Scenario

• Product: ZCF
• Component: ZStack Cloud
• Version: 4.8.x
• Environment: ZStack 4.8.x, C76, dual management
• Trigger: An OpenSSH Server remote-code-execution vulnerability requires remediation.

Symptoms

• Current-node OpenSSH version is 8.7.Xp1-30.el7.x86_64.
• All nodes require remediation or mitigation.
• When direct upgrade is not possible, configuration can reduce the risk.

Assessment

1. Check openssh and openssl versions on all nodes before the change.
2. After upgrade, confirm OpenSSH is 9.9.Xp2; otherwise, confirm that LoginGraceTime 0 is set in sshd_config.
3. Verify normal sshd service and platform resource status after restart.

Cause

This procedure remediates an OpenSSH Server remote-code-execution vulnerability. Upgrade OpenSSH on all nodes, or use configuration-based mitigation when upgrade is not possible.

Resolution

1. Preparation

• Risk level: Low.
• Confirm normal resource connections.
• Disable global VM high availability.
• The procedure applies to all nodes.

2. Method 1: Upgrade OpenSSH to 9.9.Xp2
3. Check current versions:

      rpm -qa | grep openssh
      rpm -qa | grep openssl

• Expected result: Current OpenSSH and OpenSSL versions are identified.

2. If OpenSSL is not 1.1.Xs, upgrade it first:

      tar zxvf openssl1.1.1s-full.tgz && cd openssl1.1.1s-full
      bash update.sh

• Expected result: OpenSSL is upgraded to 1.1.Xs.

3. Upgrade OpenSSH:

      tar zxvf openssh-9.9p2-1.tgz && cd openssh-9.9p2-1
      yum -y --disablerepo=* update ./*rpm

• Expected result: OpenSSH is upgraded to 9.9.Xp2.

4. If Requires: crypto-policies is reported, install:

      yum -y install crypto-policies-20170816-1.git2618a6c.el7.noarch.rpm

Then run the OpenSSH upgrade command again.

• Expected result: Upgrade continues after the dependency is resolved.

5. Restart SSH:

      systemctl restart sshd.service

• Expected result: The new OpenSSH version takes effect.

6. Repeat the steps on all remaining nodes.

• Expected result: All nodes are upgraded.

3. Method 2: Configuration mitigation when upgrade is unavailable
4. Edit sshd_config:

      vi /etc/ssh/sshd_config

2. Add or modify:

      LoginGraceTime 0

3. Save and restart sshd:

      systemctl restart sshd.service

4. Apply the same configuration to all remaining nodes.

• Expected result: All nodes receive configuration-based mitigation.

4. Closeout
5. Verify normal resource connections.
6. Re-enable global VM high availability.

• Expected result: Normal platform operation is restored.

Verification

• Verify that rpm -qa | grep openssh reports 9.9.Xp2.
• Or verify that /etc/ssh/sshd_config contains LoginGraceTime 0.
• Verify normal SSH service after systemctl restart sshd.service.
• Verify normal platform resource status.

Risks and rollback

• Risk: Unmet dependencies can block OpenSSH upgrade.
• Risk: Incorrect sshd_config changes can affect SSH connectivity.
• Risk level: Low.
• No independent command-level rollback path is available. Restore the original package or backup for upgrade changes, or restore the original sshd_config for configuration mitigation.