perfSONAR Announcements

[Mark Feit <>]

Yesterday’s statement about the Log4j vulnerability spurred a few questions from people wanting to know how to determine if the services are running on their systems.  Nothing has changed; these are clarifications.

 

Cassandra.  This will be present on any perfSONAR system running the perfsonar-core, perfsonar-toolkit or perfsonar-centralmanagement bundles.  You can identify its presence by the cassandra package being installed on the system.

 

MaDDash.  This will be present on any perfSONAR system running the perfsonar-centralmanagement bundle.  You can identify its presence by the maddash package being installed on the system.

 

To reiterate, the feature containing the vulnerable code is not present in Log4j 1.x, which is what Cassandra and MaDDash are using.

 

Lookup Service.   Most perfSONAR nodes registering with the lookup service use the central server operated by the perfSONAR project, which has been patched.  Private lookup servers are uncommon but can be identified by the presence of the lookup-server package on the system.     If that package is present, take the steps outlined in https://github.com/esnet/simple-lookup-service/wiki/Apache-log4j-Remote-Code-Execution-vulnerability to disable the vulnerable code.

 

 

To check for the presence of a package on CentOS, use rpm -q packagename.  For Debian and Ubuntu, use apt list packagename and look for the [installed] tag next to its name.

 

 

As always, if you have questions, please drop us a line at .