First, a few tools for testing your servers:
- titanous/heartbleeder (written in Go)
- FiloSottile/Heartbleed (written in Go)
- emboss/heartbeat (written in Ruby)
Nginx
Run one of these against your HTTPS server:
./heartbleeder example.com
Turns out in Ubuntu 12.04, running openssl version will always report "OpenSSL 1.0.1 14 Mar 2012" for all versions of 1.0.1. This makes it more difficult to tell if you've successfully updated.
Update the system openssl libraries:
sudo apt-get update sudo apt-get upgrade
Now, you won't be able to check the version number, but you can check the date that openssl was built:
$ openssl version -a OpenSSL 1.0.1 14 Mar 2012 built on: Mon Apr 7 20:33:29 UTC 2014
Note that unless it has a "built on" date after Apr 7, you've still got a problem.
Now just restart nginx and run the heartbleed test again and you should be fine.
Ruby
Even if you compile Ruby from source, it should be dynamically linked to the system OpenSSL library, so you should be good to go now! However, I would be more confident if I could confirm that Ruby was in fact using the updated library.
Due to the way Ubuntu OpenSSL works, asking Ruby what OpenSSL version it's using doesn't give us any more helpful information:
$ ruby -r openssl -e 'puts OpenSSL::OPENSSL_VERSION' OpenSSL 1.0.1 14 Mar 2012
(from @sferik)
So let's do a little digging:
- Load up irb
$ irb
- Find the full path of openssl.so
irb(main):001:0> $:.map{|d| Dir[File.join d, "openssl.so"]}.flatten.compact.first /usr/local/lib/ruby/2.0.0/x86_64-linux/openssl.so - Quit irb
irb(main):002:0> quit
- Find the dependencies of Ruby's openssl.so
$ ldd /usr/local/lib/ruby/2.0.0/x86_64-linux/openssl.so | grep crypto libcrypto.so.1.0.0 => /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 (0x00007f3331750000)
- Check the date that libcrypto was built:
ls -l /lib/x86_64-linux-gnu/libcrypto.so.1.0.0 -rw-r--r-- 1 root root 1930616 Apr 7 20:37 /lib/x86_64-linux-gnu/libcrypto.so.1.0.0
You should see that libcrypto.so was built on Apr 7. At this point I can be reasonably sure that Ruby is using the updated OpenSSL library. I would feel much more comfortable if I had a malicious server I could test against. Below are the issues on the three repos above about writing a client-testing tool.
