Linked Questions
17 questions linked to/from Heartbleed: What is it and what are options to mitigate it?
1
vote
2
answers
704
views
How does apache threads, running as non-root, handle private keys (used for the SSL certificate)?
How can apache's children, which are running as a non-root user, access the private key (used with the SSL certificate) which only root should have access to?
Indeed, when Apache is starting, only ...
0
votes
0
answers
30
views
Should I completely rebuild my server due to Heartbleed? [duplicate]
I have a CentOS 6.5 VPS server...
$ uname -a
Linux mary 3.14.4-x86_64-linode40 #1 SMP Tue May 13 12:25:05 EDT 2014 \
x86_64 x86_64 x86_64 GNU/Linux
When the news about the Heartbleed ...
-1
votes
1
answer
118
views
Heartbleed - Centos 6.5, Apache - should I recreate pair of default certificate and key [duplicate]
I am using Centos 6.5, Apache 2.2.15 with SSL. Due to heartbleed I have updated openssl to release 16.el6_5.7 and I have restarted the httpd service.
I am using default Apache certificate and key:
*/...
4
votes
2
answers
7k
views
debian wheezy, heartbleed, openssl refuses to update
I am having a strange problem, my system is exposed to heartbleed, and I am trying to fix it by using:
apt-get clean,
apt-get update
and
apt-get upgrade openssl
but the response is:
Reading ...
-4
votes
1
answer
134
views
Heartbleed: What if OpenSSL has been patched but SSL certs not yet rekeyed? [duplicate]
Does anyone know what entry point a hacker could have if a sever's OpenSSL has been patched but a site's SSL certs have not yet been rekeyed?
Thanks!
1
vote
3
answers
238
views
Open SSL - Is my ubuntu really secure now after dist-upgrade?
I am running a Ubuntu 12.04 server and I just updated the server with (and rebooted afterwards)
sudo apt-get dist-upgrade
Now the open SSL version sais, it is build on 7 Apr 2014 what is good, but ...
0
votes
2
answers
103
views
Possible Heartbleed Compromise recovery [duplicate]
I have a web-server, (complete with user account and payment system), that was vulnerable to the Heartbleed attack.
What I'm wondering is:
How can I detect if my server has been compromised?
How do ...
1
vote
1
answer
5k
views
Heartbleed flaw fix on Debian Wheezy [duplicate]
is there any 100% working method to update openssl to the non vulnerable version on Debian Wheezy.
I do not want to upgrade the whole OS, nor would I like to install a non official package.
Is there ...
1
vote
1
answer
12k
views
How to upgrade OpenSSL on CentOS 6.5 to protect against heartbleed? [duplicate]
When I go to run:
root@vps [~]# yum update -y openssl
I get:
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
* base: mirror.beyondhosting.net
* extras: centos.mirror.nac....
9
votes
1
answer
326
views
How do we instruct our employees to protect themselves from Heartbleed? [duplicate]
Welcome to the world after heartbleed. We've patched our servers and are replacing our SSL certificates. But just because our servers are fixed, that doesn't mean that the rest of the internet is ...
4
votes
1
answer
527
views
Heartbleed, which specific services must be restarted?
Trying to figure out exactly what services should be restarted after patching openssl against Heartbleed. At least one post mentions restarting:
sshd, apache, nginx, postfix, dovecot, courier, pure-...
1
vote
2
answers
15k
views
How to upgrade OpenSSL on Ubuntu Server 12.04 LTS? (Heartbleed) [duplicate]
How do I upgrade OpenSSL using Ubuntu's repository?
I see the USN at http://www.ubuntu.com/usn/usn-2165-1/
and the package here https://launchpad.net/ubuntu/+source/openssl/1.0.1-4ubuntu5.12
but I ...
65
votes
6
answers
13k
views
Heartbleed: are services other than HTTPS affected?
The OpenSSL 'heartbleed' vulnerability (CVE-2014-0160) affects webservers serving HTTPS. Other services also use OpenSSL. Are these services also vulnerable to heartbleed-like data leakage?
I'm ...
9
votes
4
answers
4k
views
Do I Need to Replace Keys for OpenSSH in Response to Heartbleed?
I've already updated my servers with the patches.
Do I need to regenerate any private keys with respect to OpenSSH? I know that I have to regenerate any SSL certificates.
EDIT: I didn't word this ...
2
votes
0
answers
136
views
Best method to update ubuntu 13.10 to path the HeartBleed bug [duplicate]
So we are running ubuntu 13.10 in production and they have OpenSSL 1.0.1e 11 Feb 2013, which obviously needs to be patched.
What's the best way to do it without any downtime?
What will happen to the ...