Running latest 21.1.2 LibreSSL version BUT...

[Black6spdZ]

root@OPNsense:~ # openssl version -a
OpenSSL 1.1.1d-freebsd  10 Sep 2019
built on: reproducible build, date unspecified
platform: FreeBSD-amd64
options:  bn(64,64) rc4(16x,int) des(int) idea(int) blowfish(ptr)
compiler: clang
OPENSSLDIR: "/etc/ssl"
ENGINESDIR: "/usr/lib/engines"
Seeding source: os-specific

I don't see LibreSSL version here.. whats going on here??

[chemlud]

Screenshot of the Dashboard, upper left corner, maybe? ;-)

After setting the flavor to libreSSL you have to do an update to get it installed. Maybe swith to openSSL, update, switcht to libreSSL and update again.

[Black6spdZ]

Versions   OPNsense 21.1.2-amd64
FreeBSD 12.1-RELEASE-p13-HBSD
LibreSSL 3.2.4

[Black6spdZ]

just updated to OpenSSL version, rebooted and then back to LibreSSL version and rebooted again

root@OPNsense:~ # openssl
OpenSSL> version
OpenSSL 1.1.1d-freebsd  10 Sep 2019
OpenSSL>

is this some sort of trickery here?

[franco]

When using "openssl" the shell picks /usr/bin/openssl but you actually wanted /usr/local/bin/openssl....


Cheers,
Franco

[Black6spdZ]

root@OPNsense:/usr/local/bin # openssl
OpenSSL> version
OpenSSL 1.1.1d-freebsd  10 Sep 2019
OpenSSL>

where is the system getting this old version from?

root@OPNsense:/ # find / -name openssl
/usr/bin/openssl
/usr/include/openssl
/usr/local/include/php/ext/openssl
/usr/local/include/openssl
/usr/local/openssl
/usr/local/lib/python3.7/site-packages/cryptography/hazmat/bindings/openssl
/usr/local/lib/python3.7/site-packages/cryptography/hazmat/backends/openssl
/usr/local/bin/openssl
/usr/share/openssl

tried them all, report same 1.1.1d version

[marjohn56]

Try /usr/local/bin/openssl


then version

[Greelan]

root@OPNsense:/usr/local/bin # openssl

Running the command this way will still pick the first "openssl" in $PATH (which is in /usr/bin).  You would have to run "./openssl" to pick the binary in the directory you are in. Or just use the full path in the command as marjohn56 said

[chemlud]

OK, I'm on LibreSSL as well

Code Select Expand

#  /usr/local/bin/openssl
OpenSSL> version
LibreSSL 3.2.4
OpenSSL>


But dumb question: Why is there such an old version of openSSL present on my install AT ALL

Code Select Expand

/usr/local/bin # openssl
OpenSSL> version
OpenSSL 1.1.1d-freebsd  10 Sep 2019


Isn't that a security issue?

[Black6spdZ]

./openssl did the trick in the appropriate folder..

[franco]

But dumb question: Why is there such an old version of openSSL present on my install AT ALL

[...]

Isn't that a security issue?

Because FreeBSD 12.1 was released about two years ago when all these newer OpenSSL versions were not yet available.

It's not a security issue, because

(1) FreeBSD security advisories pick them up but do not change the version number (this is what the release patch level is for)

(2) We barely use this OS based library in our builds due to forcing the port version (which is also newer so yay for those shiny version numbers).

None of this information is new and can probably be found a couple of times in the forum.


Cheers,
Franco

[chemlud]

Hi franco, but the search function for the forum is hmm... not that good in finding relevant threads.

I would have expected that if I choose flavour LibreSSL then there is no openSSL on my systems at all. What would happen, if the openSSL bins were deleted all and completely from a current OPNsense system that is on LibreSSL?

[SFC]

Hi franco, but the search function for the forum is hmm... not that good in finding relevant threads.

I would have expected that if I choose flavour LibreSSL then there is no openSSL on my systems at all. What would happen, if the openSSL bins were deleted all and completely from a current OPNsense system that is on LibreSSL?

Removing openSSL from your running system will basically be impossible.  You'd have to compile with LibreSSL from the get go - as in at makeworld and makekernel time.  And even then, there will inevitably be some packages that just won't work without openSSL.

https://attilagyorffy.com/2016/07/02/the-state-of-libressl-in-freebsd/

[chemlud]

Hi franco, but the search function for the forum is hmm... not that good in finding relevant threads.

I would have expected that if I choose flavour LibreSSL then there is no openSSL on my systems at all. What would happen, if the openSSL bins were deleted all and completely from a current OPNsense system that is on LibreSSL?

Removing openSSL from your running system will basically be impossible.  You'd have to compile with LibreSSL from the get go - as in at makeworld and makekernel time.  And even then, there will inevitably be some packages that just won't work without openSSL.

https://attilagyorffy.com/2016/07/02/the-state-of-libressl-in-freebsd/

Hi and thanks! The link is 5 years old now, really no progress in getting rid of this openSSL stuff? :-O