We have a legacy HP-UX 11.11 server that has a number of security vulnerabilities associated with OpenSSL. We have a project in the works to replace this server but until then I need to deal with the vulnerabilities. No applications on the server utilize SSL, so my plan was to simply remove it. However, when I mark OpenSSL for removal I get a long list of dependencies, including the following:
SysMgmtHomepage
EMS-Core
IOTree-Provider
LVM-Provider
SCSI-Provider
WBEMP Services
Is it actually feasible to remove OpenSSL without breaking other things? Any advise or thoughts greatly appreciated.
Thanks,
Joe
HPUX system management home page (SMH) uses SSL.
Also, there is whole subsystem to handle that among other things.
That stuff listed are various providers for WBEM, LVM which provide information about those subsystem, but are not involved in their functioning.
So systems like HPSIM can get information via WBEM over network about the machine.
Or SMH web interface can be used to administer the system via clicking the browser.
If you are having issues with security scans showing that, you can disable SMH (if you don't use it).
Now your server listenes on various ports (80,443,2301..) due to that service being active.
Security scans will find out about openssl weakness if that service is up.
If stopped/disabled, nothing will pop out regarding that subject. No uninstall is required.
The smh utility from command line should still work.
Have you consider rather upgrading the OS ?
HPUX v1 is a really old operating system.
Hope that helps
Regards
Peasant.
Peasant,
Thanks for the reply. We do have an upgrade project in the works but it's a couple months out from completion.
Can I simply disable all web services without uninstalling anything? Our ERP system does not use any web or SSL services.
Thanks,
Joe
Finally getting back to this issue. Can anyone tell me how to disable/stop OpenSSL, or at least stop it from listening on port 443?
Thanks,
Joe
That would come down to your web server, what is it?
The webserver is Apache. Not sure of the full version but the OS is 11.11.
Thanks,
Joe
Corona688, any thoughts on this? I appreciate any help!
Thanks,
Joe
Bumping up posts or double posting is not permitted in these forums.
Please read the rules, which you agreed to when you registered, if you have not already done so.
You may receive an infraction for this. If so, don't worry, just try to follow the rules more carefully. The infraction will expire in the near future
Thank You.
The UNIX and Linux Forums.
How to disable SSL for apache really depends on your apache setup. There isn't one big "disable ssl" option. You might be able to force it off by commenting out "LoadModule ssl_module modules/mod_ssl.so" in httpd.conf but then every vhost with ssl options will complain and cause apache to fail to start. You might end up having to hand edit lots of vhosts.
You might also try blocking it in your firewall.