Applicable Scenario

• Product: ZCF
• Component: ZStack Cloud
• Versions: 4.8.x and 4.6.x
• Operating system: C76
• Deployment: dual management nodes
• Trigger condition: a security scan reports CVE-2024-6387 and exposure of ZStack Cloud port 8080.

Symptoms

• OpenSSH is affected by the race-condition vulnerability CVE-2024-6387.
• ZStack Cloud port 8080 is exposed externally.
• The remediation requires both port hardening and an OpenSSH/OpenSSL upgrade.

Diagnostic Procedure

1. After port hardening, check iptables -nvxL -t mangle.
2. After the component upgrade, check the openssh/openssl versions.
3. After restarting sshd, verify host connectivity and ZStack Cloud resource status.

Cause

The remediation addresses two independent risks. The OpenSSH race-condition vulnerability requires an upgrade to 10.2.Xp1; the exposed ZStack Cloud service port 8080 requires access restrictions through the security-hardening script.

Resolution

1. Preparation

• Risk level: low.
• Disable global VM high availability.
• Back up the databases on both management nodes.
• During changes on every node, monitor connectivity.

2. Port-hardening procedure
3. Upload safe_script_4.6.x.tar.gz to a management node.
4. Extract and run the script:

   tar zxvf safe_script_v4.6.tar.gz
   cd safe_script
   bash safe.sh

• Expected result: the security-hardening menu opens.

3. Select 3 -> 1 in the menu to restrict port 8080.

• Note: unless additional requirements apply, press Enter at the IP allowlist prompt.
• Expected result: external access to 8080 is restricted.

4. Check the rule:

   iptables -nvxL -t mangle

• Expected result: the port-hardening rule has taken effect.

3. OpenSSH / OpenSSL upgrade procedure
4. Check current versions:

   rpm -qa | grep openssh
   rpm -qa | grep openssl

• Expected result: the current version baseline is confirmed.

2. Upload the upgrade package to /root on every node and prepare a directory:

   mkdir openssh-10.2.p1
   mv openssh-10.2p1-1.el7.tar.gz openssh-10.2.p1
   cd openssh-10.2.p1
   tar -xvf openssh-10.2p1-1.el7.tar.gz

• Expected result: the upgrade package is extracted.

3. Perform the upgrade:

   yum --disablerepo=* --enablerepo=zstack-mn install ./*rpm

• Expected result: OpenSSH/OpenSSL is upgraded successfully.

4. Check the versions again:

   rpm -qa | grep openssh
   rpm -qa | grep openssl

• Expected result: the versions are updated to the target range.

5. Restart sshd:

   systemctl restart sshd.service

• Expected result: the new versions take effect.

6. Upgrade the remaining nodes one by one using the same procedure.
7. After all nodes are complete, confirm that resources are connected normally and enable global VM high availability.

• Expected result: remediation is complete.

Verification

• Verify that an 8080 rule exists in iptables -nvxL -t mangle.
• Verify that rpm -qa | grep openssh and rpm -qa | grep openssl show the target versions.
• Verify that connectivity is normal after sshd restarts.
• Verify that platform resources and workloads operate normally.

Risks and Rollback

• Risk: an incorrect port allow rule can affect platform API reachability.
• Risk: an OpenSSH/OpenSSL upgrade issue can affect remote login.
• Risk level: low.
• Rollback:

1. Use the security-hardening script to restore the port configuration.
2. Roll back OpenSSH:

     yum remove openssh-askpass openssh-debuginfo
     yum --disablerepo=* --enablerepo=zstack-mn downgrade openssh*

3. Restore the previous version on each node in sequence.