LinuxWebLog.com

Logjam broke Sendmail?

Generate new DH keys file:

Edit sendmail.mc:

Update sendmail.cf and restart:

Refer to https://weakdh.org/sysadmin.html for other service fixes.

md5 digest:

sha1 digest:

Base64 encoding with openssl:

Base64 decoding with openssl:

You can programmatically generate shadow password hash via:

-1 means md5
G5cYam5w is a random salt (minimum 8)
test.123 is the password

Here is the breakdown:

The first $1 means that it is an md5 hash.
The second $G5cYam5w is a random salt.
The third $z0NDUjMRX4xVBKw9Nb6YL0 is the md5 hash.

1. Update openssh and openssl packages
   
   # apt-get update
# apt-get install openssh openssl
2. Install openssh-blacklist and openssl-blacklist
   
   # apt-get install openssh-blacklist openssl-blacklist
3. Check all ssh compromised keys via:
   
   # ssh-vulnkeys -a
4. Check all ssl keys and certificates via:
   
   # openssl-vulnkeys *.key *.pem

   Note: Plesk specific ssl certs are stored at "/opt/psa/var/certificates/"

As of this writing, the latest versions were:

• apache_1.3.41
  
• php-4.4.8
  
• openssl-0.9.8g
  
• mod_ssl-2.8.31-1.3.41

Once the files are downloaded and extracted; config, compile and install in the below order:

1. Install openssl:
   
   $ ./config --prefix=/usr/local --openssldir=/usr/local/openssl
$ make
# make install
2. mod_ssl patch:
   
   $ ./configure \
--with-ssl=../openssl-0.9.8g \
--with-apache=../apache_1.3.41
3. Pre-configure apache:
   
   $ ./configure
4. Install php:
   
   $ ./configure \
--with-gd \
--with-jpeg-dir \
--with-png-dir \
--with-zlib-dir \
--with-freetype \
--with-freetype-dir=/usr/lib \
--enable-gd-native-ttf \
--enable-memory-limit \
--with-ldap \
--with-mysql \
--with-apache=../apache_1.3.41
$ make
# make install
5. Install apache
   
   $ SSL_BASE=../openssl-0.9.8g \
./configure \
--prefix=/usr/local/apache \
--enable-module=rewrite \
--enable-module=so \
--activate-module=src/modules/php4/libphp4.a \
--enable-module=ssl

When starting sendmail, I would get the below messgage:

Although, sendmail would still run without the CRL File and just complain about it missing. A quick way to include it in the sendmail configuration is to download revoke.crl from cacert.org, add the below option in sendmail.mc and rebuild the sendmail conf file as below.

Download revoke.crl:

Add the below line to "/etc/mail/sendmail.mc" just below the "confSERVER_KEY":

Rebuild sendmail conf by running make:

Check sendmail.cf with the revoke.crl listed as below:

Now restarting sendmail should not complain about the missing Certificate Revocation List (CRL) File.

Latest Compile with pdo drivers for mysql along with mod_security.

NOTE:
Remove the MySQL-shared rpm else openssl will not work.