Security Bulletin: IBM Spectrum Scale Object Protocols functionality (Linux Standard and Advanced) is affected by security vulnerabilities in the TLS and SSL protocols (CVE-2015-2808 and CVE-2014-3566)

Workarounds and Mitigations

This procedure is applicable only if :
- Your cluster is running IBM Spectrum Scale V4.2.0.0 thru V4.2.0.4, or V4.2.1.0 thru V4.2.1.1
- Object is enabled
- Object Authentication is set to local, ad, or ldap
- SSL is enabled for Keystone

The following steps need to be issued from the protocol node where object is running:

1. Create a copy of the wsgi-keystone.conf file:

cp /etc/httpd/conf.d/wsgi-keystone.conf /tmp/

2. Update the /tmp/wsgi-keystone.conf file to add following two lines in virtual hosts for keystone:

SSLProtocol All -SSLv2 -SSLv3
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT

The updated /tmp/wsgi-keystone.conf file will look similar to the following:

WSGISocketPrefix /var/run/wsgi
SetEnv APACHE_RUN_USER keystone
SetEnv APACHE_RUN_GROUP keystone
LoadModule ssl_module modules/mod_ssl.so
<VirtualHost *:5000>
SSLEngine on
SSLCertificateFile /etc/keystone/ssl/certs/ssl_cert.pem
SSLCertificateKeyFile /etc/keystone/ssl/private/ssl_key.pem
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT
SSLProtocol All -SSLv2 -SSLv3
WSGIDaemonProcess keystone-public processes=5 threads=1 user=keystone group=keystone display-name=keystone-public
WSGIProcessGroup keystone-public
WSGIImportScript /var/www/cgi-bin/keystone/main process-group=keystone-public application-group=%{GLOBAL}
WSGIScriptAlias / /var/www/cgi-bin/keystone/main
ErrorLog /var/log/keystone/httpd-error.log
LogLevel info
CustomLog /var/log/keystone/httpd-access.log combined
LimitRequestBody 16384
</VirtualHost>
Listen 35357
<VirtualHost *:35357>
SSLEngine on
SSLCertificateFile /etc/keystone/ssl/certs/ssl_cert.pem
SSLCertificateKeyFile /etc/keystone/ssl/private/ssl_key.pem
SSLCipherSuite ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!SSLV3:!EXPORT
SSLProtocol All -SSLv2 -SSLv3
WSGIDaemonProcess keystone-admin processes=5 threads=1 user=keystone group=keystone display-name=keystone-admin
WSGIProcessGroup keystone-admin
WSGIImportScript /var/www/cgi-bin/keystone/main process-group=keystone-admin application-group=%{GLOBAL}
WSGIScriptAlias / /var/www/cgi-bin/keystone/admin
ErrorLog /var/log/keystone/httpd-error.log
LogLevel info
CustomLog /var/log/keystone/httpd-access.log combined
LimitRequestBody 16384


3. Upload the wsgi-keystone.conf file to the cluster configuration repository:

mmccr fput wsgi-keystone.conf /tmp/wsgi-keystone.conf

The fix will be in effect after restarting object services on protocol nodes. One can choose to restart object service on all nodes(Step 4a) or restart services on all nodes one node at a time(Step 4b).

4a. Stop and Start Object services on all nodes:

/usr/lpp/mmfs/bin/mmces service stop obj -a
/usr/lpp/mmfs/bin/mmces service start obj -a


4b. Stop and Start Object services on one node at a time for all nodes in a cluster:

/usr/lpp/mmfs/bin/mmces service stop obj -N nodename
/usr/lpp/mmfs/bin/mmces service start obj -N nodename


Notes :
1. After authentication reconfiguration or disabling and re-enabling object, steps need to rerun.
2. If the keystone.conf parameter was updated using the mmobj config change command, then object services need to restarted to have the changes take affect.