9

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).

There's a website:

http://www.heartbleed.com

There's a web-based test:

http://filippo.io/Heartbleed/

What should I do to protect the sites that I run?

7

You should:

  • Update your system to the latest OpenSSL version
  • Generate new keys and certificates for services relying on OpenSSL and restart them
  • Revoke former certificates
  • Invalidate all established sessions
| improve this answer | |
  • I don’t suppose you know of some nice clear instructions for the last three steps, do you? – Paul D. Waite Apr 8 '14 at 17:28
  • Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... – Roger Lipscombe Apr 8 '14 at 17:50
  • How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR: openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr! – Executifs Apr 9 '14 at 8:14
4

Stolen from a reddit comment.

  1. Update your system:

    sudo apt-get update
    sudo apt-get upgrade
    
  2. Reboot the server

  3. openssl version -a to make sure you have the latest version!!

| improve this answer | |
  • The OP delivers! – I am John Galt Apr 8 '14 at 17:12
  • 1
    @IamJohnGalt It's not like it's a locked safe or something. ;) – Ƭᴇcʜιᴇ007 Apr 8 '14 at 17:28
  • 14
    This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft. – Kyeotic Apr 8 '14 at 17:47
  • This assumes your system uses apt-get as your package manager. The question does not suggest this is necessarily the case. – Michael Apr 9 '14 at 17:12
0

More specifically for Ubuntu or Debian in general

/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start

Ref http://www.ubuntu.com/usn/usn-2165-1/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.