Nginx Upgrade OpenSSL

There was a time when it was discovered that the OpenSSL version of the vulnerability must be upgraded

1. Upgrade OpenSSL

1.1 Viewing the current OpenSSL version:

# OpenSSL version

OpenSSL 1.0.1e-fips 2013

The current version is obviously too long, you must download the latest version to 1.0.1g and above.

1.2. Package Download:

Download path:

# wget http://www.openssl.org/source/openssl-1.0.1g.tar.gz

1.3. Installing OpenSSL

# TAR-ZXVF Openssl-1.0.1g.tar.gz

# CD OPENSSL-1.0.1G

# Make && make install

1.4. Setting up OpenSSL

# Mv/usr/bin/openssl/usr/bin/openssl. OFF

#mv/usr/include/openssl/usr/include/openssl. OFF

#ln-S/usr/local/ssl/bin/openssl/usr/bin/openssl

#ln-S/usr/local/ssl/include/openssl/usr/include/openssl

Configure the library file search path

#echo "/usr/local/ssl/lib" >>/etc/ld.so.conf

#ldconfig-V

View version number:

# OpenSSL version

OpenSSL 1.0.1g 7 APR 2014

2. Upgrade Nginx OpenSSL

2.1. View current Nginx Module

#/usr/local/nginx/sbin/nginx-v

Nginx version:nginx/1.2.2

Built by GCC 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC)

Configure arguments:--prefix=/usr/local/nginx--with-google_perftools_module--user=www--group=www--with-http_ Stub_status_module--with-openssl=/usr/--with-pcre=/tmp/soft/lnmp/pcre-8.31

SSL 1.0.1g 7 APR 2014

2.2. Recompile Nginx, upgrade OpenSSL

# TAR-ZXVF Nginx-1.2.2.tar.gz

# CD nginx-1.2.2

2.3. Modify the load OpenSSL mode:

# VI Auto/lib/openssl/conf

core_incs= "$CORE _incs $OPENSSL/.openssl/include"

core_deps= "$CORE _deps $OPENSSL/.openssl/include/openssl/ssl.h"

core_libs= "$CORE _libs $OPENSSL/.OPENSSL/LIB/LIBSSL.A"

core_libs= "$CORE _libs $OPENSSL/.openssl/lib/libcrypto.a"

Switch

core_incs= "$CORE _incs $OPENSSL/include"

core_deps= "$CORE _deps $OPENSSL/include/openssl/ssl.h"

core_libs= "$CORE _libs $OPENSSL/LIB/LIBSSL.A"

core_libs= "$CORE _libs $OPENSSL/lib/libcrypto.a"

2.4. Recompile Nginx

#./configure \

--prefix=/usr/local/nginx \

--with-google_perftools_module \

--USER=WWW \

--GROUP=WWW \

--with-http_stub_status_module \

--with-http_ssl_module \

--WITH-OPENSSL=/USR/LOCAL/SSL \

--with-pcre=/tmp/soft/lnmp/pcre-8.31

#make

2.5. Modify Nginx

#cp/usr/local/nginx/sbin/nginx/usr/local/nginx/sbin/nginx.old

#cp./objs/nginx/usr/local/nginx/sbin/

2.6. View Nginx Module

#/usr/local/nginx/sbin/nginx-v

Nginx version:nginx/1.2.2

Built by GCC 4.4.7 20120313 (Red Hat 4.4.7-4) (GCC)

TLS SNI Support Enabled

Configure arguments:--prefix=/usr/local/nginx--with-google_perftools_module--user=www--group=www--with-http_ Stub_status_module--with-http_ssl_module--with-openssl=/usr/local/ssl--with-pcre=/tmp/soft/lnmp/pcre-8.31

This article is from the "OPS rookie" blog, please be sure to keep this source http://ckl893.blog.51cto.com/8827818/1682250

Nginx Upgrade OpenSSL