Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cannot download vst-install.sh #2061

Closed
kristijansoldo opened this issue Jul 27, 2021 · 24 comments
Closed

Cannot download vst-install.sh #2061

kristijansoldo opened this issue Jul 27, 2021 · 24 comments

Comments

@kristijansoldo
Copy link

kristijansoldo commented Jul 27, 2021

Operating System (OS/VERSION):

Debian 9

VestaCP Version:

Latest version

Steps to Reproduce:

I've initialized fresh Debian 9 VPS then I've try download the installation script with:

curl -O http://vestacp.com/pub/vst-install.sh

then I get in vst-install.sh:

<html>
<head>
<meta name="robots" content="noarchive" />
<meta name="googlebot" content="nosnippet" />
</head>
<body>
<div align=center>
<h3>Error. Page cannot be displayed. Please contact your service provider for more details.  (26)</h3>
</div>
</body>
</html>

and I can't start installation proces

bash vst-install.sh

the script vst-install.sh was not downloaded correctly.

@anton-reutov
Copy link
Collaborator

Try this

wget http://vestacp.com/pub/vst-install.sh
bash vst-install.sh

Grant access to your server if it doesn't help

@dpeca
Copy link
Collaborator

dpeca commented Jul 27, 2021

I think issue is because of #2060
And issue will dissappear in next 48 hours.

@anton-reutov
Copy link
Collaborator

dpeca, maybe
I think is related

@kristijansoldo
Copy link
Author

Try this

wget http://vestacp.com/pub/vst-install.sh
bash vst-install.sh

Grant access to your server if it doesn't help

Thanks, but doesn't help.
image

@anton-reutov
Copy link
Collaborator

bash vst-install.sh
not cat

@ScIT-Raphael
Copy link

@anton-reutov he just shows that the content of the file is invalid, that's why he uses cat.

In the meanwhile:

wget https://raw.githubusercontent.com/hestiacp/hestiacp/release/install/hst-install.sh
bash hst-install.sh

and you will be happy.

@anton-reutov
Copy link
Collaborator

can't reproduce on debian 9

@kristijansoldo
Copy link
Author

bash vst-install.sh
not cat

I know 😂 , but with cat vst-install.sh I want to show what is in the script.

@anton-reutov
Copy link
Collaborator

i checked on debian 9, sorry cant reproduce
can you provide access to your server ?

@ScIT-Raphael
Copy link

@kristijansoldo as written. The problem is that vesta frogot "again" to renew their domain. There are still entries in dns cache which show to the parked domain. Due to the current facts, in special they wanted to release a new patched version yesterday, I would suggest to use hestia... @anton-reutov its clearly a dns cache issue, no need to involve yourself, just renew the domain on time...

@dpeca
Copy link
Collaborator

dpeca commented Jul 27, 2021

@kristijansoldo download it from github:
curl -O https://raw.githubusercontent.com/serghey-rodin/vesta/master/install/vst-install-debian.sh

@ScIT-Raphael
Copy link

@dpeca you still should not suggest it until the exploits are closed, at least my point of view...

@dpeca
Copy link
Collaborator

dpeca commented Jul 27, 2021

I guess he is aware of it
If not... well... I must agree with @ScIT-Raphael

@kristijansoldo
Copy link
Author

@ScIT-Raphael Hahaha! I have no words! Sad and funny in the same time.

@jaapmarcus
Copy link
Contributor

@kristijansoldo download it from github:
curl -O https://raw.githubusercontent.com/serghey-rodin/vesta/master/install/vst-install-debian.sh

If it is an DNS cache issue c.vestacp.com/apt.vestacp.com might not work either...

@dpeca
Copy link
Collaborator

dpeca commented Jul 27, 2021

@jaapmarcus
ahhh, you are right...
but maybe, and again, maybe, his DNS cached only main domain, and maybe c. and apt. resolves correctly 😄

@kristijansoldo
Copy link
Author

@anton-reutov Did you renewed? 😄

@ScIT-Raphael
Copy link

@anton-reutov Did you renewed? 😄

Domain has been renewed yesterday, while it got to grace period already a second time: #2060

Even after several warnings from hestia team...

@ScIT-Raphael
Copy link

ScIT-Raphael commented Jul 27, 2021

...and @dpeca of course, he warned aswell...

@anton-reutov
Copy link
Collaborator

anton-reutov commented Jul 27, 2021

@anton-reutov Did you renewed? smile

I don't understand the reasons for your laughter
Your problem is solved ?

ScIT-Raphael, in every word you say, there is a negative against the project. It started with the creation of your fork

@ScIT-Raphael
Copy link

ScIT-Raphael commented Jul 27, 2021

@anton-reutov I'm sorry that I'm a bit negativ against the project now. But I asked you, nearly begged for a new vestacp package to fix and protect the remaining active and productive vestacp servers (#2006 (comment), #2006 (comment), #2006 (comment)). Then you were even informed from us that the vestacp domain is expiring, but nothing happened, the nameserver changed: #2006 (comment)

Also you promise things, that just didnt happened and were anyway completly in the wrong direction (if you have a project with pending exploits): #2006 (comment)

Just in addition, you should be also aware of another security issue with the used jquery version, which is, beside some minor ones on "high severity": https://snyk.io/test/npm/jQuery/1.7.2

So, I need to excuse myself to be "negative" against the project - but I honestly don't feel bad doing it. You arent able to patch partitialy, critical security issues within an aceptable timeframe, let thousands of servers in a instable situation and try to hold a, in my point of view, dying project "somehow" alive. I already pointed that out in your forum: https://forum.vestacp.com/viewtopic.php?f=10&t=20562#p84568

I will stay negativ about the project, until you either bring it back alive with a new patched version, inform the users about the current security issues before they install vesta or let the project die in peace. If you're not happy with that, you're free to block me from your github project and/or forum.

PS: Infact you added "It started with the creation of your fork" which I missed due to writing. Hestia isnt the reason that I started thinking negativ about it - it's more the product that came out due to the situation. We all know that there were serveral security issues with the vesta infrastructure, some so bad that even digital ocean had network issues due to the amount of hacked vestacp servers which itself started to ddos. There was nearly zero communication, nothing written for weeks, users that need to find out what happened. Also deleting valid discussions in vesta forum, blaming another user in forum which even lead myself to write you in this case with a pn (never got an answer), and much other things. And aswell: It isnt "my fork", hestia started with around 5 old "vesta" members and growed massively over time - we got now more than 12k stable and secure servers.

PPS: All known exploits and issues, even the jquery one have been patched in hestiacp, you're free to take the code there (leave a thanks to the hestia project if you like). It's not, as you maybe think, my target to "hurt" vesta or be negative against it - I just want that the few thousands server out there in the wild just get patched!

@anton-reutov
Copy link
Collaborator

Thank you for your reply. I understand. Only Serghey have access to compile the packages, If someone else had access there would be no such problems. Now he's waiting for me to finish adding fixes to github
Can you write more about jquery vulnerability ?

Againt thank you!

@ScIT-Raphael
Copy link

ScIT-Raphael commented Jul 27, 2021

I've sent you the link already above, you will find the rewrite here: hestiacp/hestiacp@93c2079

But this is probaly not enough, we already reworked some jquery parts in earlier commits months ago.

I'm aware of the "Serghey Repo"-Problem, but why do you still try to hold the project alive when he don't want to give you access to the repo? No one can update it, Serghey clearly doesnt want to do it - probaly due to time, which I can also understand. So either he gives the access to you or you @anton-reutov need to stop the project and inform the remaining users!

@kristijansoldo
Copy link
Author

@anton-reutov Solved, thanks!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants