Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Due to heartbleed vulnerability I have recompiled apache with non vulnerable latest openssl(I had to keep old vulnerable openssl due to some dependency problem). It is running fine and when doing heartbleed test for mydomain.com it says 'seems fixed or unaffected'. But if I do apachectl graceful and take test for heartbleed it says mydomain.com is vulnerable. If I do /usr/local/etc/rc.d/apache2 restart or apachectl restart there is no problem.

1)My question is why it takes old openssl library when doing apachectl graceful only?

2)What is the difference b/w apachectl restart and apachectl graceful when accessing openssl libraries?

share|improve this question

1 Answer 1

There is no difference between apachectl restart and graceful in terms of loading libraries. apachectl graceful sends the SIGUSR1 signal instead of SIGTERM so that open connections have the oppurtunity to close instead of being interrupted. see apachectl man page

You may have 2 installations of apache on your system. If apache was installed through your package manager and you didn't remove it before you recompiled then that could explain the bizarre test results. You could be starting apache with /usr/local/etc/rc.d/apache2 restart which would start your recompiled instance. Then when you used apachectl which is really /usr/sbin/apachectl it started your vulnerable installation and you failed the check.

share|improve this answer
    
Wrong. apachectl restart start new version (non vulnerable), but apachectl graceful is vulnerable. –  Abraham Van Helsing Apr 26 at 10:53
    
@Harikrishnan when apache fails the test, if you run ps aux | egrep "(httpd|apache)" is your new binary is what is shown by ps? –  Creek Apr 26 at 11:53
    
yes..it's new binary but with old openssl.(Old binary is moved from default path) –  Abraham Van Helsing Apr 26 at 16:36
    
In your httpd.conf, does LoadModule ssl_module [path to module] point to the new module? –  Creek Apr 26 at 19:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.