Adjusting the InSpire Host OpenSSH Settings – Set LoginGraceTime to 0
Mitigation for CVE-2024-6387

Introduction

With CVE-2024-6387 RCE vulnerability was discovered in the OpenSSH Service. This affects all appliances that have version 24.3 Hotfix 1 or older.

With the latest Mindbreeze InSpire 24.3 Hotfix 2 Release we fix the vulnerability by disabling the LoginGraceTime setting of OpenSSH and thus the exploitation of this vulnerability is not possible.

We expect an upstream patch to be available for the Mindbreeze InSpire 24.5 Release.

For older Mindbreeze InSpire installations the setting can be deployed with the steps presented in this document.

Deployment of the Mitigation

The following steps should be performed on all member nodes of a Mindbreeze InSpire cluster:

1. Login with SSH to the Mindbreeze InSpire server using root credentials.
2. Add the following line to /etc/ssh/sshd_config.d/00-mitigations.conf if it does not already exist:

LoginGraceTime 0

1. Restart the OpenSSH Service for the setting to take effect:

systemctl restart sshd

Verification

If correctly deployed, the following command should output: logingracetime 0

sshd -T | grep -i LoginGraceTime