1

On a server running RedHat 6.7 with Apache 2.4.37 I proceeded to upgrade OpenSSL to 1.1.0i following the same steps as I've done on other servers with the same set up, but on this one, somehow, 2 versions are installed:

openssl version
OpenSSL 1.1.0i  14 Aug 2018 (Library: OpenSSL 1.1.0g  2 Nov 2017)

and that makes the server fail the security scan, as 1.1.0g is the one that appears on the scan and we're required to run 1.1.0i. Both versions were installed from source.

How can I either:

  • Configure it to use 1.1.0i
  • Remove 1.1.0g completly

or

  • Revert the changes

closed as off-topic by kasperd, Gerald Schneider, womble Dec 4 '18 at 4:16

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Requests for product, service, or learning material recommendations are off-topic because they attract low quality, opinionated and spam answers, and the answers become obsolete quickly. Instead, describe the business problem you are working on, the research you have done, and the steps taken so far to solve it." – womble
  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – kasperd, Gerald Schneider
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    How did you install OpenSSL, then? – Michael Hampton Nov 15 '18 at 12:07
  • For installation, I configured as ´sudo ./config no-threads -fPIC shared --prefix=/usr/local/openssl --openssldir=/usr/local/openssl´ld.so.` then add the library to ld.so.conf, export the flags, create symlinks. I did also updated Apache and configured it to use the newly installed Openssl – David FGF Nov 16 '18 at 15:42
1

The normal way of maintaining multiple versions of a binary, and making it possible to run either of them is to install them in separate locatoions and use symlinks to point whivh one to use ( or a an environment variable, like when installing multiple java versions).

So first figure out which binary you are using:

sudo which openssl

It might point to /bin/openssl

ls -l /bin/openssl
   -rwxr-xr-x 1 root root 555296 Apr 11  2018 /bin/openssl

Then run ]# /bin/openssl version to see what version it is.

Find which other openssl binaries you have using "locate" or "find" and either replace or symlink the correct version to /bin

or actually /usr/bin, since /bin is a symlink to /user/bin

  • Thanks a lot for your answer. Openssl binary in use is on /usr/bin/openssl and for the version command is: /usr/bin/openssl version OpenSSL 1.1.0i 14 Aug 2018 (Library: OpenSSL 1.1.0g 2 Nov 2017) That leaves me at the same point where I was, no idea why I get those 2 versions,or ho to point it to use 1.1.0i – David FGF Nov 16 '18 at 14:24
  • so it boils down to what libraries it has been linked/compiled with. ldd, objdump, readelf can be used to find more information of whats in use. See also superuser.com/questions/239590/… – Ingvar J Nov 19 '18 at 9:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.