Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

This post is about applying the latest patch for OpenSSL to protect our port 443 web traffic, not using ssh to log into these systems.

I went and obtained the lastest OpenSSL tarball source patch openssl-1.0.1g.tar.gz from here for my Linux workstation running CentOS 6.5, and built the patch, including

./config; make; make test; make install # as root

This installed in /usr/local/ssl.

I wanted to prove the patch out in a safe place, before applying it to our production systems. However, after running everything, I'm stumped. The

./config, make, make test, and make install

steps completed without errors.

How do I check that the latest OpenSSL is installed?

Here is the result of testing version from various answers:

openssl version -a
OpenSSL 1.0.1e-fips 11 Feb 2013
built on: Tue Apr  8 02:33:43 UTC 2014
platform: linux-elf
share|improve this question
1  
I see 2 down-votes for this question. It would be better if people let the OP know why they are down-voting the question, so that the OP can make his question more better. For me, it seems a good question only :) –  Ramesh Apr 24 at 15:39
1  
@Ramesh Good observation. Perhaps the downvotes are from people who've presumed ssh is never dynamically linked to libssl? –  goldilocks Apr 24 at 16:00
    
@TAFKA'goldilocks', can't we make it mandatory to provide comments in case if someone is down-voting an answer? If someone is downvoting my question, I need to know what caused them to downvote. I am not saying they should not down-vote. If they provide the reason, it will give me an opportunity to fix the question and make it better. After all, we need better quality in the site :) –  Ramesh Apr 24 at 16:04
    
@Ramesh : I think you'd have to get that past the S.E. staff. Personally I disagree (you should be allowed to up/down vote anonymously, although it some cases you're right: it is not constructive without a comment). I think the only mandatory comment should be for the first close vote. –  goldilocks Apr 24 at 16:12
    
@TAFKA'goldilocks', agreed :) –  Ramesh Apr 24 at 16:15

3 Answers 3

up vote 5 down vote accepted

Preamble: As observed in the question, openssl installs by default into /usr/local/ssl. My recommendation is to use ./config --prefix=/usr/local shared (notice the space before "shared") so that it installs there (and builds the shared library, libssl), rather than its own private subdirectory. If you do not do this, you will have to add a file to /etc/ld.so.conf.d with /usr/local/ssl/lib in it (see below for the significance of /etc/ld.so.conf.d files), and add /usr/local/bin to $PATH.


You will need to run ldconfig after make install to add the libraries to the linker cache. If that doesn't work, read on.

make install probably by default went to /usr/local, which should take precedence but may not. You can thus leave your distro's openssl install to avoid messing around with the package manager and prereqs, but still use your own locally built version as the default. To check:

ldd $(which ssh) | grep libssl

If you get no output, your ssh was statically linked and needs to be rebuilt (see Anton's answer). Otherwise, this should point to your /usr/local version. If it points to something else:

ldconfig -p | grep libssl

The /usr/local version should be shown, but after some other one. If so, skip down to "/usr/local/lib does not have precedence" below. If not, make sure /usr/local is in the linker path generally:

ldconfig -p | grep "/usr/local"

If not, grep -r "/usr/local" /etc/ld.so.conf.d. If that is not there, add a file to /etc/ld.so.conf.d called 00-local.conf with one line:

/usr/local/lib

Run ldconfig (no switches) and go through this again.


/usr/local/lib does not have precedence

Find the linker cache config file where the path is added:

grep -r "/usr/local" /etc/ld.so.conf.d

If it's not there, you'll have to add a file as explained above. Presuming it is, the problem is the files are processed lexicographically. E.g., if the content of /etc/ld.so.conf.d is:

addtheselibraries.conf
libc.conf

And libc.conf contains /usr/local/lib but addtheselibraries.conf contains, e.g. /usr/lib,1 then the latter will take precedence. If the /usr/local/lib file doesn't contain anything else, just rename it with something which will supersede the other files; numbers go first so 000-whatever is good.

Because you have complete control over /usr/local/lib, it should take precedence over any paths used by the distro package manager (and usually does).

1. /usr/lib is a default compiled into the linker, but it and other standard system places (/lib, etc) are added last, which allows you to supersede them. Because of these, sometimes (e.g.) /usr/lib is added to a .conf file in order to make it supersede some other .conf file.

share|improve this answer
openssl version -a

The above command will give you the version of openssl in the system. Check the build date rather than the date on the first line.

share|improve this answer

You will have to recompile openssh, by downloading the source including the openssl source in the source tree and run ./config; make; make install for openssh as well.

Detailed instructions on compiling openssh can be found in the INSTALL document

share|improve this answer
    
ssh should link to libssl and not need to be rebuilt. You can check this with ldd /usr/bin/ssh, presuming that's where it is. –  goldilocks Apr 24 at 14:29
1  
@TAFKA'goldilocks' ldd $(which ssh) | fgrep ssl gives no output, so the executable (which is in /usr/bin) doesn't seem to be dynamically linked against ssl. –  Anthon Apr 24 at 14:44
1  
That seems to be the case on debian, yeah, maybe as a (dubious and in this case ill conceived) security measure. It's dynamically linked on fedora. +1 –  goldilocks Apr 24 at 14:54
    
Added more information per suggestions. –  octopusgrabbus Apr 24 at 15:11
1  
@octopusgrabbus For the bleeding heart bug you shouldn't need to upgrade ssh. If you want your ssh -V to show the latest OpenSSL version, as per your OP, then you need to recompile (or at least I did need to compile on Ubuntu). –  Anthon Apr 24 at 15:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.