Cisco CML and Cisco VIRL-PE
Cisco CML and Cisco VIRL-PE software releases 2.0 and later do not run the salt-master service.
For Cisco CML and Cisco VIRL-PE deployed in standalone mode, administrators can check the status of the salt-master service and disable the service as shown in the following example:
virl@virl:~$ sudo systemctl status salt-master
? salt-master.service - The Salt Master Server
Loaded: loaded (/lib/systemd/system/salt-master.service; disabled; vendor preset: enabled)
Drop-In: /etc/systemd/system/salt-master.service.d
+-override.conf
Active: active (running) since Thu 2020-05-28 17:55:10 GMT; 1s ago
Docs: man:salt-master(1)
file:///usr/share/doc/salt/html/contents.html
https://docs.saltstack.com/en/latest/contents.html
--- Output Omitted ---
virl@virl:~$ sudo systemctl stop salt-master
virl@virl:~$ sudo systemctl disable salt-master
Synchronizing state of salt-master.service with SysV init with /lib/systemd/systemd-sysv-install...
Executing /lib/systemd/systemd-sysv-install disable salt-master
insserv: warning: current start runlevel(s) (empty) of script `salt-master' overrides LSB defaults (2 3 4 5).
insserv: warning: current stop runlevel(s) (0 1 2 3 4 5 6) of script `salt-master' overrides LSB defaults (0 1 6).
virl@virl:~$
For Cisco CML and Cisco VIRL-PE deployed in cluster mode, administrators can check the status of the salt-master service and disable the service on all compute nodes. Follow the steps shown above for standalone deployments. On the cluster controller node, ensure that the salt-master is listening only on the private network interface for inter-cluster communication, as shown in the following example:
virl@virl:~$ netstat -tulpn | grep 450
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 172.16.10.250:4505 0.0.0.0:* LISTEN -
tcp 0 0 172.16.10.250:4506 0.0.0.0:* LISTEN -
virl@virl:~$
If the salt-master is listening on all interfaces as shown in the following example, customers will need to upgrade to a patched release:
virl@virl:~$ netstat -tulpn | grep 450
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
tcp 0 0 0.0.0.0:4505 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:4506 0.0.0.0:* LISTEN -
virl@virl:~$
Cisco TelePresence IX5000 Series
To disable Salt services permanently on Cisco TelePresence IX5000 Series, modifications must be made to the startup script files, which requires root access on the device. For assistance, contact the Cisco TAC through your support organization.