Subject: RHN ModSSL Backported Version question...

From: "Dan" <[email-masked]>
Date: Fri, 16 May 2003 12:24:37 -0400

Hi,

I currently have mod_ssl-2.0.40-11.3 installed on my server which came with
my Red Hat Linux 8, kernel 2.4.18-27.8.0 distribution disks.  I noticed that
the most current version listed on the modssl.org site for mod_ssl is
2.8.14-1.3.27 and have a few questions if anyone could assist with I would
appreciate it much.

I'm on the Red Hat Network and receive errata bug fix and security
advisories - reports for mods on my server.  Currently I don't have any bug
fix or security advisories for Mod_SSL.  Should I be worried that I have an
older version according to the mod_ssl site and upgrade my current version
of mod_ssl?

Because someone told me that the red hat version numbers do not always match
the most current mod version numbers from their originating sources and that
the mod_ssl package that I currently have from rh should be ok because red
hat
applies security fixes without changing the numbers or providing different
version numbers - backporting.  Is this correct for modssl too?  If so, how
would I find out if my version of RH mod_ssl is safe?

If I do upgrade mod_ssl to the most current version listed on the modssl.org
site, will it break anything or cause dependency issues on the server?
Because I have five live e-commerce sites using mod_ssl and Thawte
certificates, and I don't want to cause more trouble than I have.  But of
course if having the old versions poses a security risk I guess I should
upgrade.

Any advice would be appreciated.

Thanks much.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Mads Toftum <[email-masked]>
Date: Fri, 16 May 2003 18:29:17 +0200

> 2.8.14-1.3.27 and have a few questions if anyone could assist with I would
This is really becomming the most frequently asked question. The mod_ssl on
www.modssl.org is only for apache 1.3 - 2.8.14-1.3.27 works only with 
apache-1.3.27. Your apache is from the 2.0 series and comes with mod_ssl
built in - so by having the most recent version of apache 2.0, you'll
also have the most recent mod_ssl for that apache. I don't know the specifics
of redhats numbering scheme, but the most recent Apache/mod_ssl is 2.0.45

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 16 May 2003 12:54:20 -0400 (EDT)

moving from redhat's packages to roll-your-own can be a nightmare, a
search of the list archives will turn up alot of posts by John Airey to
this list on this very issue.  mod-ssl is tied to openssl, which is tied
to openssh, soo, breaking one tie can unbind your whole setup.  It's not a
pretty mess, and if you are patcient, and willing to jump hoops, you can
accomplish it, but, have plenty of soap and water handy...

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!