Hi Tristan,

I am sorry for the delay in approving your post. I did not want to leave it open without a consistent reply and solution.

As you find out, debian wheezy includes a libcrypto and more importantely an openssl library that are a couple of versions ahead of the ones FOP2 expects, so the symlink is not enough.

But as we tried today, having a static linked libcrypto on the fop2 binary worked ok, so I believe that in the next versions that library will be statically linked (after I test it in other platforms and distributions).

And now my opinion: if you want to run Asterisk in production, you might want to use a stable distribution, if you go cutting edge, you might experience some issues that are perhaps not present in a "stable" distribution. Remember that "testing" debian releases do not include security fixes or control, so I would stay away myself from it for a production server.

Best regards,

Hi Tristan,

It is not bad to stay current. Actually, you are really brave! :) If you are testing, then all is well, but if you are going to put that box into production, I would think it twice myself. Mostly because security updates are not handled in a timely manner in any debian testing version.

Lets go back just to Asterisk: If you want to install Asterisk 1.8 it is not hard to do it from sources. If you want to be really cutting edge, you should install Asterisk 10 instead. Installing asterisk from package (either rpm or deb files) will have you exposed to sometimes severe security risks/problems, and more often than not, with an outdated asterisk version. There are perhaps one or two security advisories per month in asterisk itself, but there are no deb or rpm package that updates that quickly. And some of the advisories are serious, that could let your machine exposed to DDOS attacks, an easier target for sip dictionary attacks, etc. VOIP fraud is rising, and it costs a lot of $$$ if you get hit. It will really hurt your bottom line (not like a script kiddie defacing a web site).

There are also a lot of cool addons for Asterisk that requires you to install Asterisk from sources. Many many times I find customer boxes that were installed via rpm, but then "upgraded" via source files and it all becomes quite a mess. That is why *I* prefer distros that compile asterisk from source instead of distros that package it in any way, because the world move faster that package managers.

Your findings were beneficial to FOP2, as it will help get the package ready for the future, and I really appreciate your detailed post and information. But let me express my opinion again: use wheezy in your lab or test setup, but *I* would not put it into production or exposed to the internet.

Tristan,

Do whatever you want, I was just expressing my opinion based on my experience. You do not have to take my word/advice. You seem to be a seasoned linux user and I am sure you can administer wheezy systems and update them on time.

We already worked it out, and fop2 is now working on wheezy when statically linked with libcrypto. The fop2 package is a little larger this way, but it solves the issue when using the latest and greatest openssl and libcrypto libraries. This very same thing can be done on Centos packages to avoid having to create symlinks on Centos 6.

Best regards,