Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running a fedora 15 2.6.32-042stab081.3 x64, I have OpenSSL 1.0.0j-fips 10 May 2012 which I understand to not be infected.

However every test tool out there is reporting the site maybe vulnerable based on the age of the certificate. So while my system doesn't need to be patched for this, the mass hysteria and panic suggests I should update so users are not presented with the site maybe insecure. by these "check tools"

However yum update, is offering nothing. I can't see to find a newer rpm, so I'm at a loss of how to update openSSL? install from source?

Any advice or points would be a great help.

UPDATE ::: I have downloaded the source for openssl-1.0.1g and installed from source, however when running openssl version, it still reports the old version?

share|improve this question

closed as off-topic by Sven, Aaron Copley, MadHatter, Rex, mdpc Apr 10 at 20:10

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Sven, Aaron Copley, MadHatter, Rex, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

6  
Fedora 15 is unsupported since 2012 and has no place on an internet facing server. If you run Fedora, keep it up to date with a supported version. Also, if the certificates are expired, you need to create new ones. That is nothing yum can help you with. –  Sven Apr 10 at 9:33
    
@svW, That is not the most helpful comment. The certs have not expired and I didn't state that they have. I am aware of how to renew and update my certs. I just thought since I am going to have to revoke/renew them that I should update open SSL at the same time. –  Shaun Forsyth Apr 10 at 10:16
2  
There is no reason to update your openssl as it is not affected by heartbleed. There is every reason to update your OS as having been unsupported for 2 years it likely contains other unpatched security vulnerabilities. –  Iain Apr 10 at 10:34
2  
@ShaunForsyth: I've inferred the expired certificate from the "age of the certificate" statement, which was apparently incorrect. Nevertheless, I repeat: Don't waste a minute on a non-issue when you have a complete server that needs to be update to a supported OS now. –  Sven Apr 10 at 10:46
1  
You will have to make a backup anyway before upgrading. Unfortunately, it's quite possible to break your systems while doing the five required updates (15->16->17->18->19->20) before you end up with a current version. Due to the short support cycle of Fedora, it is really unsuitable for a server install and I recommend something like Ubuntu or CentOS instead. My plan would be to setup a second VPS with one of those systems and after you have configured this correctly, move the data over and turn off the old machine. –  Sven Apr 10 at 11:18

1 Answer 1

While this should be a non-issue on Fedoras earlier than 18, my Fedora 17 happened to get detected by some vulnerability scanner. You shouldn't update your SSL version by hand, since it would make your another packages, like httpd stop working due to incorrect ABI.

What I did was rebuilding RPM packages without heartbeat support: $ yum groupinstall rpmdevtools $ yumdownloader --source openssl $ rpm -ivh ./openssl*.src.rpm $ nano ~/rpmbuild/SPECS/openssl.spec --- replace a line like: Release: 1%{?dist} --- with something like: Release: 1%(?dist}.heartbleed --- replace a line like: RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack" --- with something like: RPM_OPT_FLAGS="$RPM_OPT_FLAGS -Wa,--noexecstack -DOPENSSL_NO_HEARTBEATS" $ rpmbuild -ba ~/rpmbuild/SPECS/openssl.spec $ i386 rpmbuild -ba ~/rpmbuild/SPECS/openssl.spec # execute it only if on x86_64 $ rpm -Fvh ~/rpmbuild/RPMS/*/openssl*.rpm

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.