Regard command-line recipients as tainted

[exim.git] / doc / doc-txt / openssl.txt

diff --git a/doc/doc-txt/openssl.txt b/doc/doc-txt/openssl.txt
index 5d3da04b042ccf09325ecb1fcb9542e697f0e3e7..3efa8337f4784e7d2c42a9f42553d869f5183998 100644 (file)
--- a/doc/doc-txt/openssl.txt
+++ b/doc/doc-txt/openssl.txt
@@ -28,6 +28,27 @@ Fortunately, this is easy.
 So this only applies if you build Exim yourself.
 
 
 So this only applies if you build Exim yourself.
 
 

+Insecure versions and ciphers
+-----------------------------
+
+Email delivery to MX hosts is usually done with automatic fallback to
+plaintext if TLS could not be negotiated.  There are good historical reasons
+for this.  You can and should avoid it by using DNSSEC for signing your DNS
+and publishing TLSA records, to enable "DANE" security.  This signals to
+senders that they should be able to verify your certificates, and that they
+should not fallback to cleartext.
+
+In the absence of DANE, trying to increase the security of TLS by removing
+support for older generations of ciphers and protocols will actually _lower_
+the security, because the clients fallback to plaintext and retry anyway.  As
+a result, you should give serious thought to enabling older features which are
+no longer default in OpenSSL.
+
+The examples below explicitly enable ssl3 and weak ciphers.
+
+We don't like this, but reality doesn't care and is messy.
+
+

 Build
 -----
 
 Build
 -----
 


@@ -36,12 +57,24 @@ Extract the current source of OpenSSL.  Change into that directory.
 This assumes that `/opt/openssl` is not in use.  If it is, pick
 something else.  `/opt/exim/openssl` perhaps.
 
 This assumes that `/opt/openssl` is not in use.  If it is, pick
 something else.  `/opt/exim/openssl` perhaps.
 

+If you pick a location shared amongst various local packages, such as
+`/usr/local` on Linux, then the new OpenSSL will be used by all of those
+packages.  If that's what you want, great!  If instead you want to
+ensure that only software you explicitly set to use the newer OpenSSL
+will try to use the new OpenSSL, then stick to something like
+`/opt/openssl`.
+

     ./config --prefix=/opt/openssl --openssldir=/etc/ssl  \
         -L/opt/openssl/lib -Wl,-R/opt/openssl/lib         \
     ./config --prefix=/opt/openssl --openssldir=/etc/ssl  \
         -L/opt/openssl/lib -Wl,-R/opt/openssl/lib         \

-        enable-ssl-trace
+        enable-ssl-trace shared                           \
+        enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers

     make
     make install
 
     make
     make install
 

+On some systems, the linker uses `-rpath` instead of `-R`; on such systems,
+replace the parameter starting `-Wl` with: `-Wl,-rpath,/opt/openssl/lib`.
+There are more variations on less common systems.
+

 You now have an installed OpenSSL under /opt/openssl which will not be
 used by any system programs.
 
 You now have an installed OpenSSL under /opt/openssl which will not be
 used by any system programs.
 


@@ -49,23 +82,22 @@ When you copy `src/EDITME` to `Local/Makefile` to make your build edits,
 choose the pkg-config approach in that file, but also tell Exim to add
 the relevant directory into the rpath stamped into the binary:
 
 choose the pkg-config approach in that file, but also tell Exim to add
 the relevant directory into the rpath stamped into the binary:
 

+    PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig
+

     SUPPORT_TLS=yes
     USE_OPENSSL_PC=openssl
     SUPPORT_TLS=yes
     USE_OPENSSL_PC=openssl

-    EXTRALIBS_EXIM=-ldl -Wl,-rpath,/opt/openssl/lib
+    LDFLAGS+=-ldl -Wl,-rpath,/opt/openssl/lib

 
 

-The -ldl is needed by OpenSSL 1.1+ on Linux and is not needed on most
-other platforms.
+The -ldl is needed by OpenSSL 1.0.2+ on Linux and is not needed on most
+other platforms.  The LDFLAGS is needed because `pkg-config` doesn't know
+how to emit information about RPATH-stamping, but we can still leverage
+`pkg-config` for everything else.

 
 

-Then tell pkg-config how to find the configuration files for your new
-OpenSSL install, and build Exim:
+Then build Exim:

 
 

-    export PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig

     make
     sudo make install
 
     make
     sudo make install
 

-(From Exim 4.89, you can put that `PKG_CONFIG_PATH` directly into
- your `Local/Makefile` file.)
-

 
 Confirming
 ----------
 
 Confirming
 ----------


@@ -95,6 +127,22 @@ is to run:
 
     readelf -d $(which exim) | grep RPATH
 
 
     readelf -d $(which exim) | grep RPATH
 

+It is important to use `RPATH` and not `RUNPATH`!
+
+The gory details about `RUNPATH` (skip unless interested):
+The OpenSSL library might be opened indirectly by some other library
+which Exim depends upon.  If the executable does have `RUNPATH` then
+that will inhibit using either of `RPATH` or `RUNPATH` from the
+executable for finding the OpenSSL library when that other library tries
+to load it.
+In fact, if the intermediate library has a `RUNPATH` stamped into it,
+then this will block `RPATH` too, and will create problems with Exim.
+If you're in such a situation, and those libraries were supplied to you
+instead of built by you, then you're reaching the limits of sane
+repairability and it's time to prioritize rebuilding your mail-server
+hosts to be a current OS release which natively pulls in an
+upstream-supported OpenSSL, or stick to the OS releases of Exim.
+

 
 Very Advanced
 -------------
 
 Very Advanced
 -------------