News

We have scheduled an upgrade of our Idera Server Backup (formerly R1Soft CDP) platform software on cdp01.steadfast.net to version 5.6.0.  This update will address some performance issues and introduce a maintenance mode feature.  The agent update addresses a minor security risk.

This upgrade is being performed during the daytime, mid-week, because it is the lowest utilization period.  It is being performed on short notice because the agent update is already available to clients, and some servers may update automatically.  Idera recommends the backup server always run a version greater than or equal to the agent version.

Date: Tuesday, April 22nd, 2014
Start Time: 2:00 PM CDT (GMT -5)
End Time: 3:00 PM CDT (GMT -5)
Maintenance Scope: cdp01.steadfast.net Backup Server

Customer Impact:

Backups will not be performed and restoration services will be unavailable during the maintenance period. This maintenance will not impact customer equipment or services other than backup tasks.

This version will cause issues with the MySQL backup feature, meaning that you will need to upgrade your agent so that MySQL backups continue to be taken properly.  The upgraded agent fixes a security issue which can allow an unprivileged user on your server to redirect the location of restored backup files, possibly viewing their contents.  This can only be exploited if you restore files from the control panel while running the outdated agent version.  Steadfast rates this security issue as low in our deployed environment, but we recommend upgrading your agent after this maintenance is completed.

The full release notes may be viewed here.

If you have any questions regarding this maintenance, or for assistance in upgrading the agent on your server(s), please feel free to contact us via our helpdesk or by email.

A vulnerability has recently been disclosed in OpenSSL which affects all systems running CentOS 6.5 or Debian 7 "Wheezy."  This vulnerability is serious and may allow a remote user to discover the private key for any SSL certificates used with a service powered by OpenSSL.  This typically includes most web servers, control panels and mail servers running on Linux.

This vulnerability has existed for over two years in OpenSSL.  CentOS did not include a vulnerable version of OpenSSL until the 6.5 release, which became available on December 1st, 2013.  Debian 7 has included a vulnerable version of OpenSSL since it was released on May 4th, 2013

This issue is known as the "heartbleed" bug.  Further technical information may be found at the Heartbleed information site.  It has been assigned the ID CVE-2014-0160 in the Common Vunerabilities and Exposures database.

Users of CentOS 5 and Debian 6 "Squeeze" are not affected.  Windows servers do not use OpenSSL by default.  You may wish to check any third-party software you have installed for bulletins and updates, if applicable.

CentOS and Debian have patched this vulnerability as of April 7th, 2014.  To completely patch this vulnerability, you must update your OpenSSL package and then restart all services that use OpenSSL.  Please review the following directions for your installation below.

Important: As this vulnerability has existed for a long time and it is not possible to know whether it has been exploited, you should use your control panel or OpenSSL tools to generate a new private key and certificate request for each certificate you have on your server.  Then, use the "re-key" feature at your SSL certificate provider to generate a new certificate based on the new CSR file.  If your SSL private key was able to be downloaded through the exploit, someone on the Internet might be able to view encrypted data when it is transmitted to or from your server or fool users into using a fake web site with your actual SSL certificate on it.  You should not publish a new certificate until after you have applied the fix for your system.

CentOS 6.5

To check which version of OpenSSL is installed, run the following command:

rpm -q openssl

The version number should be greater than or equal to 1.0.1e-16.el6_5.7

The notable number to look for is the ".7" at the end.  If the last number is not 7 or higher, you will need to upgrade.  If your version does not match, please run the following command and ensure an update to the openssl package is included:

yum -y update openssl

If no update is available, please try the following commands, then repeat the command above:

yum clean metadata

After the upgrade processes, you should restart your web server and any other services for which you have enabled SSL certificates.  For example, to restart your web server, you can run the following command:

service httpd restart

If you have a control panel, you should step through each service listed in the "Services" area of the control panel and restart them one by one.  If you have any doubts about which services to restart, we recommend restarting your entire server.  You can do this by running the command:

reboot

Red Hat published the following advisories regarding this vulnerability:

• https://access.redhat.com/security/cve/CVE-2014-0160
• https://rhn.redhat.com/errata/RHSA-2014-0376.html

Debian 7

To check which version of OpenSSL is installed, run the following command:

dpkg -l openssl

The version number should be greater than or equal to 1.0.1e-2+deb7u6

The notable part to look for is the "+deb7u6" at the end.  If the last number is not 6 or higher, or the part after "+" is missing, you will need to upgrade.  If your version does not match, please run the following command and ensure an update to the openssl and libssl1.0.0 packages are included:

apt-get update
apt-get install -y openssl libssl1.0.0

After the upgrade processes, you should restart your web server and any other services for which you have enabled SSL certificates.  Debian will list services that appear to need to be restarted.  It is recommended that you accept the default list.

If you have a control panel, you should step through each service listed in the "Services" area of the control panel and restart them one by one.  If you have any doubts about which services to restart, we recommend restarting your entire server.  You can do this by running the command:

reboot

Debian published the following advisory regarding this vulnerability:

• https://www.debian.org/security/2014/dsa-2896

If you have any questions or need assistance performing these upgrades, please contact us and we'll be happy to help.