Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4596 > unrolled thread

Re: [SECURITY] [DSA 3500-1] openssl security update

Back to article view | Back to linux.debian.security

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: [SECURITY] [DSA 3500-1] openssl security update Carsten Aulbert <Carsten.Aulbert@aei.mpg.de> - 2016-03-02 09:20 +0100
    Re: [SECURITY] [DSA 3500-1] openssl security update Peter Ludikovsky <peter@ludikovsky.name> - 2016-03-02 09:40 +0100
    Re: [SECURITY] [DSA 3500-1] openssl security update Florent Rougon <f.rougon@free.fr> - 2016-03-02 09:40 +0100
    Re: [SECURITY] [DSA 3500-1] openssl security update Paul Wise <pabs@debian.org> - 2016-03-02 09:40 +0100
      Re: [SECURITY] [DSA 3500-1] openssl security update Paul Wise <pabs@debian.org> - 2016-03-02 09:50 +0100
      Re: [SECURITY] [DSA 3500-1] openssl security update Carsten Aulbert <Carsten.Aulbert@aei.mpg.de> - 2016-03-02 09:50 +0100

#4596 — Re: [SECURITY] [DSA 3500-1] openssl security update

Hi

brief question for a possible addendum. I believe one should at least
restart services which are currently using openssl after patching it,
right, e.g. trying to figure out by lsof -n | grep openssl.

(or reboot the machine)

Would it make sense to add that to the DSA 3500-1 page, like for
DSA-3481[1]?

Cheers

Carsten

[1] "While it is only necessary to ensure that all processes are not
using the old glibc anymore, it is recommended to reboot the machines
after applying the security upgrade."



-- 
Dr. Carsten Aulbert, Atlas cluster administration
Max Planck Institute for Gravitational Physics (Albert Einstein Institute)
Callinstraße 38, 30167 Hannover, Germany
Tel: +49 511 762 17185, Fax: +49 511 762 17193

[toc] | [next] | [standalone]

#4597

[Multipart message — attachments visible in raw view] — view raw

Hello,

Take a look at checkrestart [1] from the debian-goodies package. It
tells you which processes are using deleted files, and if possible which
service to restart.


Regards
/peter

[1] http://manpages.debian.org/cgi-bin/man.cgi?query=checkrestart

Am 02.03.2016 um 09:08 schrieb Carsten Aulbert:
> Hi
> 
> brief question for a possible addendum. I believe one should at least
> restart services which are currently using openssl after patching it,
> right, e.g. trying to figure out by lsof -n | grep openssl.
> 
> (or reboot the machine)
> 
> Would it make sense to add that to the DSA 3500-1 page, like for
> DSA-3481[1]?
> 
> Cheers
> 
> Carsten
> 
> [1] "While it is only necessary to ensure that all processes are not
> using the old glibc anymore, it is recommended to reboot the machines
> after applying the security upgrade."
> 
> 
> 

[toc] | [prev] | [next] | [standalone]

#4598

Carsten Aulbert <Carsten.Aulbert@aei.mpg.de> wrote:

> Would it make sense to add that to the DSA 3500-1 page, like for
> DSA-3481[1]?

Probably (if not already the case---didn't check). But frankly, *every*
library with a security update falls in this case AFAICT, so if you're
going to do that, do it for *all* of them, I'd say.

-- 
Florent

[toc] | [prev] | [next] | [standalone]

#4599

On Wed, Mar 2, 2016 at 4:08 PM, Carsten Aulbert wrote:

> brief question for a possible addendum. I believe one should at least
> restart services which are currently using openssl after patching it,
> right, e.g. trying to figure out by lsof -n | grep openssl.

Right. I would use one of the many existing implementations of this
rather than rolling your own:

checkrestart (from debian-goodies)
needrestart
whatmaps
https://anonscm.debian.org/cgit/mirror/dsa-nagios.git/tree/dsa-nagios-checks/checks/dsa-check-libs
http://tracer-package.com/
needs-restarting (from yum)
https://anonscm.debian.org/cgit/collab-maint/hobbit-plugins.git/tree/client-ext/libs
limited implementations in the libc/pam/openssl postinsts

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#4600

[Multipart message — attachments visible in raw view] — view raw

On Wed, 2016-03-02 at 09:44 +0100, Carsten Aulbert wrote:

> That one looks great (and yet another new thing learned today), although
> the output is quite verbose and a few false positives, but overall quite
> usable!

Personally I prefer needrestart for various reasons.

-- 
bye,
pabs

https://wiki.debian.org/PaulWise

[toc] | [prev] | [next] | [standalone]

#4601

Hi

On 03/02/2016 09:36 AM, Paul Wise wrote:
> Right. I would use one of the many existing implementations of this
> rather than rolling your own:
> 
> checkrestart (from debian-goodies)

That one looks great (and yet another new thing learned today), although
the output is quite verbose and a few false positives, but overall quite
usable!

Thanks a lot

Carsten

-- 
Dr. Carsten Aulbert, Atlas cluster administration
Max Planck Institute for Gravitational Physics (Albert Einstein Institute)
Callinstraße 38, 30167 Hannover, Germany
Tel: +49 511 762 17185, Fax: +49 511 762 17193

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web