- Log in as root
- Open the backup script for editing:
- Find the MAILLIST value, and add any additional email addresses, separated by a blank space , like so:
- Save and quit
Epicor has been keeping apprised of a vulnerability in the SSL 2.0 protocol, CVE-2016-0800, also known as DROWN, which stands for Decrypting RSA using Obsolete andWeakened eNcryption and is a Man-in-the-Middle (MITM) attack against servers running TLS for secure communications. The issue is actually quite tricky to exploit by itself, but made easier on servers that are not up to date with some previous year-old OpenSSL security updates. Red Hat has a vulnerability article in the Customer Portal which explains the technical attack and the dependencies in more detail.
Recommended Customer Actions
Red Hat recommends that customers immediately apply available updates to remediate the issue. Rebooting the system after updating is the safest way to ensure all affected services use the updated ssl library.
Microsoft IIS versions 7.0 and above should have SSLv2 disabled by default. If you are running an older version of IIS, you will need to disable insecure protocols following these instructions from Microsoft.
Q. How can I check whether or not my Linux server is vulnerable?
A. Log into your Linux server and run the command below:
curl -Ls http://bit.ly/checkDROWN | sh
For example, the following output, run against an Eclipse Linux server shows that the software needs to be updated:
[root@eclipsetest ~]# curl -Ls http://bit.ly/checkDROWN | sh WARNING: The installed version of openssl (openssl-1.0.1e-16.el6_5.14) is vulnerable to both general and special DROWN attack and should be upgraded! See https://access.redhat.com/security/vulnerabilities/drown for more information. The installed version of openssl-libs (package openssl-libs is not installed) is not vulnerable to DROWN.
Q. How can I check whether my external web server (e.g. WOE, mobile) is vulnerable?
A. Use this tool.
If you are using a paid version of Google Apps, and you would like to avoid Google rewriting the sender, you must first configure your Google Apps account for IP-based relay by following these instructions to allow relay from your server’s public IP address by any email addresses.
After Google Apps has been configured to allow relay from your server’s public IP address, you may configure postfix with:
relayhost = [smtp-relay.gmail.com]
The correct SMTP server configuration for the free version of Google Apps and Gmail is:
relayhost = [smtp.gmail.com]:587
Please note that Google will automatically rewrite the sender (FROM) address to match whichever account is used for SMTP authentication (i.e. if you authenticate with firstname.lastname@example.org, all emails will appear to be sent from that address, regardless of which from address is specified in Eclipse). This is a limitation enforced on Google’s end, so there is no way around this on the Linux server side, other than to use a paid version of Google Apps (please see above) or use a mail relay service like SendGrid.
When running yum update on a RHEL 5 system, the following error is shown:
http://linux.dell.com/repo/hardware/latest/platform_independent/rh50_64/repodata/repomd.xml: [Errno 14] HTTP Error 404: Not Found Trying other mirror. Error: Cannot retrieve repository metadata (repomd.xml) for repository: dell-omsa-indep. Please verify its path and try again
Dell discontinued support for RHEL 5 in the latest version of their yum repo, which is enabled by default, but they keep the old copies online.
Point the Dell repo at an older version:
sed -i 's/latest/Linux_Repository_14.12.00/g' /etc/yum.repos.d/dell-omsa-repository.repo
You may now re-run yum.