Re: About the openssl hole

From: Darren Pilgrim (dmp@pantherdragon.org)
Date: 07/31/02 

Date: Tue, 30 Jul 2002 18:41:03 -0700
From: Darren Pilgrim <dmp@pantherdragon.org>
To: gabriel_ambuehl@buz.ch

Gabriel Ambuehl wrote:
>
> -----BEGIN PGP SIGNED MESSAGE-----
>
> Hello Geir,
>
> Tuesday, July 30, 2002, 6:56:12 PM, you wrote:
>
> > I talked with an freind of mine who tried this solution, and he told
> me that it where only one patch that failed.
> > If you remove the patch "patch-ah" the build will go fine.
>
> > But as many know, the port of openssl will not completly replace the
> core openssl.
> > (You could see this if you build mod_ssl)
>
> Well I could live without mod_ssl for the next hours, but I can't just
> go shutdown ssh on all boxes cause that would mean I'd have to go
> onsite to some 4 NOCs (two of them on the other side of the world) to
> have SSH get backup. Hmm. Maybe I'll just shut all SSL stuff down and
> have the NOC monkeys reboot them when the patch is here....
>
> What's happening (I suppose) is that the port gets installed to
> /usr/local/lib whereas the the old version still is in /usr/lib where

Use -DOPENSSL_OVERWRITE_BASE. I recommend people install the OpenSSL
port anyway, it gives you all those nifty extra programs that the
maintainer(s) for the in-base openssl has seen fit not to include.

> it belongs to as part of the base system which means that you probably
> have to overwrite the old lib by hand but I wouldn't want to guarantee
> that nothing is going to break if you do this.

I can say from personal experience that installing the openssl port
with -DOPENSSL_OVERWRITE_BASE doesn't break anything I've found or
use (openssh, mod_ssl, courier_imap, and postfix).

> To make it short: it's
> probably best to just wait and update your boxes ASAP

Why take down the whole machine, when you can use a port to just patch
the broke part? That's what was so great about the OpenSSH port, it
let a lot of people who couldn't make world or reinstall upgrade their
copies of OpenSSH.

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message

Relevant Pages

  • Re: Using Crypt::DSA
    ... which represents the latest FreeBSD port. ... > prefer to install from ports because, especially in the case of software ... If you have OpenSSL, you may get better ... Rob ...
    (comp.lang.perl.misc)
  • Re: broken openssl on freebsd60
    ... >> install the openssl port or at least they used to. ... > Another user had a similar issue like this with OpenSSL, ... that openssl is per default within the base system, ...
    (freebsd-questions)
  • Re: openssl problem after patches install
    ... I do not have the patch called patchSG0005362 installed. ... now I Try to install it. ... In article, Ivan Rayner wrote: ... The openssl patch that is ...
    (comp.sys.sgi.admin)
  • ignoring openssl port
    ... I ended up with openssl port installed on these systems. ... and then "make install" the port. ... I have upgraded the base system to 4.8-RELEASE-p13, ...
    (freebsd-questions)
  • Re: Should I have 2 copies of OpenSSL?
    ... > If you have the OpenSSL port installed why don't you uninstall the port ... > install of OpenSSL and not to install OpenSSL as a dependency from ports. ... That seems to have done the trick, Russell; ...
    (freebsd-questions)