X-Git-Url: https://git.exim.org/exim.git/blobdiff_plain/3324ab3f03dc273e0ad6d9c6d91ce78b2ca35e17..refs/heads/pdp/regen-dh-c:/doc/doc-txt/openssl.txt?ds=sidebyside diff --git a/doc/doc-txt/openssl.txt b/doc/doc-txt/openssl.txt index 95ceccc0b..3efa8337f 100644 --- a/doc/doc-txt/openssl.txt +++ b/doc/doc-txt/openssl.txt @@ -28,6 +28,27 @@ Fortunately, this is easy. So this only applies if you build Exim yourself. +Insecure versions and ciphers +----------------------------- + +Email delivery to MX hosts is usually done with automatic fallback to +plaintext if TLS could not be negotiated. There are good historical reasons +for this. You can and should avoid it by using DNSSEC for signing your DNS +and publishing TLSA records, to enable "DANE" security. This signals to +senders that they should be able to verify your certificates, and that they +should not fallback to cleartext. + +In the absence of DANE, trying to increase the security of TLS by removing +support for older generations of ciphers and protocols will actually _lower_ +the security, because the clients fallback to plaintext and retry anyway. As +a result, you should give serious thought to enabling older features which are +no longer default in OpenSSL. + +The examples below explicitly enable ssl3 and weak ciphers. + +We don't like this, but reality doesn't care and is messy. + + Build ----- @@ -36,12 +57,24 @@ Extract the current source of OpenSSL. Change into that directory. This assumes that `/opt/openssl` is not in use. If it is, pick something else. `/opt/exim/openssl` perhaps. +If you pick a location shared amongst various local packages, such as +`/usr/local` on Linux, then the new OpenSSL will be used by all of those +packages. If that's what you want, great! If instead you want to +ensure that only software you explicitly set to use the newer OpenSSL +will try to use the new OpenSSL, then stick to something like +`/opt/openssl`. + ./config --prefix=/opt/openssl --openssldir=/etc/ssl \ -L/opt/openssl/lib -Wl,-R/opt/openssl/lib \ - enable-ssl-trace + enable-ssl-trace shared \ + enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers make make install +On some systems, the linker uses `-rpath` instead of `-R`; on such systems, +replace the parameter starting `-Wl` with: `-Wl,-rpath,/opt/openssl/lib`. +There are more variations on less common systems. + You now have an installed OpenSSL under /opt/openssl which will not be used by any system programs. @@ -49,23 +82,22 @@ When you copy `src/EDITME` to `Local/Makefile` to make your build edits, choose the pkg-config approach in that file, but also tell Exim to add the relevant directory into the rpath stamped into the binary: + PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig + SUPPORT_TLS=yes USE_OPENSSL_PC=openssl - LDFLAGS=-ldl -Wl,-rpath,/opt/openssl/lib + LDFLAGS+=-ldl -Wl,-rpath,/opt/openssl/lib The -ldl is needed by OpenSSL 1.0.2+ on Linux and is not needed on most -other platforms. +other platforms. The LDFLAGS is needed because `pkg-config` doesn't know +how to emit information about RPATH-stamping, but we can still leverage +`pkg-config` for everything else. -Then tell pkg-config how to find the configuration files for your new -OpenSSL install, and build Exim: +Then build Exim: - export PKG_CONFIG_PATH=/opt/openssl/lib/pkgconfig make sudo make install -(From Exim 4.89, you can put that `PKG_CONFIG_PATH` directly into - your `Local/Makefile` file.) - Confirming ---------- @@ -95,6 +127,22 @@ is to run: readelf -d $(which exim) | grep RPATH +It is important to use `RPATH` and not `RUNPATH`! + +The gory details about `RUNPATH` (skip unless interested): +The OpenSSL library might be opened indirectly by some other library +which Exim depends upon. If the executable does have `RUNPATH` then +that will inhibit using either of `RPATH` or `RUNPATH` from the +executable for finding the OpenSSL library when that other library tries +to load it. +In fact, if the intermediate library has a `RUNPATH` stamped into it, +then this will block `RPATH` too, and will create problems with Exim. +If you're in such a situation, and those libraries were supplied to you +instead of built by you, then you're reaching the limits of sane +repairability and it's time to prioritize rebuilding your mail-server +hosts to be a current OS release which natively pulls in an +upstream-supported OpenSSL, or stick to the OS releases of Exim. + Very Advanced -------------