Applicable scenario

• Product: ZCF
• Component: Cloud
• Versions: 4.8.x, 4.6.x
• Deployment topology: dual management nodes
• Trigger: A vulnerability scan finds exposed go-pprof and etcd ports and unauthorized Redis access.

Symptoms

• The environment has:
• poc-yaml-go-pprof-leak
• poc-yaml-etcd-unauth
• Unauthorized Redis access
• Remediation focuses on:
• 9091
• 2379
• Redis authentication configuration

Determination method

1. Confirm normal resource state before remediation.
2. After port hardening, check platform access and management-network connectivity.
3. After Redis remediation, verify that the UI works normally and Redis requires a password.

Cause

The environment has both externally exposed service ports and unauthorized Redis access. Remediation must cover network access control and service-configuration hardening.

Resolution

1. Preparation

• Risk level: medium.
• Check connection states of all resources.
• Disable global VM HA.
• Back up databases on both management nodes.

2. Port-hardening procedure
3. Upload safe_script_4.6.x to the management node.

• Expected result: The hardening script environment is ready.

2. Extract and run:

   tar zxvf safe_script_v4.6
   bash safe.sh

• Enter the management-node password.
• Expected result: The hardening menu opens.

3. Select port restriction 3, then enter:

   9091,2379

• Expected result: Target ports enter the rule configuration workflow.

4. Allow required IPs.

• Press Enter to select the current management-node IP, but confirm the actual required allowed scope for the environment.
• Expected result: Normal traffic is not blocked accidentally.

3. Remediate unauthorized Redis access
4. Perform the following operations on both management nodes.
5. Stop the UI:

   zstack-ctl stop_ui

• Expected result: Redis and UI configuration can be changed safely.

3. Back up Redis configuration:

   cp /etc/redis.conf /etc/redis.conf_bak

• Expected result: A rollback file is retained.

4. Modify /etc/redis.conf and set a strong password for requirepass.

• Expected result: Redis no longer allows unauthorized access.

5. Synchronize the Redis password on the UI side:

   zstack-ctl config_ui --redis-password ZStackp@ssw0rd

• Expected result: The UI and Redis use the same new password.

6. Start the UI:

   zstack-ctl start_ui

• Expected result: The management platform resumes operation.

4. Completion
5. Check that all resource states are normal.
6. Enable global VM HA.

• Expected result: The platform resumes normal operation.

Verification

• Platform access and management-network connectivity are normal.
• 9091 and 2379 are controlled.
• Redis configuration takes effect and unauthorized access fails.
• The UI service is normal.

Risks and rollback

• Risk: Incorrect port-hardening configuration can affect platform access.
• Risk: If the UI password is not synchronized after a Redis password change, the management platform can become abnormal.
• Risk level: medium.
• Rollback:

1. Restore port hardening through the script rollback function.
2. To roll back Redis, stop the UI, restore /etc/redis.conf_bak, then start the UI.