I'm getting ready to patch my server (Debian Wheezy), and it's going to be a pain because I built a lot of it from source (Apache 2.4, PHP, MySQL).
Before I get started patching, I'd like to have a better understanding of which OpenSSL services are vulernarable to the leak. Obviously HTTP/HTTPS services are vulnerable. What about SMTP, IMAP and POP? SSH? Or is it any public-facing service that uses the affected versions of OpenSSL I should be aware of?
My server also has IPMI/KVM (Supermicro) that I use to install my OS. It's accessible via HTTP/HTTPS on the same machine, but with a different IP address. I wonder if this is also vulnerable. I'm not sure if the built-in Supermicro web server uses OpenSSL. If so, I may ask my server provider to apply any firmware patches.