作者： 白翼

发布于

隨記 AMH php-7.4 編譯版在 Ubuntu 22 下的 OpenSSL 動態庫問題

Error: PHP 無法進行 ssl:// 的 fsocketopen，但 PHP 編譯版帶有 –with-openssl

/usr/local/php-7.4/bin# ./php -i | grep ssl
Openssl default config => /usr/local/openssl-1.1.1w/openssl.cnf

/usr/local/openssl-1.1.1w/bin# ./openssl version -a
./openssl: symbol lookup error: ./openssl: undefined symbol: EVP_mdc2, version OPENSSL_1_1_0

References:

https://github.com/openssl/openssl/issues/11227
https://blog.csdn.net/hhd1988/article/details/125563134

使用 echo “/usr/local/openssl-1.1.1w/lib” >> /etc/ld.so.conf.d/libc.conf && ldconfig 後，./openssl version -a 可以跑了，但 PHP 的 fsocketopen 依然不行，不確定何以繼續 debug，暫且改用非 SSL 端口並優先考慮環境升級。

想法來説估計把 AMH 的安裝脚本 –with-openssl 改成 3.0.2（系統版本）是最簡單的。

发布于

Security Bulletin 2024-07-02

a) regreSSHion, CVE-2024-6387, is an unauthenticated remote code execution in OpenSSH’s server (sshd) that grants full root access. It affects the default configuration and does not require user interaction. It poses a significant exploit risk. [link]

Debian 12 users are advised to upgrade to 1:9.2p1-2+deb12u3 immediately. [link]

b) NGINX PGP Signing Key is updated, all NGINX repository users are required to import the new keys. [link]

发布于

Just for fun: Now using BigQuery to import my credit card bills and analyze them, lol. (And the higest went to Uber Eats with no competition…)

SELECT
  shop,
  FORMAT_DATE('%Y-%m', date) ym,
  SUM(amount) as `count`
FROM `credit_csvs.utf-8`
GROUP BY ym, shop
ORDER BY count DESC

Replacing my Python analyzing script so I can just focus on adding more complex queries for future uses.

发布于

Interesting findings that for emails sent to Proofpoint protected MX, they might get rejected if the source domain has a stronger DMARC policy, e.g. strict DKIM alignment.

https://help.proofpoint.com/Proofpoint_Essentials/Email_Security/Administrator_Topics/Other_Features/Why_does_DKIM_fail

It all begins with a DMARC report I received from Outlook…

<policy_evaluated>
<disposition>none</disposition>
<dkim>fail</dkim>
<spf>pass</spf>
</policy_evaluated>

I was then eager to find out why DKIM failed in this case, and did some tests with a domain that has its MX pointed to pphosted servers. In the end, I was able to reproduce the issue with a URL link in my email so that it will be rewritten to URL Defense link, as a result, the email body was modified, and resulted in dkim=fail (body hash did not verify).