5

Folks,

I have been using Raspbian's native SFTP capabilities over the internet to access my files remotely. Just wondering if hearbleed has any bearing on SFTP. If it is affected then I'd like to know how to revoke certificates/keys and re-issue new ones.

Additional Info 1: I have already patched OpenSSL on my pi.

Additional Info 2: I do not use FTPS(over SSL/TLS) nor HTTPS on the pi.

Thanks!

  • The heartbleed bug is actually broader than just the keys. Any and all information stored in the system's memory might have been compromised, not limited to the keys. I will get a read on SFTP and post an answer, but in the meantime I suggest you read the Wikipedia entry on heartbleed to understand the full scope of the bug. – Marco Poli Apr 12 '14 at 17:43
4

SFTP and other SSH-based protocols are not affected by the Heartbleed bug.

So if you don't have other SSL services running (a https server for example), you are not affected by this bug.

Do take notice that if you use FTP over SSL/TLS (and that's different from SFTP), then you were most likely affected by the bug and might have had information compromised.

Please check this question to see what services are likely to have been affected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.