Originated: November 25, 2015
********************************************************************************

Patch-164118: Patch for OneFS 7.2.0.4. This patch addresses an issue with
OpenSSH where repeated login attempts could exceed configured settings and
allow a remote attack to occur.  

--------------------------------------------------------------------------------

This patch can be installed on clusters running the following OneFS version: 
7.2.0.4

********************************************************************************

RESOLVED ISSUES 

* Bug ID 158882
  OpenSSH versions earlier than 6.9p1-2 allowed successive login attempts that
  exceeded the configured limits when keyboard-interactive challenge-response
  authentication was used. This allowed a remote attacker to perform a
  brute-force attack or cause a denial of service.
  
  NOTE:  Although the vulnerability is fixed, OneFS is still running a version
  OpenSSH prior to 6.9. As such, signature-based security scanners that check
  only the reported version of OpenSSH may still incorrectly report that
  systems containing this fix are vulnerable. These reports should be
  considered "false positives" and can safely be ignored.

  For more information, see article 207853 on the EMC Online Support site.
 
********************************************************************************

CHANGED FILES

* /usr/sbin/sshd
  (MD5 = d481856554815a3e126f8d9ced864420)

********************************************************************************

INSTALLATION/REMOVAL IMPACTS

Before installation or removal of this patch, all SSH connections to the
cluster must be manually closed. After installation or removal, all SSH
connections must be manually restarted.

********************************************************************************

IMPORTANT!  
VERIFY CLUSTER-FREE SPACE
If there is insufficient free space and you attempt to install or remove a
patch, the process might not complete successfully. An incomplete patch
installation or patch removal can leave the cluster in an inaccessible state.

Before installing or removing a patch, verify that your cluster has enough
free space to perform the procedure. For more information about maintaining
sufficient free space on an Isilon cluster, see the Best Practices Guide for
Maintaining Enough Free Space on Isilon Clusters and Pools:
https://support.emc.com/docu48119.

********************************************************************************

INSTALLING THIS PATCH

IMPORTANT!
Read INSTALLATION/REMOVAL IMPACTS before performing this procedure.
   
1. Verify that your cluster has enough free space to install this patch.

2. Open an SSH connection on any node in the cluster and log in by using the
   root account.

   NOTE: If the patch is being installed on a compliance mode cluster, log in
   using the compadmin account.

3. Copy the patch-164118.tgz file to the /ifs/data directory on the cluster.

4. Run the following command to change to the /ifs/data directory:
   
   cd /ifs/data

5. To extract the patch file, run the following command:

   tar -zxvf patch-164118.tgz

6. To install this patch, run the following command:

   isi pkg install patch-164118.tar

7. To verify that this patch is installed, run the following command:
  
   isi pkg info

8. Confirm that patch-164118 appears in the list of installed packages.

********************************************************************************

REMOVING THIS PATCH

If you need to remove this patch, complete the steps below.

IMPORTANT!
Read INSTALLATION/REMOVAL IMPACTS before performing this procedure.

1. Verify that your cluster has enough free space to remove this patch.

2. Open an SSH connection on any node in the cluster and log in using the root
   account.

   NOTE: If the patch is being removed from a compliance mode cluster, log in
   using the compadmin account.

3. To remove this patch, run the following command:

   isi pkg delete patch-164118

4. To verify that this patch was removed, run the following command:

   isi pkg info

5. Confirm that patch-164118 does not appear in the list of installed packages.

********************************************************************************
