- Qlustar General - Qlustar Mailing Lists

Mitigation for the Dirty Frag vulnerability
by no-reply-list＠qlustar.org 09 May '26

09 May '26

It was discovered [1] that the Linux kernel modules esp4, esp6 and rxrpc contain a logic flaw allowing a local attacker to escalate privileges to root. All Qlustar 13 and 14 Ubuntu releases are vulnerable to this bug. On Qlustar 13 Ubuntu releases the public exploit does not work though. To mitigate the issue until kernel updates are made available please proceed as follows: On the head-node execute: $ cat > /etc/qlustar/common/rc.boot/01-remove-vulnerable-kernel-modules << EOF #!/bin/bash modules_to_be_removed="esp4 esp6 rxrpc" for mod in \$modules_to_be_removed; do mod_paths=\$(find /usr/lib/modules/\$(uname -r) -name "\$mod.*") if [ -n "\$mod_paths" ]; then echo "Found vulnerable kernel module \$mod ==> Removing it" echo \$mod_paths | xargs rm -f fi rmmod \$mod > /dev/null 2>&1 done EOF $ chmod 755 /etc/qlustar/common/rc.boot/01-remove-vulnerable-kernel-modules Then on all running cluster nodes including the head-node execute: $ /etc/qlustar/common/rc.boot/01-remove-vulnerable-kernel-modules These changes will prevent loading the faulty kernel modules, which are not needed on any standard Qlustar HPC/AI/Storage cluster setup. [1] https://dirtyfrag.io

1 0

Security/Bug fix releases 14.1.2, 13.4.2
by no-reply-list＠qlustar.org 02 May '26

02 May '26

The Qlustar releases 14.1.2 and 13.4.2 are ready including a number of security/bug fixes. Please check the following web pages for details about security fixes and special update instructions: https://qlustar.com/qsa/2026/0502261 https://qlustar.com/qsa/2026/0502262 The following non-security related updates/enhancements/bug fixes are included: For Qlustar 14 only: - QluMan 14.1.4 * Alerts - Fixes/Improvements of the expression editor + Parse metric values as float and use QDoubleSpinBox for larger range of values. + Convert value to int when it's a whole number (e.g. use 16 instead of 16.0 in the expression). + Catch and show exception when opening expression editor. - Fixes/Improvements of the alert silencing dialog + Add ErrorDialog when fetching silences fails. + Reset input mask on save. + Reset color for Starts label when selection changes. + Fix exception about c++ object deleted on update. * Slurm ManageAssociations - Convert value to str before setting text in QOSLineEdit.undo(). * Command editor - Remove duplicate save of command when the name is changed. - Don't trigger a save when setting the argument filters while selecting a command. * Switch support - Remove host_id from SwitchData entries when deleting hosts. - Add the rights for SwitchData and query_switch to the 'Can configure hosts.' right. - Delete switch data if a switch is being deleted. * Misc - Fix local variable collision preventing qlustar module files getting copied to netboot nodes for lustre nodes. - nvidia-570 module * nvidia-persistenced: Enforce persistence-mode at startup. - lustre-2.17 + lustre-client module * Make ko2iblnd work with mlnx-ofed (doca).

1 0

Mitigation for the Copy Fail vulnerability - actions refined
by no-reply-list＠qlustar.org 01 May '26

01 May '26

It was discovered that the Linux kernel algif_aead module contained a logic flaw allowing a local attacker to escalate privileges to root. All Qlustar 14 Ubuntu releases are vulnerable to this bug. Qlustar 13 Ubuntu releases are not vulnerable and Qlustar 13/14 AlmaLinux releases are vulnerable but the public exploit does not work there. To mitigate the issue until kernel updates are made available please proceed as follows: On all running Qlustar 14 Ubuntu nodes including the head-node execute $ rmmod algif_aead $ rm -f /usr/lib/modules/*/kernel/crypto/algif_aead.ko Then for each Qlustar 14 image do $ qlustar-image-edit -s <img-name> $ rm -f usr/lib/modules/*/kernel/crypto/algif_aead.ko $ exit Please note the missing / at the beginning of the path here. These changes will prevent loading the faulty algif_aead kernel module, which is not needed on any standard Qlustar HPC/AI cluster setup. To check whether a node was already exploited execute $ diff /union/image/usr/bin/su /usr/bin/su If they differ, someone definitely has exploited the bug and became root. In that case reboot the node immediately after you have changed the image like explained above.

1 0

Mitigation for the Copy Fail vulnerability
by no-reply-list＠qlustar.org 30 Apr '26

30 Apr '26

It was discovered that the Linux kernel algif_aead module contained a logic flaw allowing a local attacker to escalate privileges to root. All Qlustar 14 Ubuntu releases are vulnerable to this bug. Qlustar 13 Ubuntu releases are not vulnerable and Qlustar 13/14 AlmaLinux releases are vulnerable but the public exploit does not work there. To mitigate the issue until kernel updates are made available please proceed as follows: On all running Qlustar 14 Ubuntu nodes including the head-node execute $ rmmod algif_aead $ rm -f /usr/lib/modules/*/kernel/crypto/algif_aead.ko Then for each Qlustar 14 image do $ qlustar-image-edit -s <img-name> $ rm -f usr/lib/modules/*/kernel/crypto/algif_aead.ko $ exit 0 These changes will prevent loading the faulty algif_aead kernel module, which is not needed on any standard Qlustar HPC/AI cluster setup.

1 0

Qlustar at the HPC-AI Swiss Conference
by no-reply-list＠qlustar.org 18 Apr '26

18 Apr '26

Q-Leap Networks is sponsoring the HPC-AI Swiss Conference. The Qlustar team will be present there with a booth to showcase the current state of Qlustar and present the solutions built around it. If you are taking part in the conference, please step by to have a chat and ask us for a Qlustar overview or enjoy a live demo of the latest features. Looking forward to see you there. [1] https://www.hpcadvisorycouncil.ch/

1 0

Upgrade from Qlustar 13 to 14
by Rolandas Naujikas 09 Apr '26

09 Apr '26

Hi, I did upgrade from Qlustar 13 to 14 successfully, but there are some notes, probably important for others. 0. Before upgrade I removed HA components on Head node, we didn't use them and they created problems with "apt dist-upgrade" on test cluster. 1. LDAP server warning olcPasswordHash: value #0: setting password scheme in the global entry is deprecated. The server may refuse to start if it is provided by a loadable module, please move it to the frontend database instead could be solved with ldapmodify -c -H ldapi:/// <<EOF dn: cn=config changetype: modify delete: olcPasswordHash - dn: olcDatabase={-1}frontend,cn=config changetype: modify add: olcPasswordHash olcPasswordHash: {CRYPT} - EOF 2. Missing backup-qlustar-db /bin/sh: 1: /usr/share/qlustar/exec/backup-qlustar-db: not found could be solved by commenting line in /etc/cron.d/qluman-server 3. Prometheus/grafana works OK after suggestion to add boot config implicitly (for e.g. default). 4. In docs at https://docs.qlustar.com/Qlustar/14/ClusterOS/release-notes.html#_update_in… it is suggested to run cp -a /etc /var/backups/etc-qlustar-14 when it is better to name backups on version it was run so cp -a /etc /var/backups/etc-qlustar-13 I had to change /etc/default/slurmdbd and other old config files to silent some warnings in new version. 5. When running step 9. of update I found mariaDB not running, so I had it start manually (in qlustar-post-update.sh I let remove old qlustar 13 components). 6. In grafana I still missing the way to see all compute nodes in one page as in ganglia, of cause it doesn't scale to bigger number of nodes and probably could be made with custom grafana configuration. Also I didn't yet find the way to allow browsing of data without authentication, but with restriction by IP addresses. Regards Rolandas

2 1

Qlustar upgrade 14.1.3
by Rolandas Naujikas 09 Apr '26

09 Apr '26

Hi, I'm trying update noble chroot and getting (why spack is to be removed): (noble) root@lxibm000:~ # apt dist-upgrade Reading package lists... Done Building dependency tree... Done Reading state information... Done Calculating upgrade... Done The following packages were automatically installed and are no longer required: cmake cmake-data cpio curl file ibverbs-providers icu-devtools libarchive13t64 libbsd-dev libbz2-dev libclingo libcudart12 libcurl4t64 libdb-dev libdb5.3-dev libedit-dev libevent-2.1-7t64 libevent-dev libevent-extra-2.1-7t64 libevent-openssl-2.1-7t64 libevent-pthreads-2.1-7t64 libexpat1-dev libffi-dev libgdbm-dev libhwloc-dev libhwloc-plugins libhwloc15 libibverbs-dev libibverbs1 libicu-dev libjsoncpp25 libltdl-dev libltdl7 liblustre-2.15 libmagic-mgc libmagic1t64 libmd-dev libmunge-dev libmunge2 libncurses-dev libncurses6 libnl-3-200 libnl-3-dev libnl-genl-3-200 libnl-genl-3-dev libnl-route-3-200 libnl-route-3-dev libnuma-dev libnuma1 libnvidia-ml1 libnvpair3 libpciaccess-dev libpciaccess0 libpkgconf3 libpmi2-0 libpmi2-0-dev libpmix-dev libpmix2 libpython3-stdlib librdmacm-dev librdmacm1 libreadline-dev librhash0 libsigsegv-dev libslurm42 libslurm43 libsqlite3-dev libssl-dev libtext-unidecode-perl libtirpc-common libtirpc3t64 libucx-dev libucx0 libunwind8 libuutil3 libuv1t64 libxml-libxml-perl libxml-namespacesupport-perl libxml-sax-base-perl libxml-sax-perl libxml2-dev libyaml-0-2 libyaml-dev libzfs4 libzpool5 libzstd-dev lustre-2.15-utils mercurial mercurial-common patchelf pigz pkgconf pkgconf-bin python3 python3-cffi-backend python3-clingo python3-minimal python3.12 python3.12-minimal tex-common texinfo texinfo-lib ucf zfsutils zlib1g-dev zstd Use 'apt autoremove' to remove them. The following packages will be REMOVED: lustre-2.15-dev ql-hpl-tools spack The following NEW packages will be installed: libnvidia-ml1 libslurm43 The following packages will be upgraded: base-files binutils binutils-common binutils-x86-64-linux-gnu bsdextrautils bsdutils coreutils cpp-13 cpp-13-x86-64-linux-gnu curl dirmngr g++-13 g++-13-x86-64-linux-gnu gcc-13 gcc-13-base gcc-13-x86-64-linux-gnu gcc-14-base gfortran-13 gfortran-13-x86-64-linux-gnu gnupg gnupg-utils gpg gpg-agent gpgconf gpgsm gpgv ibverbs-providers inetutils-telnet keyboxd libarchive13t64 libasan8 libatomic1 libbinutils libblkid1 libc-bin libc-dev-bin libc6 libc6-dev libcc1-0 libclingo libctf-nobfd0 libctf0 libcudart12 libcurl3t64-gnutls libcurl4t64 libexpat1 libexpat1-dev libgcc-13-dev libgcc-s1 libgfortran-13-dev libgfortran5 libglib2.0-0t64 libglib2.0-data libgnutls30t64 libgomp1 libgprofng0 libhwasan0 libhwloc-dev libhwloc-plugins libhwloc15 libibverbs-dev libibverbs1 libitm1 libldap2 liblsan0 libmount1 libmunge-dev libmunge2 libnftables1 libnuma-dev libnuma1 libnvpair3 libpmi2-0 libpmi2-0-dev libpmix-dev libpmix2 libpython3.12-minimal libpython3.12-stdlib libpython3.12t64 libquadmath0 librdmacm-dev librdmacm1 libsframe1 libsmartcols1 libsodium23 libssh-4 libssl-dev libssl3t64 libstdc++-13-dev libstdc++6 libsystemd0 libtasn1-6 libtsan2 libubsan1 libucx-dev libucx0 libudev1 libuuid1 libuutil3 libxml2 libxml2-dev libzfs4 libzpool5 linux-libc-dev locales mount nftables openssh-client openssl python3-clingo python3.12 python3.12-minimal qlustar-base qlustar-sources-list-14 telnet tzdata util-linux vim vim-common vim-runtime zfsutils 121 upgraded, 2 newly installed, 3 to remove and 0 not upgraded. Need to get 140 MB of archives. After this operation, 48.6 MB disk space will be freed. Do you want to continue? [Y/n]

1 1

Security/Bug fix releases 14.1.1, 13.4.1
by no-reply-list＠qlustar.org 09 Apr '26

09 Apr '26

The Qlustar releases 14.1.1 and 13.4.1 are ready including a number of security/bug fixes. Please check the following web pages for details about security fixes and special update instructions: https://qlustar.com/qsa/2026/0408261 https://qlustar.com/qsa/2026/0408262 The following non-security related updates/enhancements/bug fixes are included: For Qlustar 14 only: - QluMan 14.1.3 * GUI - Fix changing of password for the QluMan Key Safe - BootConfig dialog: - Add Clone/Edit/Delete buttons - Add Clone context menu - Drop obsolete PXECommand - LDAP Import From AD dialog: - Add additional confirmation popup before starting the 'Create Users' process * Switches support - Hide switch NIC in selection for new Network Configs - Generate dhcp entries for switches - Add NIC named 'switch' for assigning MACs to switches * Slurm NodeStateManagement - Fix Reboot action - Map slurm node name back to qluman node name for RxEngine calls - Use slurm node name in EnclosureView tab instead of qluman node name * Alerts - Change default repeat interval for emails to 24h (applies only to new alerts) * Node/MAC detection from Switches + Dynamic Node booting - Use real IP of HA headnodes in dynamic networks as listen-address for dnsmasq - Give each HA headnode a different dynamic IP range - Allow duplicate MAC entries in SwitchData - Filter out uplink ports, remove MACs from switch if no longer present * Misc: - Drop obsolete nis-server from dnsmasq config

1 0

Missing dashboards in Grafana after upgrade
by Nicolai, Wouter 12 Mar '26

12 Mar '26

Hi, I managed to upgrade from 13 to 14 following the upgrade guide, but am missing all predefined dashboard of Grafana. Is there an alternative way to obtain these dashboards? Are the json files somewhere available? Thanks, Wouter

5 5

Security/Bug fix releases 14.1.0, 13.4.0
by no-reply-list＠qlustar.org 21 Feb '26

21 Feb '26

The Qlustar releases 14.1.0 and 13.4.0 are ready including a number of security/bug fixes. Please check the following web pages for details about security fixes and special update instructions: https://qlustar.com/qsa/2026/0220261 https://qlustar.com/qsa/2026/0220262 https://qlustar.com/qsa/2026/0220263 The following non-security related updates/enhancements/bug fixes are included: For Qlustar 13 and 14: - Update to HPC Core Stack 02/26 (see separate announcement) For Qlustar 14 only: - QluMan 14.1.0 * New feature: Node/MAC detection from Switches + Dynamic Node booting * Alerts: - Assign cloned alerts to the new alert config - Force alert names to be unique * Network proxy: - Catch already closed sockets when other side closes the connection - Turn down info message for socket forwarding * slurm: - use nodes visible hostname in slurm config - Re-enable GUI accounting menu when working with 13.x clusters - Only use 256MB MemSpecLimit for demo nodes at install time * qluman-slurmd - Port to new pyslurm API to support slurm 25.05.x - Multiple bug fixes

3 2

2026

2025

2024

2023

2022

2021

2020

2019

2018

Qlustar General