Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing heartbleed test for mydomain.com it says 'seems fixed or unaffected'. But if I do apachectl graceful and take test for heartbleed it says mydomain.com is vulnerable. If I do /usr/local/etc/rc.d/apache2 restart or apachectl restart there is no problem.

1)My question is why it takes old openssl library when doing apachectl graceful only?

2)What is the difference b/w apachectl restart and apachectl graceful when accessing openssl libraries?


locked by HopelessN00b 18 hours ago

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

1 Answer 1

up vote 3 down vote accepted

There is no difference between apachectl restart and graceful in terms of loading libraries. apachectl graceful sends the SIGUSR1 signal instead of SIGTERM so that open connections have the oppurtunity to close instead of being interrupted. see apachectl man page

You may have 2 installations of apache on your system. If apache was installed through your package manager and you didn't remove it before you recompiled then that could explain the bizarre test results. You could be starting apache with /usr/local/etc/rc.d/apache2 restart which would start your recompiled instance. Then when you used apachectl which is really /usr/sbin/apachectl it started your vulnerable installation and you failed the check.

Wrong. apachectl restart start new version (non vulnerable), but apachectl graceful is vulnerable. –  Harikrishnan Apr 26 '14 at 10:53
@Harikrishnan when apache fails the test, if you run ps aux | egrep "(httpd|apache)" is your new binary is what is shown by ps? –  Creek Apr 26 '14 at 11:53
yes..it's new binary but with old openssl.(Old binary is moved from default path) –  Harikrishnan Apr 26 '14 at 16:36
In your httpd.conf, does LoadModule ssl_module [path to module] point to the new module? –  Creek Apr 26 '14 at 19:07

Not the answer you're looking for? Browse other questions tagged or ask your own question.