Back to Checks
openstack

Images have cryptographic signature verification enabled

image_signature_verification_enabled
Service: imageSeverity: high
OfficialBuilt-inVerified
Categories:encryptiontrust-boundaries
Resource Type:OS::Glance::WebImage

OpenStack images are evaluated to verify that all four signature properties are configured: img_signature, img_signature_hash_method, img_signature_key_type, and img_signature_certificate_uuid. Signed images allow Nova to verify integrity before booting, detecting tampering or corruption.

Prowler logoProwlerprowler-provider-openstack

Risk

Unsigned images can be tampered with to inject backdoors, malware, or rootkits without detection. Without signature verification, compromised storage backends or man-in-the-middle attacks can modify images between upload and boot. Nova cannot verify the integrity of unsigned images, allowing corrupted or malicious images to be launched.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks image_signature_verification_enabled

Recommendation

Sign all production images using Barbican-managed certificates. Enable signature verification in Nova (verify_glance_signatures=True). Implement an image signing pipeline in CI/CD. Regularly rotate signing certificates and audit image signatures.

Remediation

Other

1*Sign images using Barbican:**
2Create a signing key and certificate in Barbican
3Sign the image data with the private key
4Upload the image with signature properties:
5`openstack image create --property img_signature=<base64_signature> --property img_signature_hash_method=SHA-256 --property img_signature_key_type=RSA-PSS --property img_signature_certificate_uuid=<barbican_cert_uuid> <image_name>`
6Configure Nova to verify signatures: set `verify_glance_signatures = True` in nova.conf

Check Code

"""OpenStack Image Signature Verification Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.image.image_client import image_client


class image_signature_verification_enabled(Check):
    """Ensure images have cryptographic signature verification properties set."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute image_signature_verification_enabled check.

        Iterates over all images and verifies that all four signature
        properties are set: img_signature, img_signature_hash_method,
        img_signature_key_type, and img_signature_certificate_uuid.

        Returns:
            list[CheckReportOpenStack]: List of findings for each image.
        """
        findings: List[CheckReportOpenStack] = []

        for image in image_client.images:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=image)

            has_all_signatures = all(
                [
                    image.img_signature,
                    image.img_signature_hash_method,
                    image.img_signature_key_type,
                    image.img_signature_certificate_uuid,
                ]
            )

            if has_all_signatures:
                report.status = "PASS"
                report.status_extended = f"Image {image.name} ({image.id}) has all signature verification properties configured."
            else:
                report.status = "FAIL"
                report.status_extended = f"Image {image.name} ({image.id}) does not have all signature verification properties configured."

            findings.append(report)

        return findings

References