BruceTonge.Info

Ok latest news on my VHCS saga is that I have just discovered the existence of a fairly big hole in the security which the dev guys don’t seem to bothered about fixing. Have a look at this, Ow and don’t listen to the early comments about it being fixed it wasn’t at time of posting this. The exploit lets you add admin accounts (Nice). I am now looking at ispCP:Omega which is a branch of VHCS but is still being developed.

I have recently installed a VHCS v2.4.7.1 server on Debian 4.0 with John. We found we had an error when adding domain users we got a blue refresh icon next to the account that never went away. If we tried to remove a user we got a yellow/orange pause icon next to the account and it would not delete. On further investigation we found that there were several forums on how to fix this problem but when we ran (as they suggested) the command:

/var/www/vhcs2/engine/vhcs2-rqst-mngr

we got an error that looked like this:

If specified by -literal_key, then the key length must be equal to the chosen cipher’s key length of 56 bytes at /var/www/vhcs2/engine//vhcs2_common_code.pl line 1443
Compilation failed in require at ./var/www/vhcs2/engine/vhcs2-rqst-mngr line 33.

The solution to this problem is quite simple John found it here but basically you need to:

• edit the file /var/www/vhcs2/engine/vhcs2_common_code.pl
• go to line 1445 and edit it to look like this: ‘keysize’ => 32,

The hole section should look as bellow when finished:

1443 my $cipher = Crypt::CBC -> new(
1444 {
1445 ‘keysize’ => 32,
1446 ‘key’ => $main::db_pass_key,
1447 ‘cipher’ => ‘Blowfish’,
1448 ‘iv’ => $main::db_pass_iv,
1449 ‘regenerate_key’ => 0,
1450 ‘padding’ => ‘space’,
1451 ‘prepend_iv’ => 0
1452 }
1453 );

Update: If you doing a fresh install you may have to edit some other files for the same problem you just need to go to the line number and add this line above the cypher code.

Ver 2.1 is out I would have written about ver 2.x coming sooner but bin busy getting things working again. Found that I had only part installed 2.0.something and so I couldn’t log myself in to the site must have been a fault with the ftp upload. have fixed it without to much stress with a simple file copy over the top. 2.1 has loads of new features and I am thus far very impressed. As far as my site goes I am working on a new theme to replace the default one. To come soon….