Applicable scenario

• Product: ZCF
• Component: Cloud
• Versions: 4.8.x, 4.6.x
• Deployment topology: dual management nodes
• Trigger: Security-scan remediation requires blocking high-risk ports and upgrading OpenSSH.

Symptoms

• Block 5900, 5901, 5902, 3306, 7070, 9100, 9103, 9090, and 6379.
• Upgrade OpenSSH components.
• Incorrect port restrictions can affect internal service communication.

Determination method

1. Confirm that customer external services do not depend on the listed ports.
2. Check iptables -nvL -t mangle and ipset list after blocking.
3. Check rpm -qa | grep openssh after upgrade.

Cause

The remediation combines blocking designated high-risk ports with a security-hardening script and upgrading OpenSSH RPMs. Define allowed IPs before running the script and retain precise iptables/ipset rollback steps.

Resolution

1. Preparation

• Risk level: low.
• Disable global HA or set HA policy to a conservative mode.
• Confirm that customer external services do not use the ports to be blocked.
• Back up current ipset configuration.

2. Port blocking
3. Back up ipset:

   ipset save > /etc/sysconfig/ipset

• Expected result: Existing rules are recoverable.

2. Upload and extract the hardening script:

   tar zxvf safe_script_v4.6.tar.gz

• Expected result: The script directory is ready.

3. Enter the directory and run it:

   cd safe_script/
   bash safe.sh

• Enter the platform admin password.
• Expected result: The script interaction interface opens.

4. Select:

• 3: Restrict physical-host ports
• 1: Configure rules
• Enter:

     5900,5901,5902,3306,7070,9100,9103,9090,6379

• Press Enter for allowed IPs to allow all cluster IPs.
• Expected result: Target port restriction rules are written.

5. Enter q after blocking completes.

• Expected result: The script completes.

6. Check the result:

   iptables -nvL -t mangle
   ipset list <ZS-ALLOW-IP-*>

• Expected result: Target-port DROP rules and allowed-IP sets exist.

3. Upgrade OpenSSH
4. Upload and verify sha256 for:

• openssh-8.2.Xp1-16.p08.ky10.aarch64.rpm
• openssh-server-8.2.Xp1-16.p08.ky10.aarch64.rpm
• openssh-clients-8.2.Xp1-16.p08.ky10.aarch64.rpm
• Expected result: Packages are complete and trusted.

2. Run:

   yum localinstall -y openssh-8.2p1-16.p08.ky10.aarch64.rpm openssh-clients-8.2p1-16.p08.ky10.aarch64.rpm openssh-server-8.2p1-16.p08.ky10.aarch64.rpm

• Expected result: OpenSSH components are upgraded.

3. Check versions:

   rpm -qa | grep openssh

• Expected result: New RPMs are installed.

4. Enable platform HA.

• Expected result: The change process is complete.

Verification

• Target-port restrictions are effective in iptables -nvL -t mangle.
• Allowed rule sets exist in ipset list.
• rpm -qa | grep openssh shows upgraded packages.
• Platform services and cluster-internal communication are normal.

Risks and rollback

• Risk: Incorrect port selection or allowed scope can affect internal services.
• Risk: Mismatched OpenSSH RPMs can cause upgrade failure.
• Risk level: low.

Rollback

1. Delete an individual IP from a rule set:

   ipset del <rule_set> <ip>

2. Find a DROP rule for a port:

   iptables-save | grep ZS-SAFE-CONFIGURATION | grep "dport 9090" | grep "DROP"

3. Delete the rule:

   iptables -t mangle -D INPUT ... --dport 9090 -j DROP

4. Delete the rule set:

   ipset destroy <rule_set>

• Note: Delete iptables rules before running ipset destroy.