Issue drwebd now fails to start on Debian 12

[TimReeves]

Server operating system version

Debian 12

Plesk version and microupdate number

18.0.67

During routine auto-maintenance last night, drwebd could not be restarted, on three servers: Debian 10, 11 and 12.
I'm aware of these threads, having had this sort of trouble before:

Issue - Key file: /opt/drweb/drweb32.key - Key file was not found / TLS Versions or Ciphers?

Last night drwebd could not be restarted after updates - on ALL the servers I manage. See error message in title. I also see in the status messages: Plesk authorization failed: HTTP request error [35] Yesterday I used the facility of SSLit! to sync protocolls and ciphers to Mozilla...

talk.plesk.com

Issue - Drweb won't start in new Debian12 installation

Hello, I'm starting to set up a new Debain 12 server with Plesk, both brand-new installations: Product version: Plesk Obsidian 18.0.59.1 OS version: Debian 12.5 x86_64 When installing DrWeb the following error shows: Copyright (c) Igor Daniloff, 1992-2024 Doctor Web, Moscow, Russia...

talk.plesk.com

https://support.plesk.com/hc/en-us/articles/12377059549975-Unable-to-start-Plesk-Premium-Antivirus-in-Plesk-Plesk-authorization-failed-HTTP-request-error-35

I now made sure all the measures mentioned were applied, on all three servers. On Debian 10 and 11, drwebd could then be started.

But not on Debian 12.

Before I play around too long, I wanted to put this here, so that the community will see the issue and hopefully, a solution.

Cheers, Tim

 

[Sebahat.hadzhi]

Hello, Tim. Have you tried applying the workaround from this guide? If that doesn't help, could you please provide the exact error you encounter?

 

[TimReeves]

Hi @Sebahat.hadzhi

thanks for your reply. It would be helpful if your article also contained the way to check which repository was used for apt (not just yum); this looks like this:

# apt-cache search drweb
# apt-cache policy drweb-daemon
> It's installed from Index of /DRWEB_6.0.2.9 bookworm/all amd64 Packages

Reinstall it anyway:

# plesk installer --select-release-current --remove-component drweb
# rm -rf /var/drweb/ /etc/drweb/
# apt-get update
# plesk installer --select-release-current --install-component drweb
# service drwebd start

Jan 30 17:49:40 mail.reeves.one drwebd.real[956612]: Plesk authorization failed: HTTP request error [35]
Jan 30 17:49:40 mail.reeves.one drwebd.real[956612]: Error: Plesk Software not running.

I'm pretty much convinced that it's a problem with the ciphers. 3rd-level support would be appreciated...

Cheers, Tim

 

[TimReeves]

Hi all,

I still can't get it running )-:

Thanks to @Sebahat.hadzhi for adding debian to the article on installing drweb from Plesk repo.

I've double-checked everything. The only difference I found to servers where it does work (Debian 11) is that in /etc/sw-cp-server/conf.d/ssl.conf there are different ciphers specified. I tried those from debian 11 on debian 12, but it made no difference. Probably because I already have an /etc/sw-cp-server/conf.d/plesk-drweb-local.conf installed, as per one of the other articles on this topic.

I see that drwebd logs to syslog, but that contains no more information than the errors noted under systemctl status. I'm still seeing:

Feb 07 21:50:12 mail.reeves.one drwebd.real[1562048]: Plesk authorization failed: HTTP request error [35]
Feb 07 21:50:12 mail.reeves.one drwebd.real[1562048]: Error: Plesk Software not running.

I really want to get this sorted out - any help would be much appreciated.

Tim

 

[Sebahat.hadzhi]

Hello, Tim. I consulted with our team about this case and their suggestion is to review the ciphers in /etc/sw-cp-server/conf.d/ssl.conf according to the values here and if everything is in order to open a ticket for further investigation. If I understand correctly, this is something you have verified already. So, I am afraid, the only option I can recommend is to indeed get in touch with the support staff and allow them with server access so they can attempt to identify the issue.

 

[TimReeves]

Hello @Sebahat.hadzhi ,

thanks for your reply. I've again checked my configuration, tried removing the /etc/sw-cp-server/conf.d/plesk-drweb-local.conf from an earlier fix suggestion, deactivated bind9 (which for strange reasons was needed during the initial config of Plesk, but now seems not to be), and rebooted the system.

And still drwebd won't start. Can you please point me to how to get in touch with the support staff? I feel a bit queasy as I have login to ssh completely disabled and have beefed up my fail2ban config to stomp on any such attempts, so I'll have to give them a private key )-: But it seems the only way forwards now for me.

Thanks! Tim

 

[Sebahat.hadzhi]

Thank you for the update, Tim. I believe they will be able to arrange a TeamView session if SSH is completely disabled. Otherwise, you can provide them with access following the instructions from this guide. If you got the license from Plesk directly, please use the following address:

https://support.plesk.com

If you got your license from a reseller, your reseller should provide support for you. If the reseller does not provide support, you can sign up for a month free trial:

https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk

 

[TimReeves]

I didn't get round to contacting support yet - but today, due to problems with drwebd on two other servers, I noticed a new log line when trying to start drwebd on my Debian 12 server:

Mar 13 11:58:45 mail.reeves.one drwebd[2870062]: Plesk authorization failed: malformed response (no 'response=' field)

Does this help intuiting what the problem may be?