Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

vRealize Automation 设备 6.2.x 针对要求本地访问的漏洞的解决办法 (56158)

Last Updated: 6/13/2018Categories: TroubleshootingTotal Views: 1Language:
Chinese (Simplified)English

Subscribe to get an email
newsletter with new updates

Please provide article feedback:

Symptoms

免责声明： 本文是 vRealize Automation Appliance 6.2.x Workaround for vulnerabilities which require local access (52497) 的翻译版本。 尽管我们会不断努力为本文提供最佳翻译版本，但本地化的内容可能会过时。 有关最新内容，请参见英文版本。

Purpose

vRealize Automation 团队已调查要求本地访问（如本地特权升级、本地信息披露、本地拒绝服务等）的漏洞的影响，并确定可通过执行本文详述的步骤，保护该产品免受这些类型漏洞的影响。此权宜措施只是为了临时解决此问题。

警告：

此临时解决办法仅适用于 vRealize Automation 设备 6.2.x。不要将此权宜措施应用于其他 VMware 产品。

此临时解决办法必须应用于高可用性部署中的所有 vRealize Automation 设备。

功能影响：
权宜措施 1：实施该解决办法后，解决办法部分中确定的所有非 root 自定义用户可能无法执行以前能够执行的操作，因为已禁用他们的 SSH 访问权限。

权宜措施 2：实施该解决办法后，所有用户（包括 root 用户）可能无法执行以前能够执行的操作，因为已禁用 SSH 服务。

Resolution

要实施临时解决办法，请执行以下操作之一：

权宜措施 1

移除非 root 用户对设备 shell 的访问权限：

使用 SSH 会话以 root 用户身份登录到 vRealize Automation 设备。

使用以下命令备份 /etc/passwd 文件：

cp /etc/passwd /etc/passwd.bkup

下载 52497_identify_non_root_users62x.py.gz 脚本。

提取脚本并将其传输到设备。

运行以下命令以确保该脚本可执行：

chmod 755 identify_non_root_users62x.py

要列出所有非 root 自定义用户，请运行以下命令，并记下列出的用户

python identify_non_root_users62x.py

如果控制台中未列出任何用户，则表示没有要禁用的用户。

使用以下命令在纯文本编辑器中打开 /etc/passwd 文件：

vi /etc/passwd

搜索在步骤 6 中确定的所有非 root 用户。

例如，用户测试有权访问 bash。

test:x:1020:100:test:/home/test:/bin/bash

将默认 shell 访问权限由 /bin/bash 更改为 /sbin/nologin。

例如：

test:x:1020:100:test:/home/test:/sbin/nologin

保存并退出文件。

要确认该解决办法可行，请运行以下步骤：

尝试使用 SSH 以步骤 6 中的非 root 用户身份登录到 vRealize Automation 设备。

非 root 用户应该不再能够登录。

要移除此解决办法，请运行以下步骤：

使用 SSH 会话以 root 用户身份登录到 vRealize Automation 设备。

使用以下命令备份 /etc/passwd 文件：

cp /etc/passwd /etc/passwd.modified.bkup

将所有非 root 用户的默认 shell 访问权限由 /sbin/nologin 更改为 /bin/bash。

例如：

test:x:1020:100:test:/home/test:/bin/bashsh

保存并退出文件

权宜措施 2

在 vRealize Automation 设备上禁用 SSH shell：

使用 SSH 会话以 root 用户身份登录到 vRealize Automation 设备。

登录后，运行以下命令：

/etc/init.d/sshd stop

chkconfig sshd off

要验证解决办法，请运行以下步骤：

尝试使用 SSH 从任何其他计算机登录到设备。

此时应提示连接被拒绝。

要移除此解决办法，请运行以下步骤：

从 vSphere 控制台以 root 身份登录。

使用命令 /etc/init.d/sshd start 启动 ssh 服务。

运行命令 chkconfig sshd on。

此权宜措施可有效解决的示例漏洞：

CVE-2017-5753

CVE-2017-5715

CVE-2017-5754

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)English

Attachments

52497_identify_non_root_users62x.py.gz

Additional Resources

No results for undefined

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware Aria Automation

Related Versions:

VMware vRealize Automation 6.2.x

Support Assistant