Isilon InsightIQ 4.1.4.x Installation Guide

Upgrade OpenSSL on a system with an internet connection

Upgrade the OpenSSL component for a running InsightIQ 4.1.3.x or InsightIQ 4.1.4.x system to address the security vulnerability: CVE-2021-3712. These steps show how to upgrade OpenSSL to version 1.1.1l on a site with an internet connection.

1. Remove the previously-installed version of OpenSSL. The commands used to uninstall OpenSSL depend on the version you are uninstalling. For example:

   sudo rpm -qa openssl openssl-1.0.2k-l9.el7.x86_64
   
   sudo rpm -e --nodeps "openssl-l.0.2k-19.el7.x86_64"

2. Download the installation files for OpenSSL 1.1.1l or later from https://www.openssl.org/source/, and then transfer them to the InsightIQ host.
3. Install dependencies required to install OpenSSL. The commands may be different for other Linux versions. For example, to update CentOS 7.8 or 7.9:

   sudo yum install -y make gcc perl pcre-devel zlib-devel perl-core

4. Verify the installation file by comparing the MD5 checksum value.

   md5sum openssl-1.1.1l.tar.gz

   For example, for OpenSSL 1.1.1l, the MD5 checksum should be: ac0d4387f3ba0ad741b0580dd45f6ff3.
5. Extract the installer:

   tar -xvf openssl-1.1.1l.tar.gz

6. Compile and install OpenSSL:

   cd openssl-1.1.1l
   
   sudo ./config
   
   sudo make
   
   sudo make install
   
   export LD_LIBRARY_PATH="/usr/local/lib:/usr/local/lib64"
   
   sudo echo "export LD_LIBRARY_PATH=/usr/local/lib:/usr/local/lib64" >> ~/.bashrc

7. Check the version of OpenSSL on your system. The version should now be 1.1.1l or later:

   [root@mk-236 ~]# openssl version
   OpenSSL 1.1.1l 24 Aug 2021

   NOTE If you receive the message: "No such file or directory", you can exit from current running shell, login again, and check again. You may also need to update the PATH environment variable to include the locations: /usr/local/sbin and /usr/local/bin.
8. Optional: Cleanup the installation by removing the installation files:

   cd ..
   
   rm -rf openssl-1.1.1l
   
   rm -rf openssl-1.1.1l.tar.gz