1

I am creating a test server that is vulnerable to the heartbleed bug.

My server is running Apache 2.4 on a FreeBSD VM. By default, FreeBSD seems to have OpenSSL 0.9.8 installed by default. I tried to uninstall OpenSSL from the ports, but since I didn't install it via ports( came by default ) I could not uninstall it that way.

Then I tried to just ignore it and installed OpenSSL 1.0.1 from source; but when I restarted the apache server, and checked the site using curl --head 127.0.0.1 "OpenSSL 0.9.8" was displayed.

Then I tried to reinstall/reconfigure apache but the same test yielded "OpenSSL 0.9.8".

So, I tried to replace the default OpenSSL like so:
- installed a newer OpenSSL via ports( in an attempt to replace the default version )
- make uninstall-ed the port-installed OpenSSL( in an attempt to erase the default OpenSSL completely )
- with my source-install the only one left, I figured that this had to have changed it
- the test still yielded "OpenSSL 0.9.8"( sadness )

So, why is it still displaying "OpenSSL 0.9.8"?

I also want to change the website to use OpenSSL 1.0.1, so advice on that would be helpful.

7
  • 1
    OpenSSL 1.0.1 is open to the very severe heartbleed bug. If you want to test against this bug, fine. If not, consider using 1.0.1g or disabling heartbeats. Apr 17, 2014 at 20:07
  • 1
    Yeah, I am specifically creating a test server that IS vulnerable to heartbleed-ing. Apr 17, 2014 at 20:09
  • I would start by doing something like find / -name openssl and deleting any folders that are obviously linked to openssl. You also may need to delete mod_ssl from Apache. From there, I would compile the new version from source. Apr 17, 2014 at 20:14
  • This post may be of some help too: stackoverflow.com/questions/1439950/…. Apr 17, 2014 at 20:21
  • If you are planning to build a vulnerable FreeBSD test system, you should go for a base FreeBSD 10.0: OpenSSL 1.0.1e with the base system. Or have a look here: superuser: about reinstalling openssl on FreeBSD.
    – Ouki
    Apr 18, 2014 at 0:32

2 Answers 2

5

The missing step is that you must say to the system that you want to use OpenSSL from ports over the one from the base system:

  • build OpenSSL from ports:

  • create/add to your /etc/make.conf the following line:

    WITH_OPENSSL_PORT=yes
    
  • then re-install all the other modules needing OpenSSL (devel/apr1, www/apache24, ...)

  • you can check the OpenSSL lib used by apache24 (in fact the apache24 mod_ssl module):

    # ldd /usr/local/libexec/apache24/mod_ssl.so |grep ssl 
    /usr/local/libexec/apache24/mod_ssl.so:
            libssl.so.8 => /usr/local/lib/libssl.so.8 (0x801634000)
    

    The apache24 mod_ssl is now using the OpenSSL library from the ports.

2
1

Compiling OpenSSL will not help you much. Your Apache is still linked with the old OpenSSL. You can verify this using the ldd command.

You should recompile Apache or mod_ssl for it to be linked to your new OpenSSL.

4
  • by "recompile Apache" do you mean, go into the extracted folder, run ./configure [options];make;make test;make install? Apr 17, 2014 at 20:37
  • @user2738698 Yes I do.
    – Spack
    Apr 17, 2014 at 21:22
  • 1
    That is still not enough! WITH_OpeNSSL_PORTS=yes is needed in /etc/make.conf.
    – Ouki
    Apr 18, 2014 at 0:38
  • @Ouki is correct. On FreeBSD there can be be two OpenSSLs-- one included with the base system, and one (or more) included with Ports. Recompiling isn't enough. Apr 18, 2014 at 0:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .