件要求 4 1.1.3. Bare Metal Provisioning 的网络要求 5 1.2. 订阅所需的频道 5 1.3. 安装 BARE METAL PROVISIONING 软件包 6 1.4. 创建 BARE METAL PROVISIONING 数据库 6 1.5. 创建 BARE METAL PROVISIONING IDENTITY 记录 7 1.6. 配置 BARE METAL PROVISIONING 身份验证 8 1.7. 配置防火墙来允许 BARE METAL PROVISIONING 的网络流量 9 1.8. 为 BARE METAL PROVISIONING 设置 RABBITMQ MESSAGE BROKER 9 1.9. 配置 BARE METAL PROVISIONING 与 OPENSTACK NETWORKING 和 OPENSTACK IMAGE 进行通讯 1.10. 配置 OPENSTACK COMPUTE 来使用 BARE METAL PROVISIONING 11 10 1.11. 配置 OPENSTACK NETWORKING 来与 BARE METAL PROVISIONING 进行交流 12 第. .2 . 章. .配 . 置. 裸. .机 . .实 . .施 . .1 .5 . 2.1. 配置 BARE METAL PROVISIONING 驱动 15 2.2. 创建上传镜像 15 2.3. 创建 BARE METAL PROVISIONING FLAVOR 18 2.4. 为 BARE METAL PROVISIONING 配置 PXE 19 2.5. 配置硬件內省 20 2.6. 添加物理机器作为裸机节点 22 2.6.1. 利用硬件內省功能添加节点 23 2.6.2. 手工添加节点 24 2.7. 使用主机集合来分离物理机部署和虚拟机部署 26 2.8. 示例：使用SSH 和 VIRSH 测试 BARE METAL PROVISIONING 27 2.8.1. 创建虚拟的裸机节点 28 2.8.2. 创建一个 SSH 密钥对 28 2.8.3. 添加虚拟节点作为裸机节点 29 第. .3 . 章. .启 . 动. 裸. .机 . .实 . .例 . .3 .1 . 3.1. 使用命令行接口实施实例 31 3.2. 通过 DASHBOARD 实施实例 31 第. .4 . 章. .对 . .B . A. .R .E . .M . E. T. A. .L . P. R. .O . V. I.S . I.O .N . I.N . G. 进 . .行 . .故 . 障. 排. .除 . .3 .3 . 4.1. 对硬件注册进行故障排除 33 4.2. 排除 NO VALID HOST 错误 33 4.3. 对硬件內省的故障排除 34 附. 录. .A .. .B . A. .R .E . .M . E. T. A. .L . P. R. .O . V. I.S . I.O .N . I.N . G. .驱 . .动 . .3 .5 . A.1. INTELLIGENT PLATFORM MANAGEMENT INTERFACE (IPMI) 35 A.2. DELL REMOTE ACCESS CONTROLLER (DRAC) 35 A.3. INTEGRATED LIGHTS-OUT (ILO) 35 A.4. IBOOT 36 A.5. SSH 和 VIRSH 36 1 Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning 2 序言 序言 本文档介绍了在 Overcloud 中安装和配置 Bare Metal Provisioning (ironic) 作为一个 OpenStack 服务 的方法，以及使用这个服务为最终用户部署和管理物理机的方法。通过配置这个服务，用户可以象启 用虚拟机实例一样，在物理机上启用实例。 作为 Undercloud 的一部分，Bare Metal Provisioning 组件也被 Red Hat Enterprise Linux OpenStack Platform director 使用来部署和管理构成 OpenStack 环境（Overcloud）的裸机节点。如需了解 director 如何使用 Bare Metal Provisioning 服务的信息，请参阅 Director Installation and Usage。 3 Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning 第 1 章 安装和配置 OPENSTACK BARE METAL PROVISIONING（IRONIC） OpenStack Bare Metal Provisioning（ironic）提供了为最终用户部署和管理物理机所需的组件。 Overcloud 中的 Bare Metal Provisioning 服务会和以下 OpenStack 服务进行交流： OpenStack Compute（nova）提供了虚拟机实例的调度、租户配额、IP 配置功能，以及用于虚拟 机实例管理的一个面向用户的 API；而 Bare Metal Provisioning 为硬件管理提供了一个管理 API。请选择一个独立的、专用的 openstack-nova-compute 主机来使用 Bare Metal Provisioning 驱动，并处理 Bare Metal Provisioning 请求。 OpenStack Identity（keystone）提供了请求的身份验证功能，并帮助 Bare Metal Provisioning 定 位其它 OpenStack 服务。 OpenStack Image 服务（glance）提供了管理镜像以及镜像元数据的功能。 OpenStack Networking（neutron）提供了 DHCP 和网络配置功能。 1.1. 配置要求 本章介绍了设置 Bare Metal Provisioning 所需的配置要求，包括安装的假设条件、硬件要求和网络要 求。 1.1.1. Bare Metal Provisioning 安装的假设条件 Bare Metal Provisioning 包括了一组组件，这些组件可以被配置为在一个节点上运行，也可以配置为 在多个独立节点上运行。本文档中所使用的示例是在一个节点上安装并配置所有 Bare Metal Provisioning 组件。同时，本文档还基于所有 OpenStack Identity、OpenStack Image、OpenStack Compute 和 OpenStack Networking 服务都已经被安装并配置这一个假设条件的。另外，Bare Metal Provisioning 还需要以下外部服务，这些服务需要作为先决条件已被安装并配置： 一个用来保存硬件信息和状态的数据库服务器。本文档假设 RHEL OpenStack Platform 环境已配 置了 MariaDB 数据库服务。 一个消息服务。本文档假设已在环境中配置了 RabbitMQ。 如果您使用 director 部署 OpenStack 环境，数据库服务和消息服务会在 Overcloud 中的一个 Controller 节点上安装。 RHEL OpenStack Platform 需要在运行 Red Hat Enterprise Linux 7 的 Compute 节点和 OpenStack Networking 节点上使用 iptables 而不是 firewalld。本文档中使用的防火墙规则都是通过 iptables 设置的。 1.1.2. Bare Metal Provisioning 的硬件要求 运行 Bare Metal Provisioning 组件的节点需要满足以下的硬件要求： 支持 Intel 64 或 AMD64 CPU 扩展的 64 位 x86 处理器。 最少 6GB 内存。 最少具有 40GB 可用磁盘空间。 最少两个 1 Gbps 网卡。但是，推荐使用 10 Gbps 网卡来作为 Provisioning 网络的接口（特别是 您需要部署大量裸机时）。 4 第 1 章 安装和配置 OPENSTACK BARE METAL PROVISIONING（IRONIC） 安装 Red Hat Enterprise Linux 7.1 作为主机操作系统。 或者，在一个专门的 openstack-nova-compute 节点上安装并配置 Bare Metal Provisioning 组件。 如需了解和硬件要求相关的信息，请参阅 Director Installation and Usage 指南中的 Compute Node Requirements 一节。 根据您所要安装的操作系统的不同，所部署的裸机的硬件要求也会有所不同。对于 Red Hat Enterprise Linux 7，请参阅 Red Hat Enterprise Linux 7 Installation Guide。对于 Red Hat Enterprise Linux 6，请参阅 Red Hat Enterprise Linux 6 Installation Guide。 1.1.3. Bare Metal Provisioning 的网络要求 Bare Metal Provisioning 最少需要两个网络： Provisioning 网络：Bare Metal Provisioning 用来部署和管理裸机的私人网络，它提供了 DHCP 和 PXE 引导功能来帮助发现裸机系统。这个网络最好使用一个主干（trunk）接口中的原生 VLAN，这样 Bare Metal Provisioning 就可以处理 PXE 引导和 DHCP 请求。另外，这个网络还被 用来通过被部署的裸机上的带外（out-of-band） 驱动控制电源管理。 External 网络 - 用来进行远程连接的一个独立网络。连接到这个网络的接口需要一个可路由的 IP 地址（静态定义或通过一个外部 DHCP 服务动态分配）。 要被部署的裸机需要满足以下要求： 两个网卡：一个作为 provisioning 网络，另一个用于外部连接。 连接到 provisioning 网络上的一个电源管理接口（如 IPMI）。如果您只需要使用 SSH 用于测 试，则不需要这个接口。 在 provisioning 网络中的 PXE 引导处于系统引导顺序的最前面（在硬盘引导和 CD/DVD 引导之 前）。系统中的所有其它网卡都需要禁用 PXE 引导。 1.2. 订阅所需的频道 为了安装 Bare Metal Provisioning 软件包，需要使用 Red Hat Subscription Manager 注册您的服务 器。如果您在一个 compute 节点上安装 Bare Metal Provisioning，您的服务器可能已经进行了适当的 订阅。运行 yum repolist 命令检查在以下操作中使用的频道是否已经被订阅。 订阅所需的频道 1. 在 Content Delivery Network 中注册您的系统，在提示时输入您的客户门户网站（Customer Portal）的用户名和密码： # subscription-manager register 2. 找到包括安装 Bare Metal Provisioning 所需频道的权利池： # subscription-manager list --available | grep -A8 "Red Hat Enterprise Linux Server" # subscription-manager list --available | grep -A8 "Red Hat Enterprise Linux OpenStack Platform" 3. 使用在上一步所获得的权利池 ID 把 Red Hat Enterprise Linux Server 7 和 Red Hat Enterprise Linux OpenStack Platform 的权利附加到系统上。运行以下命令： 5 Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning # subscription-manager attach --pool=POOL_ID 4. 启用所需的频道： # subscription-manager repos --enable=rhel-7-server-rpms -- enable=rhel-7-server-openstack-7.0-rpms --enable=rhel-7-server- rh-common-rpms --enable=rhel-7-server-optional-rpms -- enable=rhel-7-server-openstack-7.0-optools-rpms 1.3. 安装 BARE METAL PROVISIONING 软件包 Bare Metal Provisioning 需要以下软件包： openstack-ironic-api 提供 Bare Metal Provisioning API 服务。 openstack-ironic-conductor 提供 Bare Metal Provisioning 的 conductor 服务。conductor 允许添加、编辑和删除节点、关闭或开 启带有 IPMI 或 SSH 功能的节点，并可以部署、实施和停用裸机节点。 python-ironicclient 为和 Bare Metal Provisioning 服务进行交流提供一个命令行接口。 安装软件包： # yum install openstack-ironic-api openstack-ironic-conductor python- ironicclient 1.4. 创建 BARE METAL PROVISIONING 数据库 创建 Bare Metal Provisioning 使用的数据库。在这个过程中进行的所有操作都需要在数据库服务器上 进行，并需要以 root 用户登录。 创建 Bare Metal Provisioning 数据库 1. 连接到数据库服务： # mysql -u root -p 2. 创建 ironic 数据库： mysql> CREATE DATABASE ironic; 3. 创建一个 ironic 数据库用户，并为这个用户分配可以访问 ironic 数据库的权限： mysql> GRANT ALL ON ironic.* TO 'ironic'@'%' IDENTIFIED BY 'PASSWORD'; mysql> GRANT ALL ON ironic.* TO 'ironic'@'localhost' IDENTIFIED BY 'PASSWORD'; 6 第 1 章 安装和配置 OPENSTACK BARE METAL PROVISIONING（IRONIC） 把 PASSWORD 替换为用户在数据库服务器上进行验证的密码。 4. 刷新数据库权限使它们马上生效： mysql> FLUSH PRIVILEGES; 5. 退出 mysql 客户端： mysql> quit 6. 设置 connection 配置关键字的值： # openstack-config --set /etc/ironic/ironic.conf \ database connection mysql://ironic:PASS@IP/ironic 替换以下值： 使用数据库用户的密码替换 PASS。 使用数据库服务器的 IP 地址或主机名替换 IP。 重要 在 "connection" 配置关键字中指定的 IP 地址或主机名必须和在创建 Bare Metal Provisioning 数据库时设置的 Bare Metal Provisioning 数据库用户可以访问的系统的 IP 地 址或主机名相匹配。如果创建的数据库是一个本地数据库，并分配给数据库用户访问 localhost 的权限，您必须使用 localhost。 1.5. 创建 BARE METAL PROVISIONING IDENTITY 记录 创建 Bare Metal Provisioning 所需的 Identity 记录。这些记录可以帮助其它 OpenStack 服务定位并访 问 Bare Metal Provisioning 提供的功能。 这个过程假设您已经创建了一个管理用户账户和一个 services 租户。 在 Identity 服务器上进行这个过程；或在任何已经复制了 keystonerc_admin 文件并安装了 keystone 命令行工具的系统上进行。 为 Bare Metal Provisioning 创建 Identity 记录 1. 把 shell 设置为以管理用户身份访问 Identity： # source ~/keystonerc_admin 2. 创建 ironic 用户： # keystone user-create --name ironic \ --pass PASSWORD \ --email IRONIC_EMAIL 使用 Bare Metal Provisioning 用来和 Identity 进行验证时使用的密码替换 PASSWORD；使 用 Bare Metal Provisioning 所使用的电子邮件地址替换 IRONIC_EMAIL。 7 Red Hat Enterprise Linux OpenStack Platform 7 Bare Metal Provisioning 3.
Load more

Recommended publications
  • Porting Darwin to the MV88F6281 Arming the Snowleopard
    Porting Darwin to the MV88F6281 ARMing the SnowLeopard. Tristan Schaap 1269011 Apple Inc. Platform Technologies Group Delft University of Technology Dept. of Computer Science Committee: Ir. B.R. Sodoyer Dr. K. van der Meer Preface! 3 Introduction! 4 Summary! 5 Building a new platform! 6 Booting iBoot! 7 Building the kernelcache! 8 Booting the kernel! 10 THUMBs down! 16 Conclusion! 18 Future Work! 19 Glossary! 20 References! 21 Appendix A! 22 Appendix B! 23 Skills! 23 Process! 26 Reflection! 27 Appendix C! 28 Plan of Approach! 28 2 Preface Due to innovative nature of this project, I have had to limit myself in the detail in which I describe my work. This means that this report will be lacking in such things as product specific- and classified information. I would like to thank a few people who made it possible for me to successfully complete my internship at the Platform Technologies Group at Apple. First off, the people who made this internship possible, John Kelley, Ben Byer and my manager John Wright. Mike Smith, Tom Duffy and Anthony Yvanovich for helping me through the rough patches of this project. And the entirety of Core OS for making my stay an unforgettable experience. 3 Introduction About the Platform Technologies Group As it was described by a manager: “We do the plumbing, if we do our jobs right, you never see it.”. The Platform Technologies Group, a subdivision of the Core OS department, works on the embedded platforms that Apple maintains. Here, platforms are brought up and the embedded kernel and lower level support for the platforms is maintained.
    [Show full text]
  • UNITED STATES DISTRICT COURT for the Western District of Michigan
    Case 1:12-mj-00304-JGS Doc #4 Filed 10/09/12 Page 1 of 5 Page IDiffllED- GR . October 9, 2012 3:46PM AO 93 (Rev. 12109) Search and Seizure Warrant TRACEY CORDES, CLERK U.S. DISTRICT COURT WESTERN DISTRICT OF MICHIGAN BY: dmh /____ _____ UNITED STATES DISTRICT COURT for the Western District of Michigan In the Maner of the Search of (8riefl.v describe the property to be searched or identify the person by name and address) Case No. 1: 12-mj-304 an Apple 1-Phone model A 1332 with IC # SEARCH AND SEIZURE WARRANT To: Any authorized law enforcement officer An application by a federal law enforcement officer or an attorney for the government requests the search of the following person or property located in the Western District of Michigan (identify thl! person or describe the property to be searched and giw its location): One black-colored Apple 1-Phone telephone bearing model# A 1332 and IC # ••••. recovered from····· bedroom localed at····· The person or property to be searched, described above, is believed to conceal (id('ntif:v til(' pason ur dt•saib~t the property to be sei=ed): historical information regarding call activity, "phone book" directory information. stored voice-mails and text messages. and electronic files, photographs, and video images I find that the affidavit(s). or any recorded testimony, establish probable cause to search and seize the person or property. YOU ARE COMMANDED to execute this warrant on or before ·---··- ... Sep~ l9. ~1.2. ··--· ·--..... (not to I!.T,'el!d I-I days) gf in the daytime 6:00 .a.m.
    [Show full text]
  • Cache Attacks on the Apple A10 Fusion Soc
    iTimed: Cache Attacks on the Apple A10 Fusion SoC Gregor Haas, Seetal Potluri, and Aydin Aysu Department of Electrical and Computer Engineering North Carolina State University fghaas, spotlur2, [email protected] Abstract—This paper proposes the first cache timing side- devices which cannot be obtained legally [8]. Additionally, channel attack on one of Apple’s mobile devices. Utilizing Apple ensures that applications cannot arbitrarily interact a recent, permanent exploit named checkm8, we reverse- with other applications or the operating system by strictly engineered Apple’s BootROM and created a powerful toolkit for running arbitrary hardware security experiments on Ap- enforcing the allowed inter-process communication (IPC) ple’s in-house designed ARM systems-on-a-chip (SoC). Using interfaces. As shown in the literature [9], even determining this toolkit, we then implement an access-driven cache timing which interfaces exist is a challenging research problem. attack (in the style of PRIME+PROBE) as a proof-of-concept In the context of hardware security research on iPhones, illustrator. useful resources such as documentation or development The advanced hardware control enabled by our toolkit allowed us to reverse-engineer key microarchitectural details tools are even rarer than for software security research. For of the Apple A10 Fusion’s memory hierarchy. We find that the one, Apple does not release any detailed documentation SoC employs a randomized cache-line replacement policy as for their in-house designed hardware modules. Some in- well as a hardware-based L1 prefetcher. We propose statistical formation can be found in Apple’s patents for a dynamic innovations which specifically account for these hardware voltage frequency modulation (DVFM) module [10], secure structures and thus further the state-of-the-art in cache timing attacks.
    [Show full text]
  • From Cves to Proof: Make Your USB Device Stack Great Again
    From CVEs to proof: Make your USB device stack great again Ryad Benadjila1, Cyril Debergé2, Patricia Mouy1, Philippe Thierry1 [email protected] [email protected] 1 ANSSI 2 IRSN Abstract. Nowadays, many devices embed a full USB stack, whose main components are made of software elements dealing with hardware IPs. USB sticks, hard-disk drives, smartphones, vehicles, industrial automa- tons, IoT devices: they all usually offer a USB physical connection, and a USB software driver dealing with it. In critical environments where attackers are able to tamper with this interface, any exploitable software Run Time Error (RTE) such as a buffer overflow might lead to a remote code execution on the vulnerable device, usually in privileged mode. This is even worse when the USB stack runs from a BootROM [12,45], yielding unpatchable software. This matter of fact exhibits the need for a portable RTE-free USB stack with concrete proofs: the current article proposes an open-source implementation of such a stack using the Frama-C frame- work [35], with proofs and various use cases (DFU, HID, mass storage, and more to come). Beyond providing the mere implementation, we bring a generic methodology to adapt complex protocols software stacks to Frama-C with strong embedded contexts constraints. 1 Introduction Software is becoming the core component of many systems, from small embedded devices to bigger desktop Personal Computers. Even for what seems to be simple and low-level tasks, dedicated hardware with hard- wired logic circuits are almost always driven by pieces of software that tend to become more and more complex.
    [Show full text]
  • Iboot-G2s.Pdf
    Web Enabled Power Switch Models: iBoot-G2S iBoot-G2+ March 2021 Congratulations on purchasing the best network controlled power switch available. This manual covers two models, iBoot-G2+ and iBoot-G2S. This manual refers to the iBoot-G2+ and notes the changes for the iBoot-G2S. Web Setup and Control: Simple browser interface for one click reboot and all configuration. iBoot Cloud Service: Control all your iBoots from a single sign-on. Eliminates port-forwarding and security issues. Telnet: setup and control of all fuctions. Allows easy scripting. Network Switch: Built-in 2 Port 10/100 Network Switch (iBoot-G2S only). Eliminates need for extra router port and simplifies installation. Expansion: Add low cost iBoot-EXP units for up to three outlets controlled. I/O Control: Control or Monitor your own digital Inputs and Outputs. Use inputs to control the local AC outlet. iBoot-G2+ AutoPing: Automatic monitoring and action for failed equipment. Graceful Shutdown: attempt a soft shutdown or reboot before controlling power. Disable Off: To prevent accidental off state of an outlet. Event Scheduling: Power actions on regular intervals. (14 events) Management Utility: Easy Setup, Firmware upgrades and Reset to Factory Default Easy Software Integration: Use the DxP Protocol to build your own custom applications. Control Software: Create batch files or Shortcuts to control power. URL control: Create your own website link to control power. API control: Control and setup Utalizing the cloud registration *API protocol is detailed in a separate document iBoot-G2S 1. Table of Contents 1. Table of Contents .................................... 1 8. iBoot Cloud Service .............................. 27 2.
    [Show full text]
  • An Analysis on Ios Jailbreak
    An analysis on iOS Jailbreak 1. Introduction • What is iOS Jailbreak iOS is Apple's mobile operating system, which is derived from Mac OS X, with which it shares the Darwin foundation, and is therefore a Unix-like operating system. Being developed originally for the iPhone, it then has been used on the iPod Touch, iPad and Apple TV as well. So in this report iOS is specifically refer to the mini-operation system that run on the iDevices (iPhone, iPod, iPad and Apple TV. In this little apple operation system, there are four abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer, which in total will roughly use 500 megabytes of the devices’ storage. For security and commercial reasons and considerations, Apple does not permit the OS to run on third- party hardware and also has a limitation on the usage of iOS on these iDevices. Therefore iOS has been subject to a variety of different hacking methods focusing on attaching functionality not supported by Apple. This hacking procedure is called iOS Jailbreak. • Why to Jailbreak—a Self-redemption Jailbreaking is a process that allows these iDevices users to gain the root access to the command line of the iOS operating system, in order to remove usage and access limitations imposed by Apple. Once jailbroken, iPhone users are able to download extensions and themes that are unavailable through the App Store (via installers such as Cydia) and perform other tasks that are not possible on store-bought devices, including installing non-Apple operating systems such as Linux, running multi-task on old version of iDevices (the new Generation of store-bought devices includes this function).
    [Show full text]
  • Ios-Security-Guide.Pdf
    iOS Security iOS 9.3 or later May 2016 Contents Page 4 Introduction Page 5 System Security Secure boot chain S y s t e m S o f t w a r e A uthorization S e c u r e E n c l a v e T o u c h I D Page 10 Encryption and Data Protection Hardware security features File Data Protection Passcodes Data Protection classes Keychain Data Protection Access to Safari saved passwords Keybags Security Certifications and programs Page 18 App Security App code signing Runtime process security Extensions App Groups Data Protection in apps Accessories HomeKit HealthKit Secure Notes Apple Watch Page 28 Network Security TLS VPN Wi-Fi Bluetooth Single Sign-on AirDrop security Page 32 Apple Pay Apple Pay components How Apple Pay uses the Secure Element How Apple Pay uses the NFC controller Credit and debit card provisioning Payment authorization Transaction-specific dynamic security code Contactless payments with Apple Pay Paying with Apple Pay within apps Rewards cards Suspending, removing, and erasing cards iOS Security—White Paper | May 2016 2 Page 39 Internet Services A p p l e I D i M e s s a g e F a c e T i m e i C l o u d i C l o u d K e y c h a i n S i r i C o n t i n u i t y Spotlight Suggestions Page 52 Device Controls Passcode protection i O S p a i r i n g m o d e l Configuration enforcement Mobile device management (MDM) Shared iPad Apple School Manager D e v i c e E n r o l l m e n t Apple Configurator 2 Supervision Restrictions R e m o t e W ipe Lost Mode Activation Lock Page 59 Privacy Controls Location Services Access to personal data P r i v a c y p o l i c y Page 60 Conclusion A commitment to security Page 61 Glossary Page 63 Document Revision History iOS Security—White Paper | May 2016 3 Introduction Apple designed the iOS platform with security at its core.
    [Show full text]
  • Ios Security Decoded.Key
    iOS Security Decoded Dave Test Classroom and Lab Computing Penn State ITS Feedback - http://j.mp/psumac33 Why care about iOS Security? 800M • 800 million iOS 600M devices activated 400M • 130 million in last year 200M • 98% of Fortune 500 0M Sep '10 Oct '11 Mar '12 Sep '12 Jan '13 Jun '13 Oct '13 Jun '14 Definitions Public and Private Keys Certificate AES-256 Definitions Public and Private Keys • Two mathematically linked keys • One is public and can be used to encrypt data • One is private and can be used by the recipient to decrypt data. ! Definitions AES-256 and SHA-1 • Two specs for encrypting data • AES-256 generates 256 bit keys • SHA-1 generates 160 bit keys ! Definitions Certificates and Certificate Authorities • A certificate is an electronic document used to prove the ownership of a public key. • A certificate authority (CA) is a trusted group who digitally signs a certificate to signify its veracity. ! iOS Security Decoded Secure Boot Chain Hardware Security Software Security Network Security Best Practices Secure Boot Chain � Starts at power on. Each step verifies the next. If any step fails, device enters Device Firmware Upgrade (DFU) mode. Secure Boot Chain Step 1 - Boot ROM ! • Implicitly trusted • Cannot be changed • Verifies signature of next Low-Level Bootloader via embedded Apple Root CA public key • Runs Low-Level Bootloader ! Secure Boot Chain Step 2 - Low-Level Bootloader (LLB) ! • Lowest level of code on device that can be updated • Verifies signatures of firmware and iBoot • Runs iBoot Secure Boot Chain Step 3 - iBoot ! • Verifies signature of iOS Kernel (XNU) • Starts kernel • If kernel verification fails, device goes into Recovery Mode (Connect to iTunes Mode) Secure Boot Chain Baseband and Secure Enclave have their own secure boot chain processes which run before the kernel is loaded.
    [Show full text]
  • Assurance Activity Report for Apple Filevault 2 on T2 Systems Running Macos Catalina 10.15
    Assurance Activity Report for Apple FileVault 2 on T2 systems running macOS Catalina 10.15 Apple FileVault 2 on T2 systems running macOS Catalina 10.15 Security Target Version 2.5 collaborative Protection Profile for Full Drive Encryption – Authorization Acquisition, Version 2.0e collaborative Protection Profile for Full Drive Encryption – Encryption Engine, Version 2.0e AAR Version 1.9, April 2021 Evaluated by: 2400 Research Blvd, Suite 395 Rockville, MD 20850 Prepared for: National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme 1 © 2021 Apple Inc., All rights reserved. This document may be reproduced and distributed only in its original entirety without revision. The Developer of the TOE: Apple Inc. The Author of the Security Target: Acumen Security, LLC. The TOE Evaluation was Sponsored by: Apple Inc. Evaluation Personnel: Danielle Canoles Rutwij Kulkarni Dayanandini Pathmanathan Acumen Security, LLC. Common Criteria Version Common Criteria Version 3.1 Revision 5 Common Evaluation Methodology Version CEM Version 3.1 Revision 5 2 © 2021 Apple Inc., All rights reserved. This document may be reproduced and distributed only in its original entirety without revision. Revision History VERSION DATE CHANGES 1.0 November 2020 Initial Release 1.1 December 2020 Update based on updated ST 1.2 January 2021 Internal Review 1.3 February 2021 Updates based on updated ST and AGD 1.4 March 2021 Internal Review 1.5 March 2021 Updates based on updated vendor documents 1.6 March 2021 Updates based on updated ST 1.7 April 2021 Updates based on validator feedback 1.8 April 2021 Updates bases on validator feedback 1.9 April 2021 Updates bases on validator feedback 3 © 2021 Apple Inc., All rights reserved.
    [Show full text]
  • Processing Iphones Richard Gilleland Sacramento Police Department [email protected]
    Processing iPhones Richard Gilleland Sacramento Police Department [email protected] This document describes the Jonathan Zdziarski method for processing iPhones. Jonathan Zdziarski has designed a number of tools (along with great documentation) that can be used to both remove the passcode from an iPhone as well as to image an iPhone. Zdziarski offers his tools and documentation free to law enforcement through his website which is located at ‘www.iphoneinsecurity.com/’. Once an account has been established at iphonesecurity.com, users have access to the tools and documentation that Zdziarski has created. Access to these tools is necessary to process iPhones using this method. I highly recommend reading ‘iPhone Forensic Investigative Methods.pdf’ by Zdziarski for a comprehensive description of processing iPhones. This document is not meant to take the place of Zdziarski’s comprehensive publication, it is simply meant to provide a short / detailed description for processing iPhones. Prior to processing an iPhone, its firmware version must first be established. An iPhone’s firmware can be determined in both a Windows environment and a Mac environment. The following steps can be used to determine the phones firmware version in a Windows environment. Go to page 6 of this document for instructions in a Mac environment. Page 2 Determining iPhone Firmware Version - Windows Page 6 Determining iPhone Firmware Version - Mac Page 10 Removing the iPhone's Pass Code Page 15 Imaging the iPhone Page 23 Working with the Image File Pages 27 / 28 Cheat Sheets 1 Determining iPhone Firmware Version Firmware determined using Windows XP OS; System requirements; Windows XP iTunes (I used version 9.1.1.12 for this test) Internet access (* This method may not work for Vista and Windows 7 systems) 1.
    [Show full text]
  • XNU: a Security Evaluation XNU: a Security Evaluation
    XNU: a security evaluation XNU: a security evaluation D Keuper (s1019775) University of Twente and Certified Secure December 13, 2012 Abstract The XNU kernel is the kernel that powers Apple's OS X and iOS operating system. Originally developed by Next, but later acquired by Apple it has been around for more then twenty years. It is only since the introduction of code signing on iOS that hackers have developed a real interest in XNU. Prior to iOS 2.0 only a handful of articles were published on XNU in the context of security. In the past few years the interest of hackers increased by the popularity of jailbreaking (the process of removing the security restrictions of iOS) and iOS security is often discussed at the various security conferences. The interest of hackers in the XNU kernel has not gone unnoticed by Apple, which started to harden the security of their XNU kernel. In the latest releases of their operating systems they added different mitigation techniques such as kernel ASLR. The latest release of OS X (Mountain Lion) and iOS (6) are hardened with new protection mechanisms, which should reduce the risk of successful exploitation. In this thesis we describe all techniques that are meant to protect the kernel from attackers and their implementation. We argue the effectiveness of those techniques and how an attacker might try to circumvent them. We conclude this thesis with a comparison with other kernels, our opinion on the current security state of the XNU kernel and some recommendations on how to further improve the security.
    [Show full text]
  • Ivan Krstić Head of Security Engineering and Architecture, Apple
    Behind the Scenes of iOS and Mac Security Ivan Krstić Head of Security Engineering and Architecture, Apple Mac secure boot iOS code integrity protection Find My Mac secure boot iOS code integrity protection Find My Gatekeeper User Privacy Protection Gatekeeper macOS Catalina First use, quarantined First use, quarantined Non-quarantined Malicious content scan No known malicious content No known malicious content No known malicious content Signature check No tampering No tampering − All new software requires All new software requires Local policy check − notarization notarization Users must approve First launch prompt User must approve − software in bundles User Data Protections Data that requires user consent to access Contacts Calendars Reminders Photos User Data Protections Data that requires user consent to access Contacts Calendars Reminders Photos User Data Protections Data that requires user consent to access Contacts Desktop Calendars Documents Reminders Downloads Photos iCloud Drive Third-party cloud storage Removable volumes Network volumes What about secure boot? Apple Requirement UEFI Signature verification of complete boot chain System Software Authorization (server-side downgrade protection) Authorization “personalized” for the requesting device (not portable) User authentication required to downgrade secure boot policy Secure boot policy protected against physical tamper System can always be restored to known-good state Mac Secure Boot T2 Mac Secure Boot T2 x86 Mac Secure Boot T2 x86 Mac Secure Boot T2 x86 UEFI T2 ROM iBoot
    [Show full text]