diff options
Diffstat (limited to 'doc/emacs/misc.texi')
| -rw-r--r-- | doc/emacs/misc.texi | 101 |
1 files changed, 76 insertions, 25 deletions
diff --git a/doc/emacs/misc.texi b/doc/emacs/misc.texi index 41a540a7610..13e18f8a71d 100644 --- a/doc/emacs/misc.texi +++ b/doc/emacs/misc.texi @@ -314,7 +314,28 @@ You can decide to register a permanent security exception for an unverified connection, a temporary exception, or refuse the connection entirely. -Below is a list of the checks done on the @code{medium} level. +@vindex network-security-protocol-checks +In addition to the basic certificate correctness checks, several +@acronym{TLS} algorithm checks are available. Some encryption +technologies that were previously thought to be secure have shown +themselves to be fragile, so Emacs (by default) warns you about some +of these problems. + +The protocol network checks is controlled via the +@code{network-security-protocol-checks} variable. + +It's an alist where the first element of each association is the name +of the check, the second element is the security level where the check +should be used, and the optional third element is a parameter supplied +to the check. + +An element like @code{(rc4 medium)} will result in the function +@code{nsm-protocol-check--rc4} being called like thus: +@w{@code{(nsm-protocol-check--rc4 host port status optional-parameter)}}. +The function should return non-@code{nil} if the connection should +proceed and @code{nil} otherwise. + +Below is a list of the checks done on the default @code{medium} level. @table @asis @@ -352,12 +373,44 @@ over these connections. Similarly, if you're sending email via connection to be encrypted. If the connection isn't encrypted, @acronym{NSM} will warn you. +@item Diffie-Hellman low prime bits +When doing the public key exchange, the number of prime bits should be +high enough to ensure that the channel can't be eavesdropped on by third +parties. If this number is too low, Emacs will warn you. (This is the +@code{diffie-hellman-prime-bits} check in +@code{network-security-protocol-checks}). + +@item @acronym{RC4} stream cipher +The @acronym{RC4} stream cipher is believed to be of low quality and +may allow eavesdropping by third parties. (This is the @code{rc4} +check in @code{network-security-protocol-checks}). + +@item @acronym{SHA1} in the host certificate or in intermediate certificates +It is believed that if an intermediate certificate uses the +@acronym{SHA1} hashing algorithm, then third parties can issue +certificates pretending to be that issuing instance. These +connections are therefore vulnerable to man-in-the-middle attacks. +(These are the @code{signature-sha1} and @code{intermediate-sha1} +checks in @code{network-security-protocol-checks}). + +@item @acronym{SSL1}, @acronym{SSL2} and @acronym{SSL3} +The protocols older than @acronym{TLS1.0} are believed to be +vulnerable to a variety of attacks, and you may want to avoid using +these if what you're doing requires higher security. (This is the +@code{ssl} check in @code{network-security-protocol-checks}). + @end table If @code{network-security-level} is @code{high}, the following checks will be made, in addition to the above: @table @asis +@item @acronym{3DES} cipher +The @acronym{3DES} stream cipher provides at most 112 bits of +effective security, which is considered to be towards the low end. +(This is the @code{3des} check in +@code{network-security-protocol-checks}). + @item a validated certificate changes the public key Servers change their keys occasionally, and that is normally nothing to be concerned about. However, if you are worried that your network @@ -365,19 +418,6 @@ connections are being hijacked by agencies who have access to pliable Certificate Authorities which issue new certificates for third-party services, you may want to keep track of these changes. -@item Diffie-Hellman low prime bits -When doing the public key exchange, the number of prime bits -should be high to ensure that the channel can't be eavesdropped on by -third parties. If this number is too low, you will be warned. - -@item @acronym{RC4} stream cipher -The @acronym{RC4} stream cipher is believed to be of low quality and -may allow eavesdropping by third parties. - -@item @acronym{SSL1}, @acronym{SSL2} and @acronym{SSL3} -The protocols older than @acronym{TLS1.0} are believed to be -vulnerable to a variety of attacks, and you may want to avoid using -these if what you're doing requires higher security. @end table Finally, if @code{network-security-level} is @code{paranoid}, you will @@ -402,6 +442,7 @@ This means that one can't casually read the settings file to see what servers the user has connected to. If this variable is @code{t}, @acronym{NSM} will also save host names in the @code{nsm-settings-file}. + @end table @@ -985,8 +1026,8 @@ Move backward across one shell command, but not beyond the current line Ask the shell for its working directory, and update the Shell buffer's default directory. @xref{Directory Tracking}. -@item M-x send-invisible @key{RET} @var{text} @key{RET} -@findex send-invisible +@item M-x comint-send-invisible @key{RET} @var{text} @key{RET} +@findex comint-send-invisible Send @var{text} as input to the shell, after reading it without echoing. This is useful when a shell command runs a program that asks for a password. @@ -1133,7 +1174,7 @@ Fetch the next subsequent command from the history @item C-c . @kindex C-c . @r{(Shell mode)} -@findex comint-input-previous-argument +@findex comint-insert-previous-argument Fetch one argument from an old shell command (@code{comint-input-previous-argument}). @@ -1180,14 +1221,20 @@ you just repeated. Then type @key{RET} to reexecute this command. You can reexecute several successive commands by typing @kbd{C-c C-x @key{RET}} over and over. - The command @kbd{C-c .}@: (@code{comint-input-previous-argument}) + The command @kbd{C-c .}@: (@code{comint-insert-previous-argument}) copies an individual argument from a previous command, like -@kbd{@key{ESC} .} in Bash. The simplest use copies the last argument from the -previous shell command. With a prefix argument @var{n}, it copies the -@var{n}th argument instead. Repeating @kbd{C-c .} copies from an -earlier shell command instead, always using the same value of @var{n} -(don't give a prefix argument when you repeat the @kbd{C-c .} -command). +@kbd{@key{ESC} .}@: in Bash and @command{zsh}. The simplest use +copies the last argument from the previous shell command. With a +prefix argument @var{n}, it copies the @var{n}th argument instead. +Repeating @kbd{C-c .} copies from an earlier shell commands, always +using the same value of @var{n} (don't give a prefix argument when +you repeat the @kbd{C-c .} command). + +@vindex comint-insert-previous-argument-from-end + If you set @code{comint-insert-previous-argument-from-end} to a +non-@code{nil} value, @kbd{C-c .}@: will instead copy the @var{n}th +argument counting from the last one; this emulates @kbd{@key{ESC} .}@: +in @command{zsh}. These commands get the text of previous shell commands from a special history list, not from the shell buffer itself. Thus, editing the shell @@ -1919,6 +1966,10 @@ is given by the variable @code{server-name} on the Emacs server. If this option is omitted, @command{emacsclient} connects to the first server it finds. (This option is not supported on MS-Windows.) +Alternatively, you can set the @env{EMACS_SOCKET_NAME} environment +variable to point to the server socket. (The command-line option +overrides the environment variable.) + @item -t @itemx --tty @itemx -nw @@ -2565,7 +2616,7 @@ e.g., the daemon cannot use GUI features, so parameters such as frame position, size, and decorations cannot be restored. For that reason, you may wish to delay restoring the desktop in daemon mode until the first client connects, by calling @code{desktop-read} in a hook -function that you add to @code{after-make-frame-functions} +function that you add to @code{server-after-make-frame-hook} (@pxref{Creating Frames,,, elisp, The Emacs Lisp Reference Manual}). @node Recursive Edit |