Do i need to recompile open vpn after open ssl Upgrade?

steven29

Hi Guy's,

as linux is just a hobby for me i'm not really deep in that building stuff, altough i like to run ubuntu and latest version of open vpn (wich is not in the repos). So i build open vpn by hand.

Now as open SSL Vulnerabillity get fixed nearly every day 😉 i just want to know:
Do i need to recompile Open VPN after i upgraded the open ssl Package on Ubuntu ?

I didn't find any 100% cleare information on this, i found some post on the net where people trying to link open ssl staticly.
Does this mean if you build it the default way (./configure,make,make install) the lib's are not staticly linked, and open ssl from the ubuntu package is used?

Ubuntu also makes it a little harder to figure out if you're up to Date, by just patching Open SSl Version and not replacing it with the new one.

Can Somebody please clarify this?

thanks and
regard
Steven

steven29

Hi,

thanks for your reply, but 1:) some time ago i had trouble with these repos, and 2.) now my home Server is running trusty.

So the question still remains 🙂

cron2

If openvpn is linked dynamically (which is the default) it will pick up changes to shared libraries automatically upon openvpn restart.

If you linked statically, you need to recompile (as OpenSSL would then be part of the OpenVPN binary).

To see which it is, run "ldd /your/path/to/openvpn". If "libssl.so.<something>" and "libcrypto.so.<something>" show up in the output, you're dynamically linking, and are fine.

(OpenVPN tries to be helpful and includes OpenSSL version number in "openvpn --version" these days, but that doesn't help with distributions that patch the vulnerabilities but do not bump the version number)

steven29

thank you cron, now i understand

cron2 wrote
To see which it is, run "ldd /your/path/to/openvpn". If "libssl.so.<something>" and "libcrypto.so.<something>" show up in the output, you're dynamically linking, and are fine.

Thes tow lib's show up so i should be fine

cron2 wrote (OpenVPN tries to be helpful and includes OpenSSL version number in "openvpn --version" these days, but that doesn't help with distributions that patch the vulnerabilities but do not bump the version number)

Jep i saw that before, but ubuntu trusty states:
library versions: OpenSSL 1.0.1f 6 Jan 2014, LZO 2.06

and you have to look at "openssl version -a"
to see when it was build and if its maybe up to date.

thank you

regards
Steven