HeartBleed - How to Fix & Test on Ubuntu

Img Source: WikiPedia

Suddenly There was an havoc on tech networks, created by HeartBleed bug. 

As it was related to omnipresent and widely believed to most secure OpenSSL, Everyone on internet is trying to gain traction by writing about it. But very few are writing about how to detect, fix and test. 

I got few articles from certain Q&A sites, just thought of putting them all together in easy way.

How to Detect for your ubuntu server :

   Which Ubuntu Servers : 
    
   Dont Know Version? Here is the command :
    $lsb_release -a
  
   Security issue affects these releases of Ubuntu and its derivatives:

      Ubuntu 13.10
      Ubuntu 12.10
      Ubuntu 12.04 LTS

   From Your own machine:
    1) Login to your server 

       $openssl version -a
        if version is 1.0.1 (till f), your openssl is vulnerable.

    From outside
     1) Visit Fillippo.io 
         

     2) from command prompt : 
          $openssl s_client -connect example.com:443 -tlsextdebug 2>&1| grep 'server extension "heartbeat" (id=15)' || echo safe


How to Fix for your ubuntu server :

      The problem can be corrected by updating your system to the following package version: 

       Ubuntu 13.10:

libssl1.0.0 1.0.1e-3ubuntu1.2

       Ubuntu 12.10:

libssl1.0.0 1.0.1c-3ubuntu2.7

       Ubuntu 12.04 LTS:

libssl1.0.0 1.0.1-4ubuntu5.12

Or  You can do following
$sudo apt-get update
$sudo apt-get install openssl libssl-dev

Find Which services to restart

sudo find /proc -maxdepth 2 -name maps -exec grep -HE '/libssl\.so.* \(deleted\)' {} \; | cut -d/ -f3 | sort -u | xargs --no-run-if-empty ps uwwp 


Restart services which are using OpenSSL like Apache, nginx.





How to Test for Success?

$dpkg -l | grep openssl
You should see, following, then you are ok
  openssl                            1.0.1-4ubuntu5.12                       Secure Socket Layer (SSL) binary  

or
 Visit Fillippo.io 
Hope it helps you to fix Heartbleed.



 

Code Igniter - Setting Secure flag for Session

Php5 gives you ability to set secure flag with function setcookie, but codeigniter doesnt.

http://php.net/manual/en/function.setcookie.php

see 6th argument to setcookie.

It saves session with Encryption and using md5 but still security softwares objects your website because
non secure session.

I was searching for a while do it good way, but didnt find it, so I came up with this hack.

In CI_HOME/system/libraries/Session.php

Basically CI passes $secure = 0 as  a hardcoded argument to setcookie function.

I set this value to 1. one can write some more code to make it configurable thru CI config file.

With $secure=1, Session cookie wont be saved for domains accessed with http://urdomain.com

it only works with https://urdomain.com


Let me know if its issue or better way doing this.

All the best.