[Pkg-exim4-users] Downgrading or removing TLS due to lack of entropy

[Sven Hartge]

Um 15:43 Uhr am 19.01.06 schrieb Marc Haber:

> Additionally, the latest exim4 packages (starting with 4.60-3) allow 
> optionally build with openssl instead of GnuTLS. If you have the 
> possiblity to re-build exim4 locally, this may be an option. I would 
> also be interested in learning whether this actually works better than 
> GnuTLS.

I have been hit by the entropy problem as well, but it was really bad, 
since only some encrypted mails caused a major DoS on my server, since the 
entropie pool was depleted so fast (in fact, just _one_ mail was needed 
for the pool to go from 3500 to about 120), the kernel was not able to 
refill it fast enough.

After recompiling exim with OpenSSL, this problem went away.

So in my opinion, the is definitely something wrong with gnutls as it uses 
_way_ to much entropie from the pool as compared to openssl.

Grüße,
Sven.

-- 
Sven Hartge -- professioneller Unix-Geek
Meine Gedanken im Netz: http://www.svenhartge.de/

Achtung, neue Mail-Adresse: sven at svenhartge.de