A few months ago the company I work for needed a small NAS solution for an office. It wasn’t to be used for any real service related items, just backups of local machines and such.
After looking at all the alternatives, we decided to give a new vendor a shot. Aberdeen INC has wide array of storage products at unbeatable prices when compared to the major brands. We decided to go with a 4TB NAS running windows 2003 Appliance Edition, since there was very little documentation on their Linux system.
After ordering the system, it only took a week for the machine to arrive at the office. Opening up the box, it soon became apparent that Aberdeen actually just built the machines by hand with off the shelf parts. The enclosure was quite possible the cheapest looking 2U case available. Also included the box were an array of spare parts and boxes to devices included in the system.
I really didn’t care how it looked as long as it performed its job admirably. Once we managed to get the cheap rail kit on the rack, the machine started up without issue. After a few hours of testing though, it became apparent that any attempt to mount an NFS share would result in a BSOD. (Blue Screen of Death).
After a few days of back and forth with Aberdeen tech support, the techs concluded that the best bet was to send the unit back to them for further testing. I asked about a replacement unit, but it turns out that Aberdeen has zero inventory. Every machine is hand built upon ordering!
A week after the machine arrived at Aberdeen, I called for a status update.
me: What is the status on the repair?
tech: We just got it on the rack today and started running diagnostics..
me: Did you attempt to recreate the crash issue by mounting an NFS share?
tech: We are currently running diagnostics, so we will not do anything at this time.
A few days later I called Aberdeen to see what the status was on my repair. They hadn’t attempted to actually take the steps to recreate the issue I was having with my system! I finally convinced a tech to mount a freaking NFS share but surprise surprise:
me: Please just mount an nfs share.
tech: We do not have any Linux tech support on site, we will have to bring in a developer to recreate this issue.
It took 2 more weeks for them to finally recreate the issue, and they couldn’t even come up with a solution. They offered to replace the windows system, but recommended the Linux system. Of course, they had to build the system from scratch, but I figured maybe the Linux box would be a better option, as long as it worked with AD.
Here is a quick timeline:
March 13th Abernas ordered
March 20th Abernas shipped
March 27th Abernas returned
May 19th Replacement shipped
I received the replacement over 2 months after my original order. When I setup the replacement unit, I initially had trouble getting it to integrate with our AD realm. After calling to get some help, I became aware that absolutely nobody in tech support knew anything about this product.
In order to get support for Linux product, I ended up being referred to a software developer, a week after my first support call on the AD issue. The catch was, the developer was not even employed with Aberdeen. This whole NAS setup was just a bunch of off the shelf parts slapped together with third party software.
I managed to get Linux AberNAS running well with our AD realm but the final issue that left me completely disgusted with Aberdeen came a few weeks later. After doing some routine security scans, it became apparent that the versions of samba and rsyncd used on the Abernas are open to remotely exploitable security vulnerabilties.
I contacted Aberdeen about the issue and received the following response:
From: Tracy Gardner
To: Alex Valentine
Subject: RE: Abernas Linux Patches
Date: Mon, 19 Jun 2006 20:40:14 -0700 (23:40 EDT)
Hello again Alex.
Thanks for your continued patience.
After much debate and discussion it has been decided that there will be
no new security patch created for our Linux Nas at this time.
Most of the Security Check Tools will always report samba/rsync is
vulnerable if the samba/rsync is not the latest. Security Check Tools
always complain samba/rsync is vulnerable.
Even if we upgrade samba and rsync to latest one as time passes it
becomes vulnerable again in terms of security tool viewpoint. So far
we have not had any problems with any incidents since selling this unit
and do not see any type of security patch being done in the near future.
If you have any further questions or comments regarding this let me
know.
Thanks again.
Tracy T. Gardner
Customer Service/RMA/Technical Support Manager
Aberdeen LLC
The response was basically “New security Vulnerabilities come out” and “tools use version numbers.” The fact is that the Abernas is remotely vulnerable and Aberdeen is not releasing updates. I responded with the following message:
From: Alex Valentine
To: Tracy Gardner
Subject: RE: Abernas Linux Patches
Date: Tue, 20 Jun 2006 10:53:07 -0400
Tracy,
Thanks for getting back to me, but I have to say that I’m somewhat
shocked with the response.
There is a remote vulnerability on your product, and you are not
providing a patch for it because a new vulnerability will come out
sooner or later? Why should ANY company even bother patching their
software? Do you realize how insane this logic is?
That would be like saying, “I’m not going to clean my house because it’s
just going to get dirty anyway.” Yes, vulnerability scanners use version
numbers, but that does not make the reading incorrect.
How about if I exploit the vulnerabilities on the AberNAS and publish
the results? Would that somehow convince you to actually support your
product by actually providing security updates?
Look at the Samba vulnerability, every major Linux distribution chose to
patch that samba hole nearly two years ago.
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2004-0815
I have to say, between the 2 month battle to get a working machine and
now the pushback on actually keeping your product updated and secure, we
have the makings of a great cautionary tale.
Sincerely,
Alex Valentine
After my experience with Aberdeen, I would highly recommend avoiding them like the plague. Your better off building something yourself, instead of purchasing a product from a vendor that has:
- zero inventory
- zero trained support technicians
- zero software updates
- zero security awareness