Ubuntu 16.04 이상에서 PowerFlex 3.x LDAP 인증 실패

시나리오
Ubuntu 16.04 이상에서 실행되는 PowerFlex 3.5 이상은 LDAP를 사용하여 로그인하지 않으며 MDM 서비스를 재시작합니다. 

조짐
SCLI 명령 실패:

 root@ubuntu16-mdm1# date; scli --login --username test_user --password test_password --ldap_authentication
Wed Dec 15 03:09:03 EST 2021
Error: MDM failed command. Status: Communication error

MDM 추적은 다음과 mdmNet_AbnormalExitCK같이 LDAP 인증 시도가 시작되지 않고 MDM 서비스가 정상적으로 다시 시작됨을 보여 줍니다. 00334: Signal 6(SIGABRT = 심각한 오류가 있는 경우 프로그램을 중단하는 데 일반적으로 사용됨)을 사용하여 네트워크를 일시 중지합니다.

 15/12 03:09:03.974587 7efef1ce2db0:mosEventLog_PostInternal:00609: New event added. Message: "Command login received, User: 'test_user'. [9]". Additional info: ". Originating source IP: 127.0.0.1" Severity: Info
15/12 03:09:03.974601 7efef1ce2db0:ldapAuthMgr_GetLdapServiceRefByKey:02332: Failed to get LDAP service object by name - rc: LDAP_SERVICE_NOT_FOUND
15/12 03:09:03.982275 7efef1ce2db0:mdmNet_AbnormalExitCK:00334: Will pause network     <<<<<--- MDM service gracefully prepares for a restart
15/12 03:09:03.982290 7efef1ce2db0:net_Pause:02235: Net paused 1 (reversible 0)
15/12 03:09:03.982310 7efef6a9ddb0:netListen_Mit:00170: Error (ABORTED) accepting on socket 26
15/12 03:09:03.982322 7efef1ce2db0:net_Pause:02235: Net paused 1 (reversible 0)
15/12 03:09:03.982346 7efef1ce2db0:mosOsThrd_DumpBacktraceToTraces:01120: Dumping thread 0x33af7d0 backtrace:
15/12 03:09:03.982347 7efef1ce2db0:mosOsThrd_DumpBacktraceToTraces:01133: Thread 0x33af7d0: frame 0: __fortify_fail+0x5c [0x7eff1426e21c]
15/12 03:09:03.982349 7efef1ce2db0:mosDbg_SignalHandler:00723: ---Termination due to signal 6. PID 16584 Faulting address 0x40c8. errno 0---
15/12 03:09:04.133079 0:mosTrcLayer_Create:00239: ---------- Process started. Version private PowerFlex R3_5.1400.104_Release, CodeBase , Sep 12 2021. PID 20567 ----------
15/12 03:09:04.133096 0:mosTrcLayer_Create:00251: No debug actions enabled
15/12 03:09:04.133162 0:mosXmti_SetLastSdbgOpStatus:00750: Last XMTI status set to XMTI is online.
15/12 03:09:04.133169 0:mosDynamicLib_Open:00093: lib-name: libblkid.so.1
15/12 03:09:04.133304 0:mosDynamicLib_Open:00103: load success lib-name: libblkid.so.1
15/12 03:09:04.133909 0:mosDynamicLib_Open:00093: lib-name: libpmem.so.1.0.0:libpmem.so.1:libpmem.so:/usr/lib64/libpmem.so.1.0.0:/usr/lib64/libpmem.so.1:/usr/lib64/libpmem.so

성공한 LDAP 인증 및 로그인의 예(RHEL OS의 경우):

 15/12 03:09:28.422220 0x7fd8b1cfddb0:mosEventLog_PostInternal:00609: New event added. Message: "Command login received, User: 'test_user'. [144]". Additional info: ". Originating source IP: 127.0.0.1" Severity: Info
15/12 03:09:28.422354 0x7fd8b1cfddb0:ldapAuthMgr_GetLdapServiceRefByKey:02332: Failed to get LDAP service object by name - rc: LDAP_SERVICE_NOT_FOUND
15/12 03:09:28.422404 0x7fd8b1cfddb0:ldapAuthMgr_Authenticate:00711: base-dn: dc=TESTLDAP,dc=LAB,dc=COM, uri: ldap://TESTLDAP.COM:389, user: test_user, num-groups: 4
15/12 03:09:28.422732 (nil):mosOsThrd_StartFunc:00576: Starting thread () tid 293046
15/12 03:09:28.422888 (nil):mosLdap_SearchUserInDomainGroupsIntr:00463: Initializing - timeout: 8 (1)...
15/12 03:09:28.422911 (nil):mosLdap_InitConInternal:00046: Before ldap_initialize - URI: ldap://TESTLDAP.COM:389
15/12 03:09:28.423112 (nil):mosLdap_InitConInternal:00048: After  ldap_initialize - rc: 0
15/12 03:09:28.423125 (nil):mosLdap_InitConnection:00205: Connection was successfully established to ldap://TESTLDAP.COM:389 ldap service
15/12 03:09:28.423169 (nil):mosLdap_SearchUserInDomainGroupsIntr:00478: username: test_user, search-user: test_user, bind-user: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM
15/12 03:09:28.423172 (nil):mosLdap_SearchUserInDomainGroupsIntr:00481: Binding (1)...
15/12 03:09:28.423196 (nil):mosLdap_Bind:00120: Before ldap_sasl_bind - user-name: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM, timeout-sec: 8
15/12 03:09:28.423198 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 8 seconds
15/12 03:09:28.433429 (nil):mosLdap_Bind:00130: After ldap_sasl_bind - rc: 0, msg-id: 1
15/12 03:09:28.433458 (nil):mosLdap_Bind:00141: Set timeout to 7 sec
15/12 03:09:28.434458 (nil):mosLdap_Bind:00153: ldap_result: res-type: 0x61, result: 0x7fd86c045260
15/12 03:09:28.434470 (nil):mosLdap_Bind:00182: User id=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM was successfully binded to LDAP service
15/12 03:09:28.434475 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 0: 10 ms
15/12 03:09:28.434478 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 0, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.434479 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.436388 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 0, rc: SUCCESS
15/12 03:09:28.436394 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 1: 10 ms
15/12 03:09:28.436398 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 1, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.436401 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.437628 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 1, rc: SUCCESS
15/12 03:09:28.437632 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 2: 20 ms
15/12 03:09:28.437634 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 2, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.437635 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.438884 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 2, rc: SUCCESS
15/12 03:09:28.438890 (nil):mosLdap_SearchUserInDomainGroupsIntr:00532: Time passed till search of group 3: 20 ms
15/12 03:09:28.438894 (nil):mosLdap_SearchUserInDomainGroupsIntr:00538: Searching group: 3, filter: (&(uid=test_user)(memberOf=cn=Lab-Test,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM))
15/12 03:09:28.438896 (nil):mosLdap_SetTimeout:00072: Set library timeout to: 9 seconds
15/12 03:09:28.440113 (nil):mosLdap_SearchUserInDomainGroupsIntr:00546: Searching group: 3, rc: SUCCESS
15/12 03:09:28.440118 (nil):mosLdap_SearchUserInDomainGroupsIntr:00572: Un-binding...
15/12 03:09:28.441164 (nil):mosLdap_SearchUserInDomainGroupsIntr:00581: User test_user was found in 4 groups - search-user: ccmadm, bind-user: uid=test_user,ou=Operations,dc=TESTLDAP,dc=LAB,dc=COM, rc: SUCCESS, time: 20 ms
15/12 03:09:28.441647 0x7fd8b1cfddb0:ldapAuthMgr_Authenticate:00731: Completed - roles-mask: 0xF
15/12 03:09:28.441730 0x7fd8b1cfddb0:repType_AllocObjects:04767: Allocating 1 objects (first-index: 2) of type SESSION
15/12 03:09:28.441785 0x7fd8b16fadb0:repExtent_IO:03750: Writing to the repository - Extent: 7092, Page: 113778, Size: 8192, Batch size: 1, Last type: SESSION
15/12 03:09:28.445751 0x7fd8b170cdb0:repExtent_IO:03750: Writing to the repository - Extent: 7092, Page: 113778, Size: 8192, Batch size: 1, Last type: SESSION
15/12 03:09:28.447731 0x7fd8b1cfddb0:mosEventLog_PostInternal:00609: New event added. Message: "Command login succeeded. [144]". Additional info: "" Severity: Info

영향

 LDAP 인증 사용자는 MDM에 로그인할 수 없습니다. 각 LDAP 시도에서 MDM 전환

OpenLDAP를 사용할 때 Ubuntu에 해당하는 OS 관련 문제입니다.

PowerFlex 내부 함수는 baseDn 문자 번호를 인증 요청에 복사하려고 할 때 하드 코딩된 LdapDn char[256] 문자 크기(256)를 사용합니다. 여기서 연결 요청을 시작하기 위한 최대값은 FQDN(char[128])으로 표시되는 128자입니다.

연결 요청을 시작하기 위한 최대값은 128자이므로 인증 요청을 보내려고 하면 버퍼 오버플로가 발생합니다.

다른 OS에서 복사 작업은 실제 문자 수(128 미만)인 Fqdn(char[128])의 최소 문자를 복사합니다. Ubuntu에서는 LdapDn char[256] 길이(256)를 복사합니다.

영향을 받는 버전

PowerFlex 3.5.x.x

PowerFlex 3.6.x.x

수정된 버전

PowerFlex 3.5.1.6

PowerFlex 3.6.0.4