<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>See, this sort of thing:</div>
<div><br>
</div>
<div>"<span style="color: rgb(51, 51, 51); font-family: AvenirNext-Regular, Avenir, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px;">A security vulnerability has been identified in the current levels of IBM Spectrum Scale V4.1.1 thru 4.1.1.3
and V4.2.0.0 that could allow a local unprivileged user,</span></div>
<span style="color: rgb(51, 51, 51); font-family: AvenirNext-Regular, Avenir, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px;">or a user with network access to the IBM Spectrum Scale cluster, to access admin passwords for object storage infrastructure.</span><br style="color: rgb(51, 51, 51); font-family: AvenirNext-Regular, Avenir, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px; max-width: 100% !important;">
<span style="color: rgb(51, 51, 51); font-family: AvenirNext-Regular, Avenir, 'Helvetica Neue', Helvetica, Arial, sans-serif; font-size: 16px;">This vulnerability only affects clusters which have installed and deployed the Object protocol."</span>
<div><br>
</div>
<div>Is exactly why we don't want to be installing components that we aren't actively using ...</div>
<div><br>
</div>
<div>Simon</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span><<a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a>> on behalf of Mathias Dietz <<a href="mailto:MDIETZ@de.ibm.com">MDIETZ@de.ibm.com</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>" <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
<span style="font-weight:bold">Date: </span>Wednesday, 16 December 2015 at 12:43<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>" <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>><br>
<span style="font-weight:bold">Subject: </span>Re: [gpfsug-discuss] 4.2 & protocols (missing dependency?)<br>
</div>
<div><br>
</div>
<div>
<div><font size="2" face="sans-serif">I see your point, but our recommendation is to always install gpfs.protocols-support-4.2.0-0.noarch on protocol nodes, even if a single protocol is used only.
</font><br>
<font size="2" face="sans-serif">This is consistent with how the Spectrum Scale installer is setting up systems.
</font><br>
<br>
<font size="2" face="sans-serif">Mit freundlichen Grüßen / Kind regards<br>
<br>
Mathias Dietz<br>
<br>
Spectrum Scale Development</font><br>
<font size="2" face="sans-serif">System Health Team - Scrum Master<br>
IBM Certified Software Engineer<br>
<br>
----------------------------------------------------------------------------------------------------------<br>
IBM Deutschland<br>
Hechtsheimer Str. 2<br>
55131 Mainz<br>
Phone: +49-6131-84-2027<br>
Mobile: +49-15152801035<br>
E-Mail: <a href="mailto:mdietz@de.ibm.com">mdietz@de.ibm.com</a><br>
----------------------------------------------------------------------------------------------------------<br>
IBM Deutschland Research & Development GmbH<br>
Vorsitzender des Aufsichtsrats: Martina Koederitz, Geschäftsführung: Dirk Wittkopp<br>
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294<br>
<br>
</font><br>
<br>
<br>
<br>
<font size="1" color="#5f5f5f" face="sans-serif">From: </font><font size="1" face="sans-serif">"Simon Thompson (Research Computing - IT Services)" <<a href="mailto:S.J.Thompson@bham.ac.uk">S.J.Thompson@bham.ac.uk</a>></font><br>
<font size="1" color="#5f5f5f" face="sans-serif">To: </font><font size="1" face="sans-serif">gpfsug main discussion list <<a href="mailto:gpfsug-discuss@spectrumscale.org">gpfsug-discuss@spectrumscale.org</a>></font><br>
<font size="1" color="#5f5f5f" face="sans-serif">Date: </font><font size="1" face="sans-serif">12/16/2015 01:16 PM</font><br>
<font size="1" color="#5f5f5f" face="sans-serif">Subject: </font><font size="1" face="sans-serif">Re: [gpfsug-discuss] 4.2 & protocols (missing dependency?)</font><br>
<font size="1" color="#5f5f5f" face="sans-serif">Sent by: </font><font size="1" face="sans-serif"><a href="mailto:gpfsug-discuss-bounces@spectrumscale.org">gpfsug-discuss-bounces@spectrumscale.org</a></font><br>
<hr noshade="">
<br>
<br>
<br>
<font size="2" face="Calibri">OK, Iooked at that. This means pulling in all the object and NFS stuff as well onto my server as well.</font><br>
<br>
<font size="2" face="Calibri">I only run SMB, so I don;'t want lots of other stuff installing as well ..</font><br>
<br>
<font size="1">--> Running transaction check</font><br>
<font size="1">---> Package gpfs.protocols-support.noarch 0:4.2.0-0 will be installed</font><br>
<font size="1">--> Processing Dependency: spectrum-scale-object >= 4.2.0 for package: gpfs.protocols-support-4.2.0-0.noarch</font><br>
<font size="1">--> Processing Dependency: nfs-ganesha >= 2.2 for package: gpfs.protocols-support-4.2.0-0.noarch</font><br>
<font size="1">--> Running transaction check</font><br>
<font size="1">---> Package gpfs.protocols-support.noarch 0:4.2.0-0 will be installed</font><br>
<font size="1">--> Processing Dependency: spectrum-scale-object >= 4.2.0 for package: gpfs.protocols-support-4.2.0-0.noarch</font><br>
<font size="1">---> Package nfs-ganesha.x86_64 0:2.3.0-1.el7 will be installed</font><br>
<font size="1">--> Processing Dependency: libntirpc.so.1.3(NTIRPC_1.3.1)(64bit) for package: nfs-ganesha-2.3.0-1.el7.x86_64</font><br>
<font size="1">--> Processing Dependency: libntirpc.so.1.3()(64bit) for package: nfs-ganesha-2.3.0-1.el7.x86_64</font><br>
<font size="1">--> Processing Dependency: libjemalloc.so.1()(64bit) for package: nfs-ganesha-2.3.0-1.el7.x86_64</font>
<p><br>
<br>
<font size="2" face="Calibri"><b>From: </b><</font><a href="mailto:gpfsug-discuss-bounces@spectrumscale.org"><font size="2" color="blue" face="Calibri"><u>gpfsug-discuss-bounces@spectrumscale.org</u></font></a><font size="2" face="Calibri">> on behalf of Mathias
Dietz <</font><a href="mailto:MDIETZ@de.ibm.com"><font size="2" color="blue" face="Calibri"><u>MDIETZ@de.ibm.com</u></font></a><font size="2" face="Calibri">><b><br>
Reply-To: </b>"</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="2" color="blue" face="Calibri"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="2" face="Calibri">" <</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="2" color="blue" face="Calibri"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="2" face="Calibri">><b><br>
Date: </b>Wednesday, 16 December 2015 at 12:02<b><br>
To: </b>"</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="2" color="blue" face="Calibri"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="2" face="Calibri">" <</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="2" color="blue" face="Calibri"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="2" face="Calibri">><b><br>
Subject: </b>Re: [gpfsug-discuss] 4.2 & protocols (missing dependency?)</font><br>
<br>
<font size="2" face="sans-serif">Hi,</font><font size="2" face="Calibri"><br>
</font><font size="2" face="sans-serif"><br>
you are right that python-ldap is a required dependency for 4.2 protocol nodes.<br>
Please make sure to have the gpfs.protocols-support-4.2.0-0.noarch RPM installed on protocol nodes because this package will enforce the dependencies.
</font><font size="2" face="Calibri"><br>
</font><font size="2" face="sans-serif"><br>
>> rpm -qi gpfs.protocols-support-4.2.0-0.noarch</font><font size="2" face="Calibri"><br>
</font><font size="2" face="sans-serif"><br>
Name : gpfs.protocols-support<br>
Version : 4.2.0<br>
Release : 0<br>
Architecture: noarch<br>
Install Date: Wed 16 Dec 2015 07:56:42 PM CET<br>
Group : System Environment/Base<br>
Size : 0<br>
License : (C) COPYRIGHT International Business Machines Corp. 2015<br>
Signature : (none)<br>
Source RPM : gpfs.protocols-support-4.2.0-0.src.rpm<br>
Build Date : Sat 14 Nov 2015 12:20:07 AM CET<br>
Build Host : bldlnx84.pok.stglabs.ibm.com<br>
Relocations : (not relocatable)<br>
Summary : gpfs protocol dependencies<br>
Description :<br>
This package includes the dependency list for all the protocols to<br>
enforce that all relevant Spectrum Scale protocol packages are installed.<br>
If this package is not installed "mmchnode" will fail with an appropriate message.<br>
[root@p8-10-rhel-71be-01 ~]# rpm -qi gpfs.protocols-support-4.2.0-0.noarch --requires<br>
Name : gpfs.protocols-support<br>
Version : 4.2.0<br>
Release : 0<br>
Architecture: noarch<br>
Install Date: Wed 16 Dec 2015 07:56:42 PM CET<br>
Group : System Environment/Base<br>
Size : 0<br>
License : (C) COPYRIGHT International Business Machines Corp. 2015<br>
Signature : (none)<br>
Source RPM : gpfs.protocols-support-4.2.0-0.src.rpm<br>
Build Date : Sat 14 Nov 2015 12:20:07 AM CET<br>
Build Host : bldlnx84.pok.stglabs.ibm.com<br>
Relocations : (not relocatable)<br>
Summary : gpfs protocol dependencies<br>
Description :<br>
This package includes the dependency list for all the protocols to<br>
enforce that all relevant Spectrum Scale protocol packages are installed.<br>
If this package is not installed "mmchnode" will fail with an appropriate message.<br>
gpfs.base >= 4.2.0<br>
nfs-ganesha >= 2.2<br>
gpfs.smb >= 4.2.0_gpfs<br>
spectrum-scale-object >= 4.2.0<b><br>
python-ldap</b><br>
rpmlib(PayloadFilesHavePrefix) <= 4.0-1<br>
rpmlib(CompressedFileNames) <= 3.0.4-1</font><font size="2" face="Calibri"><br>
<br>
<br>
<br>
</font><font size="2" face="sans-serif"><br>
Mit freundlichen Grüßen / Kind regards<br>
<br>
Mathias Dietz<br>
<br>
Spectrum Scale Development<br>
System Health Team - Scrum Master<br>
IBM Certified Software Engineer<br>
<br>
----------------------------------------------------------------------------------------------------------<br>
IBM Deutschland<br>
Hechtsheimer Str. 2<br>
55131 Mainz<br>
Phone: +49-6131-84-2027<br>
Mobile: +49-15152801035<br>
E-Mail: </font><a href="mailto:mdietz@de.ibm.com"><font size="2" color="blue" face="sans-serif"><u>mdietz@de.ibm.com</u></font></a><font size="2" face="sans-serif"><br>
----------------------------------------------------------------------------------------------------------<br>
IBM Deutschland Research & Development GmbH<br>
Vorsitzender des Aufsichtsrats: Martina Koederitz, Geschäftsführung: Dirk Wittkopp<br>
Sitz der Gesellschaft: Böblingen / Registergericht: Amtsgericht Stuttgart, HRB 243294<br>
</font><font size="2" face="Calibri"><br>
<br>
<br>
<br>
</font><font size="1" color="#5f5f5f" face="sans-serif"><br>
From: </font><font size="1" face="sans-serif">"Simon Thompson (Research Computing - IT Services)" <</font><a href="mailto:S.J.Thompson@bham.ac.uk"><font size="1" color="blue" face="sans-serif"><u>S.J.Thompson@bham.ac.uk</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5f5f5f" face="sans-serif"><br>
To: </font><font size="1" face="sans-serif">"</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="1" color="blue" face="sans-serif"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="1" face="sans-serif">" <</font><a href="mailto:gpfsug-discuss@spectrumscale.org"><font size="1" color="blue" face="sans-serif"><u>gpfsug-discuss@spectrumscale.org</u></font></a><font size="1" face="sans-serif">></font><font size="1" color="#5f5f5f" face="sans-serif"><br>
Date: </font><font size="1" face="sans-serif">12/15/2015 11:50 PM</font><font size="1" color="#5f5f5f" face="sans-serif"><br>
Subject: </font><font size="1" face="sans-serif">[gpfsug-discuss] 4.2 & protocols (missing dependency?)</font><font size="1" color="#5f5f5f" face="sans-serif"><br>
Sent by: </font><a href="mailto:gpfsug-discuss-bounces@spectrumscale.org"><font size="1" color="blue" face="sans-serif"><u>gpfsug-discuss-bounces@spectrumscale.org</u></font></a><font size="2" face="Calibri"><br>
</font></p>
<hr noshade="">
<font size="2" face="Calibri"><br>
<br>
</font><font size="2" face="Tahoma"><br>
Hi, </font><font size="2" face="Calibri"><br>
</font><font size="2" face="Tahoma"><br>
I;ve just upgraded some of my protocol nodes to 4.2, I noticed on startup that in the logs I get:</font><font size="2" face="Calibri"></font>
<p><font size="1" face="Calibri">Traceback (most recent call last):</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/bin/mmcesmon.py", line 178, in <module></font></p>
<p><font size="1" face="Calibri"> import mmcesmon.CommandHandler</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/CommandHandler.py", line 29, in <module></font></p>
<p><font size="1" face="Calibri"> from FILEService import FILEService</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/FILEService.py", line 19, in <module></font></p>
<p><font size="1" face="Calibri"> from ExtAuthMonitor import ActiveDirectoryServiceMonitor</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/ExtAuthMonitor.py", line 15, in <module></font></p>
<p><font size="1" face="Calibri"> import ldap</font></p>
<p><font size="1" face="Calibri">ImportError: No module named ldap</font></p>
<p><font size="1" face="Calibri">Tue 15 Dec 22:39:12 GMT 2015: mmcesmonitor: Monitor has started pid=18963</font></p>
<p><font size="1" face="Calibri">Traceback (most recent call last):</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/bin/mmcesmon.py", line 178, in <module></font></p>
<p><font size="1" face="Calibri"> import mmcesmon.CommandHandler</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/CommandHandler.py", line 29, in <module></font></p>
<p><font size="1" face="Calibri"> from FILEService import FILEService</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/FILEService.py", line 19, in <module></font></p>
<p><font size="1" face="Calibri"> from ExtAuthMonitor import ActiveDirectoryServiceMonitor</font></p>
<p><font size="1" face="Calibri"> File "/usr/lpp/mmfs/lib/mmcesmon/ExtAuthMonitor.py", line 15, in <module></font></p>
<p><font size="1" face="Calibri"> import ldap</font></p>
<p><font size="1" face="Calibri">ImportError: No module named ldap</font></p>
<p><font size="1" face="Calibri">Error: Cannot connect to server(localhost), port(/var/mmfs/ces/mmcesmonitor.socket): No such file or directory</font></p>
<p><font size="2" face="Calibri"><br>
</font><font size="2" face="Tahoma"><br>
It looks like one EL7, you also need python-ldap installed (perhaps the installer does this, but it should really be a dependency of the RPM if its required?).</font><font size="2" face="Calibri"><br>
</font><font size="2" face="Tahoma"><br>
Anyway, if you see issues, add the python-ldap RPM and it should fix it.</font><font size="2" face="Calibri"><br>
</font><font size="2" face="Tahoma"><br>
Simon</font><font size="2" face="Calibri"><br>
</font><font size="2" face="Calibri"><br>
_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org</font><font size="2" color="blue" face="Calibri"><u><br>
</u></font><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><font size="2" color="blue" face="Calibri"><u>http://gpfsug.org/mailman/listinfo/gpfsug-discuss</u></font></a><font size="2" face="Calibri"><br>
<br>
<br>
</font><tt><font size="2">_______________________________________________<br>
gpfsug-discuss mailing list<br>
gpfsug-discuss at spectrumscale.org<br>
</font></tt><a href="http://gpfsug.org/mailman/listinfo/gpfsug-discuss"><tt><font size="2">http://gpfsug.org/mailman/listinfo/gpfsug-discuss</font></tt></a><tt><font size="2"><br>
</font></tt></p>
<p></p>
<p><br>
</p>
</div>
</div>
</span>
</body>
</html>