Upgrading VRTSsfmh package to address TLS 1.0/1.1 security issues on Solaris 10

Description

This guide provides detailed instructions on upgrading the VRTSsfmh package on Solaris 10 to version 7.1.0.800, which enables TLS 1.2 by default.

Version 7.0.0.500 and earlier versions rely on TLS 1.0 and 1.1, which are considered insecure and deprecated. To comply with the latest security standards, there is a need to upgrade to 7.1.0.800 (the latest version that supports Solaris 10 and TLS 1.2)

As all versions of VRTSsfmh higher than 7.1 only support Solaris 11, this guide ensures compatibility with Solaris 10.

This guide applies to:

• Operating System: Solaris 10
• VRTSsfmh Versions: 7.0.0.500 (or earlier)
• Target Version: 7.1.0.800

Solution

1) Verify the currently installed version of VRTSsfmh using the below command:

# pkginfo -l VRTSsfmh

If the version is 7.0.0.500 or earlier, proceed with the commands further below.

2) Remove the currently installed version of VRTSsfmh from

# pkgrm VRTSsfmh

3) Install the base version of VRTSsfmh 7.1 using the provided installation file:

# pkgadd -d /path/to/VRTSsfmh_7.1.pkg

NOTE: Replace /path/to/VRTSsfmh_7.1.pkg with the actual path to the package file.

4) Confirm that the base version 7.1 is installed using: 

# pkginfo -l VRTSsfmh

The output should display version 7.1.

5) Install the patch (VRTSsfmh_7.1.0.800.patch) to upgrade the package to version 7.1.0.800 using:

# /opt/VRTSsfmh/bin/vomadm hotfix --install ./*vom-7.1.0.800.sfa

NOTE: Ensure the actual path to the patch file is correct.

6)  Verify the patch installation by checking the version again to ensure the patch has been applied successfully using: 

# pkginfo -l VRTSsfmh

The version should now display as 7.1.0.800.

7) After the upgrade, verify that TLS 1.2 is being used. Use tools like openssl or other network scanning utilities to confirm this.

Example:

# openssl s_client -connect <hostname>:<port> -tls1_2

Replace <hostname> and <port> with the appropriate values for the environment.

8) As a final check, from the VIOM GUI, ensure that the managed host is able to be refreshed without error