9

The recently announced Heartbleed bug in OpenSSL affects many sites (70% of the internet).

There's a website:

http://www.heartbleed.com

There's a web-based test:

http://filippo.io/Heartbleed/

What should I do to protect the sites that I run?

5

3 Answers 3

7

You should:

  • Update your system to the latest OpenSSL version
  • Generate new keys and certificates for services relying on OpenSSL and restart them
  • Revoke former certificates
  • Invalidate all established sessions
3
  • I don’t suppose you know of some nice clear instructions for the last three steps, do you? Apr 8, 2014 at 17:28
  • Revoking and regenerating production certificates usually involves whichever process your CA has in place. Since that varies from one CA to the next... Apr 8, 2014 at 17:50
  • How to update your system depends on your package manager. Invalidating sessions is application-dependent. As for certificates, you'll have to contact your CA but the first step should be to generate a new key and CSR: openssl req -nodes -newkey rsa:4096 -keyout post_heartbleed.key -out post_heartbleed.csr!
    – Executifs
    Apr 9, 2014 at 8:14
4

Stolen from a reddit comment.

  1. Update your system:

    sudo apt-get update
    sudo apt-get upgrade
    
  2. Reboot the server

  3. openssl version -a to make sure you have the latest version!!

4
  • The OP delivers! Apr 8, 2014 at 17:12
  • 1
    @IamJohnGalt It's not like it's a locked safe or something. ;) Apr 8, 2014 at 17:28
  • 14
    This is not sufficient. The SSL keys need to be replaced, without doing that a patch will still leave you vulnerable to past key theft.
    – Kyeotic
    Apr 8, 2014 at 17:47
  • This assumes your system uses apt-get as your package manager. The question does not suggest this is necessarily the case.
    – Michael
    Apr 9, 2014 at 17:12
0

More specifically for Ubuntu or Debian in general

/etc/init.d/apache2 stop
aptitude update
dpkg -l \*libssl\*
aptitude safe-upgrade libssl1.0.0
dpkg -l \*libssl\*
/etc/init.d/apache2 start

Ref http://www.ubuntu.com/usn/usn-2165-1/

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .