gnutls-cli or any other Linux tool to verify TLS version

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Must we install the package gnutls-utils or just download
the gnutls-cli binary & it will run?

Any other tool with similar function that doesn't require
installation (just like putty)? Even a Windows freeware
is fine

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Could point me to URLs/links that have gnutls-cli binary
for RHES 5.8, 5.9, 6.1 ?

ASKER

I mean standalone binary that doesn't need installation:
gnutls-cli (for Linux) or gnutls-cli.exe (for Windows)

ASKER CERTIFIED SOLUTION

skullnobrains

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

>why the hell don't you actually install that rpm ?
To install an rpm is a change & will require an approved CR.
Just running the binary that's copied to the server is not a
change.

I just googled & found that cygwin has this tool built into it
but I'll need to install cygwin on a laptop (or non-critical
server)

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

skullnobrains

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

come on you can install oracle linux or centos in vrtualbox or vmware or virtual pc, and extract 1:1 gnutls-cli from their RPMs.
I'd say it is better to ask admin to extract the binary you need in your directory (or at least they will handle your request for new software)

ASKER

Ok, thanks got your point now.

Just to sidetrack, how do I detect if I have a vulnerable OpenSSL
for the bugnote below. What's the openssl command that I can
execute to detect/verify this?

Google Security's Neel Mehta and 3 researchers from security vendor Codenomicon,
explains that the Heartbleed vulnerability could expose some of the most sensitive
data transmitted over the Internet, including the secret keys used for X.509 certificates,
usernames and passwords, emails and instant messages, and any other
communications supposedly protected by an OpenSSL implementation.

"This bug has left [a] large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation, and attacks leaving no trace, this exposure should be taken seriously."

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

skullnobrains

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Gee, thanks a lot guys.

We have Solaris x86 that run OpenSSL 0.97.x : is this affected?
The official vulnerability site did not indicate if this is affected.

no, it does not implement any TLS version
SSLv3 has its own dragons

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION