Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Matthew Weigel
You should at least be able to know which of your packages have access to an SSL private key, and speak SSL. You also need to recursively check each library dovecot links to... That libdovecot looks like a likely candidate for linking ssl.so. That said, For dovecot, I THINK it uses dlopen at ru

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Didier Wiroth
Ok, thank you very much! Didier On 8 April 2014 19:44, Stefan Sperling wrote: > On Tue, Apr 08, 2014 at 07:26:06PM +0200, Didier Wiroth wrote: >> F.ex. I use dovecot: >> # ldd `which dovecot` >> /usr/local/sbin/dovecot: >> StartEnd Type Open Ref GrpRef Name >> 04f81c5

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Jérémie Courrèges-Anglas
Didier Wiroth writes: > Hello, > I'm not a developer but more of an openbsd hobbyist. > I'm using current with current packages that are a few days old. > > I patched my openbsd servers and revoked all my ssl keys, generated > new ones and changed every possible password. > Even though, as far as

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Stefan Sperling
On Tue, Apr 08, 2014 at 07:26:06PM +0200, Didier Wiroth wrote: > F.ex. I use dovecot: > # ldd `which dovecot` > /usr/local/sbin/dovecot: > StartEnd Type Open Ref GrpRef Name > 04f81c50 04f81c913000 exe 10 0 /usr/local/sbin/dovecot > 04fa2152c000

heartbleed ssl bug and ports or packages question

2014-04-08 Thread Didier Wiroth
Hello, I'm not a developer but more of an openbsd hobbyist. I'm using current with current packages that are a few days old. I patched my openbsd servers and revoked all my ssl keys, generated new ones and changed every possible password. Even though, as far as I understood, you can't be sure cred