Changes between Version 2 and Version 3 of GENIRacksHome/InstageniRacks/AcceptanceTestStatus/IG-ADM-2


Ignore:
Timestamp:
05/12/12 09:05:43 (7 years ago)
Author:
chaos@bbn.com
Comment:

--

Legend:

Unmodified
Added
Removed
Modified
  • GENIRacksHome/InstageniRacks/AcceptanceTestStatus/IG-ADM-2

    v2 v3  
    55''This page is GPO's working page for performing IG-ADM-2.  It is public for informational purposes, but it is not an official status report.  See [wiki:GENIRacksHome/InstageniRacks/AcceptanceTestStatus] for the current status of InstaGENI acceptance tests.''
    66
    7 ''Last substantive edit of this page: 2012-05-08''
     7''Last substantive edit of this page: 2012-05-12''
    88
    99== Page format ==
     
    3535|| 3B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 3A ||
    3636|| 3C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 3A ||
    37 || 4A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to infrastructure VM server ||
     37|| 4A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to FlowVisor VM ||
    3838|| 4B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 4A ||
    3939|| 4C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 4A ||
    40 || 5A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on sudo access to boss; allocation of OpenVZ node ||
     40|| 5A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to infrastructure VM server ||
    4141|| 5B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 5A ||
    4242|| 5C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 5A ||
    43 || 6A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to switches   ||
    44 || 6B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 6A                        ||
    45 || 6C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 6A                        ||
    46 || 6D         || [[Color(orange,Blocked)]] ||                      ||               || blocked on serial access to switches ||
     43|| 6A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on sudo access to boss; allocation of OpenVZ node ||
     44|| 6B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 6A ||
     45|| 6C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 6A ||
    4746|| 7A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to switches   ||
    4847|| 7B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 7A                        ||
    4948|| 7C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 7A                        ||
    5049|| 7D         || [[Color(orange,Blocked)]] ||                      ||               || blocked on serial access to switches ||
    51 || 8          || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to rack iLO ||
     50|| 8A         || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to switches   ||
     51|| 8B         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 8A                        ||
     52|| 8C         || [[Color(orange,Blocked)]] ||                      ||               || blocked on 8A                        ||
     53|| 8D         || [[Color(orange,Blocked)]] ||                      ||               || blocked on serial access to switches ||
     54|| 9          || [[Color(orange,Blocked)]] ||                      ||               || blocked on access to rack iLO ||
    5255
    5356== High-level description from test plan ==
     
    178181 * The command which was run should be recorded in a log
    179182
    180 == Step 4: verify access to rack infrastructure VM server host ==
    181 
    182 === Step 4A: verify that SSH to foam succeeds and allows public keys only ===
     183== Step 4: verify access to rack FlowVisor node ==
     184
     185=== Step 4A: verify that SSH to FlowVisor succeeds and allows public keys only ===
     186
     187'''Using:'''
     188 * SSH to `chaos@flowvisor.instageni.gpolab.bbn.com` from outside of the rack using public-key SSH
     189 * SSH to `chaos@flowvisor.instageni.gpolab.bbn.com` from outside of the rack using password-based SSH
     190
     191'''Verify:'''
     192 * Public-key SSH succeeds
     193 * Password-based SSH does not succeed
     194
     195=== Step 3B: verify the absence of common unencrypted login protocols ===
     196
     197'''Using:'''
     198 * Use netstat to enumerate the network-listening processes running on foam
     199 * Identify each process and determine whether it is a common unencrypted login protocol
     200 * For any unencrypted login protocols found to be listening, try to access the relevant port remotely and determine whether login is possible
     201
     202'''Verify:'''
     203 * No unencrypted login protocols are listening on accessible networks
     204 * Login does not succeed via any unencrypted login protocol
     205
     206=== Step 4C: verify sudo and sudo logging ===
     207
     208'''Using:'''
     209 * On flowvisor, run: `sudo whoami`
     210 * Look for a syslog file containing a record of the sudo command which was run
     211
     212'''Verify:'''
     213 * The sudo command should succeed
     214 * The command which was run should be recorded in a log
     215
     216== Step 5: verify access to rack infrastructure VM server host ==
     217
     218=== Step 5A: verify that SSH to foam succeeds and allows public keys only ===
    183219
    184220'''Using:'''
     
    190226 * Password-based SSH does not succeed
    191227
    192 === Step 4B: verify the absence of common unencrypted login protocols ===
     228=== Step 5B: verify the absence of common unencrypted login protocols ===
    193229
    194230'''Using:'''
     
    201237 * Login does not succeed via any unencrypted login protocol
    202238
    203 === Step 4C: verify sudo and sudo logging ===
     239=== Step 5C: verify sudo and sudo logging ===
    204240
    205241'''Using:'''
     
    211247 * The command which was run should be recorded in a log
    212248
    213 == Step 5: verify access to experimental OpenVZ node ==
    214 
    215 === Step 5A: verify that SSH to experimental OpenVZ node succeeds and allows public keys only on public IPs ===
     249== Step 6: verify access to experimental OpenVZ node ==
     250
     251=== Step 6A: verify that SSH to experimental OpenVZ node succeeds and allows public keys only on public IPs ===
    216252
    217253'''Using:'''
     
    223259 * Password-based SSH does not succeed from outside of the rack
    224260
    225 === Step 5B: verify the absence of common unencrypted login protocols ===
     261=== Step 6B: verify the absence of common unencrypted login protocols ===
    226262
    227263'''Using:'''
     
    234270 * Login does not succeed via any unencrypted login protocol
    235271
    236 === Step 5C: verify sudo and sudo logging ===
     272=== Step 6C: verify sudo and sudo logging ===
    237273
    238274'''Using:'''
     
    244280 * The command which was run should be recorded in a log
    245281
    246 == Step 6: verify access to control network switch ==
    247 
    248 === Step 6A: verify SSH access ===
     282== Step 7: verify access to control network switch ==
     283
     284=== Step 7A: verify SSH access ===
    249285
    250286'''Using:'''
     
    254290 * SSH login succeeds
    255291
    256 === Step 6B: verify privileged access to the control network switch ===
     292=== Step 7B: verify privileged access to the control network switch ===
    257293
    258294'''Using:'''
     
    266302 * Viewing the MAC address table should succeed
    267303
    268 === Step 6C: verify absence of unencrypted login access ===
     304=== Step 7C: verify absence of unencrypted login access ===
    269305
    270306'''Using:'''
     
    280316 * No other services appear to allow remote unencrypted authentication
    281317
    282 === Step 6D: verify serial console access to the device ===
     318=== Step 7D: verify serial console access to the device ===
    283319
    284320'''Using:'''
     
    293329 * It should be possible to view the running configuration via the serial console
    294330
    295 == Step 7: verify access to dataplane switch ==
    296 
    297 === Step 7A: verify SSH access ===
     331== Step 8: verify access to dataplane switch ==
     332
     333=== Step 8A: verify SSH access ===
    298334
    299335'''Using:'''
     
    303339 * SSH login succeeds
    304340
    305 === Step 7B: verify privileged access to the dataplane switch ===
     341=== Step 8B: verify privileged access to the dataplane switch ===
    306342
    307343'''Using:'''
     
    315351 * Viewing the MAC address table should succeed
    316352
    317 === Step 7C: verify absence of unencrypted login access ===
     353=== Step 8C: verify absence of unencrypted login access ===
    318354
    319355'''Using:'''
     
    329365 * No other services appear to allow remote unencrypted authentication
    330366
    331 === Step 7D: verify serial console access to the device ===
     367=== Step 8D: verify serial console access to the device ===
    332368
    333369'''Using:'''
     
    342378 * It should be possible to view the running configuration via the serial console
    343379
    344 == Step 8: verify that iLO is not accessible via unencrypted protocols ==
     380== Step 9: verify that iLO is not accessible via unencrypted protocols ==
    345381
    346382'''Using:'''