LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Slackware (http://www.linuxquestions.org/questions/slackware-14/)
-   -   Heartbleed (http://www.linuxquestions.org/questions/slackware-14/heartbleed-4175500917/)

metageek 04-07-2014 10:50 PM

Heartbleed
 
I'm freaking out with this heartbleed bug (see here).

Eagerly waiting for a patch to come out for Slackware.

Thanks in advance to all the developers!

BenCollver 04-07-2014 10:55 PM

A patch came out about 8 hours ago.

http://www.linuxquestions.org/questi...ml#post5148304

BenCollver 04-07-2014 11:01 PM

My apologies. The OpenSSL patch came out 8 hours ago, not the Slackware patch.

metageek 04-07-2014 11:02 PM

Yes I know, I'm building a temporary package with the 1.0.1g source and the source package. Unfortunately the build fails at some point, though it is only for the documentation part (which I am disabling).

But not knowing all the implications (ie which other packages to rebuild), I will be much more confident when all PV's official patches are released.

metageek 04-07-2014 11:38 PM

I've successfully built openssl-1.0.1g-x86_64-1_slack14.1.txz and openssl-solibs-1.0.1g-x86_64-1_slack14.1.txz using the source package for openssl-1.0.1f. All it took was to remove the previous tarball (openssl-1.0.1f.tar.gz) and drop in the new one openssl-1.0.1g .tar.gz

I'd put it on a server for others to download, but right now I do not want to ssh into any server not yet patched... at least my client is already clean.

Now get all new passwords, ssl keys... what a nightmare!

ponce 04-07-2014 11:46 PM

AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

FYI, waiting for the official packages, I tried here building from slackware64-current's and slackware64-14.1's sources just substituting the tarball file (well, I got also the signature) and everything seems to have went fine (no problems with docs building like metageek reported).

metageek 04-07-2014 11:53 PM

Quote:

Originally Posted by ponce (Post 5148539)
AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

Thanks for the info, this sounds good. I did manage to build now that I used the source package in the 14.1 patch folder (rather than the one on the original 14.1 source).

jtsn 04-07-2014 11:54 PM

Another example that the newest version isn't always the best version. Slackware 13.37 and below are not affected, because they use OpenSSL 0.9.8y.

ponce 04-08-2014 12:04 AM

Quote:

Originally Posted by ponce (Post 5148539)
AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

well, to avoid misunderstanding I have to specify (for the ones that haven't read mancha's post or the dedicated site) that when I said "you should be safe" I meant on the software side: like the reporters say, every certificate (server-side and client-side) is potentially compromised and must be regenerated and so, still potentially, are passwords trasmitted on services using openssl...

metageek 04-08-2014 12:18 AM

Yes, all passwords, and ssl keys need to be reset, and this is only on the clients. Servers have further problems with certificates. And all the goodies they keep might already have been taken (password DBs, SSNs, credit card numbers, bitcoins, the whole lot).

Before updating passwords and ssl keys I am not loggin in to any site of importance (ie banks, etc). I'm physically copying the updated packages using USB memory stick, not daring using ssh (since machines receiving them through ssh would not have been patched yet).

BenCollver 04-08-2014 12:26 AM

After the upgrade, here is a check for processes that are still using the old version of SSL.

lsof -n | grep ssl | grep DEL

ponce 04-08-2014 12:56 AM

regarding that, consider that /usr/lib$LIBDIRSUFFIX/libssl3.so, provided by the mozilla-nss package, is not openssl...

moisespedro 04-08-2014 05:21 AM

I tried upgrading it, the build failed :/

willysr 04-08-2014 06:09 AM

You can also rebuilt the current version but add this parameter so that heartbeats module will not be built: -DOPENSSL_NO_HEARTBEATS

ruario 04-08-2014 09:43 AM

Quote:

Originally Posted by moisespedro (Post 5148653)
I tried upgrading it, the build failed :/

Worked for me. Try this sequence:

Code:

$ cd /tmp
$ wget -R "openssl-1.0.1f.*" -nH --cut-dirs=3 -rl2 ftp://mirrors1.kernel.org/slackware/slackware-14.1/patches/source/openssl/
$ wget -P source/openssl https://www.openssl.org/source/openssl-1.0.1g.tar.gz
$ su -
# cd /tmp/source/openssl
# sh openssl.SlackBuild

At the end you should find two packages in your /tmp directory: openssl-1.0.1g and openssl-solibs-1.0.1g.


All times are GMT -5. The time now is 01:36 PM.