I am building a testing environment for Heartbleed vulnerability. So I do the following things:
Before start, I setup apache2 to work with SSL (https://www.digitalocean.com/community/tutorials/how-to-create-a-ssl-certificate-on-apache-for-ubuntu-14-04). I ran this command:
openssl s_client -connect [server IP] -tlsextdebug 2>&1 | grep 'server extension "heartbeat" (id=15)' || echo safe
It returns this
TLS server extension "heartbeat" (id=15), len=1
==> heartbeat extension is being used.I choose Ubuntu server 12.04 as OS
- I remove Openssl and Apache2 completely with
apt-get remove --purge
andapt-get autoremove
- I download Openssl 1.0.1e from here: https://www.openssl.org/source/old/1.0.1/
I build it with following commands:
./config --prefix=/usr/openssl --openssldir=/usr/openssl make make install
- Reinstall Apache2 with
apt-get install apache2
- Do the same things as Step 0 to check. But this time, it returns
safe
, means heartbeat is not running.
How can I make it work now?
Additional information: after building Openssl from source, I check by running these commands:
openssl genrsa -out server.pem 1024
openssl req -new -x509 -key server.pem -subj /CN=localhost >> server.pem
openssl s_server -www
and test with Metasploit, it shows that this version of Openssl has the vulnerabitlity.
Using command openssl version
show 1.0.1e ==> The version which I built
apache2
package, it will install the OpenSSL libraries from Ubuntu as well. You'll need to build apache yourself to use your locally built OpenSSL.