Compile ntp without ssl

ntpopenssl

I need to deploy ntp to a very space-critical pxe-imaging-system. (Yes, each KB matters.) Footprint needs to be as small as possible, so I want to compile ntp without linking openssl. According to the manual this is should be possible:

If available, the OpenSSL library from http://www.openssl.org is used
to support public key cryptography. The library must be built and
installed prior to building NTP. The procedures for doing that are
included in the OpenSSL documentation. The library is found during the
normal NTP configure phase and the interface routines compiled
automatically. Only the libcrypto.a library file and openssl header
files are needed. If the library is not available or disabled, this
step is not required.

I already tried out

./configure --without-openssl

however, this didn't help. This is my ldd output:

ldd ntpd/ntpd
        linux-gate.so.1 =>  (0xb7706000)
        libm.so.6 => /lib/i686/cmov/libm.so.6 (0xb76d5000)
        libcrypto.so.0.9.8 => /usr/lib/i686/cmov/libcrypto.so.0.9.8 (0xb7582000)
        librt.so.1 => /lib/i686/cmov/librt.so.1 (0xb7578000)
        libc.so.6 => /lib/i686/cmov/libc.so.6 (0xb741d000)
        /lib/ld-linux.so.2 (0xb7707000)
        libdl.so.2 => /lib/i686/cmov/libdl.so.2 (0xb7419000)
        libz.so.1 => /usr/lib/libz.so.1 (0xb7404000)
        libpthread.so.0 => /lib/i686/cmov/libpthread.so.0 (0xb73eb000)

The system I am compiling on is 32-bit debian lenny using openssl 0.9.8g-15+lenny16.

What is the correct configure option to compile ntp without openssl?

Best Answer

Works for me:

[me@risby ntp-4.2.6p5]$ ./configure --without-openssl && make

[me@risby ntp-4.2.6p5]$ ldd ntpd/ntpd
    linux-vdso.so.1 =>  (0x00007fffd516c000)
    libm.so.6 => /lib64/libm.so.6 (0x0000003838a00000)
    librt.so.1 => /lib64/librt.so.1 (0x0000003838600000)
    libc.so.6 => /lib64/libc.so.6 (0x0000003837a00000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x0000003837e00000)
    /lib64/ld-linux-x86-64.so.2 (0x0000003837600000)

Can you show us it not working for you? (Don't forget to do a make distclean first.)

Edit: yes, I do have it installed:

[me@risby ntp-4.2.6p5]$ rpm -qa|grep openssl
openssl-1.0.0k-1.fc17.x86_64
openssl-devel-1.0.0k-1.fc17.x86_64

You have told us nothing about your distro (nor even OS, though we know it's Linux from your ldd output). Maybe this is a good time to get a bit more specific?

Related Solutions

Compiling Apache mod_ssl for different target hardware (hardware capability unsupported SSE2 error)

Here are the steps that I have done to successfully build and install the Apache httpd-2.4.10 and OpenSSL openssl-1.0.1j on Solaris 10.

Download following software
openssl-1.0.1j.tar.gz
httpd-2.4.10.tar.gz
apr-1.5.1.tar.gz
apr-util-1.5.4.tar.gz
pcre-8.36.tar.gz
Verify Make and CC
By default gcc is at /usr/sfw/bin/gcc and make is at /usr/ccs/bin/make

Include following in the PATH
usr/local/ssl/bin:/usr/sfw/bin:/usr/local/bin:/usr/ccs/bin

Include following in the LD_LIBRARY_PATH
/usr/local/lib:/usr/local/ssl/lib
Build and install openssl-1.0.1j
Unzip and un-tar openssl-1.0.1j.tar.gz to /usr/local/openssl-1.0.1j
Execute following commands in order. The shared parameter is very important so that it can be linked with httpd-2.4.10 build for SSL enabling.
```
$ cd /usr/local/openssl-1.0.1j
$ ./config shared
$ make
$ make test
$ make install
```
By default it installs openssl at /usr/local/ssl
Install pcre-8.36 Unzip and un-tar pcre-8.36.tar.gz to /usr/local/ pcre-8.36

Execute following commands in order
```
$ cd /usr/local/ pcre-8.36
$ ./configure 
$ make
$ make install
```
By default, make install installs the package's commands under /usr/local/bin, include files under /usr/local/include, etc.
Build and install httpd-2.4.10

Unzip and un-tar httpd-2.4.10.tar.gz to /usr/local/httpd-2.4.10

Unzip and un-tar apr-1.5.1.tar.gz to /usr/local/httpd-2.4.10/srclib
Rename /usr/local/apr-1.5.1 to /usr/local/apr

Unzip and un-tar apr-util-1.5.4.tar.gz to /usr/local/httpd-2.4.10/srclib
Rename /usr/local/apr-util to /usr/local/apr-util

Execute following commands in order
```
$ ./configure --prefix=/usr/local/apache2 --with-included-apr --enable-so –enable-ssl=shared --with-ssl=/usr/local/ssl
$ make
$ make install
```
It installs it at /usr/local/apache2

The installation is complete. To enable SSL and Proxy, update /usr/local/apache2/conf/httpd.conf with uncommentting following lines

LoadModule socache_shmcb_module modules/mod_socache_shmcb.so

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_connect_module modules/mod_proxy_connect.so
LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
LoadModule proxy_scgi_module modules/mod_proxy_scgi.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
LoadModule proxy_express_module modules/mod_proxy_express.so

LoadModule slotmem_shm_module modules/mod_slotmem_shm.so
LoadModule ssl_module modules/mod_ssl.so

Include conf/extra/httpd-ssl.conf

Now you can work on httpd-ssl.conf as you usually do to complete your configuration

SSL Certificate – How to Download SSL Certificate from a Website

In order to download the certificate, you need to use the client built into openssl like so:

echo -n | openssl s_client -connect $HOST:$PORTNUMBER -servername $SERVERNAME \
    | openssl x509 > /tmp/$SERVERNAME.cert

That will save the certificate to /tmp/$SERVERNAME.cert.

The -servername is used to select the correct certificate when multiple are presented, in the case of SNI.

You can use -showcerts if you want to download all the certificates in the chain. But if you just want to download the server certificate, there is no need to specify -showcerts. The x509 at the end will strip out the intermediate certs, you will need to use sed -n '/-----BEGIN/,/-----END/p' instead of the x509 at the end.

echo -n gives a response to the server, so that the connection is released

openssl x509 removes information about the certificate chain and connection details. This is the preferred format to import the certificate into other keystores.

Best Answer

Related Solutions

Compiling Apache mod_ssl for different target hardware (hardware capability unsupported SSE2 error)

SSL Certificate – How to Download SSL Certificate from a Website

Related Topic