Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
emerge apache without ssl heartbeat [solved]
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
stmiller
Tux's lil' helper
Tux's lil' helper


Joined: 28 Feb 2006
Posts: 119

PostPosted: Tue Apr 08, 2014 12:34 am    Post subject: emerge apache without ssl heartbeat [solved] Reply with quote

It light of this vuln, http://seclists.org/oss-sec/2014/q2/27 (CVE-2014-0160) I am curious if it is possible to emerge apache without the mod_ssl heartbeat feature.

Is that possible?

I can see that some TLS servers of various vendors have heartbeating disabled and I am curious if I can do the same with Gentoo. Ex:


Code:
   
$ openssl s_client -connect www.qualys.com:443 -tlsextdebug

[skip]

   PSK identity hint: None
    SRP username: None
    Start Time: 1396916504
    Timeout   : 300 (sec)
    Verify return code: 20 (unable to get local issuer certificate)
---
B
HEARTBEATING
140408723089064:error:1413B16D:SSL routines:SSL_F_TLS1_HEARTBEAT:peer does not accept heartbearts:t1_lib.c:2566:


Last edited by stmiller on Tue Apr 08, 2014 3:22 pm; edited 1 time in total
Back to top
View user's profile Send private message
stmiller
Tux's lil' helper
Tux's lil' helper


Joined: 28 Feb 2006
Posts: 119

PostPosted: Tue Apr 08, 2014 1:18 am    Post subject: Reply with quote

Welp, answering my own question.

Emerging openssl with use flag of -tls-heartbeat does the trick. Thanks,
Back to top
View user's profile Send private message
lagalopex
Guru
Guru


Joined: 16 Oct 2004
Posts: 544

PostPosted: Tue Apr 08, 2014 7:58 am    Post subject: Reply with quote

Alternative (and offtopic) to fix openssl but keep heartbeat enabled:
Update to dev-libs/openssl-1.0.1g (is already in portage)
_________________
System: AMD FX 8350, 16GB RAM, NVidia GeForce GTX 750 Ti, Asus M5A99X EVO R2.0
Back to top
View user's profile Send private message
SamuliSuominen
Retired Dev
Retired Dev


Joined: 30 Sep 2005
Posts: 2133
Location: Finland

PostPosted: Tue Apr 08, 2014 8:15 am    Post subject: Reply with quote

1.0.1g is now stable on both, amd64 and x86, so time to `emerge --sync` and upgrade
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum