1

Today I installed ,,empty'' (just minimal set of packages) Debian 8.1 on my VirtualBox. I wanted to play with compiling apps from sources.

I started with OpenSSL: compiled from sources OpenSSL 1.0.1p.

user@debian8:/$ /opt/openssl/bin/openssl version
OpenSSL 1.0.1p 9 Jul 2015
user@debian8:/$ ldd /opt/openssl/bin/openssl
        linux-gate.so.1 (0xb76ed000)
        libssl.so.1.0.0 => /opt/openssl/lib/libssl.so.1.0.0 (0xb767c000)
        libcrypto.so.1.0.0 => /opt/openssl/lib/libcrypto.so.1.0.0 (0xb748a000)
        libdl.so.2 => /lib/i386-linux-gnu/i686/cmov/libdl.so.2 (0xb747f000)
        libc.so.6 => /lib/i386-linux-gnu/i686/cmov/libc.so.6 (0xb72d5000)
        /lib/ld-linux.so.2 (0xb76f0000)

Then OpenSSH. First problem I had was that ./configure complained that the version of my OpenSSL headers (1.0.1p) doesn't match the version of OpenSSL libraries (1.0.1k). I found out, that apt installed just libs of OpenSSL 1.0.1k. So I did:

LD_LIBRARY_PATH=/opt/openssl/lib ./configure (..params...) --with-ssl-dir=/opt/openssl/lib
LD_LIBRARY_PATH=/opt/openssl/lib make
sudo make install

This worked.

But: (notice the version OpenSSL 1.0.1k and the path of libcrypto.so)

user@debian8:/opt/openssh/bin$ ./ssh -V
OpenSSH_7.0p1, OpenSSL 1.0.1k 8 Jan 2015
user@debian8:/opt/openssh/bin$ ldd ssh
        linux-gate.so.1 (0xb770b000)
        libresolv.so.2 => /lib/i386-linux-gnu/i686/cmov/libresolv.so.2 (0xb761d000)
        libcrypto.so.1.0.0 => /usr/lib/i386-linux-gnu/i686/cmov/libcrypto.so.1.0.0 (0xb7451000)
        libdl.so.2 => /lib/i386-linux-gnu/i686/cmov/libdl.so.2 (0xb744b000)
        libutil.so.1 => /lib/i386-linux-gnu/i686/cmov/libutil.so.1 (0xb7447000)
        libz.so.1 => /lib/i386-linux-gnu/libz.so.1 (0xb742a000)
        libnsl.so.1 => /lib/i386-linux-gnu/i686/cmov/libnsl.so.1 (0xb7411000)
        libcrypt.so.1 => /lib/i386-linux-gnu/i686/cmov/libcrypt.so.1 (0xb73e0000)
        libc.so.6 => /lib/i386-linux-gnu/i686/cmov/libc.so.6 (0xb7235000)
        /lib/ld-linux.so.2 (0xb770e000)

And, again, adding LD_LIBRARY_PATH helps:

user@debian8:/opt/openssh/bin$ LD_LIBRARY_PATH=/opt/openssl/lib ./ssh -V
OpenSSH_7.0p1, OpenSSL 1.0.1p 9 Jul 2015
user@debian8:/opt/openssh/bin$ LD_LIBRARY_PATH=/opt/openssl/lib ldd ssh
        linux-gate.so.1 (0xb776f000)
        libresolv.so.2 => /lib/i386-linux-gnu/i686/cmov/libresolv.so.2 (0xb7681000)
        libcrypto.so.1.0.0 => /opt/openssl/lib/libcrypto.so.1.0.0 (0xb748f000)
        libdl.so.2 => /lib/i386-linux-gnu/i686/cmov/libdl.so.2 (0xb7489000)
        libutil.so.1 => /lib/i386-linux-gnu/i686/cmov/libutil.so.1 (0xb7485000)
        libz.so.1 => /lib/i386-linux-gnu/libz.so.1 (0xb7468000)
        libnsl.so.1 => /lib/i386-linux-gnu/i686/cmov/libnsl.so.1 (0xb744f000)
        libcrypt.so.1 => /lib/i386-linux-gnu/i686/cmov/libcrypt.so.1 (0xb741e000)
        libc.so.6 => /lib/i386-linux-gnu/i686/cmov/libc.so.6 (0xb7273000)
        /lib/ld-linux.so.2 (0xb7772000)

I of course tested if sshd works: it listens on 22, I can connect with PuTTY.

And now come my questions:

  1. Maybe I did something wrong?
  2. How can I force using version 1.0.1p of OpenSSL by my OpenSSH without adding LD_LIBRARY_PATH (I tried with /etc/ld.so.conf.d/, but without any effect: ldconfig sees /opt/openssl/lib, but it doesn't make ssh or sshd use 1.0.1p).
  3. Why do openssl and ldd openssl use the correct path without any LD_LIBRARY_PATHing?
1

See man ld.so for the documentation of the dynamic linker. To give your own compiled OpenSSL priority, put it into /usr/local/lib. Adding a new search path in /etc/ld.so.conf.d should also work, maybe you put it too late? Try

LD_DEBUG=libs /lib64/ld-linux-x86-64.so.2 --list /usr/bin/ssh

to gain insight. For you self compiled binary, an RPATH setting may help it find its own library, check with

objdump -x /opt/openssl/bin/openssl | grep RPATH

(taken from https://stackoverflow.com/questions/2836330/is-there-a-way-to-inspect-the-current-rpath-on-linux).

  • +1 for RPATH: widened my knowledge – jacek.ciach Sep 9 '15 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.