Resolved Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

[Sebahat.hadzhi]

@D3nnis3n , are you referring to the workaround from this article. If yes, does the update actually fail or you only get warnings? I am asking because it is normal to get the warnings with that workaround.

 

[learning_curve]

Well, we don't - but the source files are still included in apt.

If you have already removed the Imunify360 Extension, then why have you not also removed the associated file from within: /etc/apt/sources.list.d/
That's straightforward & will immediately resolve the issues below assuming... that Imunify360 is the only package that you still have this issue with?

The workaround noted by Plesk also doesn't help - the Imunify repositories are still considered to be in failure and as such we still get an e-mail every day noting to us that updating failed.

See above

 

[D3nnis3n]

@D3nnis3n , are you referring to the workaround from this article. If yes, does the update actually fail or you only get warnings? I am asking because it is normal to get the warnings with that workaround.

_Manual_ updating never failed, the issue is the warnings are seen as error which leads to the Plesk configured automatic updates _not_ working and sending an update failed e-mail every day.

If you have already removed the Imunify360 Extension, then why have you not also removed the associated file from within: /etc/apt/sources.list.d/
That's straightforward & will immediately resolve the issues below assuming... that Imunify360 is the only package that you still have this issue with?

It is readded on every execution of Plesk Installer.

 

[learning_curve]

It is readded on every execution of Plesk Installer.

Do you mean, that in your case / on your server(s), that the Imunify360 associated file has been added back into: /etc/apt/sources.list.d/ as part of every Plesk Main Upgrade and / or Plesk Point Upgrade, even WHEN you didn't have the Imunify360 extension installed, when invoking those upgrades?

That's strange if you do, as it certainly isn't in our case.
FWIW It's never, ever been added back during any daily manual upgrades (e.g. Ubuntu / Plesk CLI updates via CLI #apt) any way.

Have you actually deleted it, but then seen it be added back, since you upgraded to Obsidian 18.0.70 #MU 1 and removed the Imunify360 extension?

 

[D3nnis3n]

So we figured this one out as well. The workaround is bad.

It configures:

APT::Key::Assert-Pubkey-Algo ">=dsa1024,rsa4096,rsa3072";

However, this line will replace the defaults, e.g. if this is configured, what is accepted by default will no longer be accepted when it is not in that configuration.
That was the case for rsa2048 for us, which is used by elasticsearch repository - which then was no longer trusted and caused the actual upgrade error.

Use the following instead to accept the insecure Imunify key and all default accepted ones.

APT::Key::Assert-Pubkey-Algo ">=dsa1024,>=rsa2048,ed25519,ed448";

 

[learning_curve]

~~~
Use the following instead to accept the insecure Imunify key and all default accepted ones.

APT::Key::Assert-Pubkey-Algo ">=dsa1024,>=rsa2048,ed25519,ed448";

Not commenting on the Plesk workaround. Plesk can do that.
The workaround below, was posted on the very 1st page of this thread, but the Imunify360 related issue was still an issue (at the time of that post)

Resolved - Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

Hi Plesk Support Team and Community, I’m running into an issue with the Plesk repositories on my Ubuntu 24.04 LTS server and would appreciate some guidance. When I run sudo apt update, I get warnings about the Plesk repositories using a weak algorithm (DSA1024) for their signatures. The...

talk.plesk.com

Either of those ^ should (currently) prevent you from experiencing this:

_Manual_ updating never failed, the issue is the warnings are seen as error which leads to the Plesk configured automatic updates _not_ working and sending an update failed e-mail every day.

However, the other (separate) questions, relating to the Imunify360 associated file, being added back into: /etc/apt/sources.list.d/ still remain (post #64)

 

[D3nnis3n]

Not commenting on the Plesk workaround. Plesk can do that.

Doing so causes the updating problems if you have any other repositories configured that use default accepted algorithms, so they should not do that as it breaks their clients servers ...

However, the other (separate) questions, relating to the Imunify360 associated file, being added back into: /etc/apt/sources.list.d/ still remain (post #64)

We only updated to .70 yesterday, and it did indeed restore the Imunify sources. There is no signs of anything from Imunify installed, but we're finding files related to aibolit, which seems to be related in some way to Imunify or what was Plesk E-Mail-Security.