Skip to content

Commit 0e747ef

Browse files
macdaddiemacdaddie
committed
fixed broken link to openssl document
1 parent bf4054e commit 0e747ef

File tree

2 files changed

+289
-1
lines changed

2 files changed

+289
-1
lines changed

‎docs/useful_ssl/Useful_OpenSSL.md‎

Lines changed: 288 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,288 @@
1+
# Useful OpenSSL Tricks
2+
3+
**By Van Emery**
4+
5+
## Introduction
6+
7+
OpenSSL deserves a lot of credit. It is an extremely useful, valuable Open Source project. When people talk about how successful Apache is, rock-solid crypto toolkits like OpenSSL and OpenSSH should also be mentioned. Here are a few (of the many) functions that I have found useful, along with examples of how to use them:
8+
9+
- Base64 Encoding and Decoding
10+
- Symmetric Encryption and Decryption of Files
11+
- Cryptographic Hashing of Files
12+
- S_CLIENT SSL/TLS Test Utility
13+
14+
These examples assume that you are using a Unix-like OS, with OpenSSL 0.9.6b or higher.
15+
16+
## Base64 Encode/Decode
17+
18+
Base64 encoding is a standard method for converting 8-bit binary information into a limited subset of ASCII characters for safe transport through e-mail systems, and other systems that are not 8-bit safe. With OpenSSL, it is very easy to encode and decode Base64 data:
19+
20+
$ `openssl enc -base64 -in myfile -out myfile.b64`
21+
22+
$ `openssl enc -d -base64 -in myfile.b64 -out myfile.decrypt`
23+
24+
## Symmetric Encryption/Decryption of Files
25+
26+
As you can imagine, being able to encrypt and decrypt files with strong ciphers is a useful function. With OpenSSL, you can even use the commands in shell scripts. Here are some command line examples using the Blowfish, Triple DES, and CAST5 ciphers:
27+
28+
$ `openssl enc -e -a -salt -bf -in tomcat.jpg -out tomcat.blowfish`
29+
30+
enter bf-cbc encryption password:
31+
32+
Verifying password - enter bf-cbc encryption password:
33+
34+
$ `openssl enc -d -a -bf -in tomcat.blowfish -out tomcat-decrypt.jpg`
35+
36+
enter bf-cbc decryption password:
37+
38+
$ `openssl enc -e -a -salt -des3 -in tomcat.jpg -out tomcat.des3`
39+
40+
enter des-ede3-cbc encryption password:
41+
42+
Verifying password - enter des-ede3-cbc encryption password:
43+
44+
$ `openssl enc -d -a -des3 -in tomcat.des3 -out tomcat-des3.jpg`
45+
46+
enter des-ede3-cbc decryption password:
47+
48+
$ `openssl enc -e -a -salt -cast5-cbc -in tomcat.jpg -out tomcat.cast5`
49+
50+
enter cast5-cbc encryption password:
51+
52+
Verifying password - enter cast5-cbc encryption password:
53+
54+
$ `openssl enc -d -a -cast5-cbc -in tomcat.cast5 -out tomcat-cast5.jpg`
55+
56+
enter cast5-cbc decryption password:
57+
58+
If the file will not be transported as an e-mail attachment, you can forego the -a argument, which base64 encodes and decodes the ciphertext. Sometimes this is referred to as "ASCII armor". The non-base64 encoded files should be smaller. Here is an example using the CAST5-CBC algorithm:
59+
60+
$ `openssl enc -e -salt -cast5-cbc -in tomcat.jpg -out tomcat.nob64`
61+
62+
enter cast5-cbc encryption password:
63+
64+
Verifying password - enter cast5-cbc encryption password:
65+
66+
$ `openssl enc -d -cast5-cbc -in tomcat.nob64 -out tomcat-nob64.jpg`
67+
68+
enter cast5-cbc decryption password:
69+
70+
## Cryptographic Hashing Functions
71+
72+
What if you want to check to see that a file has not been tampered with? One simple way to do this is a cryptographic *hashing* function. This will give you a fixed-length string (called a message digest) given an input file of any length. SHA-1 and RIPE-MD160 are considered current; MD-5 is considered outdated.
73+
74+
$ `openssl dgst -sha1 -c tomcat.jpg`
75+
76+
SHA1(tomcat.jpg)= 92:b1:9b:96:ef:45:c3:89:b4:2e:e6:96:5b:43:bf:02:66:4a:47:8f
77+
78+
$ `openssl dgst -ripemd160 -c tomcat.jpg`
79+
80+
RIPEMD160(tomcat.jpg)= 68:f2:05:a9:9d:52:f1:cc:04:ed:d7:1e:42:80:0a:b8:c0:e6:cc:6d
81+
82+
$ openssl dgst -md5 -c tomcat.jpg
83+
84+
MD5(tomcat.jpg)= e7:13:d6:a7:cc:16:e3:da:0a:f7:ab:5a:fa:e3:3b:34
85+
86+
You can see that the md5sum utility that is shipped with most GNU/Linux distributions returns the same value as the openssl md5 message digest:
87+
88+
$ `md5sum tomcat.jpg`
89+
90+
e713d6a7cc16e3da0af7ab5afae33b34 tomcat.jpg
91+
92+
The OpenSSL dgst (message digest/hashing) command also has numerous options for signing digests, verifying signatures, etc.
93+
94+
## S_CLIENT SSL/TLS Test Utility
95+
96+
OpenSSL has a great test utility available, called s_client. This lets you test servers that use SSL/TLS with a powerful command line utility. The following is an example of using s_client to view information about a secure web server:
97+
98+
$ `openssl s_client -connect www.redhat.com:443`
99+
100+
CONNECTED(00000003)
101+
102+
depth=0 /C=US/ST=North Carolina/L=Durham/O=Red Hat, Inc./OU=Web Operations/CN=www.redhat.com
103+
104+
verify error:num=20:unable to get local issuer certificate
105+
106+
verify return:1
107+
108+
depth=0 /C=US/ST=North Carolina/L=Durham/O=Red Hat, Inc./OU=Web Operations/CN=www.redhat.com
109+
110+
verify error:num=27:certificate not trusted
111+
112+
verify return:1
113+
114+
depth=0 /C=US/ST=North Carolina/L=Durham/O=Red Hat, Inc./OU=Web Operations/CN=www.redhat.com
115+
116+
verify error:num=21:unable to verify the first certificate
117+
118+
verify return:1
119+
120+
\---
121+
122+
### Certificate chain
123+
124+
0 s:/C=US/ST=North Carolina/L=Durham/O=Red Hat, Inc./OU=Web Operations/CN=www.redhat.com
125+
126+
i:/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority
127+
128+
\---
129+
130+
### Server certificate
131+
132+
```hex
133+
-----BEGIN CERTIFICATE-----
134+
135+
MIID3TCCA0qgAwIBAgIQC4A9mzg//B7clolOw0V4WzANBgkqhkiG9w0BAQQFADBf
136+
137+
MQswCQYDVQQGEwJVUzEgMB4GA1UEChMXUlNBIERhdGEgU2VjdXJpdHksIEluYy4x
138+
139+
LjAsBgNVBAsTJVNlY3VyZSBTZXJ2ZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkw
140+
141+
HhcNMDExMTE0MDAwMDAwWhcNMDMxMjA1MjM1OTU5WjCBgTELMAkGA1UEBhMCVVMx
142+
143+
FzAVBgNVBAgTDk5vcnRoIENhcm9saW5hMQ8wDQYDVQQHFAZEdXJoYW0xFjAUBgNV
144+
145+
BAoUDVJlZCBIYXQsIEluYy4xFzAVBgNVBAsUDldlYiBPcGVyYXRpb25zMRcwFQYD
146+
147+
VQQDFA53d3cucmVkaGF0LmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
148+
149+
4MFi5Xg1rYKETCZ4inSeLJwK4/g/WcOI8JUpH7aK/Hm/e8Lz0uwagzEg/EQnACGl
150+
151+
o6HZsAwlNwV/H4LDXhf4I7NIfgLHmrp6qY1e3SX5qfAAPbxFl4ghiGzNdlTR2Pkn
152+
153+
XQhj/0eW8Pt7NdmQ6LDaMHxb2WchBQYVTYC/cK2zU+8CAwEAAaOCAXkwggF1MAkG
154+
155+
A1UdEwQCMAAwCwYDVR0PBAQDAgWgMDwGA1UdHwQ1MDMwMaAvoC2GK2h0dHA6Ly9j
156+
157+
cmwudmVyaXNpZ24uY29tL1JTQVNlY3VyZVNlcnZlci5jcmwwgawGA1UdIASBpDCB
158+
159+
oTCBngYLYIZIAYb4RQEHAQEwgY4wKAYIKwYBBQUHAgEWHGh0dHBzOi8vd3d3LnZl
160+
161+
cmlzaWduLmNvbS9DUFMwYgYIKwYBBQUHAgIwVjAVFg5WZXJpU2lnbiwgSW5jLjAD
162+
163+
AgEBGj1WZXJpU2lnbidzIENQUyBpbmNvcnAuIGJ5IHJlZmVyZW5jZSBsaWFiLiBs
164+
165+
dGQuIChjKTk3IFZlcmlTaWduMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
166+
167+
AjAZBgpghkgBhvhFAQYPBAsWCTg3ODA1MTU1NjA0BggrBgEFBQcBAQQoMCYwJAYI
168+
169+
KwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNvbTANBgkqhkiG9w0BAQQF
170+
171+
AAN+AEBUhe0gnMw8OWcnKA5XnoglC3V9v//UIZh7lVJCaMA/K2tFAiRlmkGPsim7
172+
173+
H8rHpZhtTOUBqZl6PuA/VJD2wCECJ+uUYx0zUh1dKwoJKWgcaBQOQ6GsCgxsOB2a
174+
175+
i6wMUcAlqHZULjF1mDkM4bu0gNmLXpIMIsw9UotTvz/O
176+
177+
-----END CERTIFICATE-----
178+
```
179+
180+
subject=/C=US/ST=North Carolina/L=Durham/O=Red Hat, Inc./OU=Web Operations/CN=www.redhat.com
181+
182+
issuer=/C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority
183+
184+
\---
185+
186+
No client certificate CA names sent
187+
188+
\---
189+
190+
SSL handshake has read 1549 bytes and written 314 bytes
191+
192+
\---
193+
194+
New, TLSv1/SSLv3, Cipher is EDH-RSA-DES-CBC3-SHA
195+
196+
Server public key is 1024 bit
197+
198+
SSL-Session:
199+
200+
Protocol : TLSv1
201+
202+
Cipher : EDH-RSA-DES-CBC3-SHA
203+
204+
Session-ID: 97D3E2DF903F5757AF8BED807F5FD9665F43300F139BDFCD1701974D97E5C5CA
205+
206+
Session-ID-ctx:
207+
208+
Master-Key: 4B2295AEDCE520F4615769135FB65EBD6E2345C88FCE4EB7450B71B17FD1A2B4460D751DC3DF05C311DA54B02A7B04D1
209+
210+
Key-Arg : None
211+
212+
Start Time: 1063899107
213+
214+
Timeout : 300 (sec)
215+
216+
Verify return code: 21 (unable to verify the first certificate)
217+
218+
\---
219+
220+
Once you have connected, you can manually type in any commands you want, such as "GET /" and "HEAD / HTTP/1.0" for secure web servers. There are also options like -no_tls1 and -no_ssl2 that let you specify which version of SSL/TLS that you want to connect with.
221+
222+
The -showcerts and -debug options are also worth a look.
223+
224+
Most web servers that run SSL (https) run on SSL version 3 or TLS version 1. There are still some outdated servers running SSL version 2.
225+
226+
To check if your web server is running SSL v2.0, run this on your Unix/Linux console:
227+
228+
openssl s_client -connect localhost:443 -ssl2
229+
230+
If it shows an error like SSL2_WRITE:ssl handshake failure:s2_pkt.c, it means SSL v2.0 has been disabled.
231+
232+
EXAMPLE: Lets test if slashdot.org is running SSL v2.0 or v3.0.
233+
234+
Check for SSL version 2
235+
236+
$ openssl s_client -connect slashdot.org:443 -ssl2
237+
238+
CONNECTED(00000004)
239+
240+
11358:error:1407F0E5:SSL routines:SSL2_WRITE:ssl handshake failure:s2_pkt.c:428:
241+
242+
| | [![en-000000.png](blob:file:///71a8aae3-ebcd-4164-9dd7-9665e8cc59b0)](http://www.google.com/url?ct=abg&q=https://www.google.com/adsense/support/bin/request.py%3Fcontact%3Dabg_afc%26url%3Dhttp://aruljohn.com/info/sslversion/%26gl%3DGB%26hl%3Den%26client%3Dca-pub-4499772829528217&usg=AFQjCNHW-AIThZy4JnE45Tik15X4L0jgag) | | [► Secure SSL](<http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4499772829528217&output=html&h=15&slotname=4331892416&w=468&lmt=1369502168&flash=11.8.800&url=http://aruljohn.com/info/sslversion/&dt=1374744092218&bpp=17&shv=r20130718&cbv=r20130206&saldr=sa&prev_slotnames=4824922504&correlator=1374744092203&frm=20&adk=4066576775&ga_vid=1851460068.1374744092&ga_sid=1374744092&ga_hid=2038637376&ga_fc=0&u_tz=60&u_his=5&u_java=1&u_h=1080&u_w=1920&u_ah=1054&u_aw=1920&u_cd=24&u_nplug=10&u_nmime=67&dff=arial&dfs=14&adx=142&ady=602&biw=1265&bih=690&oid=3&ref=http://www.google.co.uk/url?sa=t&rct=j&q=openssl> ssl verify version&source=web&cd=1&ved=0CC0QFjAA&url=http%3A%2F%2Faruljohn.com%2Finfo%2Fsslversion%2F&ei=GO7wUd6oM5Cl0wWx-oHwDw&usg=AFQjCNE8Aojq9c3waLxpm_QJLawC-cwCmQ&sig2=Cr4jdRKL8U_9HhsTpUI1Ag&fu=0&ifi=2&dtd=32&xpc=ncQTdQXVue&p=<http://aruljohn.com&rl_rc=true&adsense_enabled=true&ad_type=text_image&oe=utf8&hei>) [► SSL Key](<http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4499772829528217&output=html&h=15&slotname=4331892416&w=468&lmt=1369502168&flash=11.8.800&url=http://aruljohn.com/info/sslversion/&dt=1374744092218&bpp=17&shv=r20130718&cbv=r20130206&saldr=sa&prev_slotnames=4824922504&correlator=1374744092203&frm=20&adk=4066576775&ga_vid=1851460068.1374744092&ga_sid=1374744092&ga_hid=2038637376&ga_fc=0&u_tz=60&u_his=5&u_java=1&u_h=1080&u_w=1920&u_ah=1054&u_aw=1920&u_cd=24&u_nplug=10&u_nmime=67&dff=arial&dfs=14&adx=142&ady=602&biw=1265&bih=690&oid=3&ref=http://www.google.co.uk/url?sa=t&rct=j&q=openssl> ssl verify version&source=web&cd=1&ved=0CC0QFjAA&url=http%3A%2F%2Faruljohn.com%2Finfo%2Fsslversion%2F&ei=GO7wUd6oM5Cl0wWx-oHwDw&usg=AFQjCNE8Aojq9c3waLxpm_QJLawC-cwCmQ&sig2=Cr4jdRKL8U_9HhsTpUI1Ag&fu=0&ifi=2&dtd=32&xpc=ncQTdQXVue&p=<http://aruljohn.com&rl_rc=true&adsense_enabled=true&ad_type=text_image&oe=utf8&hei>) [► Domain SSL](<http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4499772829528217&output=html&h=15&slotname=4331892416&w=468&lmt=1369502168&flash=11.8.800&url=http://aruljohn.com/info/sslversion/&dt=1374744092218&bpp=17&shv=r20130718&cbv=r20130206&saldr=sa&prev_slotnames=4824922504&correlator=1374744092203&frm=20&adk=4066576775&ga_vid=1851460068.1374744092&ga_sid=1374744092&ga_hid=2038637376&ga_fc=0&u_tz=60&u_his=5&u_java=1&u_h=1080&u_w=1920&u_ah=1054&u_aw=1920&u_cd=24&u_nplug=10&u_nmime=67&dff=arial&dfs=14&adx=142&ady=602&biw=1265&bih=690&oid=3&ref=http://www.google.co.uk/url?sa=t&rct=j&q=openssl> ssl verify version&source=web&cd=1&ved=0CC0QFjAA&url=http%3A%2F%2Faruljohn.com%2Finfo%2Fsslversion%2F&ei=GO7wUd6oM5Cl0wWx-oHwDw&usg=AFQjCNE8Aojq9c3waLxpm_QJLawC-cwCmQ&sig2=Cr4jdRKL8U_9HhsTpUI1Ag&fu=0&ifi=2&dtd=32&xpc=ncQTdQXVue&p=<http://aruljohn.com&rl_rc=true&adsense_enabled=true&ad_type=text_image&oe=utf8&hei>) [► APACHE2 SSL](<http://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-4499772829528217&output=html&h=15&slotname=4331892416&w=468&lmt=1369502168&flash=11.8.800&url=http://aruljohn.com/info/sslversion/&dt=1374744092218&bpp=17&shv=r20130718&cbv=r20130206&saldr=sa&prev_slotnames=4824922504&correlator=1374744092203&frm=20&adk=4066576775&ga_vid=1851460068.1374744092&ga_sid=1374744092&ga_hid=2038637376&ga_fc=0&u_tz=60&u_his=5&u_java=1&u_h=1080&u_w=1920&u_ah=1054&u_aw=1920&u_cd=24&u_nplug=10&u_nmime=67&dff=arial&dfs=14&adx=142&ady=602&biw=1265&bih=690&oid=3&ref=http://www.google.co.uk/url?sa=t&rct=j&q=openssl> ssl verify version&source=web&cd=1&ved=0CC0QFjAA&url=http%3A%2F%2Faruljohn.com%2Finfo%2Fsslversion%2F&ei=GO7wUd6oM5Cl0wWx-oHwDw&usg=AFQjCNE8Aojq9c3waLxpm_QJLawC-cwCmQ&sig2=Cr4jdRKL8U_9HhsTpUI1Ag&fu=0&ifi=2&dtd=32&xpc=ncQTdQXVue&p=<http://aruljohn.com&rl_rc=true&adsense_enabled=true&ad_type=text_image&oe=utf8&hei>) |
243+
| ---- | ------------------------------------------------------------ | ---- | ------------------------------------------------------------ |
244+
| | | | |
245+
246+
Check for SSL version 3
247+
248+
$ `openssl s_client -connect slashdot.org:443 -ssl2`
249+
250+
CONNECTED(00000004)
251+
252+
depth=0 /C=US/O=slashdot.org/OU=3246035501/OU=See www.geotrust.com/resources/cps (c)08/OU=
253+
254+
Domain Control Validated - QuickSSL(R)/CN=slashdot.org
255+
256+
verify error:num=20:unable to get local issuer certificate
257+
258+
verify return:1
259+
260+
........
261+
262+
........
263+
264+
........
265+
266+
New, TLSv1/SSLv3, Cipher is RC4-MD5
267+
268+
Server public key is 1024 bit
269+
270+
Compression: NONE
271+
272+
Expansion: NONE
273+
274+
SSL-Session:
275+
276+
Protocol : SSLv3
277+
278+
Cipher : RC4-MD5
279+
280+
Enable version SSLv3 and disable SSLv2
281+
282+
Edit Apache's ssl.conf and include these lines at minimum:
283+
284+
SSLProtocol -all +SSLv3
285+
286+
SSLCipherSuite SSLv3:+HIGH:+MEDIUM
287+
288+
Restart Apache and you're good to go.

‎docs/useful_unix.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -319,7 +319,7 @@ mount -t smbfs //[email protected]/CSW01 /<path_to_mount_point/<mount_point>
319319
[source, bash]
320320
mount_smbfs //[email protected]/CSW01 /<path_to_mount_point/<mount_point>
321321

322-
== link:Useful_OpenSSL.md[useful Openssl]
322+
== link:./useful_ssl/Useful_OpenSSL.md[useful Openssl]
323323

324324
=== Encrypt a file using OpenSSL
325325

0 commit comments

Comments
 (0)