Data Domain: Modifying the default admin ports "ssh (22) and https (443)"

When the user runs the adminaccess cli to change the default ports for ssh and
https, inaddition to opening up the new port the default port of 443 and 22 are
not changed in the admin interface.

When user modifies the ports being used on the DDR, Sometimes it is just a
matter of specifying a port in the command line, while at other times it takes
an application command change. 

Two of these port that can be changed are ssh(22) and https (443). 
The ssh is used to do the majority of configuration and https can also be used.
The netfilter allow access to ssh port by default and it is also used as one of 
the two ports to access the net filter administration interface. The other port
is 443.  The default ports can be disabled, but the net filter administration 
ports cannot be turned off.  This prevents the user from getting locked out of 
the system by setting the wrong things in the net filter.  There is one new
function that increases the accessibility through the netfilter: 
auto ports to allow access to ports that programs are listening to on the DDR.

If the customer changes the ssh and https ports to ports that are not default
ports they can be locked out of the system if they also disable the net port
auto feature of netfilter. In that case they would have to have a support
person boot the system up in single user mode and change the registries to
allow the user access again.

If the ssh port is changed then one of three things are needed:

1 The net filter auto function needs to be enabled or stay enabled if possible.
2 The new port is enabled using the "se net filter add operation allow" command
3 Run "net filter stop" command before changing the ssh port number.

Here are the possible cases that can happen:

1) Fresh install of release 6.2
2) Upgrade from 6.1 to 6.2, port 22 is not changed, net filter auto is on
3) Upgrade from 6.1 to 6.2, port 22 is changed, net filter auto is on
4) Upgrade from 6.1 to 6.2, port 22 is not changed, net filter auto is not on
5) Upgrade from 6.0 to 6.2, port 22 is not changed
6) Upgrade from 6.0 to 6.1, port 22 is not changed
7) Upgrade from 5.7 to 6.1, port 22 is not changed
8) Upgrade from 5.7 to 6.1, port 22 is changed
9) Upgrade from 5.7 to 6.0, port 22 is not changed
10) Upgrade from 5.7 to 6.0, port 22 is changed
11) Running 6.0, port 22 is changed - This is invalid 
12) Running 6.1, port 22 is changed, net filter auto is off - invalid

1) Fresh install of release 6.2
No issues and ssh port can be changed without issues as long as auto is not
deleted.  If the customer wants or requires auto to be turned off and wants to
change ports that are not well known then the support should use the 

"se net filter add operation allow protocol tcp ports <new port number>"
or for UDP ports
"se net filter add operation allow protocol udp ports <new port number>"

to allow the new ports to connect.  One advantage to this is this can be
restricted to specific client addresses and restricted to specific local
interfaces or addresses depending on the customer's security preference.  This
requires support assistance and be running as a SE.

2) Upgrade from 6.1 to 6.2, port 22 is not changed, net filter auto is on
This is not a problem and will work OK.  The control of "net filter auto" will
now require SE permissions.  Since the release is 6.2 the explanation of case 1
applies to this case.

3) Upgrade from 6.1 to 6.2, port 22 is changed, net filter auto is on
This is not a problem and will work OK.  The control of "net filter auto" will
now require SE permissions.  Since the release is 6.2 the explanation of case 1
applies to this case.

4) Upgrade from 6.1 to 6.2, port 22 is not changed, net filter auto is not on
This is not a problem and will work OK.  The control of "net filter auto" will
now require SE permissions.  Since the release is 6.2 the explanation of case 1
applies to this case.

5) Upgrade from 6.0 to 6.2, port 22 is not changed
This is not a problem and will work OK.  The control of new "net filter auto"
will require SE permissions.  Since the release is 6.2 the explanation of case
1 applies to this case.

6) Upgrade from 6.0 to 6.1, port 22 is not changed
This is not a problem and will work OK.  The explanation of case 1 applies to
this case.  Be aware that net filter auto is controlled by the user.  It can be
turned off at anytime and if the user wants to change port SSH the customer
will get locked out unless the scenario of case 1 is followed. That will
require a support person and therefore it is a real danger that the customer
will not be aware of that and get locked out.  The customer should be informed
of this potential.

7) Upgrade from 5.7 to 6.1, port 22 is not changed
Release 5.7 does not have the net filter available.  Therefore it cannot be
locked out by switching the SSH port number to something else.  In this case
since the SSH port has not been changed, upgrade is not a problem.  The port
can even be changed because net filter auto will be on.  Be aware that the
customer can turn off the net filter auto and if the ssh port number is changed
the customer will be locked out.  If the net filter auto needs to be turned
off, follow steps in case 1, but those require support due to the SE command. 
Therefore the customer may not be aware of this and add the needed
configuration.  The customer should be informed of this potential.

8) Upgrade from 5.7 to 6.1, port 22 is changed
Release 5.7 does not have the net filter available.  Therefore it cannot be
locked out by switching the SSH port number to something else.  The upgrade
will not be a problem because the net filter will become active and by default
it will have net filter auto operation on.  Be aware that net filter auto is
controlled by the user.  It can be turned off at anytime and if the user wants
to change port SSH the customer will get locked out unless the scenario of case
1 is followed. That will require a support person and therefore it is a real
danger that the customer will not be aware of that and get locked out.  The
customer should be informed of this potential.

9) Upgrade from 5.7 to 6.0, port 22 is not changed
Release 5.7 does not have the net filter available.  Therefore it cannot be
locked out by switching the SSH port number to something else.  In this case
since the SSH port has not been changed, it is not a problem.  If the customer
does change the SSH port number after this it will lock out the system.  The
customer should be made aware of this.

10) Upgrade from 5.7 to 6.0, port 22 is changed
Release 5.7 does not have the net filter available.  Therefore it cannot be
locked out by switching the SSH port number to something else.  The upgrade
will cause the system to be locked out unless the new port number happens to be
another default - highly unlikely.  In this case something MUST be done before
the upgrade.  There are 2 options: 
   change the SSH port back to 22, or 
   set a registry flag to prevent the netfilter from coming active with 6.0.  

To do this the support person would need to run the following command:

reg set config_master.net.filter.stopped true

What this will do is to set the net filter to off. After the upgrade when the
system is being brought up it will check this flag and since it is indicating
that the net filter needs to be stopped (not started), it will not run the net
filter and therefore will not block the port.  If the customer wants the net
filter to be running, the following can be done

After logging in, run two commands:
"net filter start" 
"se net filter add operation allow protocol tcp ports <new SSH port number>"

The first command will start the net filter and the second command will add the
filter function that will allow new connections to SSH with the new port number
to be ALLOW.  The support person will not be blocked because all current
connections are maintained and not dropped.

11) Running 6.0, port 22 is changed - This is invalid 
This condition cannot exist without the DDR/DDVE system being locked out unless
the port chosen happens to be supported by the defaults ports.  Not likely, but
it is possible that one of the default ports that is not currently being used
by another application is chosen or the port is allowed using the

"se net filter add operation allow" command mentioned in case 1. 

12) Running 6.1, port 22 is changed, net filter auto is off - invalid
This condition cannot exist without the DDR/DDVE system being locked out unless
the port chosen happens to be supported by the net filter default ports.  Once
the auto ports are turned off the default ports used by the DDR become active. 
It is possible that one of the default ports that is not currently being used
by another application is chosen or the port is allowed using the

"se net filter add operation allow" command mentioned in case 1.

In any of these cases with the original release being 6.0 or 6.1, if the user
already added using the

"se net filter add operation allow protocol tcp ports <new SSH port number>"

function for for the new SSH port number, then there
will be no problem with the upgrade the net filter function will be carried
forward.