MBG - how to update

[DevAudio]

So I have an old MBG VM that needs to be updated. I've searched the forum, but I'm not finding anything, I can't find any setting in the web interface, and the package manager (YUM) isn't configured with any repositories.

What is the procedure for updating one of these?

Thanks for your time!

[martyn]

You should definately not be updating via yum as if you managed to you would end up with an unsupported server.
You need to upgrade via the blades pages on the MBG web interface.

What version are you currently running and do you have current software assurance though?

[DevAudio]

I never looked under blades. Very non-intuitive interface decision by Mitel there. Found the updates section. That was what was needed! Thank you very much!

[martyn]

No worries.

It isn't actually designed by Mitel though. MSL is built on an SME server base, so they are just utilising what is already there.

If you get stuck with other questions that might be OS specific, I always find that doing a quick search on SME server will provide an answer, otherwise asking here also works as well. 

[DevAudio]

I updated the MBG successfully, but even after installing the latest available updates, the purpose of the update is unresolved. The MBG VMware virtual appliance uses an older (2.2.3 - released late 2010) version of Apache that is vulnerable to a DoS attack that can overload the CPU.

Having said that, apache has a workaround that involves modifying it's configuration file, which SME Linux supports. The question is will making a mod to a config file render the MBG unsupported?

The server is running Mitel Standard Linux 9.3.8.0 and V7.0.12.0 of the MBG application.

Any thoughts/help on this?

[ralph]

The question is will making a mod to a config file render the MBG unsupported?]The question is will making a mod to a config file render the MBG unsupported?

Here's my opinion:
Yes and No.

Yes it will render it unsupported.
No - they wouldn't know.   Don't ask - don't tell.

I've never been asked what ver of appache I'm using.   No one has ever looked.
But, if they look (very doubtful) then, depending on the engineer on the support call, they'll just tell you to re-install it and call back if you still have a problem.

If it works then you don't need support.

Ralph

[DevAudio]

Thank you Ralph. Rather than update Apache, I just added a line to the SME Linux template that controls /etc/httpd/conf/httpd.conf that turns off the legacy feature designed to support IE 3 and Netscape 3(!!!) and that negates the vulnerability without risking having the Mitel package updater break during the next update cycle, etc.

For any other admin out there that is interested in securing thier MBG (and by extension the VMware host if you're using a virtual appliance) against script-kiddies wielding ApacheKiller:
You can't edit the config file directly or it will just get overwritten at next boot. Google about how SME linux uses templates to create these config files and how to modify the template. All you're trying to do is get the following line added anywhere into the httpd.conf file:
RequestHeader unset Request-Range

[bluewhite4]

Not to highjack your thread, but I thought MBG was unsupported as a vm anyway? Thus why a vMAS has to have a separate physical MBG server to run teleworkers.

[DevAudio]

You could be right; I have no idea. You're dealing with an engineer who has inherited a network and is still trying to absorb the details of his new environment.

Having said that, I'd imagine that supported or not, the vulnerability would remain - unless the physical MBGs get different software and the Apache version is 2.3.21 or greater (which is a very recent release) they're still vulnerable to ApacheKiller, Metaspl0it, etc. 

[martyn]

vMBG is supported, and is published by Mitel just the same as vMCD, vUCA, and vMAS is! OVA files are available to download for all of them.

There are restrictions around how it can be run, but it is supported and runs just as well virtualised as it does on a physical server.

[bluewhite4]

vMBG is supported, and is published by Mitel just the same as vMCD, vUCA, and vMAS is! OVA files are available to download for all of them.

There are restrictions around how it can be run, but it is supported and runs just as well virtualised as it does on a physical server.

Sorry, yes I see that. I spoke without looking, thus why I phrased it as a question. I knew that teleworkers could not be offered of a vMAS, as it is only LAN mode, so incorrectly assumed that was a MBG limitation as well.