[SOLVED] Heartbleed

metageek · 04-07-2014, 10:50 PM

I'm freaking out with this heartbleed bug (see here).

Eagerly waiting for a patch to come out for Slackware.

Thanks in advance to all the developers!

BenCollver · 04-07-2014, 10:55 PM

A patch came out about 8 hours ago.

http://www.linuxquestions.org/questi...ml#post5148304

BenCollver · 04-07-2014, 11:01 PM

My apologies. The OpenSSL patch came out 8 hours ago, not the Slackware patch.

metageek · 04-07-2014, 11:02 PM

Yes I know, I'm building a temporary package with the 1.0.1g source and the source package. Unfortunately the build fails at some point, though it is only for the documentation part (which I am disabling).

But not knowing all the implications (ie which other packages to rebuild), I will be much more confident when all PV's official patches are released.

metageek · 04-07-2014, 11:38 PM

I've successfully built openssl-1.0.1g-x86_64-1_slack14.1.txz and openssl-solibs-1.0.1g-x86_64-1_slack14.1.txz using the source package for openssl-1.0.1f. All it took was to remove the previous tarball (openssl-1.0.1f.tar.gz) and drop in the new one openssl-1.0.1g .tar.gz

I'd put it on a server for others to download, but right now I do not want to ssh into any server not yet patched... at least my client is already clean.

Now get all new passwords, ssl keys... what a nightmare!

ponce · 04-07-2014, 11:46 PM

AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

FYI, waiting for the official packages, I tried here building from slackware64-current's and slackware64-14.1's sources just substituting the tarball file (well, I got also the signature) and everything seems to have went fine (no problems with docs building like metageek reported).

metageek · 04-07-2014, 11:53 PM

Quote:

Originally Posted by ponce

AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

Thanks for the info, this sounds good. I did manage to build now that I used the source package in the 14.1 patch folder (rather than the one on the original 14.1 source).

jtsn · 04-07-2014, 11:54 PM

Another example that the newest version isn't always the best version. Slackware 13.37 and below are not affected, because they use OpenSSL 0.9.8y.

ponce · 04-08-2014, 12:04 AM

Quote:

Originally Posted by ponce

AFAIK pretty much everything in Slackware linking the openssl libraries does it with the dynamic ones, so you should be safe upgrading the openssl and openssl-solibs packages.

well, to avoid misunderstanding I have to specify (for the ones that haven't read mancha's post or the dedicated site) that when I said "you should be safe" I meant on the software side: like the reporters say, every certificate (server-side and client-side) is potentially compromised and must be regenerated and so, still potentially, are passwords trasmitted on services using openssl...

metageek · 04-08-2014, 12:18 AM

Yes, all passwords, and ssl keys need to be reset, and this is only on the clients. Servers have further problems with certificates. And all the goodies they keep might already have been taken (password DBs, SSNs, credit card numbers, bitcoins, the whole lot).

Before updating passwords and ssl keys I am not loggin in to any site of importance (ie banks, etc). I'm physically copying the updated packages using USB memory stick, not daring using ssh (since machines receiving them through ssh would not have been patched yet).

BenCollver · 04-08-2014, 12:26 AM

After the upgrade, here is a check for processes that are still using the old version of SSL.

lsof -n | grep ssl | grep DEL

ponce · 04-08-2014, 12:56 AM

regarding that, consider that /usr/lib$LIBDIRSUFFIX/libssl3.so, provided by the mozilla-nss package, is not openssl...

moisespedro · 04-08-2014, 05:21 AM

I tried upgrading it, the build failed :/

willysr · 04-08-2014, 06:09 AM

You can also rebuilt the current version but add this parameter so that heartbeats module will not be built: -DOPENSSL_NO_HEARTBEATS

ruario · 04-08-2014, 09:43 AM

Quote:

Originally Posted by moisespedro

I tried upgrading it, the build failed :/

Worked for me. Try this sequence:

Code:

$ cd /tmp
$ wget -R "openssl-1.0.1f.*" -nH --cut-dirs=3 -rl2 ftp://mirrors1.kernel.org/slackware/slackware-14.1/patches/source/openssl/
$ wget -P source/openssl https://www.openssl.org/source/openssl-1.0.1g.tar.gz
$ su -
# cd /tmp/source/openssl
# sh openssl.SlackBuild

At the end you should find two packages in your /tmp directory: openssl-1.0.1g and openssl-solibs-1.0.1g.