Successful private key extraction from OpenVPN using Heartbleed

Re:Successful private key extraction from OpenVPN using Hear... by jareds on Wednesday April 16, 2014 @02:44PM (#7599663)

As someone who runs a personal OpenVPN server am I correct in assuming that I am not vulnerable to this as long as I have updated my OpenSSL library’s through the standard Linux package managers to a recent version that has fixed the Heartbleed bug?

[ Parent | on HN ]

Re:Successful private key extraction from OpenVPN using Hear... by syzzer on Wednesday April 16, 2014 @03:07PM (#7599837)

You should do that for all your vulnerable peers (i.e. clients too), and restart the daemon to make it load the updated library. Then generate new keys for all of them.

While there are vulnerable clients out there, you should consider your (vpn) network compromised.

[ Parent | on HN ]

Re:Successful private key extraction from OpenVPN using Hear... by jamesbritt on Wednesday April 16, 2014 @04:55PM (#7600485)

Are you sure that OpenVPN is not using it's own bundled openssl lib? I believe that was the case with OpenVPN_AS.

[ Parent | on HN ]

Re:Successful private key extraction from OpenVPN using Hear... by kyllo on Wednesday April 16, 2014 @07:20PM (#7601119)

That was definitely the case with openvpn-as. I updated my openssl package but my VPS was still testing vulnerable until I updated openvpn-as.

[ Parent | on HN ]

Re:Successful private key extraction from OpenVPN using Hear... by dserodio on Wednesday April 16, 2014 @03:04PM (#7599819)

You should regenerate the keys after updating because they might've been exposed.

[ Parent | on HN ]