Security problems due to the heartbleed bug
TL;DR: change ALL your passwords
The CS Departement's CIP-Pool was also affected by the so-called heartbleed bug. The Rechenzentrum has also published some recommendations and comments. Affected server certificates have been swapped out, all software has been updated.
For you, as user, this means: If you are using one of the following services of the CIP-Pool or have been using it at some point since 2011, you have to change the passwords you used:
Redmine and Waffel each have a separate password database, you can reset those passwords
on the respective websites. Your general CIP-Pool password can be reset via kpasswd.
If you have set a separate service password for the aforementioned VPN or mail
services you can reset those passwords via /local/bin/servicepasswd -s vpn
and /local/bin/servicepasswd -s mail respectively. With /local/bin/servicepasswd -l you
can check if you have set service passwords, in case you are unsure.
When in doubt, reset all your passwords.
For the OpenFAUpn service the server certificate has also changed. This means that you need to download the new configuration and the new certificate chain and install them. You need to do this before you use your freshly reset password with the VPN for the first time.
All over the internet, lots and lots of services and websites have been affected. If you have re-used any password on any two websites or services anywhere (which we strongly advise you not to do), you have to reset all those passwords. You should also try to use separate passwords for each service in the future.
When in doubt, just reset all your passwords, and set them all different.
-- Alexander Würstlein