Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).

There's a website:

http://www.heartbleed.com

There's a web-based test:

http://filippo.io/Heartbleed/

What should I do to protect the sites that I run?

share|improve this question
6  
5  
… as well as the StackExchange for security professionals. See security.stackexchange.com/questions/55076 and security.stackexchange.com/questions/tagged/heartbleed . –  JdeBP Apr 8 at 16:22
4  
Every major SE computer related site now has this question... Probably soon it will be asked even on cooking.stackexchange.com :D –  Nikolay Apr 8 at 19:10
    
I have added an end-user version of this question at superuser.com/questions/739260/… (but someone has already downvoted it, without explanation). –  danorton Apr 8 at 19:10
1  
@Nikolay, now I'm so tempted to ask it on cooking.se... –  Joe Apr 8 at 21:30

3 Answers 3

You should:

  • Update your system to the latest OpenSSL version
  • Generate new keys and certificates for services relying on OpenSSL and restart them
  • Revoke former certificates
  • Invalidate all established sessions
share|improve this answer
    
I don’t suppose you know of some nice clear instructions for the last three steps, do you? –  Paul D. Waite Apr 8 at 17:28
    
Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... –  Roger Lipscombe Apr 8 at 17:50
    
How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR: openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr! –  Executifs Apr 9 at 8:14

Stolen from a reddit comment.

  1. Update your system:

    sudo apt-get update
    sudo apt-get upgrade
    
  2. Reboot the server

  3. openssl version -a to make sure you have the latest version!!

share|improve this answer
    
The OP delivers! –  I am John Galt Apr 8 at 17:12
1  
@IamJohnGalt It's not like it's a locked safe or something. ;) –  Ƭᴇcʜιᴇ007 Apr 8 at 17:28
14  
This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft. –  Tyrsius Apr 8 at 17:47
    
This assumes your system uses apt-get as your package manager. The question does not suggest this is necessarily the case. –  Michael Apr 9 at 17:12

More specifically for Ubuntu or Debian in general

/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start

Ref http://www.ubuntu.com/usn/usn-2165-1/

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.