Re: [Pound Mailing List] Pound failing SSL Labs tests

On 19/08/2016 10:57, Scott McKeown wrote:
> I have just found out that for some very strange reason our build of Pound
> is failing the SSL Labs tests for:
> DROWN attack & OpesnSSL Padding Oracle vaulnerability (CVE-2016-2107)
> this is happening even after we have taken the steps to resolve the issue.
> 
> # pound -V
> starting...
> detect_tproxy(): tproxy is is detected
> tproxy: available
> Version 2.7
>   Configuration switches:
>     --enable-cert1l
>     --with-ssl=/usr/local/bin/openssl
>     --with-maxbuf=4096
>     --with-dh=2048
> Exiting...


> # /usr/local/bin/openssl version
> OpenSSL 1.0.1t  3 May 2016

Verify that your pound binary is really linked to this version of
OpenSSL: run ldd against the pound binary and make sure it's linked to
the libcrypto and libssl you have in /usr/local/openssl.

Although you've specified the location of your openssl when building
Pound, it may have linked to an older one provided by your OS.

My pound build also uses a separate OpenSSL install but I find it's
necessary to use

  export LD_RUN_PATH=/usr/local/openssl/lib

prior to running pound's 'configure' otherwise it won't explicitly link
to my OpenSSL libraries.

-- 
Liam Gretton                                    liam.gretton-/[email protected]
Systems Specialist                           http://www.le.ac.uk/its/
IT Services                                   Tel: +44 (0)116 2522254
University Of Leicester, University Road
Leicestershire LE1 7RH, United Kingdom

--
To unsubscribe send an email with subject unsubscribe to [email protected]
Please contact [email protected] for questions.