Resolved Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

[Sebahat.hadzhi]

@D3nnis3n , are you referring to the workaround from this article. If yes, does the update actually fail or you only get warnings? I am asking because it is normal to get the warnings with that workaround.

 

[learning_curve]

Well, we don't - but the source files are still included in apt.

If you have already removed the Imunify360 Extension, then why have you not also removed the associated file from within: /etc/apt/sources.list.d/
That's straightforward & will immediately resolve the issues below assuming... that Imunify360 is the only package that you still have this issue with?

The workaround noted by Plesk also doesn't help - the Imunify repositories are still considered to be in failure and as such we still get an e-mail every day noting to us that updating failed.

See above

 

[D3nnis3n]

@D3nnis3n , are you referring to the workaround from this article. If yes, does the update actually fail or you only get warnings? I am asking because it is normal to get the warnings with that workaround.

_Manual_ updating never failed, the issue is the warnings are seen as error which leads to the Plesk configured automatic updates _not_ working and sending an update failed e-mail every day.

If you have already removed the Imunify360 Extension, then why have you not also removed the associated file from within: /etc/apt/sources.list.d/
That's straightforward & will immediately resolve the issues below assuming... that Imunify360 is the only package that you still have this issue with?

It is readded on every execution of Plesk Installer.

 

[learning_curve]

It is readded on every execution of Plesk Installer.

Do you mean, that in your case / on your server(s), that the Imunify360 associated file has been added back into: /etc/apt/sources.list.d/ as part of every Plesk Main Upgrade and / or Plesk Point Upgrade, even WHEN you didn't have the Imunify360 extension installed, when invoking those upgrades?

That's strange if you do, as it certainly isn't in our case.
FWIW It's never, ever been added back during any daily manual upgrades (e.g. Ubuntu / Plesk CLI updates via CLI #apt) any way.

Have you actually deleted it, but then seen it be added back, since you upgraded to Obsidian 18.0.70 #MU 1 and removed the Imunify360 extension?

 

[D3nnis3n]

So we figured this one out as well. The workaround is bad.

It configures:

APT::Key::Assert-Pubkey-Algo ">=dsa1024,rsa4096,rsa3072";

However, this line will replace the defaults, e.g. if this is configured, what is accepted by default will no longer be accepted when it is not in that configuration.
That was the case for rsa2048 for us, which is used by elasticsearch repository - which then was no longer trusted and caused the actual upgrade error.

Use the following instead to accept the insecure Imunify key and all default accepted ones.

APT::Key::Assert-Pubkey-Algo ">=dsa1024,>=rsa2048,ed25519,ed448";

 

[learning_curve]

~~~
Use the following instead to accept the insecure Imunify key and all default accepted ones.

APT::Key::Assert-Pubkey-Algo ">=dsa1024,>=rsa2048,ed25519,ed448";

Not commenting on the Plesk workaround. Plesk can do that.
The workaround below, was posted on the very 1st page of this thread, but the Imunify360 related issue was still an issue (at the time of that post)

Resolved - Weak Algorithm Warning (DSA1024) for Plesk Repositories on Ubuntu 24.04 LTS

Hi Plesk Support Team and Community, I’m running into an issue with the Plesk repositories on my Ubuntu 24.04 LTS server and would appreciate some guidance. When I run sudo apt update, I get warnings about the Plesk repositories using a weak algorithm (DSA1024) for their signatures. The...

talk.plesk.com

Either of those ^ should (currently) prevent you from experiencing this:

_Manual_ updating never failed, the issue is the warnings are seen as error which leads to the Plesk configured automatic updates _not_ working and sending an update failed e-mail every day.

However, the other (separate) questions, relating to the Imunify360 associated file, being added back into: /etc/apt/sources.list.d/ still remain (post #64)

 

[D3nnis3n]

Not commenting on the Plesk workaround. Plesk can do that.

Doing so causes the updating problems if you have any other repositories configured that use default accepted algorithms, so they should not do that as it breaks their clients servers ...

However, the other (separate) questions, relating to the Imunify360 associated file, being added back into: /etc/apt/sources.list.d/ still remain (post #64)

We only updated to .70 yesterday, and it did indeed restore the Imunify sources. There is no signs of anything from Imunify installed, but we're finding files related to aibolit, which seems to be related in some way to Imunify or what was Plesk E-Mail-Security.

 

[learning_curve]

~~
We only updated to .70 yesterday, and it did indeed restore the Imunify sources. There is no signs of anything from Imunify installed, but we're finding files related to aibolit, which seems to be related in some way to Imunify or what was Plesk E-Mail-Security.

Bizarre! FWIW In your case, it might have been linked to this:

Resolved - Plesk, what’s going on here? - Imunify auto installation

Imunify installed itself on my Plesk Obsidian (AlmaLinux) without my knowledge a day or two ago. I handle all updates manually — everything is set to manual only, and I apply updates myself. I already have my own solutions in place, including firewalls. Why are you pushing extensions I didn’t...

talk.plesk.com

 

[M.Kleisti]

Hello,

First of all, I'm new here in the Plesk forum because we were suddenly affected by the problem and I found this discussion while looking for a solution.
Imunify360 was installed unasked with the update 18.0.70(.1), which confuses me personally, because at the time of these two Plesk updates, the problem was already known for some time.
Uninstalling Imunify360 was not successful, so I looked under “/etc/apt/sources.list.d/” and deleted the “imunify-rollout.list”. Then ran a “# sudo apt update”, problem is now solved, we no longer get warnings and/or errors.

If you are actively using Imunify360, it might help if you move the “imunify-rollout.list” instead of deleting it, don't forget to run “# sudo apt update” afterwards.

Edit/Update: Our system Ubuntu Server 24.04.2 LTS

 

[Sebahat.hadzhi]

@M.Kleisti , kindly refer to my update here for more clarity on the unexpected Imunify installation.