RHBA-2012:0844 - Bug Fix Advisory

Topic

Updated matahari packages that fix multiple bugs and add two enhancements are
now available for Red Hat Enterprise Linux 6.

Description

The matahari packages provide a set of APIs for operating system management that
are exposed to remote access over the Qpid Management Framework (QMF).

Note: The Matahari agent framework (matahari-*) packages are deprecated starting
with the Red Hat Enterprise Linux 6.3 release. Focus for remote systems
management has shifted towards the use of the CIM infrastructure. This
infrastructure relies on an already existing standard, which provides a greater
degree of interoperability for all users. It is strongly recommended that users
discontinue the use of the matahari packages and other packages which depend on
the Matahari infrastructure (specifically, libvirt-qmf and
fence-virtd-libvirt-qpid). It is recommended that users uninstall Matahari from
their systems to remove any possibility of security issues being exposed.

Users who choose to continue to use the Matahari agents should note the
following:

• The matahari packages are not installed by default starting with Red Hat

Enterprise Linux 6.3 and are not enabled by default to start on boot when they
are installed. Manual action is needed to both install and enable the matahari
services.

• The default configuration for qpid (the transport agent used by Matahari) does

not enable access control lists (ACLs) or SSL. Without ACLs/SSL, the Matahari
infrastructure is not secure. Configuring Matahari without ACLs/SSL is not
recommended and may reduce your system's security.

• The matahari-services agent is specifically designed to allow remote

manipulation of services (start, stop). Granting a user access to Matahari
services is equivalent to providing a remote user with root access. Using
Matahari agents should be treated as equivalent to providing remote root SSH
access to a host.

• By default in Red Hat Enterprise Linux, the Matahari broker (qpidd running on

port 49000) does not require authentication. However, the Matahari broker is not
remotely accessible unless the firewall is disabled, or a rule is added to make
it accessible. Given the capabilities exposed by Matahari agents, if Matahari is
enabled, system administrators should be extremely cautious with the options
that affect remote access to Matahari.

Note that Matahari will not be shipped in future releases of Red Hat Enterprise
Linux (including Red Hat Enterprise Linux 7), and may be considered for formal
removal in a future release of Red Hat Enterprise Linux 6.

This update fixes, among others, the following bug:

• Prior to this update, matahari agents were being unnecessarily restarted

during upgrades. As a consequence, unexpected output could appear during the
upgrade process. This update modifies the underlying code so that agents are not
restarted more than once and no more unexpected reporting occurs. (BZ#752325)

This update also adds the following enhancements:

• Prior to this update, no shell tool for using matahari agents was available.

This update adds a Python API and command-line shell to matahari. (BZ#723078)

• Prior to this update, the matahari interface could not identify Python scripts

written by users. This update adds the RPC agent to provide an API to execute
user-written Python scripts installed on the target machine. (BZ#759243)

All users of matahari are advised to upgrade to these updated packages, which
fix these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 723078 - RFE: Matahari Shell for sysadmin and scripting usage
• BZ - 759243 - gofer integration
• BZ - 795430 - service matahari-broker fails to start when qpid store module is available
• BZ - 803718 - Man pages for matahari agents not generated properly
• BZ - 805367 - Remove unnecessary Qpid headers and linking so Qpid ABI remains stable
• BZ - 806923 - Remove matahari package from non-x86 platforms in RHEL6.3

CVEs

(none)

References

(none)