Indfern
commented
8 months ago My Questions.
1.) Why the PB does not apply the applicable fixes to the system? I do not want to fix issues, file system by file system wise. I just need to fully patch my server in a single run of the PB, which should apply all the fixes to all the filesets.
2.) Am I using wrong switches in the PB? Please let me know what switches to put, for the server to get fully patched in a single go? I tried putting "filesets: all" to flrtVC-patch.yml PB, but that too failed.
3.) Since downloding patches takes time and we have very tight "Change Request Time Windows" for production systems, can we download and keep the patches beforehand and just do only the apply operation during the change window? If yes, what switches do i need to put in a new flirtdownload.yml PB? This PB, should only download the applicable fixes to the system, but not install them.
sumitradawn
nitismis
Describe the bug I'm using ibm.power_aix.flrtvc: module to identify and fix vulnerabilities in aix.
My Goal:
1.) Generate vulnerability reports for p10test host group. (Successful) 2.) Fix vulnerabilities whereever they exists in p10test host group. (Facing Issues)
Background Details.
apa alias details [root@txansible01 Aix]# alias apa alias apa='ANSIBLE_STDOUT_CALLBACK=yaml ansible-playbook -i inventory' [root@txansible01 Aix]#
Inventory details. [p10test] txulp10atest ansible_host=10.0.12.91 txulp10btest ansible_host=10.0.12.128
I injest values for variables, during the playbook run time
Steps I'm carrying out.
1.) Generate the report for the servers. Here, i use "check_only: yes", so no download happens.
[root@txansible01 Aix]# cat flrtVC-chk.yml
name: Generate applicable security and HIPER fixes report for {{ host }} host(s) and/or group(s) hosts: "{{ host | default('jmpvr') }}" gather_facts: no tasks:
filesets: all
path: /var/adm/ansible save_report: yes verbose: yes force: no check_only: yes ... [root@txansible01 Aix]#
Running the playbook. [root@txansible01 Aix]# apa flrtVC-chk.yml -e host=p10test
PLAY [Provide applicable security and HIPER fixes report for p10test host(s) and/or group(s)] *
TASK [Provide FLRT VC Report] ***** ok: [txulp10atest] ok: [txulp10btest]
PLAY RECAP **** txulp10atest : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
txulp10btest : ok=1 changed=0 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[root@txansible01 Aix]#
2.) Then i checked the report. txulp10atest:/var/adm/ansible# pwd /var/adm/ansible txulp10atest:/var/adm/ansible# ls -ltr total 40 drwxr--r-- 3 root system 4096 Mar 8 11:05 work -rw-r--r-- 1 root system 12918 Mar 8 11:06 flrtvc.txt txulp10atest:/var/adm/ansible#
I can see there are total 19 vulnerabilities found. txulp10atest:/var/adm/ansible# cat flrtvc.txt //////////////////////////////////////////////////////////// // IBM FLRTVC (v0.8.8) Report // Server: txulp10atest // Date: Fri Mar 8 11:06:14 CST 2024 // Report by: root // Vulnerable Filesets: 16 // Total Vulnerabilities: 19 // Total Fixes (not shown): 16 ////////////////////////////////////////////////////////////
Out of 19, 11 related to SP/ML upgrades. But 8 seems to be ok to be fixed in current OS version.
invscout.rte - 2.2.0.23 - Vulnerabilities (2)
(1) NOT FIXED - AIX is vulnerable to arbitrary command execution due to invscout
Type: sec Score: 8.4 Versions: 2.2.0.0-2.2.0.23 APARs/CVEs: CVE-2023-28528 Last Update: 04/12/2023 Bulletin: https://aix.software.ibm.com/aix/efixes/security/invscout_advisory4.asc Download: https://aix.software.ibm.com/aix/efixes/security/invscout_fix4.tar Fixed In: See Bulletin
(2) NOT FIXED - AIX is vulnerable to arbitrary command execution due to invscout Type: sec Score: 8.4 Versions: 2.2.0.0-2.2.0.24 APARs/CVEs: CVE-2023-45168 Last Update: 11/30/2023 Bulletin: https://aix.software.ibm.com/aix/efixes/security/invscout_advisory5.asc Download: https://aix.software.ibm.com/aix/efixes/security/invscout_fix5.tar Fixed In: See Bulletin
ntp.rte - 7.4.2.8153 - Vulnerabilities (1)
(1) NOT FIXED - AIX is vulnerable to a denial of service due to NTP
openssh.base.client - 8.1.102.2106 - Vulnerabilities (1)
(1) NOT FIXED - AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH
openssh.base.server - 8.1.102.2106 - Vulnerabilities (1)
(1) NOT FIXED - AIX is vulnerable to unauthorized file access and arbitrary code execution due to OpenSSH
openssl.base - 1.1.2.2200 - Vulnerabilities (1)
(1) NOT FIXED - AIX is vulnerable to a denial of service (CVE-2023-5678 CVE-2023-6129 CVE-2023-6237) and an attacker may obtain sensitive information (CVE-2023-5363) due to OpenSSL
(2) NOT FIXED - AIX is vulnerable to sensitive information exposure due to Perl - CVE-2023-31484
(3) NOT FIXED - AIX is vulnerable to sensitive information exposure due to Perl - CVE-2023-2331486
3.) Then I ran another playbook to fix the issues.
[root@txansible01 Aix]# cat flrtVC-patch.yml
name: Patch security and HIPER fixes of {{ host }} host(s) and/or group(s) hosts: "{{ host | default('jmpvr') }}" gather_facts: no tasks:
filesets: dfsdffd
path: /var/adm/ansible save_report: yes verbose: yes force: yes check_only: no clean: no download_only: no extend_fs: yes ... [root@txansible01 Aix]#
Here I put "check_only: no" to install the fixes. Also I did not specify "filesets" key, since I need to install all the fixes what ever applicable.
Running the playbook. apa flrtVC-patch.yml -e host=p10test
Summary has a changed status for the host txulp10atest, which seems it's patched.
[root@txansible01 Aix]# apa flrtVC-patch.yml -e host=p10test PLAY [Patch security and HIPER fixes of p10test host(s) and/or group(s)] **
TASK [Downloading & Patching security and HIPER fixes of p10test. Can take extensive amount of time depending on the number of fixes & the size] *
changed: [txulp10atest] changed: [txulp10btest] PLAY RECAP ** txulp10atest : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
txulp10btest : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[root@txansible01 Aix]#
I can see the flrtvc.txt file has an updated time stamp as well. txulp10atest:/var/adm/ansible# ls -ltr total 40 -rw-r--r-- 1 root system 12918 Mar 8 11:26 flrtvc.txt drwxr--r-- 4 root system 4096 Mar 8 11:30 work txulp10atest:/var/adm/ansible#
But the issue is it staill says, nothing is fixed.
txulp10atest:/var/adm/ansible# ls -ltr total 40 -rw-r--r-- 1 root system 12918 Mar 8 11:26 flrtvc.txt drwxr--r-- 4 root system 4096 Mar 8 11:30 work txulp10atest:/var/adm/ansible# txulp10atest:/var/adm/ansible# cat flrtvc.txt|head -20 //////////////////////////////////////////////////////////// // IBM FLRTVC (v0.8.8) Report // Server: txulp10atest // Date: Fri Mar 8 11:26:53 CST 2024 // Report by: root // Vulnerable Filesets: 16 // Total Vulnerabilities: 19 // Total Fixes (not shown): 16 ////////////////////////////////////////////////////////////
Also I can see it has downloads some fixes to the system as well, inside the work folder. I believe these are the fixes applicable to the system.
txulp10atest:/var/adm/ansible# pwd /var/adm/ansible txulp10atest:/var/adm/ansible# ls -ltr total 40 -rw-r--r-- 1 root system 12918 Mar 8 11:26 flrtvc.txt drwxr--r-- 4 root system 4096 Mar 8 11:30 work txulp10atest:/var/adm/ansible# ls -ltr work total 827528 -rw-r--r-- 1 root system 9144320 Apr 12 2023 invscout_fix4.tar -rw-r--r-- 1 root system 1090615 Apr 24 2023 IJ46542s1a.230424.AIX73TL01SP01.epkg.Z -rw-r--r-- 1 root system 1091537 Apr 24 2023 IJ46541s5a.230424.AIX72TL05SP05.epkg.Z -rw-r--r-- 1 root system 1091730 Apr 24 2023 IJ46487s3a.230424.AIX73TL00SP03.epkg.Z -rw-r--r-- 1 root system 1091799 Apr 26 2023 IJ46487s2a.230425.AIX73TL00SP02.epkg.Z -rw-r--r-- 1 root system 1091526 Apr 26 2023 IJ46487s1a.230425.AIX73TL00SP01.epkg.Z -rw-r--r-- 1 root system 1091891 Apr 26 2023 IJ46576s4a.230426.AIX72TL05SP04.epkg.Z -rw-r--r-- 1 root system 1093806 May 3 2023 IJ46541s6a.230503.AIX72TL05SP06.epkg.Z -rw-r--r-- 1 root system 1092523 May 3 2023 IJ46542s2a.230503.AIX73TL01SP02.epkg.Z -rw-r--r-- 1 root system 148746 Jun 1 2023 IJ46727s2a.230509.AIX73TL01SP02.epkg.Z -rw-r--r-- 1 root system 146617 Jun 1 2023 IJ46694s6a.230509.VIOS3.1.4.20-21.epkg.Z -rw-r--r-- 1 root system 146617 Jun 1 2023 IJ46694s6a.230509.AIX72TL05SP06.epkg.Z -rw-r--r-- 1 root system 27258880 Aug 23 2023 openssh_fix15.tar -rw-r--r-- 1 root system 8355840 Oct 5 11:02 ntp_fix14.tar -rw-r--r-- 1 root system 32194560 Oct 12 09:02 libxml2_fix5.tar -rw-r--r-- 1 root system 9144320 Nov 30 11:02 invscout_fix5.tar -rw-r--r-- 1 root system 6010880 Dec 18 10:02 bind_fix25.tar -rw-r--r-- 1 root system 71680 Dec 18 10:02 aixwindows_fix.tar -rw-r--r-- 1 root system 192122880 Jan 9 15:02 kernel_fix6.tar -rw-r--r-- 1 root system 125890560 Jan 25 15:02 openssl_fix40.tar -rw-r--r-- 1 root system 4147200 Feb 2 14:02 printers_fix.tar -rw-r--r-- 1 root system 15534 Mar 5 21:11 FLRTVC-latest.zip drwxr-xr-x 10 root system 256 Mar 5 21:17 tardir -rw-r--r-- 1 root system 0 Mar 8 11:25 emgr.txt -rw-r--r-- 1 root system 116640 Mar 8 11:25 lslpp.txt drwxr-xr-x 3 root system 256 Mar 8 11:30 flrtvc_lpp_source txulp10atest:/var/adm/ansible#
To Reproduce Steps to reproduce the behavior: 1.) Run the patching Playbook.
name: Patch security and HIPER fixes of {{ host }} host(s) and/or group(s) hosts: "{{ host | default('jmpvr') }}" gather_facts: no tasks:
filesets: dfsdffd
path: /var/adm/ansible save_report: yes verbose: yes force: yes check_only: no clean: no download_only: no extend_fs: yes ... [root@txansible01 Aix]#
Here I put "check_only: no" to install the fixes. Also I did not specify "filesets" key, since I need to install all the fixes what ever applicable.
Running the playbook. apa flrtVC-patch.yml -e host=p10test
Summary has a changed status for the host txulp10atest, which seems it's patched.
[root@txansible01 Aix]# apa flrtVC-patch.yml -e host=p10test PLAY [Patch security and HIPER fixes of p10test host(s) and/or group(s)] **
TASK [Downloading & Patching security and HIPER fixes of p10test. Can take extensive amount of time depending on the number of fixes & the size] *
changed: [txulp10atest] changed: [txulp10btest] PLAY RECAP ** txulp10atest : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
txulp10btest : ok=1 changed=1 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
[root@txansible01 Aix]#
2.) Observe the flirt report. You can see, still the patches have not been applied to the system. I can see the flrtvc.txt file has an updated time stamp as well. txulp10atest:/var/adm/ansible# ls -ltr total 40 -rw-r--r-- 1 root system 12918 Mar 8 11:26 flrtvc.txt drwxr--r-- 4 root system 4096 Mar 8 11:30 work txulp10atest:/var/adm/ansible#
But the issue is, it still says, nothing is fixed on the flirt report. txulp10atest:/var/adm/ansible# ls -ltr total 40 -rw-r--r-- 1 root system 12918 Mar 8 11:26 flrtvc.txt drwxr--r-- 4 root system 4096 Mar 8 11:30 work txulp10atest:/var/adm/ansible# txulp10atest:/var/adm/ansible# cat flrtvc.txt|head -20 //////////////////////////////////////////////////////////// // IBM FLRTVC (v0.8.8) Report // Server: txulp10atest // Date: Fri Mar 8 11:26:53 CST 2024 // Report by: root // Vulnerable Filesets: 16 // Total Vulnerabilities: 19 // Total Fixes (not shown): 16 ////////////////////////////////////////////////////////////
Expected behavior I expect the playbook to apply the fixes to the system and the filrt report saying, all the vulnerabilities are fixed.
Screenshots If applicable, add screenshots to help explain your problem.
Environment (please complete the following information):
OS: [e.g. AIX 7.2.4.0]
txulp10atest:/var/adm/ansible# oslevel -s 7200-05-06-2320 txulp10atest:/var/adm/ansible#
Python Version: [e.g. 2.7.5, 3.6]
txulp10atest:/var/adm/ansible# python -V
Python 2.7.18 txulp10atest:/var/adm/ansible#
OpenSSH Version: [e.g. 1.0.2]
txulp10atest:/var/adm/ansible# lslpp -l|grep -i openssh openssh.base.client 8.1.102.2106 COMMITTED Open Secure Shell Commands openssh.base.server 8.1.102.2106 COMMITTED Open Secure Shell Server openssh.license 8.1.102.2106 COMMITTED Open Secure Shell License openssh.man.en_US 8.1.102.2106 COMMITTED Open Secure Shell openssh.base.client 8.1.102.2106 COMMITTED Open Secure Shell Commands openssh.base.server 8.1.102.2106 COMMITTED Open Secure Shell Server txulp10atest:/var/adm/ansible#
Ansible Version: [e.g. 2.10.7]
[root@txansible01 Aix]# ansible --version ansible 2.9.27 config file = /root/Aix/ansible.cfg configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules'] ansible python module location = /usr/lib/python3.6/site-packages/ansible executable location = /usr/bin/ansible python version = 3.6.8 (default, Jan 5 2024, 08:58:17) [GCC 8.5.0 20210514 (Red Hat 8.5.0-20)] [root@txansible01 Aix]#
AIX Collection Version: [e.g. 1.2.1]
1.7.2
Additional context Add any other context about the problem here.