Herman Bos » ssl http://dev.osso.nl/herman/blog open source guerilla Tue, 27 Jul 2010 13:32:06 +0000 en hourly 1 http://wordpress.org/?v=3.0.1 Weak SSL key vulnerabilities not so funny http://dev.osso.nl/herman/blog/2008/05/14/weak-ssl-key-vulnerabilities-not-so-funny/ http://dev.osso.nl/herman/blog/2008/05/14/weak-ssl-key-vulnerabilities-not-so-funny/#comments Wed, 14 May 2008 05:33:31 +0000 Herman http://dev.osso.nl/herman/blog/?p=305 Yet Another Related Posts Plugin.]]> Yesterday evening I had the pleasure to pick up the following three security notices:

I can tell you these are really not funny. They really generate a lot of work indirectly. Annoying but doable are things like regeneration SSH keys. The PITA situation is with OpenVPN, looks like we have the push new keys out to all the clients in a few setups. That really deserves a curse or two.

As a special bonus:

Once the update is applied, weak shared encryption keys and
SSL/TLS certificates will be rejected where possible (though
they cannot be detected in all cases). If you are using such
keys or certificates, OpenVPN will not start and the keys or
certificates will need to be regenerated.

Which means I am happy to read security notices. Just updating might result in a broken setup.

If anybody could give extra information on how weak those keys actually are and how easy they are to crack, I would be delighted. In the meanwhile, looking at the amount of servers, I guess I can schedule a teambuilding event where we can mass regenerate keys.

ps. I can tell you I’m quite happy that our backup machines which use SSH+RSYNC for automatic incremental backups are not vulnerable.

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

]]> http://dev.osso.nl/herman/blog/2008/05/14/weak-ssl-key-vulnerabilities-not-so-funny/feed/ 6 SSL Support *GRR* http://dev.osso.nl/herman/blog/2005/12/12/ssl-support-grr/ http://dev.osso.nl/herman/blog/2005/12/12/ssl-support-grr/#comments Mon, 12 Dec 2005 15:59:16 +0000 Herman http://users.lichtsnel.nl/~spacey/?p=130 Yet Another Related Posts Plugin.]]> Before I already encountered disabled SSL support in packages (vsftpd, gftp, yafc, etc.). Today I wanted to give mail-notification a try and encountered the same issue. Apparantly SSL is disabled here because of licensing issues.

Treenaks notes that the OpenSSL libs are not compatible with the GPL and that GNUTLS has an OpenSSL-compatibility layer (but unfortunately is incomplete).

Too bad people write software which use incompatible libs (license wise).

Ah well.. I succesfully rebuild the package with SSL support. Time for my own repository. :D

No related posts.

Related posts brought to you by Yet Another Related Posts Plugin.

]]> http://dev.osso.nl/herman/blog/2005/12/12/ssl-support-grr/feed/ 0