Harvest and recent security scan | NetApp | Page 1

fleet bolt Jul 7, 2023, 1:21 PM

#

This morning we were contacted by the security team saying that a vulerablity had been found on our Harvest server in regards to Unix World-Writable files. The files in question are in /opt/harvest/asup/payload/clusterORfsx_payload.json. Do these files need to be rwxrwxrwx? There is also another file in /opt/harvest/asup/spool/harvest with rw and it's a tgz file.

sturdy hill Jul 7, 2023, 2:35 PM

#

hi @fleet bolt thanks for raising this. Those files are Harvest's auto-support files and they do not need to be world writable. We'll fix in nightly and ping you when the pull request has been reviewed and passed CI
https://github.com/NetApp/harvest/issues/2192

fleet bolt Jul 7, 2023, 3:13 PM

#

thanks!

fleet bolt Jul 10, 2023, 1:19 PM

#

Have the updates been made on the nightlies?

stiff tangle Jul 10, 2023, 1:54 PM

#

@fleet bolt It is not yet in. There is an ongoing PR. We'll update you once it is available.

fleet bolt Jul 10, 2023, 1:55 PM

#

ok thanks

stiff tangle Jul 10, 2023, 5:04 PM

#

@fleet bolt Could you please specify the type of installation for Harvest? Is it RPM, DEB, Docker, NaBox, or Native?

fleet bolt Jul 10, 2023, 5:04 PM

#

RPM

stiff tangle Jul 10, 2023, 5:05 PM

#

Thanks

sturdy hill Jul 10, 2023, 6:58 PM

#

hi @fleet bolt nightly has a fix for the issue you raised. When you get a chance, please let us know if this fixes the issue for you. Thanks! https://github.com/NetApp/harvest/releases/tag/nightly We've also added file/dir permissions linters to make sure this doesn't happen in the future

fleet bolt Jul 11, 2023, 2:08 PM

#

the payload files are still rwxrwxrwx

stiff tangle Jul 11, 2023, 2:09 PM

#

how long it has been since upgrade?

fleet bolt Jul 11, 2023, 2:10 PM

#

about two hours ago

stiff tangle Jul 11, 2023, 2:11 PM

#

could you share output of bin/harvest version if you run it from harvest installation dir. in rpm it should be /opt/harvest

fleet bolt Jul 11, 2023, 2:14 PM

#

oh wait, this is my fault I installed 23.07.10 by mistake

stiff tangle Jul 11, 2023, 2:15 PM

#

okay

#

We can verify with bin/harvest version if you have the fix.

fleet bolt Jul 11, 2023, 2:23 PM

#

ok just upgraded, is there a way I can manually trigger an ASUP to see if the fix worked?

stiff tangle Jul 11, 2023, 2:23 PM

#

Permissions should get auto correct with in next 10 mins

#

There is no manual way to trigger asup generation currently.

fleet bolt Jul 11, 2023, 2:25 PM

#

ok

stiff tangle Jul 11, 2023, 2:33 PM

#

@fleet bolt Could you check the permissions now?

fleet bolt Jul 11, 2023, 2:37 PM

#

they are now rw------- so we're good

stiff tangle Jul 11, 2023, 2:37 PM

#

Thanks!

fleet bolt Jul 11, 2023, 2:38 PM

#

I don't see an /opt/harvest/asup/spool directory yet, I assume that will populate at some point?

stiff tangle Jul 11, 2023, 2:38 PM

#

yes that will get created after 24 hours.

fleet bolt Jul 11, 2023, 2:38 PM

#

ok thanks

fleet bolt Jul 12, 2023, 3:20 PM

#

So I just checked and the tar file in /opt/harvest/asup/spool/harvest is still rw-rw-rw-

sturdy hill Jul 12, 2023, 3:25 PM

#

hi @fleet bolt can you check with ls -la and see if the tar file with 666 permissions was created earlier, i.e. before this was fixed or if that tar gz was created after the nightly you deployed yesterday?

fleet bolt Jul 12, 2023, 3:25 PM

#

no it was created an hour ago

#

the spool directory wasn't there yesterday after I upgraded to the 7.11 nightly

sturdy hill Jul 12, 2023, 3:28 PM

#

thanks for the confirmation! right, I recall you mentioning that. Sorry about the miss here, we'll fix it. Feel free to rm the spool directory in the meantime if your system is getting flagged

fleet bolt Jul 12, 2023, 3:28 PM

#

ok

sturdy hill Jul 12, 2023, 4:09 PM

#

hi @fleet bolt I downloaded the rpm you used to a local linux box, uncompressed it and ran the asup executable directly so I could check the permissions of the spool and tgz files that are created. Here's what I did.

uncompressed rpm into /tmp
cd /tmp/harvest-23.07.11-nightly.x86_64/opt/harvest/autosupport
./asup --payload /opt/harvest/asup/payload/umeng_aff300_payload.json --working-dir foo
the umeng_aff300_payload.json is from a previous run
checked permissions of foo and foo/spool/harvest - they all look correct

Let's check and make sure we are using the same version.
What does this print for you?
/opt/harvest/autosupport/asup --version

fleet bolt Jul 12, 2023, 4:16 PM

#

asup version 23.07.11-nightly (commit e25f18b) (build date 2023-07-11T00:23:48-0400) endpoint: stable linux/amd64

sturdy hill Jul 12, 2023, 4:18 PM

#

same

fleet bolt Jul 12, 2023, 4:24 PM

#

I generated one using .asup --payload and it's also rw-r--r--

#

so this is weird

sturdy hill Jul 12, 2023, 4:30 PM

#

excellent, was getting ready to ask if you wanted to try that 🙂 the behavior you describe almost sounds like last night's tgz and spool directory were created by an earlier version of Harvest and the test you just did was done with nightly. That would happen if RPM upgrade installed the new files, but did not restart existing pollers. Let's check when the poller that wrote the wrong permissions was started via ps aux | grep poller This will show us the process start time and the date should be Jul11 in your case

fleet bolt Jul 12, 2023, 4:37 PM

#

Jul 11th before I ran the upgrade

sturdy hill Jul 12, 2023, 4:38 PM

#

ah! ok sounds like that's it

fleet bolt Jul 12, 2023, 4:38 PM

#

I did upgrade twice, I mistakenly installed the 7-10 nightly, realized my mistake and installed the 7-11 nightly

sturdy hill Jul 12, 2023, 4:44 PM

#

sounds like if you bounce your pollers, they'll restart using the 7-11 nightly code and you should be good to go. If you want to verify one of them without waiting you can run with an environment variable that tells Harvest to invoke autosupport 4m after startup instead of waiting 24 hours. Might be worth rm -rf the asup directory to start from a clean slate. To run with env var use this ASUP=1 bin/harvest restart $pollerName

fleet bolt Jul 13, 2023, 5:13 PM

#

Just wanted to confirm that the .tgz file has the correct permissions this morning. We're good.

#Harvest and recent security scan