Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Rainer M. Canavan
On Apr 14, 2014, at 13:13 , LOKESH JANGIR wrote: > Hi Fedor, > > Yes i did not move this file out. and i can see the output of ls -la > /lib64/libcrypt.so.1 > libcrypt.so -> ../../lib64/libcrypt.so.1 > > > I complied openssl and it created this library files, > engines libcrypto.a li

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread mancha
On Mon, Apr 14, 2014 at 10:57:37PM +0530, LOKESH JANGIR wrote: > Hi team, > > I am using amazon ami release Amazon Linux AMI release 2014.03. When i > restart httpd service then i can see in logs that old version of openssl is > loading with this. Can you please guide me what to do in this case ?

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread LOKESH JANGIR
Hi team, I am using amazon ami release Amazon Linux AMI release 2014.03. When i restart httpd service then i can see in logs that old version of openssl is loading with this. Can you please guide me what to do in this case ? Regards, Lokesh On Mon, Apr 14, 2014 at 10:36 PM, TJ <0.open...@iam.

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread TJ
On 14/04/14 10:42, LOKESH JANGIR wrote: I am using Ubuntu, Amazon ami with apache 2.0 and mod_ssl installed. I The oldest still-supported Ubuntu version - 10.04 Lucid Lynx - ships with: apache2.2-bin (2.2.14-5ubuntu8.13) [security] Hi Fedor, Thanks for the reply. My httpd path is /usr/sbin/

RE: seems openssl version 1.0.1g also infected

2014-04-14 Thread Salz, Rich
> Why are building your own openssl? Did you try the official Ubuntu update? Especially since the original poster seems to have problems with the basic software engineering stuff. (No criticism intended, it can be confusing.) /r$ -- Principal Security Engineer Akamai Technology Camb

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Jason Gerfen
The wiki provides some very useful information http://wiki.openssl.org/index.php/Compilation_and_Installation On Mon, Apr 14, 2014 at 5:40 AM, Olivier BARTHELEMY < barthel...@geovariances.com> wrote: > I use > export CFLAGS=-fPIC > ./config shared --prefix=$inst && \ > make > to buil

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Martin Simmons
Why are building your own openssl? Did you try the official Ubuntu update? sudo apt-get update sudo apt-get upgrade __Martin > On Mon, 14 Apr 2014 16:59:06 +0530, LOKESH JANGIR said: > > Hi, > > I am installing openssl in /usr/local/openssl folder and it is creating > libssl.a and libcry

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Fedor Indutny
Yes, I agree with everyone. Just thought that linking a blog post would be more helpful. Better use instructions provided here, than at that page. Thank you, guys! On Mon, Apr 14, 2014 at 3:40 PM, Olivier BARTHELEMY < barthel...@geovariances.com> wrote: > I use > export CFLAGS=-fPIC >

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Olivier BARTHELEMY
I use export CFLAGS=-fPIC ./config shared --prefix=$inst && \ make to build the shared library version i use 2014-04-14 13:34 GMT+02:00 Fedor Indutny : > I guess you need to build it in a shared library mode. Take a look at this: > > http://www.linuxfromscratch.org/blfs/view/svn/post

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Fedor Indutny
I guess you need to build it in a shared library mode. Take a look at this: http://www.linuxfromscratch.org/blfs/view/svn/postlfs/openssl.html . You may skip applying some unverified patches as author suggest, but generally the instructions are correct. Cheers, Fedor. On Mon, Apr 14, 2014 at 3

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Jason Gerfen
If I had ever needed to use different versions of OpenSSL I would use the ./config --openssldir=/path/to/openssl-ver then for Apache to use that during installation. Example: ./configure --with-ssl=/path/to/openssl-ver --enable-ssl That will at least verify your using the new patched version. O

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread LOKESH JANGIR
Hi, I am installing openssl in /usr/local/openssl folder and it is creating libssl.a and libcrypt.a library files. so how can i use these files as library. Or i need to install this in default folders. Should i follow this article http://www.akadia.com/services/ssh_test_certificate.html Lokesh Ja

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Fedor Indutny
Hello again! That depends on your setup. I'd suppose that OpenSSL's default installer should create symlinks itself. If it did and they doesn't match the previous location - you could try creating a new one: `ln -s /path/to/new/libcrypto.so.1 /lib64/libcrypt.so.1` Cheers, Fedor. On Mon, Apr 14,

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread LOKESH JANGIR
Hi Fedor, Yes i did not move this file out. and i can see the output of ls -la /lib64/libcrypt.so.1 libcrypt.so -> ../../lib64/libcrypt.so.1 I complied openssl and it created this library files, engines libcrypto.a libssl.a pkgconfig So now should i move this libcrypt.a file to /usr/lib64 f

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Fedor Indutny
So, considering that it fails to start now. Could you please verify that `ls -la /lib64/libcrypt.so.1` is still valid? Fedor. On Mon, Apr 14, 2014 at 2:53 PM, LOKESH JANGIR wrote: > Hi Rainer, > > Yes, apache was running with the old library, i have moved this out, and > copied new libssl libra

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread LOKESH JANGIR
Hi Rainer, Yes, apache was running with the old library, i have moved this out, and copied new libssl library from new openssl installation folder. But it is not working and now i am unable to start apache. Now what to do with this ? Regards, Lokesh Jangir On Mon, Apr 14, 2014 at 2:52 PM, Rain

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread LOKESH JANGIR
Hi Fedor, Thanks for the reply. My httpd path is /usr/sbin/httpd and please find the output of ldd /usr/sbin/httpd [root@ip-10-253-83-223 openssl-1.0.1g]# ldd /usr/sbin/httpd linux-vdso.so.1 => (0x7fffebdfe000) libm.so.6 => /lib64/libm.so.6 (0x7ff2d74a7000) libpcr

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Rainer M. Canavan
On Apr 14, 2014, at 10:17 , LOKESH JANGIR wrote: > Hi Team, > > I am using Ubuntu, Amazon ami with apache 2.0 and mod_ssl installed. I found > the same openssl vulnerability issue with my ssl certificate. I have > installed new openssl bugfixed version 1.0.1g and create csr and key file > fr

Re: seems openssl version 1.0.1g also infected

2014-04-14 Thread Fedor Indutny
Hello! What does `ldd /path/to/httpd` says? Cheers, Fedor. On Mon, Apr 14, 2014 at 12:17 PM, LOKESH JANGIR wrote: > Hi Team, > > I am using Ubuntu, Amazon ami with apache 2.0 and mod_ssl installed. I > found the same openssl vulnerability issue with my ssl certificate. I have > installed new o