Sure, you can handle it. But should you?
Let our experts manage the tech maintenance while you focus on your business.
Let our experts manage the tech maintenance while you focus on your business.
Adjusting the InSpire Host OpenSSH Settings – Set LoginGraceTime to 0
Mitigation for CVE-2024-6387
Copyright ©
Mindbreeze GmbH, A-4020 Linz, 2024.
All rights reserved. All hardware and software names used are brand names and/or trademarks of their respective manufacturers.
These documents are strictly confidential. The submission and presentation of these documents does not confer any rights to our software, our services and service outcomes, or any other protected rights. The dissemination, publication, or reproduction hereof is prohibited.
For ease of readability, gender differentiation has been waived. Corresponding terms and definitions apply within the meaning and intent of the equal treatment principle for both sexes.
Introduction
With CVE-2024-6387 RCE vulnerability was discovered in the OpenSSH Service. This affects all appliances that have version 24.3 Hotfix 1 or older.
With the latest Mindbreeze InSpire 24.3 Hotfix 2 Release we fix the vulnerability by disabling the LoginGraceTime setting of OpenSSH and thus the exploitation of this vulnerability is not possible.
We expect an upstream patch to be available for the Mindbreeze InSpire 24.5 Release.
For older Mindbreeze InSpire installations the setting can be deployed with the steps presented in this document.
Deployment of the Mitigation
The following steps should be performed on all member nodes of a Mindbreeze InSpire cluster:
- Login with SSH to the Mindbreeze InSpire server using root credentials.
- Add the following line to /etc/ssh/sshd_config.d/00-mitigations.conf if it does not already exist:
LoginGraceTime 0
- Restart the OpenSSH Service for the setting to take effect:
systemctl restart sshd
Verification
If correctly deployed, the following command should output: logingracetime 0
sshd -T | grep -i LoginGraceTime