Starting plesk failed after recent software update

[bob83]

Thinq openssl (openssl-0.9.8e-12.el5_4.6) gives a problem.
I have this only on Virtuozzo vpssen, on dedi servers no problem.

[root@vps admin]# service psa start
Starting xinetd service... done
Starting named service... done
Starting mysqld service... done
Starting postgresql service... not installed
Starting psa-spamassassin service... done
Plesk: Starting Mail Server... already started
Starting mail handlers tmpfs storage
Starting Plesk... failed
[root@vps admin]#

I already search httpd logs, messages and /usr/local/psa/admin/logs/ but cant find why plesk failed.
How can i detect what exactly is going wrong?

I use plesk 9.2.3 on the 5 vpsses where plesk wont start anymore. I already tryed updating to plesk 9.3, the update was succesful, but plesk wont start

plesk start failed was come after i update this packages:
openssl-0.9.8e-12.el5_4.6 Sun 28 Mar 2010 05:07:58 PM CEST
gnutls-1.4.1-3.el5_4.8 Sun 28 Mar 2010 05:07:57 PM CEST
cyrus-sasl-2.1.22-5.el5_4.3 Sun 28 Mar 2010 05:07:55 PM CEST
openssl-0.9.8e-12.el5_4.6 Sun 28 Mar 2010 05:07:53 PM CEST
cyrus-sasl-lib-2.1.22-5.el5_4.3 Sun 28 Mar 2010 05:07:39 PM CEST

Best regards, Bob

Edit: I found the CP error_log. This is the error:

2010-03-28 17:45:14: (connections.c.299) SSL: 1 error:140780E5:SSL routines:SSL23_READ:ssl handshake failure
2010-03-28 17:48:15: (log.c.135) server stopped
2010-03-28 17:58:34: (log.c.75) server started
2010-03-28 17:58:34: (network.c.336) SSL: error:00000000:lib(0):func(0):reason(0)

Someone any idea how to fix this?

Update:
yum downgrade openssl
Fixed my problem.

Removed:
openssl.i686 0:0.9.8e-12.el5_4.6 openssl.x86_64 0:0.9.8e-12.el5_4.6

Installed:
openssl.i686 0:0.9.8e-12.el5_4.1 openssl.x86_64 0:0.9.8e-12.el5_4.1

Conclusion: plesk is not compatible with openssl.i686 0:0.9.8e-12.el5_4.6.

[zeki]

it seems to be a bug: http://forum.parallels.com/showthread.php?t=100247

[breun]

Yep, this is a nasty one.

[breun]

If you've already upgraded OpenSSL, Apache httpd and mod_ssl, you'll need to downgrade these packages if you care more about Plesk being up than fixing these vulnerabilities:

OpenSSL: https://rhn.redhat.com/errata/RHSA-2010-0162.html
Apache httpd: https://rhn.redhat.com/errata/RHSA-2010-0168.html

Here are the previous versions of the packages which do work with Plesk, but also do contain the vulnerabilities mentioned in the errata above.

CentOS 4.8 32-bit

Code: Select all

wget http://mirror.centos.org/centos-4/4.8/os/i386/CentOS/RPMS/openssl-0.9.7a-43.17.el4_7.2.i686.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/i386/RPMS/mod_ssl-2.0.52-41.ent.6.centos4.i386.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/i386/RPMS/httpd-2.0.52-41.ent.6.centos4.i386.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/i386/RPMS/httpd-suexec-2.0.52-41.ent.6.centos4.i386.rpm

CentOS 4.8 64-bit

Code: Select all

wget http://mirror.centos.org/centos-4/4.8/os/x86_64/CentOS/RPMS/openssl-0.9.7a-43.17.el4_7.2.x86_64.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/x86_64/RPMS/mod_ssl-2.0.52-41.ent.6.centos4.x86_64.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/x86_64/RPMS/httpd-2.0.52-41.ent.6.centos4.x86_64.rpm
wget http://mirror.centos.org/centos-4/4.8/updates/x86_64/RPMS/httpd-suexec-2.0.52-41.ent.6.centos4.x86_64.rpm

CentOS 5.4 32-bit

Code: Select all

wget http://mirror.centos.org/centos-5/5.4/updates/i386/RPMS/openssl-0.9.8e-12.el5_4.1.i686.rpm
wget http://mirror.centos.org/centos-5/5.4/updates/i386/RPMS/mod_ssl-2.2.3-31.el5.centos.2.i386.rpm
wget http://mirror.centos.org/centos-5/5.4/updates/i386/RPMS/httpd-2.2.3-31.el5.centos.2.i386.rpm

CentOS 5.4 64-bit

Code: Select all

wget http://mirror.centos.org/centos-5/5.4/updates/x86_64/RPMS/openssl-0.9.8e-12.el5_4.1.x86_64.rpm
wget http://mirror.centos.org/centos-5/5.4/updates/x86_64/RPMS/mod_ssl-2.2.3-31.el5.centos.2.x86_64.rpm
wget http://mirror.centos.org/centos-5/5.4/updates/x86_64/RPMS/httpd-2.2.3-31.el5.centos.2.x86_64.rpm

Download the relevant packages for your distribution and install them using:

Code: Select all

# rpm -Uvh --oldpackage openssl*.rpm mod_ssl*.rpm httpd*.rpm
# service sw-cp-server restart
# service httpd restart

P.S. If you're on Plesk 8, use service psa restart instead of service sw-cp-server to restart the Plesk web interface daemon.

[faris]

The Parallels thread seems to indicate that Plesk 8.6 is not affected by this issue. Can anyone confirm please?

Thanks,

Faris.

[davinci]

# rpm -Uvh --oldpackage openssl*.rpm mod_ssl*.rpm httpd*.rpm
error: Failed dependencies:
httpd = 2.2.3-31.el5.centos.4 is needed by (installed) httpd-devel-2.2.3-31.el5.centos.4.x86_64

after downloading httpd-devel-2.2.3-31.el5.centos.4.x86_64.rpm

# rpm -Uvh --oldpackage openssl*.rpm mod_ssl*.rpm httpd*.rpm
error: Failed dependencies:
httpd = 2.2.3-31.el5.centos.4 is needed by httpd-devel-2.2.3-31.el5.centos.4.x86_64
httpd = 2.2.3-31.el5.centos.4 is needed by (installed) httpd-devel-2.2.3-31.el5.centos.4.x86_64

Any suggestions?

UPDATE:
fixed it by downloading the original openssl RPM from http://autoinstall.plesk.com/PSA_9.3.0/ ... -5-x86_64/ and reinstalled it

[breun]

You downloaded the most recent version (.4) of httpd-devel, while you should have downloaded the previous version (.2) to match the other packages you downloaded.

[aus-city]

Don't downgrade httpd and mod_ssl

Its just openssl causing the issues.

I am running httpd-2.2.15 so its NOT that, its simply openssl

[davinci]

yup did that, only downgraded openSSL by downloading the original openssl RPM from http://autoinstall.plesk.com/PSA_9.3.0/ and reinstalled it

[breun]

Don't downgrade httpd and mod_ssl

Its just openssl causing the issues.

I am running httpd-2.2.15 so its NOT that, its simply openssl

On CentOS the latest mod_ssl package also required the latest openssl package. If you wanted to downgrade openssl, you also needed to downgrade mod_ssl, which meant also downgrading httpd. I don't know what OS you're running (there is no CentOS version shipping httpd 2.2.15 AFAIK), so it might be different in your situation.

[breun]

Fixed sw-cp-server packages for CentOS/RHEL 4 and 5 now available here: http://kb.parallels.com/en/8338

[Kalimari]

Fixed sw-cp-server packages for CentOS/RHEL 4 and 5 now available here: http://kb.parallels.com/en/8338

Thanks for the heads up, BTW RHEL 5 is not listed and has no rpm download option...

[breun]

The packages for RHEL and CentOS should be interchangable AFAIK as they are binary compatible releases.

[Kalimari]

The packages for RHEL and CentOS should be interchangable AFAIK as they are binary compatible releases.

Thanks, it worked using CentOS 5 rpm!