The vRealize Automation team has investigated the impact of vulnerabilities which require local access (such as local privilege escalation, local information disclosures, local denial of service, etc.) and determined that the product can be protected from these types of vulnerabilities by performing the steps detailed in this article. This workaround is meant to be a temporary solution only.

Warning:

• This workaround is applicable ONLY to vRealize Automation Appliance 6.2.x. Do not apply this workaround to other VMware products.
• This workaround must be applied to all vRealize Automation appliances in High Availability deployments.

Functionality Impacts:
Workaround 1: All non-root custom users identified in the resolution section may not be able to perform actions that were previously possible while the workaround is in place due their disabled SSH access.

Workaround 2: All users, including root, may not be able to perform actions that were previously possible while the workaround is in place due to disabled SSH service.

VMware vRealize Automation 6.2.x

To implement the workaround for one of the following:

Workaround 1

Remove access to the appliance shell for non-root users:

1. Login to the vRealize Automation Appliance with a SSH session and the root user.
2. Backup the /etc/passwd file with this command:

3. Download the 52497_identify_non_root_users62x.py.gz script.
4. Extract and transfer the script to the appliance.
5. Run this command to make sure that the script is executable:

6. To list all the non-root custom users, run this command and take note of the users listed

 

7. Open the /etc/passwd file with a plain text editor using this command:

8. Search for all non-root users identified in step 6.

 

9. Change the default shell access from /bin/bash to /sbin/nologin.

10. Save and exit the file.

To confirm that the workaround works, run these steps:

1. Attempt to log into vRealize Automation Appliance using SSH and with a non-root user from step 6.
2. Non-root users should no longer be able to log in.

To remove the workaround, run these following steps:

1. Login to the vRealize Automation Appliance with an SSH session and the root user.
2. Backup the /etc/passwd file by with this command:

3. Change the default shell access from /sbin/nologin to /bin/bash for all the non-root users.

4. Save and Exit the file

Workaround 2

Disable the SSH shell on vRealize Automation Appliance:

1. Login to the vRealize Automation Appliance with an SSH session and the root user.
2. Once logged in, run these commands:
   • /etc/init.d/sshd stop
   • chkconfig sshd off

To validate the workaround run these following steps:

1. Try to log in from any other machine using SSH to the appliance.
2. It should prompt that connection is refused. 

To remove the workaround run these steps:

1. Log in from the vSphere console as root.
2. Start the ssh service with the command /etc/init.d/sshd start.
3. Run the command chkconfig sshd on.

Example vulnerabilities that this workaround will be effective against:

• CVE-2017-5753
• CVE-2017-5715
• CVE-2017-5754

简体中文：vRealize Automation 设备 6.2.x 针对要求本地访问的漏洞的解决办法