+ -- Ian Jackson <ian@davenant.greenend.org.uk> Wed, 9 Aug 2000 16:59:28 +0100

[adns.git] / INSTALL

diff --git a/INSTALL b/INSTALL
index 2b3338f483ebfc5fb52d918af6bcaafe535da2b6..5c9961a9ee39a0095a3090f1f8d417b190e7bf0c 100644 (file)
--- a/INSTALL
+++ b/INSTALL
@@ -1,5 +1,8 @@
 INSTALLATION INSTRUCTIONS for ADNS
 
+1. Read the security note below.
+
+2. Standard GNU package build process:
    $ ./configure
    $ make
    # make install
@@ -14,9 +17,9 @@ system.
 In particular, the build system assumes that you have ELF shared
 libraries.  If you don't then please don't send me patches to support
 your kind of shared libraries, and don't send me patches to use
-libtool.  I'm not interested in supporting non-ELF shared libraries.
-However, if you send me an appropriate patch I'd be willing to make it
-easy or automatic to disable the ELF shared library arrangements.
+libtool.  I'm not interested in supporting non-ELF shared libraries,
+and I dislike libtool.  If you do not have ELF shared libraries then
+please use the --disable-shared configure option.
 
 The adnsresfilter utility uses `tsearch' from the C library (a la SVID
 and X/Open).  If your C library doesn't have tsearch you will find
@@ -29,10 +32,32 @@ perform badly.
 You will probably find that GNU Make is required.
 
 
+SECURITY AND PERFORMANCE - AN IMPORTANT NOTE
+
+adns is not a full-service resolver.  It does no caching of responses
+at all, and has no defence against bad nameservers or fake packets
+which appear to come from your real nameservers.  It relies on the
+full-service resolvers listed in resolv.conf to handle these tasks.
+
+For secure and reasonable operation you MUST run a full-service
+nameserver on the same system as your adns applications, or on the
+same local, fully trusted network.  You MUST only list such
+nameservers in the adns configuration (eg resolv.conf).
+
+You MUST use a firewall or other means to block packets which appear
+to come from these nameservers, but which were actually sent by other,
+untrusted, entities.
+
+Furthermore, adns is not DNSSEC-aware in this version; it doesn't
+understand even how to ask a DNSSEC-aware nameserver to perform the
+DNSSEC cryptographic signature checking.
+
+
 COPYRIGHT
 
 This file, INSTALL, contains installation instructions and other
-details for adns.
+details for adns.  It is
+ Copyright (C) 1997-2000 Ian Jackson <ian@davenant.greenend.org.uk>
 
 adns is
  Copyright (C) 1997-2000 Ian Jackson <ian@davenant.greenend.org.uk>
@@ -50,7 +75,7 @@ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 General Public License for more details.
 
 You should have received a copy of the GNU General Public License
-along with userv as the file COPYING; if not, email me at the address
+along with adns as the file COPYING; if not, email me at the address
 above or write to the Free Software Foundation, 59 Temple Place -
 Suite 330, Boston, MA 02111-1307, USA.