The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).
There's a website:
There's a web-based test:
What should I do to protect the sites that I run?
-
6Better answered on Server Fault - Heartbleed: What is it and what are options to mitigate it?– Sathyajith Bhat ♦Apr 8, 2014 at 15:56
-
5… as well as the StackExchange for security professionals. See security.stackexchange.com/questions/55076 and security.stackexchange.com/questions/tagged/heartbleed .– JdeBPApr 8, 2014 at 16:22
-
4Every major SE computer related site now has this question... Probably soon it will be asked even on cooking.stackexchange.com :D– VL-80Apr 8, 2014 at 19:10
-
I have added an end-user version of this question at superuser.com/questions/739260/… (but someone has already downvoted it, without explanation).– danortonApr 8, 2014 at 19:10
-
1@Nikolay, now I'm so tempted to ask it on cooking.se...– JoeApr 8, 2014 at 21:30
Add a comment
|
3 Answers
You should:
- Update your system to the latest OpenSSL version
- Generate new keys and certificates for services relying on OpenSSL and restart them
- Revoke former certificates
- Invalidate all established sessions
-
I don’t suppose you know of some nice clear instructions for the last three steps, do you? Apr 8, 2014 at 17:28
-
Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... Apr 8, 2014 at 17:50
-
How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR:
openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr! Apr 9, 2014 at 8:14
Update your system:
sudo apt-get update sudo apt-get upgradeReboot the server
openssl version -ato make sure you have the latest version!!
-
-
1
-
14This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft.– KyeoticApr 8, 2014 at 17:47
-
This assumes your system uses
apt-getas your package manager. The question does not suggest this is necessarily the case.– MichaelApr 9, 2014 at 17:12
More specifically for Ubuntu or Debian in general
/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start
