linux下解决Openssl FREAK 漏洞bug步骤
发布时间：2022-06-15 10:04:07 所属栏目：教程 来源：互联网
导读：Openssl出现的bug 很多朋友都知道是非常的严重了,对于Openssl bug小编每次安装系统都需要来补一下它,下面来看看linux下修复Openssl FREAK 漏洞bug步骤. 修复方法: 1:升级最新版本openssl，重新启动对应服务,#比如OpenSSL的1.0.1的用户应该升级到1.0.2. 2:
|
Openssl出现的bug 很多朋友都知道是非常的严重了,对于Openssl bug小编每次安装系统都需要来补一下它,下面来看看linux下修复Openssl FREAK 漏洞bug步骤. 修复方法: 1:升级最新版本openssl，重新启动对应服务,#比如OpenSSL的1.0.1的用户应该升级到1.0.2. 2:修改ssl加密算法:(nginx conf:ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;) nginx修改为 ssl_ciphers HIGH:!aNULL:!MD5:!EXPORT56:!EXP; httpd修改为 SSLCipherSuite HIGH:!aNULL:!MD5:!EXPORT56:!EXP 3:重新启动对应服务。 漏洞测试: [root@localhost ~]# openssl s_client -connect www.111cn.net :443 -cipher EXPORT CONNECTED(00000003) depth=3 C = IL, O = ### Ltd., OU = Secure Digital Certificate Signing, CN = ### Certification Authority verify return:1 depth=2 C = CN, O = ### Limited, CN = CA E6B283###E8AF81E4B9A6 verify return:1 depth=1 C = CN, O = ### CA Limited, CN = CA E6B283E980###81E4B9A6 verify return:1 depth=0 description = E5858DE8B4B####AF81E4B9A6 E794B3E8###91E59D80EFBC9Ahttps://####.com, CN = mail.####.com verify return:1 --- Certificate chain 0 s:/description=xE5x85x8D###Fx81xE4xB9xA6 xE7x94xB3xE8xAFxB7xE7xBDx91xE5x9Dx80xEFxBCx9Ahttps://buy.wosign.com/CN=mail.####.com i:/C=CN/O=WoSign CA Limited/CN=CA xE6xB2x83####x8DxE8xB4xB9SSLxE8xAFx81xE4xB9xA6 1 s:/C=CN/O=WoSign CA Limited/CN=CA xE6xB2x83xE9###x8DxE8xB4xB9SSLxE8xAFx81xE4xB9xA6 i:/C=CN/O=WoSign CA Limited/CN=CA xE6xB2x83xE9###xB9xE8xAFx81xE4xB9xA6 2 s:/C=CN/O=WoSign CA Limited/CN=CA xE6xB2x83xE9x80###xB9xE8xAFx81xE4xB9xA6 i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=### Certification Authority 3 s:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=### Certification Authority i:/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=### Certification Authority --- Server certificate -----BEGIN CERTIFICATE----- #######################FMm1PJLA9iewtlE9XETANBgkqhkiG9w0BAQUFADBM MQswCQYDVQQGEwJDTjEaMBgGA1UEChMRV29TaWduIENBIExpbWl0ZWQxITAfBgNV BAMMGENBIOayg+mAmuWFjei0uVNTTOivgeS5pjAeFw0xNDEyMjUwMzI5MDlaFw0x NTEyMjUwMzI5MDlaMFkxPjA8BgNVBA0MNeWFjei0uVNTTOivgeS5piDnlLPor7fn vZHlnYDvvJ####################################YDVQQDDA5tYWlsLmp1 YXN5LmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPjfJK6tHr7n c5LgnyyfesG+jMRm+hIHCKVl8xcToUC9xfqhXpTPBLC+0NxGdwHpHY5jsLqE+Mi8 k6VtB0XxP5t644P8j3/felLush1AQdAIHmlWvCYhA4XlnHDNiI2PxqbaJl7CsVVU 24K0r1N5w1kMsGW354SKrAAA8qXy9fRd8sl+8EUmL+51eyo+bziC0obCoHFP7+i6 FQwtZWxabxkT08kGUeaR3gjFx1Nt3HCDPKSxTTVxqH2xu5vAR77Uf1j6OavxLlco XlheTEO7GySKM2ilN8lVlrFfnCuOLJjpl2CaK7B0V6gk/Cvnl22zHomPpuqxGqnN pCGoZUFTdzcCAwEAAaOCAaUwggGhMAsGA1UdDwQEAwIDqDAdBgNVHSUEFjAUBggr BgEFBQcDAgYIKwYBBQUHAwEwCQYDVR0TBAIwADAdBgNVHQ4EFgQULfReKHXU6/pk vPB/e+KbvHzaT90wHwYDVR0jBBgwFoAU/cOuEdflyOXUNEGqQQ0oKdwL9z4wewYI KwYBBQUHAQEEbzBtMDMGCCsGAQUFBzABhidodHRwOi8vb2NzcDIud29zaWduLmNu ########################################Kmh0dHA6Ly9haWEyLndvc2ln bi5jbi9jYTIuc2VydmVyMS5mcmVlLmNlcjA8BgNVHR8ENTAzMDGgL6AthitodHRw Oi8vY3JsczIud29zaWduLmNuL2NhMi1zZXJ2ZXIxLWZyZWUuY3JsMBkGA1UdEQQS MBCCDm1haWwuanVhc3kuY29tMFIGA1UdIARLMEkwCAYGZ4EMAQIBMD0GDisGAQQB gptRAwECBwECMCswKQYIKwYBBQUHAgEWHWh0dHA6Ly93d3cud29zaWduLmNvbS9w ###################################Lhx97YtyFOlvC92qjVQWvZjZ7X8Ii uqbxGDKxVJt6s7ARomQ7toK35SCdfVpgXYlMS2eHNgXdL1gzjRQU4FyDskNgcZqL fruVhm2JV17yDM+Szy16MT8chh+FS3BAOESpwz0I71L7V+mgkVDmz1/sTekFGS0E #########################################pswOZF0QVr/DOaDK41OglfG Wac2V1kbLk4JwMz5BD3YRPmTHGJn04MZikilVzyoLrJpP1UCUIhewJsmV6WVW7fn ############################################### -----END CERTIFICATE----- subject=/description=xE5x85x8DxE8xB4###### xE7x94xB3xE8xAFxB7xE7xBDx91xE5x9Dx80xEFxBCx9Ahttps://buy.wosign.com/CN=mail.####.com issuer=/C=CN/O=#### CA Limited/CN=CA xE6xB2x83xE9x80x9Ax####B4xB9SSLxE8xAFx81xE4xB9xA6 --- No client certificate CA names sent --- SSL handshake has read 6799 bytes and written 199 bytes --- New, TLSv1/SSLv3, Cipher is EXP-DES-CBC-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE SSL-Session: Protocol : TLSv1 Cipher : EXP-DES-CBC-SHA Session-ID: 5343####4FC455F26700B Session-ID-ctx: Master-Key: 2CCA993F6#########C6EE5A17FEA6F52D5BCA697C09A169ED59E0 Key-Arg : None Krb5 Principal: None PSK identity: None PSK identity hint: None Start Time: 1427162168 Timeout : 300 (sec) Verify return code: 0 (ok) --- closed //修复后： [root@localhost ~]# openssl s_client -connect www.111cn.net :443 -cipher EXPORT //phpfensi.com CONNECTED(00000003) 139642907903816:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:741: --- no peer certificate available --- No client certificate CA names sent --- SSL handshake has read 7 bytes and written 73 bytes --- New, (NONE), Cipher is (NONE) Secure Renegotiation IS NOT supported Compression: NONE Expansion: NONE --- 好了有没有发现修复之后我们再测试这个bug是已经没有 bug. （编辑：PHP编程网 - 黄冈站长网） 【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容! |
浙公网安备 33038102330482号