Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am so new to updating server technologies it is unbelievable but we are trying to become PCI Compliant and have to update some of our server technologies. One in particular is OpenSSL.

We are currently running arch i686 0.9.8e but we have to upgrade to ATLEAST 0.9.8g.

When I run a yum update command, there are no updates available. If I run "yum info openssl" it says available packages are: arch i386 0.9.8e but the only difference is smaller file size.

I am running the following repositories:

Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * addons: mirrors.netdna.com * atomic: www6.atomicorp.com * base: mirrors.igsobe.com * extras: mirror.vcu.edu * updates: mirror.vcu.edu

any help out there?

EDIT

I am running CentOS release 5.5 (Final)

When I try to manually compile using the following code:

  • cd /usr/local/src
  • rm -fR openssl-0.9.*
  • wget -N http://www.openssl.org/source/openssl-0.9.8g.tar.gz
  • gzip -d -c openssl-0.9.8n.tar.gz | gtar xvf -
  • cd openssl-0.9.8g
  • ./config
  • make
  • make install
  • alias cp=cp
  • cp -f /usr/local/ssl/bin/openssl /usr/bin/openssl
  • cd /usr/local/include
  • mv openssl openssl.old
  • ln -s /usr/local/ssl/include/openssl openssl

I get the following error:

gtar: This does not look like a tar archive gtar: Error exit delays from previous errors

share|improve this question
    
Why do you need 0.9.8g? –  Ignacio Vazquez-Abrams May 19 '10 at 23:08
    
dont know - that's irrelevant - because the PCI Scanning Organization said so. We need 0.9.8g or more recent –  JM4 May 19 '10 at 23:13
    
They probably want you to upgrade due to this brute force vulnerability: web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-0166 . If I remember, this was a pretty big deal when it came out. –  Stefan Lasiewski May 19 '10 at 23:22
    
Can you provide more details on your CentOS version? Which version of CentOS are you running? What does "lsb_release -a" say? –  Stefan Lasiewski May 19 '10 at 23:23
    
@Stefan - I added notes as an edit, running CentOS 5.5 final –  JM4 May 19 '10 at 23:33

2 Answers 2

up vote 1 down vote accepted

As a worst-case scenario, you could always just compile your own version of openssl as an RPM for your system, and then rpm -ihv.

EDIT: Starting with the source file (.tar.gz), here's what you want to do:

1) Create a new directory to house the RPM hierarchy.

# mkdir -p myopenssl/BUILD myopenssl/RPMS myopenssl/SOURCES myopenssl/SPECS myopenssl/SRPMS

2) Go into the SOURCES directory, and download your source openssl.tar.gz

# cd myopenssl/SOURCES
# mv openssl.tar.gz myopenssl/SOURCES/

3) Create a spec file that provides the necessary metadata (you will need to verify all the values are correct)

--- spec ----
%define _topdir     /home/user/myopenssl
%define name            openssl
%define release     0
%define version     x.x
%define buildroot %{_topdir}/%{name}-%{version}-root

BuildRoot:  %{buildroot}
Summary:        openssl
License:        GPL
Name:           %{name}
Version:        %{version}
Release:        %{release}
Source:         %{name}-%{version}.tar.gz
Prefix:         /usr
Group:          Development/Tools

%description
Special build of openssl for centos.

%prep
%setup -q

%build
./configure
make

%install
make install prefix=$RPM_BUILD_ROOT/usr

%files
%defattr(-,root,root)
/usr/local/bin/openssl

%doc %attr(0444,root,root) /usr/local/share/man/man1/openssl.1

4) After you have a spec file, use the rpmbuild command to build your RPM

# rpmbuild -v -bb --clean myopenssl/SPECS/openssl.spec

5) Your RPM is built at this point... use the following command to look at the contents:

# rpm -Vp RPMS/i386/myopenssl.i386.rpm

6) To install it, run the following as root:

# rpm -ihv myopenssl.i386.rpm

Hope this helps!

share|improve this answer
    
I have absolutely no idea how to do that –  JM4 May 19 '10 at 23:33
1  
The nutshell version is basically you download the source, prepare/compile it into an RPM, and then install the resultant RPM. For detailed directions, ibm.com/developerworks/library/l-rpm1. –  Tony May 19 '10 at 23:36
    
this is very helpful, how do you recommend building the spec file? Is there a particular program used to do so? –  JM4 May 20 '10 at 0:07
    
Use any text editor... when I first got into linux, joe was the best for me, since it was very much like edit.com from DOS. nano, vi, vim are also viable, just not as user-friendly. –  Tony May 20 '10 at 1:16

i tried this solution but i had to fix some lines:

* cd /usr/local/src
* wget -N http://www.openssl.org/source/openssl-1.0.0c.tar.gz
* tar -xzvf openssl-1.0.0c.tar.gz 
* cd openssl-1.0.0c
* ./config
* make
* make install
* alias cp=cp
* cp /usr/local/ssl/bin/openssl /usr/bin/openssl
* cd /usr/local/ssl/include
* ln -s /usr/local/ssl/include/openssl openssl

it worked for me, with centos 5.5

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.