LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 02-26-2024, 12:18 PM   #1
JASlinux
Member
 
Registered: Oct 2020
Posts: 380

Rep: Reputation: Disabled
Question How to run 2 versions of OpenSSL?


OpenSSL is not backwards compatible so I find myself locked out of my own data.

Is it possible to run 2 versions simultaneously, perhaps one standalone?

Currently I am uninstalling then reinstalling the version I wish to use.
 
Old 02-26-2024, 02:33 PM   #2
smallpond
Senior Member
 
Registered: Feb 2011
Location: Massachusetts, USA
Distribution: Fedora
Posts: 4,143

Rep: Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264Reputation: 1264
Leave the one installed by your distro alone in /lib64/libssl and /usr/bin/openssl. Install the alternate one in /usr/local/lib and /usr/local/bin. Are you building the alternate yourself or pulling a package from somewhere?
 
Old 02-27-2024, 08:10 AM   #3
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,665
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
Most likely, your "new" version of OpenSSL does not, by default, install a particular cipher that you have been using.
 
Old 02-28-2024, 09:04 AM   #4
JASlinux
Member
 
Registered: Oct 2020
Posts: 380

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by smallpond View Post
Leave the one installed by your distro alone in /lib64/libssl and /usr/bin/openssl. Install the alternate one in /usr/local/lib and /usr/local/bin. Are you building the alternate yourself or pulling a package from somewhere?
That's a good idea, but I'm a little fuzzy on the implementation.

I can see components in /usr/lib & the path executable /usr/bin, skipping the "*/local/*" directory.

I am not sure how simply a 2nd version would work. The newer version I install in the older OS is a .deb. It works, but I haven't tried the reverse. 2 versions???

Would you say this is simply a matter of renaming the 2nd version of "openssl" or executing from its directory? openssl-new & openssl-old?
 
Old 02-28-2024, 01:50 PM   #5
dugan
LQ Guru
 
Registered: Nov 2003
Location: Canada
Distribution: distro hopper
Posts: 11,232

Rep: Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320Reputation: 5320
Docker. Although this is very obviously an X/Y problem.

You obviously didn't get an error message saying that an earlier version of OpenSSL is required for what you're doing (as that would not be true), so, if you want better help, what's happening here?

Last edited by dugan; 02-28-2024 at 06:31 PM.
 
Old 02-28-2024, 05:10 PM   #6
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,665
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
Intuitively: "OpenSSL" is a framework which supports multiple ciphers (as "plugins") and "uses them properly." Therefore, I cannot see any reason why you would need to run multiple versions of that "framework."

But, ciphers do "fall out of fashion," such that later releases of a system might not [by default ...] include them. This is what I suspect has happened here.
 
Old 02-29-2024, 12:44 AM   #7
JASlinux
Member
 
Registered: Oct 2020
Posts: 380

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by sundialsvcs View Post
Intuitively: "OpenSSL" is a framework which supports multiple ciphers (as "plugins") and "uses them properly." Therefore, I cannot see any reason why you would need to run multiple versions of that "framework."

But, ciphers do "fall out of fashion," such that later releases of a system might not [by default ...] include them. This is what I suspect has happened here.
I get your point & do get frequent 'X has been deprecated' command line warnings, but it requires sophistication to know how 'adjust the framework' of ciphers, while the simple solution of installing the new version works.

Ergo, the dilemma as present is simply a way to access data with tool incompatibility. If it were nearly impossible to run two versions but a modest challenge to learn cipher framework, I would possibly bog myself down.

It should work backwards, same input/output, but if that's possible it's another level of sophistication. Straightforward it's incompatible.
 
Old 02-29-2024, 12:50 AM   #8
JASlinux
Member
 
Registered: Oct 2020
Posts: 380

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by dugan View Post
Docker. Although this is very obviously an X/Y problem.

You obviously didn't get an error message saying that an earlier version of OpenSSL is required for what you're doing (as that would not be true), so, if you want better help, what's happening here?
No, it's not literal, but obviously you decrypt with the ciphering version & it works, the other it doesn't.

Recently I have old+new in the old by the install/remove method. I still need to check old in the new which is an appropriate reminder to download it now.
 
Old 02-29-2024, 04:19 AM   #9
elcore
Senior Member
 
Registered: Sep 2014
Distribution: Slackware
Posts: 1,753

Rep: Reputation: Disabled
Configure scripts usually rely on pkg-config to detect openssl.
I'd just remove old openssl package, install new openssl package, and then provide old openssl libs in /usr/local/lib64.
This way the old binaries which require old openssl will not break, and compiling new binaries will not link to old openssl since configure scripts can't find it via pkg-config.
I'm sure there are better ways, but the above works fine for me. I've never had a need to support both at the same time, i.e. link a binary to multiple openssl versions.
 
1 members found this post helpful.
Old 03-01-2024, 03:47 AM   #10
MilesWeb
LQ Newbie
 
Registered: Jan 2024
Posts: 8

Rep: Reputation: 1
Generally it's not recommended to use two versions of OpenSSL simultaneously. There are some limitations while you try to run 2 versions of OpenSSL.
Check if you can upgrade your application the newer OpenSSL version.

You can check containerization technologies that may be able to create isolated environments each OpenSSL version.
 
Old 04-18-2024, 06:23 AM   #11
murugesandins
Member
 
Registered: Apr 2024
Location: Bangalore Karnataka India
Distribution: CYGWIN_NT
Posts: 59

Rep: Reputation: 0
Quote:
Originally Posted by JASlinux View Post
OpenSSL is not backwards compatible so I find myself locked out of my own data.

Is it possible to run 2 versions simultaneously, perhaps one standalone?

Currently I am uninstalling then reinstalling the version I wish to use.
01)
I have compiled openssl opensource code from 2004 to till now a lot of times at all operating systems(HP-UX CYGWIN_NT SunOS AIX Linux).
I have performed backward compatibility myself for my testing.
02)
Is it possible to run 2 versions simultaneously.
Yes it is possible.
Example at Windows CYGWIN:
open cmd.exe as administrator(two times)
a)
Execute following command at one command prompt:
%cygwin_dir%\bin\openssl.exe speed -multi 900000000
At the same time execute following at 2nd command prompt:
taskkill.exe /f /im openssl.exe
b)
Download openssl opensource code at windows:
Code:
$ /usr/bin/wget -c --no-check-certificate "https://openssl.org/source/openssl-3.3.0.tar.gz"
$# firefox.exe download faster than wget.exe as per my comparison at diff timings using related pause like a tester.
After compilation at windows:
Code:
$ ./openssl-3.3.0/apps/openssl.exe speed -multi 900000000
malloc failure
Hence we can have multiple openssl.exe/openssl file location for testing(from development team too)
 
Old 04-18-2024, 09:26 AM   #12
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,665
Blog Entries: 4

Rep: Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945Reputation: 3945
You should run only one version of this critically-important software: "the very latest one, with the very latest ciphers."
 
Old 04-18-2024, 10:23 AM   #13
teckk
LQ Guru
 
Registered: Oct 2004
Distribution: Arch
Posts: 5,138
Blog Entries: 6

Rep: Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827Reputation: 1827
Depends on your distro I guess. And how they have been packaged. Arch has 2 version in its repo

I'm not up to date.

Code:
core/openssl 3.2.1-1
    The Open Source toolkit for Secure Sockets Layer and Transport Layer Security
core/openssl-1.1 1.1.1.w-1
    The Open Source toolkit for Secure Sockets Layer and Transport Layer Security
Which means that they can play together.
 
Old 04-18-2024, 08:18 PM   #14
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Rocky 9.2
Posts: 18,360

Rep: Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751Reputation: 2751
You might find this helpful https://www.madboa.com/geek/openssl/
 
Old 04-19-2024, 12:02 AM   #15
pan64
LQ Addict
 
Registered: Mar 2012
Location: Hungary
Distribution: debian/ubuntu/suse ...
Posts: 21,879

Rep: Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317Reputation: 7317
And we still don't know what is the real reason to use 2 different versions. Exactly what kind of problem do you want to solve? What is incompatible with what?
 
  


Reply

Tags
compatibility, openssl, security



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
[SOLVED] new openssl 1.1.0 - broken compatibility with openssl 1.0.1 FranekW Linux - Newbie 2 06-26-2018 10:49 AM
Does recursive mutex lock in openssl will affect other openssl users in same system? T.Selvan Linux - Networking 3 02-09-2016 12:59 AM
openssl: any simple examples no how to use openssl to do some decryption? eantoranz Programming 7 07-26-2012 07:57 PM
install of openssl-0.9.8b-8.3.el5 conflicts with file from package openssl-0.9.8b-8.3 jsaravana87 Linux - Server 1 09-26-2011 01:02 PM
oops openssl-0.9.8e over openssl-0.9.8d bad install now 2 copies? rcorkum Slackware 4 06-29-2007 01:58 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 11:24 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration