Openssl brute-force vulnerability and emergency repair Guide

Openssl was another big event. in June 5, 2014, the SSL/TLS Man-in-the-Middle Vulnerability allowed attackers to intercept malicious intermediate nodes to encrypt and decrypt data, at the same time, the ssl client that uses weak keys is forced to be exposed to malicious nodes. When the software uses the affected version of OpenSSL, there is a risk of tampering during encrypted communication such as content and Identity Authentication through web browsing, email, and VPN.

The upgrade method of openssl is introduced here. The latest version that is not affected currently is OpenSSL 1.0.1h,

Wget http://www.openssl.org/source/openssl-1.0.1h.tar.gz

Zlib is required here. If zlib is not installed, you can directly install yum zlib.

Compile and install

./Config shared zlib

Make & make install

Rename the old openssl File

Mv/usr/bin/openssl. bak

Mv/usr/include/openssl. bak

Reference the newly installed openssl File

Ln-s/usr/local/ssl/bin/openssl/usr/bin/openssl

Ln-s/usr/local/ssl/include/openssl/usr/include/openssl

Configure the index path of the Library File

Echo "/usr/local/ssl/lib">/etc/ld. so. conf

Load library files

Ldconfig-v

Verify

Openssl version