Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).

There's a website:

http://www.heartbleed.com

There's a web-based test:

http://filippo.io/Heartbleed/

What should I do to protect the sites that I run?

share|improve this question
6  
5  
… as well as the StackExchange for security professionals. See security.stackexchange.com/questions/55076 and security.stackexchange.com/questions/tagged/heartbleed . – JdeBP Apr 8 '14 at 16:22
4  
Every major SE computer related site now has this question... Probably soon it will be asked even on cooking.stackexchange.com :D – VL-80 Apr 8 '14 at 19:10
    
I have added an end-user version of this question at superuser.com/questions/739260/… (but someone has already downvoted it, without explanation). – danorton Apr 8 '14 at 19:10
1  
@Nikolay, now I'm so tempted to ask it on cooking.se... – Joe Apr 8 '14 at 21:30

You should:

  • Update your system to the latest OpenSSL version
  • Generate new keys and certificates for services relying on OpenSSL and restart them
  • Revoke former certificates
  • Invalidate all established sessions
share|improve this answer
    
I don’t suppose you know of some nice clear instructions for the last three steps, do you? – Paul D. Waite Apr 8 '14 at 17:28
    
Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... – Roger Lipscombe Apr 8 '14 at 17:50
    
How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR: openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr! – Executifs Apr 9 '14 at 8:14

Stolen from a reddit comment.

  1. Update your system:

    sudo apt-get update
    sudo apt-get upgrade
    
  2. Reboot the server

  3. openssl version -a to make sure you have the latest version!!

share|improve this answer
    
The OP delivers! – I am John Galt Apr 8 '14 at 17:12
1  
@IamJohnGalt It's not like it's a locked safe or something. ;) – Ƭᴇcʜιᴇ007 Apr 8 '14 at 17:28
14  
This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft. – Tyrsius Apr 8 '14 at 17:47
    
This assumes your system uses apt-get as your package manager. The question does not suggest this is necessarily the case. – Michael Apr 9 '14 at 17:12

More specifically for Ubuntu or Debian in general

/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start

Ref http://www.ubuntu.com/usn/usn-2165-1/

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .