Big Data Appliance Integrated Software
 
Big Data Appliance Hardware
 

PLA-Support>Eng Systems>BDA>Big Data Appliance>DB: BDA_EST
 

In this Document

Purpose

Scope

Details

Affected BDA Releases

Instructions to check BDA Release and OS Version

Instruction to Update OpenSSL on BDA Nodes

Download Latest Patched Version of OpenSSL

Upgrade OpenSSL on BDA Cluster

Instruction to Disable SSLv3 on Hardware Components

ILOM on BDA Nodes

NM2-36p and NM2-GW InfiniBand Switches

Post Installation Steps

Verify Openssl  Version

Hdfs Cluster Restart

Applies to:

Purpose

This document provides required steps to resolve issues related to SSL Poodle Vulnerability CVE-2014-3566 on Oracle Big Data Appliance(BDA) . This is important due to SSL Poodle Vulnerability (CVE-2014-3566) as described in Note 1935500.1. 

Scope

This document applies to Oracle Big Data Appliance(BDA)

Details

By default on all BDA components, SSLv3 is not used. However, it is configured to be available if requested by a client. This means that malicious users may be able to leverage the SSLv3 weaknesses to compromise the system. The best way to avoid the vulnerability is to update OpenSSL rpm on BDA nodes and disable SSLv3 capabilities on Hardware components as described in the procedures here.

The Oracle Linux security advisories describing these OpenSSL updates are available at:

• OL6: ELSA-2014-1652, https://oss.oracle.com/pipermail/el-errata/2014-October/004533.html
• OL5: ELSA-2014-1653, https://oss.oracle.com/pipermail/el-errata/2014-October/004532.html

Affected BDA Releases

BDA V2.* and higher until V4.0 releases are affected by SSL Poodle Vulnerability (CVE-2014-3566) .

Openssl has been updated on servers in BDA v4.1.0 and up so not effected .

But hardware component updates are applicable to all releases of BDA.

Instructions to check BDA Release and OS Version

These steps are the same for HDFS or NoSQL Cluster installed on BDA

1) Log into Node01 of the BDA cluster as root user

2) Check BDA image and OS details by executing imageinfo command

a) Sample output for BDA 2.* with OEL6 OS

OR

b) Sample output for BDA 2.* with OEL5 OS

3) Check the version of openssl rpm installed. dcli can used to check the openssl rpm release on all nodes in the cluster

For OL6

For OL5   

Note:- Package versions earlier than the package versions shown below in 'Download Latest Patched Version of OpenSSL section' are affected.

Instruction to Update OpenSSL on BDA Nodes

Download Latest Patched Version of OpenSSL

For OL6

openssl-1.0.1e-30.el6_6.2.x86_64.rpm 

For OL5

openssl-0.9.8e-31.el5_11.i686.rpm

openssl-0.9.8e-31.el5_11.x86_64.rpm

The rpms can be downloaded from
Free (Public Yum): http://public-yum.oracle.com/
OR
Paid (ULN): https://linux.oracle.com/

Upgrade OpenSSL on BDA Cluster

These steps are the same for a HDFS or NoSQL Cluster installed on BDA.

Note:- If more than one cluster is installed on a rack, then please execute below steps on all clusters in the rack .

1) Log into Node01 of the BDA cluster as root user

2) Download/Copy the rpms based on OS release to node01 into /tmp

3) Use dcli to copy the ssl rpm to all nodes in the cluster

For OL6

For OL5

4) Upgrade the ssl rpm on all the nodes in the cluster

For OL6

For OL5

Sample output

Instruction to Disable SSLv3 on Hardware Components

ILOM on BDA Nodes

BDA nodes ILOM have SSLv3 enabled by default. To disable SSLv3 via the command line interface, connect to the ILOM via SSH and run:

To disable SSLv3 via the web browser interface, connect to the ILOM via a web browser, login, and navigate to Configuration > Web Server (on earlier versions) or ILOM Administration > Management Access > Web Server (on later versions). Then uncheck SSLv3 checkbox and click Save.

NM2-36p and NM2-GW InfiniBand Switches

NM2-36p and NM2-GW InfiniBand Switch ILOMs have SSLv3 enabled by default. There is no way to disable SSLv3, so the only available option currently is to disable https. Since http only redirects to https, we also recommend disabling http access.

To disable http and https access via the command line interface, follow the steps below. Perform the steps on all 3 NM2 Infiniband switches in every BDA rack

1. Connect to the switch's ILOM by logging in to the switch using SSH as the ilom-admin user
   1. ssh ilom-admin@<IB_switch_name_or_IP>
2. Once connected, set the following properties:
   1. -> set /SP/services/http servicestate=disabled secureredirect=disabled
   2. -> set /SP/services/https servicestate=disabled

Post Installation Steps

Verify Openssl  Version

Check if the openssl rpm is updated correctly

For OL6

For OL5   

Hdfs Cluster Restart

If network encryption is enabled on the HDFS cluster or for any services on the HDFS cluster then the cluster (or those particular services) should be restarted.

To restart the HDFS cluster or a particular service/s follow below steps

1) Log into Cloudera Manager(CM) UI as admin user 

CM resides on node03 of the primary rack and can be accessed using http://<node3-name>:7180

2) Start the BDA cluster or just the services needed

a) To restart 'All Services' or the complete cluster

Services > All Services > Actions > ReStart

b) To restart a specific service

Services > All Services > Choose the Service to restart

This solution has no attachment