Product Support Notice

Transcription

1 PSN # PSN027026u Product Support Notice 2015 Avaya Inc. All Rights Reserved. Avaya Proprietary Use pursuant to the terms of your signed agreement or company policy. Original publication date: 18-Dec-15. This is Issue #03, published date: 5-Jul-17. Name of problem Access Security Gateway keys update. Products affected Avaya Aura System Platform Releases x Problem description This problem occurs in all Avaya Aura System Platform Releases prior to Severity/risk level Medium Urgency Immediately Access Security Gateway keys update. In keeping with NIST guidelines and industry best practices, Avaya is rotating the security keys associated with remote maintenance access through the Access Security Gateway (ASG). Resolution This problem is resolved in System Platform Service Pack and higher Service Packs/Releases. Note: A complete resolution for solutions deployed on Avaya Aura System Platform requires that remediation must be performed in the following order: 1. Remediate the individual Virtual Machines (VMs) running on System Platform first (activate the Service Pack or patch or hot fix refer to the individual VM s product documentation). 2. Remediate System Platform via the steps detailed below. The following procedure should be applied to any System Platform x through 6.3.x. Execution of the procedure will result in a restart of Tomcat, therefore access to the cdom Webconsole will be momentarily disrupted. There will be no service impact to the Virtual Machines running in the template during application of the System Platform remediation. This procedure should not be performed when any other activities are taking place via the cdom Webconsole (e.g., patching, platform upgrade, HA configuration, etc.). Releases prior to System Platform x are end of bug-fix support and software fixes are not provided for end of bug-fix support releases. The Avaya Product Lifecycle Policy can be referenced for additional details. Special Instructions for High Availability Systems: For Avaya Aura Solution for Midsize Enterprise (ME) HA systems, please stop and remove HA prior to remediation. For all other systems that have High Availability configured via the System Platform Webconsole, you do not need to stop and remove HA. However, you MUST ensure that the system is fully synced prior to proceeding with the scripted installation. The scripted install should be applied to the active server s cdom and dom0, and to the standby server s dom0. Download the System Platform ASG Executable Installer from PLDS & Unpack the zip file This self-extracting executable script is posted on PLDS under System Platform, PLDS Download ID SP Scripted Installation Procedure for System Platform ASG Keys Update, asg-installer-1.0.bsx 1. Copy the asg-installer-1.1.bsx file to the /tmp directory on cdom and verify the md5sum. Note that you will need to utilize a tool such as WinSCP to copy the file to cdom. Verify the md5sum. For example: [admin@ha1cdom tmp]# asg-installer-1.1.bsx bfed184d1e02b9cfa0f953514aa2fec4 asg-installer-1.1.bsx 2. On cdom, become super user (note that customers own the root login on System Platform) [admin@ha1cdom ~]$ su -

2 Using major release number R016x on System Platform Password: Last login: Thu May 14 17:36:01 MDT 2015 on cron ~]# 3. Change to the /tmp directory ~]# cd /tmp 4. Run the self-extracting installer tmp]# sh./asg-installer-1.1.bsx Self Extracting Installer./Messages.properties./asgtools-2-0.AV13sp.x86_64.rpm./installer./updateIso./update_authfile Running ASG Installer Preparing... ########################################### [100%] 1:asgtools ########################################### [100%] Shutting down tomcat: done. Starting tomcat: done. 5. Verify the fix was applied correctly by executing the following command. The version of the asgtools rpm should be as follows: tmp]# rpm qa grep asg asgtools-2-0.av13sp 6. Execute the same steps 1-5 on dom0. Loading new authorization file after application of Scripted Installation Procedure for System Platform ASG Keys Update Application of the scripted installation procedure for the ASG Keys Update provides a new command on the dom0 CLI that will allow you to load a new authorization file. Loading of a new authorization file must be done via the dom0 CLI since the scripted installation procedure removes the ability to load an authorization file via the cdom webconsole. Attempts to utilize the cdom Webconsole User Management->Authentication File page will fail with an error message "Please load Authentication file manually" as noted in the screen shot below: The functionality to load an authorization file via the cdom Webconsole will be restored in System Platform and later. The following steps are necessary to load a new authorization file. 1. Access rfa.avaya.com, start the AFS application and follow the steps to obtain a new authorization file for System Platform 6.x. Ensure that you select the New System option. Do not redeliver for an existing system Avaya Inc. All Rights Reserved. Page 2

3 2. Copy that new authorization file to the /tmp directory on dom0 utilizing a tool such as winscp 3. Login to dom0 and become super user. Do NOT ssh into dom0 from cdom. Access dom0 directly. 4. Execute the following command, making sure to include the -f option. Replace [new_auth_file.xml] with the actual name of your new authorization file created on RFA/AFS. [root@ha1dom0a ~]#/opt/avaya/vsp/bin/update_authfile /tmp/[new_auth_file.xml] f [root@ha1dom0a ~]# update_authfile /tmp/new_auth_file.xml -f Updating auth file on dom0 Using major release number R016x on this product. Loading file /tmp/new_auth_file.xml Skipping certificate installation on this product, as expected. lacfile 100% 10KB 9.9KB/s 00:00 Updating auth file on cdom Using major release number R016x on this product. Loading file /tmp/lacfile Skipping certificate installation on this product, as expected. Updating env iso on aes mkisofs -o tmpl-iso-aes.iso -m tmpl-iso-aes.iso -r -T -J. INFO: UTF-8 character encoding detected by locale settings. Total translation table size: 1578 Total rockridge attributes bytes: 848 created new ISO tmpl-iso-aes.iso Block detach on aes Block attach on aes Updating env iso on cm mkisofs -o tmpl-iso-cm.iso -m tmpl-iso-cm.iso -r -T -J. Total translation table size: 1577 Total rockridge attributes bytes: 847 created new ISO tmpl-iso-cm.iso Block detach on cm Block attach on cm 2015 Avaya Inc. All Rights Reserved. Page 3

4 Updating env iso on presence_va mkisofs -o tmpl-iso-presence_va.iso -m tmpl-iso-presence_va.iso -r -T -J. Total translation table size: 1586 Total rockridge attributes bytes: 856 created new ISO tmpl-iso-presence_va.iso Block detach on presence_va Block attach on presence_va Updating env iso on services_vm mkisofs -o tmpl-iso-services_vm.iso -m tmpl-iso-services_vm.iso -r -T -J. Total translation table size: 1805 Total rockridge attributes bytes: extents written (0 MB) created new ISO tmpl-iso-services_vm.iso Block detach on services_vm Block attach on services_vm Updating env iso on sm mkisofs -o tmpl-iso-sm.iso -m tmpl-iso-sm.iso -r -T -J. Total translation table size: 1577 Total rockridge attributes bytes: 847 created new ISO tmpl-iso-sm.iso Block detach on sm Block attach on sm Updating env iso on smgr mkisofs -o tmpl-iso-smgr.iso -m tmpl-iso-smgr.iso -r -T -J. Total translation table size: 1579 Total rockridge attributes bytes: 849 created new ISO tmpl-iso-smgr.iso Block detach on smgr Block attach on smgr Updating env iso on utility_server mkisofs -o tmpl-iso-utility_server.iso -m tmpl-iso-utility_server.iso -r -T -J Avaya Inc. All Rights Reserved. Page 4

5 Total translation table size: 1589 Total rockridge attributes bytes: 859 created new ISO tmpl-iso-utility_server.iso Block detach on utility_server Block attach on utility_server 5. Workaround or alternative remediation n/a Remarks Issue 2 clarification to stop/remove HA for ME systems & updated md5sum. Issue 3 clarification that it is resolved in and higher service packs/releases. Patch Notes The information in this section concerns the patch, if any, recommended in the Resolution above. Backup before applying the patch Always Download The patch can be downloaded directly from plds.avaya.com. PLDS Download ID SP Patch install instructions Changes applied via scripted installation described above. Service-interrupting? Yes Verification As noted above in the Resolution section. Failure Contact Technical Support. Patch uninstall instructions Once activated these changes cannot be removed. Security Notes The information in this section concerns the security risk, if any, represented by the topic of this PSN. Security risks In keeping with NIST guidelines and industry best practices, Avaya is rotating the security keys associated with remote maintenance access through the Access Security Gateway. Avaya Security Vulnerability Classification Not Susceptible Mitigation n/a 2015 Avaya Inc. All Rights Reserved. Page 5

6 If you require further information or assistance please contact your Authorized Service Provider, or visit support.avaya.com. There you can access more product information, chat with an Agent, or open an online Service Request. Support is provided per your warranty or service contract terms unless otherwise specified in the Avaya support Terms of Use. Disclaimer: ALL INFORMATION IS BELIEVED TO BE CORRECT AT THE TIME OF PUBLICATION AND IS PROVIDED AS IS. AVAYA INC., ON BEHALF OF ITSELF AND ITS SUBSIDIARIES AND AFFILIATES (HEREINAFTER COLLECTIVELY REFERRED TO AS AVAYA ), DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND FURTHERMORE, AVAYA MAKES NO REPRESENTATIONS OR WARRANTIES THAT THE STEPS RECOMMENDED WILL ELIMINATE SECURITY OR VIRUS THREATS TO CUSTOMERS SYSTEMS. IN NO EVENT SHALL AVAYA BE LIABLE FOR ANY DAMAGES WHATSOEVER ARISING OUT OF OR IN CONNECTION WITH THE INFORMATION OR RECOMMENDED ACTIONS PROVIDED HEREIN, INCLUDING DIRECT, INDIRECT, CONSEQUENTIAL DAMAGES, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF AVAYA HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE INFORMATION PROVIDED HERE DOES NOT AFFECT THE SUPPORT AGREEMENTS IN PLACE FOR AVAYA PRODUCTS. SUPPORT FOR AVAYA PRODUCTS CONTINUES TO BE EXECUTED AS PER EXISTING AGREEMENTS WITH AVAYA. All trademarks identified by or TM are registered trademarks or trademarks, respectively, of Avaya Inc. All other trademarks are the property of their respective owners Avaya Inc. All Rights Reserved. Page 6