Resolved Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

[Sebahat.hadzhi]

Everyone, the issues with Grafana, PHP 7.4 and PHP 8.0 and the signing keys should be sorted. Our team released an update:

The GPG signing keys for the PHP 7.4 and 8.0 repositories on Ubuntu 24.04 have been updated addressing apt-get failure “untrusted public key algorithm: dsa1024”. (PPPM-14985)

Please let us know if you continue encountering any errors/warnings.

I cannot provide any ETA for CloudLinux's repositories, at this point.

 

[Michael Poellath]

Everyone, the issues with Grafana, PHP 7.4 and PHP 8.0 and the signing keys should be sorted. Our team released an update:



Please let us know if you continue encountering any errors/warnings.

I cannot provide any ETA for CloudLinux's repositories, at this point.

PHP 7.4 and PHP 8.0 are now ok.
Thank you

 

[D3nnis3n]

Imunify still shows the error.

 

[learning_curve]

Imunify still shows the error.

We don't use imunify360, but if you do, then Plesk have posted a workaround until the Cloudlinux team completely resolve it:

https://support.plesk.com/hc/en-us/articles/31896680837527-An-issue-with-the-system-update-The-following-signatures-were-invalid-9EE467641C635726A184D64B8C55A6628608CB71-untrusted-public-key-algorithm-dsa1024-E-The-repository

 

[Camel Design]

Everyone, the issues with Grafana, PHP 7.4 and PHP 8.0 and the signing keys should be sorted. Our team released an update:



Please let us know if you continue encountering any errors/warnings.

I cannot provide any ETA for CloudLinux's repositories, at this point.

 

[learning_curve]

@Camel Design
IF you had read post #44 above and then looked at ALL of the Plesk workaround (via the link in that post), then you would not have needed to make your post...

 

[Camel Design]

@Camel Design
IF you had read post #44 above and then looked at ALL of the Plesk workaround (via the link in that post), then you would not have needed to make your post...

my post is here just for help and indicate all is ok now exept immunify so the problem is not 100% fix.

i have read all post and your, and i have try all solution and is not because you don't use immunify that fix the problem

Immunify work well just before this problem with the last update so we considerate is fix ? i don't know and yes i have try the workarround but is just a temporary patch

 

[learning_curve]

@Camel Design You posted an image (no words) relating to the weak algorithm warnings (DSA1024) thread, as a response to an earlier post, yet... imunify360 and its (current) weak algorithm warnings (DSA1024) is specifically covered, with advice, by Plesk, in the link that was posted, so you completely missed the point of the previous post... No problem. It's not that important.

 

[anatol]

A this moment my temporary solutions are:

1. For Grafana

sudo nano /etc/apt/sources.list.d/plesk-ext-grafana.list

commented line:

#deb Index of /grafana/deb stable main

added line:

deb [trusted=yes] Index of /grafana/deb stable main

2. For DSA-1024 warning
created file:

/etc/apt/apt.conf.d/99weakkey-warning

with the code:

APT::Key::Assert-Pubkey-Algo ">=rsa2048,ed25519,ed448,dsa1024";

For munify360 is not needed a temporary solution, even it is warning, the update is working.

 

[learning_curve]

A this moment my temporary solutions are:
1. For Grafana

Grafana is already completely fixed. There's no need for any temp solutions now. See Changelog plus:

Resolved - The repository 'https://autoinstall.plesk.com/grafana/deb stable InRelease' is not signed

Previous issues with Grafana / Monitoring & Plesk are numerous and have been posted by many. Fortunately, we've had minimum problems with both to date, but it seems our time has finally come, with the advent of Plesk Obsidian 18.0.70 :D The Grafana Extention auto-update via Plesk Panel just...

talk.plesk.com

2. For DSA-1024 warning
For munify360 is not needed a temporary solution, even it is warning, the update is working.

See / read all of the previous link:

https://support.plesk.com/hc/en-us/articles/31896680837527-An-issue-with-the-system-update-The-following-signatures-were-invalid-9EE467641C635726A184D64B8C55A6628608CB71-untrusted-public-key-algorithm-dsa1024-E-The-repository

 

[anatol]

Grafana is already completely fixed. There's no need for any temp solutions now. See Changelog plus:

Resolved - The repository 'https://autoinstall.plesk.com/grafana/deb stable InRelease' is not signed

Previous issues with Grafana / Monitoring & Plesk are numerous and have been posted by many. Fortunately, we've had minimum problems with both to date, but it seems our time has finally come, with the advent of Plesk Obsidian 18.0.70 :D The Grafana Extention auto-update via Plesk Panel just...

talk.plesk.com

See / read all of the previous link:

https://support.plesk.com/hc/en-us/articles/31896680837527-An-issue-with-the-system-update-The-following-signatures-were-invalid-9EE467641C635726A184D64B8C55A6628608CB71-untrusted-public-key-algorithm-dsa1024-E-The-repository

Thanks for Grafana solution, I applied it and solved.

See / read all of the previous link:
https://support.plesk.com/hc/en-us/...public-key-algorithm-dsa1024-E-The-repository

This link does not open anything.

 

[learning_curve]

Thanks for Grafana solution, I applied it and solved.

Great!

This link does not open anything.

Ahhh Yes. The linked article has now been removed by Plesk. Understood.
Effectively, the temp solution was very similar to your own, (slightly different syntax) but the important closing statement on that page, was, that the Cloudlinux team will completely resolve this (in due course) and that the (current) weak algorithm warnings (DSA1024) that are still being generated by imunify360, can be safely ignored. We don't use imunify360 so were / are not affected.

 

[Michael.P]

There are still problems with imunify360.

 

[Sebahat.hadzhi]

Hello, @Michael.P . Imunify360 is a third-party product and it is maintained by CloudLinux. The warnings you get are related to their repositories. As previously mentioned, they are aware of the issue and working on fixing it. However, I cannot provide any ETA on when that will be fixed. At this time, you can safely ignore the warnings.

 

[Ash155]

Very new to Linux, so please excuse my lack of knowledge! Was wondering why this issue is only affecting Ubuntu 24.04.2 LTS? I have another server running on Ubuntu 22.04.5 LTS, and there are no warnings about the keys and everything updates fine. Does that mean the older LTS versions of Ubuntu are no longer considered secure? Or will they be rolling out the same key upgrade on older but still supported versions of Ubuntu?

 

[Ash155]

So an update on this situation - on my server which is running Imunify360 I have to have the workaround applied, otherwise no system updates are allowed at all. As soon as I applied the workaround everything updated.

I was advised by Imunify support to leave the workaround in place until they release their fix - although they couldn’t give me an ETA. Not sure how great it is to leave a potentially unsafe workaround on the server, but the alternative is no server updates which is equally as unsafe. Catch 22?!

I do find it odd that this scenario wasn’t prepared for - the warnings about the keys have been around for quite a while so the change was coming. Plesk jumped on it and released fixes pretty quickly, not sure why a company like Imunify whose only job is to protect a server wasn’t ready for the new secure keys, and seems to be taking a long time to fix the issue…

 

[D3nnis3n]

Effectively, the temp solution was very similar to your own, (slightly different syntax) but the important closing statement on that page, was, that the Cloudlinux team will completely resolve this (in due course) and that the (current) weak algorithm warnings (DSA1024) that are still being generated by imunify360, can be safely ignored.

So a security software is not able to actually provide secure keys, despite warnings about that having been given for ages and the "in due course" is so far months since they have been made first aware? Noone should use that security software. I don't even know why these repositories are included, we do not have anything from Imunify installed.

 

[learning_curve]

So a security software is not able to actually provide secure keys, despite warnings about that having been given for ages and the "in due course" is so far months since they have been made first aware? Noone should use that security software ~~

We don't use imunify360, but if you do ~~

 

[Goncharenko]

Same problem

 

[D3nnis3n]

Well, we don't - but the source files are still included in apt.

The workaround noted by Plesk also doesn't help - the Imunify repositories are still considered to be in failure and as such we still get an e-mail every day noting to us that updating failed.