source: postlfs/security/openssl.xml@ 295ca00

systemd-13485
Last change on this file since 295ca00 was 295ca00, checked in by Douglas R. Reno <renodr@…>, 6 years ago

Update to Sudo-1.8.15 (merged from trunk r16594)
Update to stunnel-5.29 (merged from trunk r16797)
Update to ssh-askpass-4.1p2 (merged from trunk r16811)
Update to p11-kit-0.23.2 (merged from trunk r16716)
Update to OpenSSL-1.0.2e (merged from trunk r16708)
Update to OpenSSH-7.1p2 (merged from trunk r16811)
Update to NSS-3.21 (merged from trunk r16627)
Update to MIT Kerberos V5-1.14 (merged from trunk r16679)
Update to iptables-1.6.0 (merged from trunk r16742)
Update to GPGME-1.6.0 (merged from trunk r16360)
Update to GnuTLS-3.4.8 (merged from trunk r16797)

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/branches/systemd@16833 af4574ff-66df-0310-9fd7-8a98e5e911e0

  • Property mode set to 100644
File size: 9.7 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY openssl-download-http
8 "https://www.openssl.org/source/openssl-&openssl-version;.tar.gz">
9 <!ENTITY openssl-download-ftp
10 "ftp://ftp.openssl.org/source/openssl-&openssl-version;.tar.gz">
11 <!ENTITY openssl-md5sum "5262bfa25b60ed9de9f28d5d52d77fc5">
12 <!ENTITY openssl-size "5.1 MB">
13 <!ENTITY openssl-buildsize "68 MB (with tests)">
14 <!ENTITY openssl-time "1.4 SBU (with tests)">
15]>
16
17<sect1 id="openssl" xreflabel="OpenSSL-&openssl-version;">
18 <?dbhtml filename="openssl.html"?>
19
20 <sect1info>
21 <othername>$LastChangedBy$</othername>
22 <date>$Date$</date>
23 </sect1info>
24
25 <title>OpenSSL-&openssl-version;</title>
26
27 <indexterm zone="openssl">
28 <primary sortas="a-OpenSSL">OpenSSL</primary>
29 </indexterm>
30
31 <sect2 role="package">
32 <title>Introduction to OpenSSL</title>
33
34 <para>
35 The <application>OpenSSL</application> package contains management tools
36 and libraries relating to cryptography. These are useful for providing
37 cryptography functions to other packages, such as
38 <application>OpenSSH</application>, email applications and web browsers
39 (for accessing HTTPS sites).
40 </para>
41
42 &lfs78_checked;
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>
48 Download (HTTP): <ulink url="&openssl-download-http;"/>
49 </para>
50 </listitem>
51 <listitem>
52 <para>
53 Download (FTP): <ulink url="&openssl-download-ftp;"/>
54 </para>
55 </listitem>
56 <listitem>
57 <para>
58 Download MD5 sum: &openssl-md5sum;
59 </para>
60 </listitem>
61 <listitem>
62 <para>
63 Download size: &openssl-size;
64 </para>
65 </listitem>
66 <listitem>
67 <para>
68 Estimated disk space required: &openssl-buildsize;
69 </para>
70 </listitem>
71 <listitem>
72 <para>
73 Estimated build time: &openssl-time;
74 </para>
75 </listitem>
76 </itemizedlist>
77
78<!-- <bridgehead renderas="sect3">Additional Downloads</bridgehead>
79 <itemizedlist spacing="compact">
80 <listitem>
81 <para>
82 Required patch:
83 <ulink url="&patch-root;/openssl-&openssl-version;-fix_parallel_build-1.patch"/>
84 </para>
85 </listitem>
86 </itemizedlist> -->
87
88 <bridgehead renderas="sect3">OpenSSL Dependencies</bridgehead>
89
90 <bridgehead renderas="sect4">Optional</bridgehead>
91 <para role="optional">
92 <xref linkend="mitkrb"/>
93 </para>
94
95 <para condition="html" role="usernotes">
96 User Notes: <ulink url='&blfs-wiki;/OpenSSL'/>
97 </para>
98 </sect2>
99
100 <sect2 role="installation">
101 <title>Installation of OpenSSL</title>
102
103 <para>
104 Install <application>OpenSSL</application> with the following commands:
105 </para>
106
107<!-- libdir=lib so it doesn't write over /usr/lib64 symlink on 64 bit system.
108 Might break packaging. -->
109
110<screen><userinput>./config --prefix=/usr \
111 --openssldir=/etc/ssl \
112 --libdir=lib \
113 shared \
114 zlib-dynamic &amp;&amp;
115make</userinput></screen>
116
117 <para>
118 To test the results, issue: <command>make test</command>.
119 </para>
120
121 <para>
122 If you want to disable installing the static libraries, use this sed:
123 </para>
124
125<screen><userinput>sed -i 's# libcrypto.a##;s# libssl.a##' Makefile</userinput></screen>
126
127 <para>
128 Now, as the <systemitem class="username">root</systemitem> user:
129 </para>
130
131<!-- dev note: make INSTALL_PREFIX=<DESTDIR> MANDIR=/usr/share/man MANSUFFIX=ssl install -->
132
133<screen role="root"><userinput>make MANDIR=/usr/share/man MANSUFFIX=ssl install &amp;&amp;
134install -v -dm755 /usr/share/doc/openssl-&openssl-version; &amp;&amp;
135cp -rfv doc/* /usr/share/doc/openssl-&openssl-version;</userinput></screen>
136
137 </sect2>
138
139 <sect2 role="commands">
140 <title>Command Explanations</title>
141
142 <para>
143 <parameter>shared</parameter>: This parameter forces the creation of
144 shared libraries along with the static libraries.
145 </para>
146
147 <para>
148 <parameter>zlib-dynamic</parameter>: This parameter adds
149 compression/decompression functionality using the
150 <filename class="libraryfile">libz</filename> library.
151 </para>
152
153 <para>
154 <option>no-rc5 no-idea</option>: When added to the
155 <command>./config</command> command, this will eliminate the building
156 of those encryption methods. Patent licenses may be needed for you to
157 utilize either of those methods in your projects.
158 </para>
159
160 <para>
161 <command>make MANDIR=/usr/share/man MANSUFFIX=ssl install</command>:
162 This command installs <application>OpenSSL</application> with the man
163 pages in <filename class="directory">/usr/share/man</filename>
164 instead of <filename class="directory">/etc/ssl/man</filename> and
165 appends "ssl" suffix to the manual page names to avoid conflicts with
166 manual pages installed by other packages.
167 </para>
168
169 </sect2>
170
171 <sect2 role="configuration">
172 <title>Configuring OpenSSL</title>
173
174 <sect3 id="openssl-config">
175 <title>Config Files</title>
176
177 <para>
178 <filename>/etc/ssl/openssl.cnf</filename>
179 </para>
180
181 <indexterm zone="openssl openssl-config">
182 <primary sortas="e-etc-ssl-openssl.cnf">/etc/ssl/openssl.cnf</primary>
183 </indexterm>
184
185 </sect3>
186
187 <sect3>
188 <title>Configuration Information</title>
189
190 <para>
191 Most users will want to install Certificate Authority Certificates
192 for validation of downloaded certificates. For example, these
193 certificates can be used by <xref linkend='git'/>,
194 <xref linkend='curl'/> or <xref linkend='wget'/> when accessing secure
195 (https protocol) sites. To do this, follow the instructions from the
196 <xref linkend='cacerts'/> page.
197 </para>
198
199 <para>
200 Users who just want to use <application>OpenSSL</application> for
201 providing functions to other programs such as
202 <application>OpenSSH</application> and web browsers do not need to worry
203 about additional configuration. This is an advanced topic and so those
204 who do need it would normally be expected to either know how to properly
205 update <filename>/etc/ssl/openssl.cnf</filename> or be able to find out
206 how to do it.
207 </para>
208
209 </sect3>
210
211 </sect2>
212
213 <sect2 role="content">
214 <title>Contents</title>
215
216 <segmentedlist>
217 <segtitle>Installed Programs</segtitle>
218 <segtitle>Installed Libraries</segtitle>
219 <segtitle>Installed Directories</segtitle>
220
221 <seglistitem>
222 <seg>
223 c_rehash
224 and openssl
225 </seg>
226 <seg>
227 libcrypto.{so,a}
228 and libssl.{so,a}
229 </seg>
230 <seg>
231 /etc/ssl,
232 /usr/include/openssl,
233 /usr/lib/engines and
234 /usr/share/doc/openssl-&openssl-version;
235 </seg>
236 </seglistitem>
237 </segmentedlist>
238
239 <variablelist>
240 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
241 <?dbfo list-presentation="list"?>
242 <?dbhtml list-presentation="table"?>
243
244 <varlistentry id="c_rehash">
245 <term><command>c_rehash</command></term>
246 <listitem>
247 <para>
248 is a <application>Perl</application> script that scans all files in
249 a directory and adds symbolic links to their hash values.
250 </para>
251 <indexterm zone="openssl c_rehash">
252 <primary sortas="b-c_rehash">c_rehash</primary>
253 </indexterm>
254 </listitem>
255 </varlistentry>
256
257 <varlistentry id="openssl-prog">
258 <term><command>openssl</command></term>
259 <listitem>
260 <para>
261 is a command-line tool for using the various cryptography functions
262 of <application>OpenSSL</application>'s crypto library from the
263 shell. It can be used for various functions which are documented in
264 <command>man 1 openssl</command>.
265 </para>
266 <indexterm zone="openssl openssl-prog">
267 <primary sortas="b-openssl">openssl</primary>
268 </indexterm>
269 </listitem>
270 </varlistentry>
271
272 <varlistentry id="libcrypto">
273 <term><filename class="libraryfile">libcrypto.{so,a}</filename></term>
274 <listitem>
275 <para>
276 implements a wide range of cryptographic algorithms used in various
277 Internet standards. The services provided by this library are used
278 by the <application>OpenSSL</application> implementations of SSL,
279 TLS and S/MIME, and they have also been used to implement
280 <application>OpenSSH</application>,
281 <application>OpenPGP</application>, and other cryptographic
282 standards.
283 </para>
284 <indexterm zone="openssl libcrypto">
285 <primary sortas="c-libcrypto">libcrypto.{so,a}</primary>
286 </indexterm>
287 </listitem>
288 </varlistentry>
289
290 <varlistentry id="libssl">
291 <term><filename class="libraryfile">libssl.{so,a}</filename></term>
292 <listitem>
293 <para>
294 implements the Secure Sockets Layer (SSL v2/v3) and Transport Layer
295 Security (TLS v1) protocols. It provides a rich API, documentation
296 on which can be found by running <command>man 3 ssl</command>.
297 </para>
298 <indexterm zone="openssl libssl">
299 <primary sortas="c-libssl">libssl.{so,a}</primary>
300 </indexterm>
301 </listitem>
302 </varlistentry>
303
304 </variablelist>
305
306 </sect2>
307
308</sect1>
Note: See TracBrowser for help on using the repository browser.