Hello, please I already have a private cloud environment built on 3 physical servers based on Openstack (Juno), and also have another private cloud environment built on 2 physical servers based on CloudStack. I want to know how to implement an access control model to control the cloud resources, for example a database on the cloud.
Any helpful answer will be appreciated.
Not sure I fully understand your question; but, in general, you can access the private clouds over VPN, where you allocate different ip ranges to each cloud...
You could implement MAC (Mandatory Access Control) on the cloud servers operating system. I would recommend SELinux or TrustedBSD with a "targeted" policy only for specific cloud-related services. Additionally you could use Oracle databases instead of My/pgSQL databases and implement MAC there too, which is quite complicated though.
Regarding the cloud software itself I would recommend a well implemented IM (identity management), with directory servers (e.g. OpenDirectoy), secure protocols (crypted LDAP, Kerberos) and RBAC (e.g. for API protection) within the system ([1] http://docs.openstack.org/admin-guide/identity-service-api-protection.html).
In addition to that you could implement RBAC-support within the Linux kernel with grsecurity and also apply memory protection with PaX. Note that Linux by default only provides you with DAC (Discretionary Access Control).
Bottom line: you have to implement access control within your OS and your cloud services alike.
- Badges
- Science method