<div dir="ltr"><div><div><div><div><div><div><div><div><div><div>Public facing services such as APIs and web-facing services such as Horizon are critical to update, but don't forget everything within the cluster that uses internal secure communications. Anything that could potentially use OpenSSL is impacted and needs to have OpenSSL updated on it, services restarted, and key material (both primary and secondary) and credentials changed. Services such as the following should all be restarted:<br>
<br></div>DB: MySQL, Postgres<br></div>MQ: Rabbit, Qpid<br></div>APIs: Likely Apache httpd, nginx, pound, etc</div>Keystone: Or Apache httpd, nginx, pound, etc<br>django/horizon: Or Apache httpd, nginx, pound, etc<br></div>
glance-*<br></div></div>nova-*<br></div>cinder-*<br></div>libvirtd<br></div><div></div><div><br>"lsof | grep ssl | grep DEL" is your friend. It will output any
services that may still have stale handles using the old library. <br><br></div><div>Nate<br></div><br><div><br><div><div><div><div><div><div><div><div><br></div></div></div></div></div></div></div></div></div></div><div class="gmail_extra">
<br><br><div class="gmail_quote">On Wed, Apr 9, 2014 at 3:29 PM, Greg C <span dir="ltr"><<a href="mailto:agregc@gmail.com" target="_blank">agregc@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">I found that my openstack system was vulnerable by using the test found here: <br><div class="gmail_extra"><a href="http://filippo.io/Heartbleed" target="_blank">http://filippo.io/Heartbleed</a><br><br></div>
<div class="gmail_extra">
I'm
running on Ubuntu12.04, and this is an older openstack system (folsom). I fixed the vulnerability by updating package
python-openssl and restarting apache (apt-get update, apt-get install
python-openssl, service apache2 restart). Test then returned "OK"<br><br></div><div class="gmail_extra">Openstack runs on python, so naturally that's how it became vulnerable. Not strictly an "openstack component", but it can/will make you system vulnerable to heartbleed.<br>
</div><div class="gmail_extra"><br></div>There could be other places that need updates too, but at least there's that one.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><br><div class="gmail_quote">
On Wed, Apr 9, 2014 at 3:46 AM, Thierry Carrez <span dir="ltr"><<a href="mailto:thierry@openstack.org" target="_blank">thierry@openstack.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>Aryeh Friedman wrote:<br>
> What parts of openstack (if any) are vulnerable to heartbleed?<br>
<br>
</div>OpenStack in itself is not vulnerable to heartbleed, however OpenStack<br>
makes use of the host SSL library (libssl) and that one should be<br>
properly patched.<br>
<br>
If you have a production deployment of OpenStack, you should consider<br>
the SSL private keys for your SSL endpoints potentially compromised and<br>
revoke / renew them (primary key material).<br>
<br>
Once you've done that, you should warn your users that passwords and<br>
tokens used over that previously-flawed secure connection could have<br>
been compromised and encourage them to change their own passwords and<br>
expire existing tokens (secondary key material).<br>
<br>
Regards,<br>
<span><font color="#888888"><br>
--<br>
Thierry Carrez (ttx)<br>
</font></span><div><div><br>
_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org" target="_blank">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
</div></div></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Mailing list: <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
Post to : <a href="mailto:openstack@lists.openstack.org">openstack@lists.openstack.org</a><br>
Unsubscribe : <a href="http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack" target="_blank">http://lists.openstack.org/cgi-bin/mailman/listinfo/openstack</a><br>
<br></blockquote></div><br></div>