nmap serviceguard cluster

[jpcast_real]

We have discoverd that in the ServiceGuard release 11.16 , with the nmap tool, the cluster cmclconfd daemons gets hung.

Does anyone has had this problem before?? I knew it from old SG releases but not in the 11.16. Is there any patch to solve it???

Is it solved in the 11.17???

I have read also in the 11.17:

JAGaf30745 (SR8606370323): nmap on hacl-cfg/udp port causes inetd looping, cmclconfd problem

What was the problem? This message appears in syslog:
inetd[891]: hacl-cfg/udp: Server failing (looping),
service terminated.

What was the resolution? Receive the message even if it is invalid, then discard it.

[Duncan Edmonstone]

Javier,

The resolution was in patch PHSS_34503:

___________________
6. UDP messages were not marked as invalid even if there
were invalid values for length and offset fields in the
message, causing cmclconfd to exit without receiving
the message and/or cmviewcl to spin indefinitely. In
the cmclconfd case the message hence remains in the
inetd socket buffer causing inetd to spawn another
cmclconfd server. This is repeated until it reaches 40
servers in 60 seconds when it terminates the service
and only reinstates the service again after 10 minutes.

Resolution:
Mark the message as invalid if the length and offset
fields in the message contained improper values.

___________________


That patch is now superseded - the reccomended patch for 11.16 is PHSS_36466

HTH

Duncan

[Armin Kunaschik · Accepted solution]

You should, in addition to the patch installation, add hacl-cfg to /var/inetd.sec like:
hacl-cfg allow cluster_node(s)

Even if there will be another port scan/ problem, the connection is simply denied.

My 2 cents,
Armin