Strengthen secure shell (SSH) protocol / security / communication between the nodes.
Note: SSH communication is secured by default when you upgrade the nodes to Platform Release 2022E and higher.
Before You Begin
Enable root access on the nodes if root access is disabled.
Procedure
Log on to any one of the nodes in the storage pool as root user.
Navigate to the following folder:
# cd /opt/commvault/MediaAgentRun the following script:
# ./cvavahi.py secure_hsOutput similar to the following will be displayed:
INFO: Processing SSH configurations...
INFO: Setting SSH cipher configurations...
Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc
INFO: Completed setting SSH cipher configurations successfully...
INFO: Setting SSH MAC configurations...
MACs hmac-sha2-512,hmac-sha2-256,hmac-sha1,hmac-sha1-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com
INFO: Completed setting SSH MAC configurations successfully...
INFO: Setting SSH KexAlgorithms configurations...
INFO: Completed setting SSH Kex Algorithms configurations successfully...
Removed symlink /etc/systemd/system/multi-user.target.wants/avahi-daemon.service.
Removed symlink /etc/systemd/system/sockets.target.wants/avahi-daemon.socket.
Removed symlink /etc/systemd/system/dbus-org.freedesktop.Avahi.service.
Warning: Stopping avahi-daemon.service, but it can still be activated by:
avahi-daemon.socket
Removed symlink /etc/systemd/system/multi-user.target.wants/httpd.service.
WARNING: Unable to update sysctl file.
INFO: /etc/sysctl file updated successfully
INFO: File permissions updated successfully
Unable to find home directory for user[gluster]
Unable to find home directory for user[insights]
INFO: user home directories permission set successfully.
INFO: umask set to 077 successfully...
INFO: user umask set successfully to 077.
INFO: Anonymous root login disabled.
INFO: All security changes completed successfullyRepeat the above steps from all the nodes in the storage pool.
What to Do Next
Disable root access, if root access was previously disabled.