heartbleed ssl bug and ports or packages question

2014-04-08 Thread Didier Wiroth
Hello, I'm not a developer but more of an openbsd hobbyist. I'm using current with current packages that are a few days old. I patched my openbsd servers and revoked all my ssl keys, generated new ones and changed every possible password. Even though, as far as I understood, you can't be sure

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Stefan Sperling
On Tue, Apr 08, 2014 at 07:26:06PM +0200, Didier Wiroth wrote: F.ex. I use dovecot: # ldd `which dovecot` /usr/local/sbin/dovecot: StartEnd Type Open Ref GrpRef Name 04f81c50 04f81c913000 exe 10 0 /usr/local/sbin/dovecot 04fa2152c000

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Jérémie Courrèges-Anglas
Didier Wiroth dwir...@gmail.com writes: Hello, I'm not a developer but more of an openbsd hobbyist. I'm using current with current packages that are a few days old. I patched my openbsd servers and revoked all my ssl keys, generated new ones and changed every possible password. Even

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Didier Wiroth
Ok, thank you very much! Didier On 8 April 2014 19:44, Stefan Sperling s...@openbsd.org wrote: On Tue, Apr 08, 2014 at 07:26:06PM +0200, Didier Wiroth wrote: F.ex. I use dovecot: # ldd `which dovecot` /usr/local/sbin/dovecot: StartEnd Type Open Ref GrpRef Name

Re: heartbleed ssl bug and ports or packages question

2014-04-08 Thread Matthew Weigel
You should at least be able to know which of your packages have access to an SSL private key, and speak SSL. You also need to recursively check each library dovecot links to... That libdovecot looks like a likely candidate for linking ssl.so. That said, For dovecot, I THINK it uses dlopen at