Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am creating a test server that is vulnerable to the heartbleed bug.

My server is running Apache 2.4 on a FreeBSD VM. By default, FreeBSD seems to have OpenSSL 0.9.8 installed by default. I tried to uninstall OpenSSL from the ports, but since I didn't install it via ports( came by default ) I could not uninstall it that way.

Then I tried to just ignore it and installed OpenSSL 1.0.1 from source; but when I restarted the apache server, and checked the site using curl --head 127.0.0.1 "OpenSSL 0.9.8" was displayed.

Then I tried to reinstall/reconfigure apache but the same test yielded "OpenSSL 0.9.8".

So, I tried to replace the default OpenSSL like so:
- installed a newer OpenSSL via ports( in an attempt to replace the default version )
- make uninstall-ed the port-installed OpenSSL( in an attempt to erase the default OpenSSL completely )
- with my source-install the only one left, I figured that this had to have changed it
- the test still yielded "OpenSSL 0.9.8"( sadness )

So, why is it still displaying "OpenSSL 0.9.8"?

I also want to change the website to use OpenSSL 1.0.1, so advice on that would be helpful.

share|improve this question
1  
OpenSSL 1.0.1 is open to the very severe heartbleed bug. If you want to test against this bug, fine. If not, consider using 1.0.1g or disabling heartbeats. –  Travis Pessetto Apr 17 '14 at 20:07
1  
Yeah, I am specifically creating a test server that IS vulnerable to heartbleed-ing. –  user2738698 Apr 17 '14 at 20:09
    
I would start by doing something like find / -name openssl and deleting any folders that are obviously linked to openssl. You also may need to delete mod_ssl from Apache. From there, I would compile the new version from source. –  Travis Pessetto Apr 17 '14 at 20:14
    
This post may be of some help too: stackoverflow.com/questions/1439950/…. –  Travis Pessetto Apr 17 '14 at 20:21
    
If you are planning to build a vulnerable FreeBSD test system, you should go for a base FreeBSD 10.0: OpenSSL 1.0.1e with the base system. Or have a look here: superuser: about reinstalling openssl on FreeBSD. –  Ouki Apr 18 '14 at 0:32

2 Answers 2

up vote 3 down vote accepted

The missing step is that you must say to the system that you want to use OpenSSL from ports over the one from the base system:

  • build OpenSSL from ports:

  • create/add to your /etc/make.conf the following line:

    WITH_OPENSSL_PORT=yes
    
  • then re-install all the other modules needing OpenSSL (devel/apr1, www/apache24, ...)

  • you can check the OpenSSL lib used by apache24 (in fact the apache24 mod_ssl module):

    # ldd /usr/local/libexec/apache24/mod_ssl.so |grep ssl 
    /usr/local/libexec/apache24/mod_ssl.so:
            libssl.so.8 => /usr/local/lib/libssl.so.8 (0x801634000)
    

    The apache24 mod_ssl is now using the OpenSSL library from the ports.

share|improve this answer
1  
It's actually "WITH_OPENSSL_PORT=yes". See freebsd.org/doc/en/books/handbook/openssl.html –  northox Feb 22 at 14:47
    
@northox: typo fixed. Thanks for the extra eyes –  Ouki Feb 22 at 15:54

Compiling OpenSSL will not help you much. Your Apache is still linked with the old OpenSSL. You can verify this using the ldd command.

You should recompile Apache or mod_ssl for it to be linked to your new OpenSSL.

share|improve this answer
    
by "recompile Apache" do you mean, go into the extracted folder, run ./configure [options];make;make test;make install? –  user2738698 Apr 17 '14 at 20:37
    
@user2738698 Yes I do. –  Spack Apr 17 '14 at 21:22
1  
That is still not enough! WITH_OpeNSSL_PORTS=yes is needed in /etc/make.conf. –  Ouki Apr 18 '14 at 0:38
    
@Ouki is correct. On FreeBSD there can be be two OpenSSLs-- one included with the base system, and one (or more) included with Ports. Recompiling isn't enough. –  Stefan Lasiewski Apr 18 '14 at 0:57

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.