Linked Questions

1 vote
2 answers
704 views

How does apache threads, running as non-root, handle private keys (used for the SSL certificate)?

How can apache's children, which are running as a non-root user, access the private key (used with the SSL certificate) which only root should have access to? Indeed, when Apache is starting, only ...
Pierre's user avatar
  • 23
0 votes
0 answers
30 views

Should I completely rebuild my server due to Heartbleed? [duplicate]

I have a CentOS 6.5 VPS server... $ uname -a Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \ x86_64 x86_64 x86_64 GNU/Linux When the news about the Heartbleed ...
Agvorth's user avatar
  • 2,449
-1 votes
1 answer
118 views

Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]

I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service. I am using default Apache certificate and key: */...
teo's user avatar
  • 143
4 votes
2 answers
7k views

debian wheezy, heartbleed, openssl refuses to update

I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using: apt-get clean, apt-get update and apt-get upgrade openssl but the response is: Reading ...
Wazime's user avatar
  • 471
-4 votes
1 answer
134 views

Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]

Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed? Thanks!
Honey Badger's user avatar
1 vote
3 answers
238 views

Open SSL - Is my ubuntu really secure now after dist-upgrade?

I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards) sudo apt-get dist-upgrade Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
jan's user avatar
  • 129
0 votes
2 answers
103 views

Possible Heartbleed Compromise recovery [duplicate]

I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack. What I'm wondering is: How can I detect if my server has been compromised? How do ...
Azzie Rogers's user avatar
1 vote
1 answer
5k views

Heartbleed flaw fix on Debian Wheezy [duplicate]

is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy. I do not want to upgrade the whole OS, nor would I like to install a non official package. Is there ...
Patrick's user avatar
  • 31
1 vote
1 answer
12k views

How to upgrade OpenSSL on CentOS 6.5 to protect against heartbleed? [duplicate]

When I go to run: root@vps [~]# yum update -y openssl I get: Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: mirror.beyondhosting.net * extras: centos.mirror.nac....
UKB's user avatar
  • 113
9 votes
1 answer
326 views

How do we instruct our employees to protect themselves from Heartbleed? [duplicate]

Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
Wayne Conrad's user avatar
4 votes
1 answer
527 views

Heartbleed, which specific services must be restarted?

Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting: sshd, apache, nginx, postfix, dovecot, courier, pure-...
xref's user avatar
  • 273
1 vote
2 answers
15k views

How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]

How do I upgrade OpenSSL using Ubuntu's repository? I see the USN at http://www.ubuntu.com/usn/usn-2165-1/ and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12 but I ...
ameagher's user avatar
  • 113
65 votes
6 answers
13k views

Heartbleed: are services other than HTTPS affected?

The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage? I'm ...
Flup's user avatar
  • 8,108
9 votes
4 answers
4k views

Do I Need to Replace Keys for OpenSSH in Response to Heartbleed?

I've already updated my servers with the patches. Do I need to regenerate any private keys with respect to OpenSSH? I know that I have to regenerate any SSL certificates. EDIT: I didn't word this ...
Olly's user avatar
  • 449
2 votes
0 answers
136 views

Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]

So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched. What's the best way to do it without any downtime? What will happen to the ...
pdeva's user avatar
  • 2,517

15 30 50 per page