Exim 4.86.2 - SECURITY

DirectAdmin Support · Mar 2, 2016

Hello,

I've added exim 4.86.2 to the versions.txt on files1.
There was a report of an exim security issue: CVE-2016-1531
DirectAdmin server do use the perl_startup, so it's important that everyone update to this latest exim version.

Note it's available now on files1, but other mirrors make take up to 24 hours to sync.

To get it, run:

Code:

cd /usr/local/directadmin/custombuild
./build update
./build exim
./build exim_conf

After exim is comipled and the exim.conf updated, we want to ensure we see this somewhere:

Code:

keep_environment=PWD

so the exim.pl isn't broken.
4.3+ should have it in /etc/exim.variables.conf
4.2 should have it in /etc/exim.conf
2.x will need to add it manually.

Note that I've made a few changes to the tar.gz so that it can compile on older OS's (had to do the same for 4.86):

1)

Code:

--- src/tls-openssl.c.orig      2016-03-02 16:48:38.000000000 -0600
+++ src/tls-openssl.c   2016-03-02 16:50:34.000000000 -0600
@@ -659,15 +659,15 @@
 static BOOL
 init_ecdh(SSL_CTX * sctx, host_item * host)
 {
+#ifdef OPENSSL_NO_ECDH
+return TRUE;
+#else
+
 EC_KEY * ecdh;
 uschar * exp_curve;
 int nid;
 BOOL rv;


-#ifdef OPENSSL_NO_ECDH
-return TRUE;
-#else
-
 if (host)      /* No ECDH setup for clients, only for servers */
   return TRUE;

to prevent the compile error:

Code:

In file included from tls.c:120:
tls-openssl.c: In function 'init_ecdh':
tls-openssl.c:662: error: 'EC_KEY' undeclared (first use in this function)
tls-openssl.c:662: error: (Each undeclared identifier is reported only once
tls-openssl.c:662: error: for each function it appears in.)
tls-openssl.c:662: error: 'ecdh' undeclared (first use in this function)
In file included from tls.c:121:
tlscert-openssl.c: In function 'asn1_time_copy':
tlscert-openssl.c:121: warning: passing argument 2 of 'ASN1_TIME_print' discards qualifiers from pointer target type
make[1]: *** [tls.o] Error 1

2) Plus this patch, just as we did before in 4.86:
http://permalink.gmane.org/gmane.mail.exim.devel/8438
to address delivery segfaults.

3) And lastly, the version was 4.86_2, which was confusing CB and would have broken things in many areas, so I also made this change so it's 4.86.2 without the underscore:

Code:

--- src/version.sh.orig 2016-03-02 22:13:29.000000000 -0600
+++ src/version.sh      2016-03-02 22:11:50.000000000 -0600
@@ -1,4 +1,4 @@
 # initial version automatically generated from release-process/scripts/mk_exim_release.pl
 EXIM_RELEASE_VERSION=4.86
-EXIM_VARIANT_VERSION=_2
+EXIM_VARIANT_VERSION=.2
 EXIM_COMPILE_NUMBER=0

Took a few tries to get it packed correctly, so don't be suprised if you an md5sum error.
Currently: 8e5044092f979d06ecd8f885cde13115

------

Related error message:

Code:

2016-03-03 20:12:09 WARNING: purging the environment.
  Suggested action: use keep_environment and add_environment.

which just means the keep_environment hasn't been added to the /etc/exim.conf or /etc/exim.variables.conf

John

zEitEr · Mar 2, 2016

Hello John,

Thank you for your update, here is an issue with installing exim:

Code:

Exim installation completeMoving exim binary.
ls: cannot access /usr/sbin/exim-4.86.2-*: No such file or directory
mv: missing destination file operand after `/usr/sbin/exim'
Try `mv --help' for more information.
Exim 4.86.2 Installed.
Restarting exim.
Shutting down exim:
Starting exim:

and as a result:

Code:

# ls -al /usr/sbin/exim*
-rwsr-xr-x  1 root root 1172005 Feb 17 18:10 /usr/sbin/exim
-rwsr-xr-x  1 root root 1176541 Mar  3 11:21 /usr/sbin/exim-4.86_2-2

The script looks for /usr/sbin/exim-4.86.2-* but it is /usr/sbin/exim-4.86_2-*

ViAdCk · Mar 3, 2016

After updating on one server I see the following in the log:

2016-03-03 09:16:15 WARNING: purging the environment.
Suggested action: use keep_environment and add_environment.

But mail appears to work correctly though.

DirectAdmin Support · Mar 3, 2016

@zEiEr: I did take a few tries, so I'm guessing you've got an older tar.gz.
Double check the md5sum .. or just set options.conf to files1 for now.

LawsHosting · Mar 3, 2016

ViAdCk said:
2016-03-03 09:16:15 WARNING: purging the environment.
Suggested action: use keep_environment and add_environment.

I see this too..... Is this a conf setting or compile setting?

keep_environment should contain a list of trusted environment variables.
(Do you trust PATH?). This may be a list of names and REs.

keep_environment = ^LDAP_ : FOO_PATH

To add (or override) variables, you can use add_environment:

add_environment = <; PATH=/sbin:/usr/sbin

ditto · Mar 3, 2016

Peter Laws said:
I see this too..... Is this a conf setting or compile setting?

From: https://lists.exim.org/lurker/message/20160302.195554.d8f9b6f7.en.html

Code:

New options 
----------- 

We had to introduce two new configuration options: 

    keep_environment =
    add_environment =


Both options are empty per default. That is, Exim cleans the complete 
environment on startup. This affects Exim itself and any subprocesses, 
as transports, that may call other programs via some alias mechanisms, 
as routers (queryprogram), lookups, and so on. This may affect used 
libraries (e.g. LDAP). 

** THIS MAY BREAK your existing installation ** 

[B]If both options are not used in the configuration, Exim issues a warning 
on startup. This warning disappears if at least one of these options is 
used (even if set to an empty value). [/B]

keep_environment should contain a list of trusted environment variables. 
(Do you trust PATH?). This may be a list of names and REs. 

    keep_environment = ^LDAP_ : FOO_PATH


To add (or override) variables, you can use add_environment: 

    add_environment = <; PATH=/sbin:/usr/sbin

zEitEr · Mar 3, 2016

@John,

Code:

./build clean

with the following:

Code:

./build update
./build exim

fixed the issue.

@ViAdCk,

Read the link https://lists.exim.org/lurker/message/20160302.195554.d8f9b6f7.en.html provided by John to learn on why this happens, to fix it you can run this:

For exim.conf 4.3/4.4:

Code:

echo "keep_environment=PWD" >> /etc/exim.variables.conf.custom
cd /usr/local/directadmin/custombuild
./build update
./build set eximconf yes
./build exim_conf

LawsHosting · Mar 3, 2016

Ok, well, I added them blank to /etc/exim.variables.conf.custom but still get warnings

Note:

Adding them to /etc/exim.variables.conf worked! Why isn't my custom being read?

Ok, I understand.... Just woke up..

zEitEr · Mar 3, 2016

/etc/exim.variables.conf.custom is not included into exim configuration.
Run custombuild script to build a new configuration based on /etc/exim.variables.conf.custom

ViAdCk · Mar 3, 2016

For exim.conf 4.3/4.4:

Code:

echo "keep_environment=" >> /etc/exim.variables.conf.custom
cd /usr/local/directadmin/custombuild
./build update
./build set eximconf yes
./build exim_conf

This server is running centos5 and an older exim.conf file (SpamBlocker.exim.conf.2.1.1-release). Any idea if this is going to work?

zEitEr · Mar 3, 2016

Manually insert the line

Code:

keep_environment=PWD

somewhere in the top part of /etc/exim.conf and restart exim, for example after the line:

Code:

perl_startup = do '/etc/exim.pl'

Erulezz · Mar 3, 2016

Upgrade for Exim went without any problems on files6.

@zEitEr thanks, i don't see any warnings anymore with exim.variables.conf.custom. However can this be added to the default exim.conf with a new version?

zEitEr · Mar 3, 2016

That's up to John to ad into default exim.conf. I'm sure they will add it as soon as they test it enough long.

DirectAdmin Support · Mar 3, 2016

Hi guys,

I've done some testing, and we need PWD in the env or else the exim.pl can't see the PWD (path) which is used by many of the SB/BC/ESF features, so I've updated all SpamBlockers 4+ versions to have it, either in the exim.conf (4.2.5) or the exim.variables.conf.default (4.3 & 4.4).

CB2 would need a ./build update, in the event you are updating the exim_conf, but are using an exim version older than 4.86.2, or else the keep_environment=PWD will break the setup as it's not a backwards compatible variable for 4.86.0.

The default exim.conf 2.2 with new installs does not have it, as the pre-compiled exim binaries are typically a bit oldler, so a post-install exim compile and ./build exim_conf would be recommended. We may address this policy (possibly updating the default binaries where applicable).

The changes were a bit messy, as there are several versions/scenarios I had to take into account, so please let me know if I've missed anything

If everything worked correctly (and you have exim 4.86.2 and SB 4.3 or 4.4), you should see the keep_environment=PWD in the /etc/exim.conf.variables.conf after all is done.
If your exim is older, you shouldn't see it anywhere.
For SB4.2.5, it should be in /etc/exim.conf under #EDIT#20

John

Remco00 · Mar 4, 2016

Thanks, updating exim.conf with CB2.0 from 4.4.1 to 4.4.2 went fine and keep_environment=PWD is now in exim.variables.conf. Warning messages in log are gone.

Fred. · Mar 4, 2016

I also had some warnings when I ran the update this morning. But everything seems to work.

Code:

[root@server01 custombuild]# ./build update_versions
Updating Exim
Found /usr/local/directadmin/custombuild/exim-4.86.2.tar.gz
Extracting ...
Done.
--2016-03-04 07:07:39--  http://files6.directadmin.com/services/custombuild/Makefile
Resolving files6.directadmin.com (files6.directadmin.com)... 62.148.181.110, 2001:16e8:1:4:62:148:181:110
Connecting to files6.directadmin.com (files6.directadmin.com)|62.148.181.110|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 48603 (47K) [text/plain]
Saving to: 'Local/Makefile'

100%[======================================>] 48,603      --.-K/s   in 0.009s  

2016-03-04 07:07:39 (5.12 MB/s) - 'Local/Makefile' saved [48603/48603]

Trying to make exim...
/bin/sh scripts/source_checks

>>> Creating links to source files...
>>> Creating lookups/Makefile for building dynamic modules
>>> New Makefile & lookups/Makefile installed
>>> Use "make makefile" if you need to force rebuilding of the makefile
 
make[1]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'
/bin/sh ../scripts/Configure-os.c
gcc buildconfig.c
/bin/sh ../scripts/Configure-config.h "make"
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'
make[2]: `buildconfig' is up to date.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'
Building configuration file config.h
>>> config.h built

>>> version 4.86.2 #1

>>> exicyclog script built
>>> exinext script built
>>> exiwhat script built
>>> exigrep script built
>>> eximstats script built
>>> exipick script built
>>> exiqgrep script built
>>> exiqsumm script built
>>> transport-filter.pl script built
>>> convert4r3 script built
>>> convert4r4 script built
>>> exim_checkaccess script built

/bin/sh ../scripts/Configure-os.h
gcc exim_dbmbuild.c
gcc -o exim_dbmbuild
>>> exim_dbmbuild utility built
 
gcc -DEXIM_DUMPDB exim_dbutil.c
gcc -DCOMPILE_UTILITY os.c
gcc -DCOMPILE_UTILITY store.c
gcc -o exim_dumpdb
>>> exim_dumpdb utility built
 
gcc -DEXIM_FIXDB exim_dbutil.c
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/auths'
gcc auth-spa.c
gcc b64decode.c
gcc b64encode.c
gcc call_pam.c
gcc call_pwcheck.c
gcc call_radius.c
gcc check_serv_cond.c
gcc cram_md5.c
gcc cyrus_sasl.c
gcc dovecot.c
gcc get_data.c
gcc get_no64_data.c
gcc gsasl_exim.c
gcc heimdal_gssapi.c
gcc md5.c
gcc plaintext.c
gcc pwcheck.c
gcc sha1.c
gcc spa.c
gcc tls.c
gcc xtextdecode.c
gcc xtextencode.c
ar cq auths.a
ranlib auths.a
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/auths'
 
gcc -o exim_fixdb
>>> exim_fixdb utility built
 
gcc -DEXIM_TIDYDB exim_dbutil.c
gcc -o exim_tidydb
>>> exim_tidydb utility built
 
gcc exim_lock.c
gcc -o exim_lock
>>> exim_lock utility built
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/lookups'
gcc cdb.c
gcc dbmdb.c
gcc dnsdb.c
gcc lsearch.c
gcc spf.c
ar cq lookups.a
ranlib lookups.a
gcc lf_quote.c
gcc lf_check_file.c
gcc lf_sqlperform.c
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/lookups'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/pdkim'
gcc base64.c
gcc bignum.c
gcc pdkim.c
gcc rsa.c
gcc sha1.c
gcc sha2.c
ar cq pdkim.a
ranlib pdkim.a
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/pdkim'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/routers'
gcc accept.c
gcc dnslookup.c
gcc ipliteral.c
gcc iplookup.c
gcc manualroute.c
gcc queryprogram.c
gcc redirect.c
gcc rf_change_domain.c
gcc rf_expand_data.c
gcc rf_get_errors_address.c
gcc rf_get_munge_headers.c
gcc rf_get_transport.c
gcc rf_get_ugid.c
gcc rf_lookup_hostlist.c
gcc rf_queue_add.c
gcc rf_self_action.c
gcc rf_set_ugid.c
ar cq routers.a
ranlib routers.a
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/routers'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/transports'
gcc appendfile.c
gcc autoreply.c
gcc lmtp.c
gcc pipe.c
gcc smtp.c
gcc smtp_socks.c
gcc tf_maildir.c
ar cq transports.a
ranlib transports.a
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/transports'
 
gcc acl.c
acl.c: In function 'acl_check_condition':
acl.c:3535:7: warning: passing argument 1 of 'demime' from incompatible pointer type [enabled by default]
       rc = demime(&arg);
       ^
In file included from exim.h:493:0,
                 from acl.c:10:
functions.h:141:16: note: expected 'uschar **' but argument is of type 'const uschar **'
 extern int     demime(uschar **);
                ^
gcc child.c
gcc crypt16.c
gcc daemon.c
gcc dbfn.c
gcc debug.c
gcc deliver.c
gcc directory.c
gcc dns.c
gcc drtables.c
gcc enq.c
gcc exim.c
exim.c: In function 'main':
exim.c:2249:14: warning: passing argument 1 of 'string_nextinlist' from incompatible pointer type [enabled by default]
              big_buffer_size)) != NULL)
              ^
In file included from exim.h:493:0,
                 from exim.c:13:
functions.h:426:16: note: expected 'const uschar **' but argument is of type 'uschar **'
 extern uschar *string_nextinlist(const uschar **, int *, uschar *, int);
                ^
gcc expand.c
gcc filter.c
gcc filtertest.c
gcc globals.c
gcc dkim.c
gcc header.c
gcc host.c
gcc ip.c
gcc log.c
gcc lss.c
gcc match.c
gcc moan.c
gcc os.c
gcc parse.c
gcc queue.c
gcc rda.c
gcc readconf.c
gcc receive.c
gcc retry.c
gcc rewrite.c
gcc rfc2047.c
gcc route.c
gcc search.c
gcc sieve.c
gcc smtp_in.c
gcc smtp_out.c
gcc spool_in.c
gcc spool_out.c
gcc std-crypto.c
gcc store.c
gcc string.c
gcc tls.c
gcc tod.c
gcc transport.c
gcc tree.c
gcc verify.c
gcc environment.c
gcc lookups/lf_quote.c
gcc lookups/lf_check_file.c
gcc lookups/lf_sqlperform.c
gcc local_scan.c
gcc perl.c
gcc malware.c
gcc mime.c
gcc regex.c
gcc spam.c
gcc spool_mbox.c
gcc demime.c
demime.c: In function 'demime':
demime.c:34:35: warning: passing argument 1 of 'string_nextinlist' from incompatible pointer type [enabled by default]
                                   sizeof(option_buffer))) != NULL) {
                                   ^
In file included from exim.h:493:0,
                 from demime.c:10:
functions.h:426:16: note: expected 'const uschar **' but argument is of type 'uschar **'
 extern uschar *string_nextinlist(const uschar **, int *, uschar *, int);
                ^
demime.c:97:32: warning: passing argument 1 of 'string_nextinlist' from incompatible pointer type [enabled by default]
                                sizeof(option_buffer));
                                ^
In file included from exim.h:493:0,
                 from demime.c:10:
functions.h:426:16: note: expected 'const uschar **' but argument is of type 'uschar **'
 extern uschar *string_nextinlist(const uschar **, int *, uschar *, int);
                ^
gcc bmi_spam.c
gcc dane.c
gcc dcc.c
gcc dmarc.c
gcc imap_utf7.c
gcc spf.c
gcc srs.c
gcc utf8.c
gcc version.c
gcc -o exim
 
>>> exim binary built
 
make[1]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'
Make Complete
Installing exim...
/bin/sh scripts/source_checks
`Makefile' is up to date.
 
make[1]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'
>>> version 4.86.2 #2

>>> exicyclog script built
>>> exinext script built
>>> exiwhat script built
>>> exim_checkaccess script built

make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/auths'
make[2]: `auths.a' is up to date.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/auths'
 
gcc -o exim_fixdb
>>> exim_fixdb utility built
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/lookups'
make[2]: Nothing to be done for `all'.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/lookups'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/pdkim'
make[2]: `pdkim.a' is up to date.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/pdkim'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/routers'
make[2]: `routers.a' is up to date.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/routers'
 
make[2]: Entering directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/transports'
make[2]: `transports.a' is up to date.
make[2]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64/transports'
 
gcc lookups/lf_quote.c
gcc lookups/lf_check_file.c
gcc lookups/lf_sqlperform.c
gcc local_scan.c
gcc version.c
gcc -o exim
 
>>> exim binary built
 
make[1]: Leaving directory `/usr/local/directadmin/custombuild/exim-4.86.2/build-Linux-x86_64'

Installation directory is /usr/sbin

cp exim /usr/sbin/exim-4.86.2-2
/bin/chown root /usr/sbin/exim-4.86.2-2
chmod a+x /usr/sbin/exim-4.86.2-2
chmod u+s /usr/sbin/exim-4.86.2-2
creation of symlink omitted
(NO_SYMLINK is specified in Local/Makefile)
cp /usr/sbin/exim_dumpdb /usr/sbin/exim_dumpdb.O
cp exim_dumpdb /usr/sbin
cp /usr/sbin/exim_fixdb /usr/sbin/exim_fixdb.O
cp exim_fixdb /usr/sbin
cp /usr/sbin/exim_tidydb /usr/sbin/exim_tidydb.O
cp exim_tidydb /usr/sbin
cp /usr/sbin/exinext /usr/sbin/exinext.O
cp exinext /usr/sbin
cp /usr/sbin/exiwhat /usr/sbin/exiwhat.O
cp exiwhat /usr/sbin
cp /usr/sbin/exim_dbmbuild /usr/sbin/exim_dbmbuild.O
cp exim_dbmbuild /usr/sbin
cp /usr/sbin/exicyclog /usr/sbin/exicyclog.O
cp exicyclog /usr/sbin
cp /usr/sbin/exigrep /usr/sbin/exigrep.O
cp exigrep /usr/sbin
cp /usr/sbin/eximstats /usr/sbin/eximstats.O
cp eximstats /usr/sbin
cp /usr/sbin/exipick /usr/sbin/exipick.O
cp exipick /usr/sbin
cp /usr/sbin/exiqgrep /usr/sbin/exiqgrep.O
cp exiqgrep /usr/sbin
cp /usr/sbin/exiqsumm /usr/sbin/exiqsumm.O
cp exiqsumm /usr/sbin
cp /usr/sbin/exim_lock /usr/sbin/exim_lock.O
cp exim_lock /usr/sbin
cp /usr/sbin/exim_checkaccess /usr/sbin/exim_checkaccess.O
cp exim_checkaccess /usr/sbin

Configuration file /etc/exim.conf already exists

Exim installation complete
Moving exim binary.
Enabling exim in systemd...
Exim 4.86.2 Installed.
Restarting exim.
[root@server01 custombuild]#

nielsh · Mar 4, 2016

By default /usr/local/directadmin/custombuild/options.conf has eximconf=no and eximconf 2.1.1 - wouldn't it be good to have things working / secure with the default settings? As currently this requires manual changes in the exim.conf, that means even people with a new setup will have to fix stuff manually afterwards, right?

rancidio · Mar 4, 2016

DirectAdmin Support said:
Hi guys,

I've done some testing, and we need PWD in the env or else the exim.pl can't see the PWD (path) which is used by many of the SB/BC/ESF features, so I've updated all SpamBlockers 4+ versions to have it, either in the exim.conf (4.2.5) or the exim.variables.conf.default (4.3 & 4.4).

CB2 would need a ./build update, in the event you are updating the exim_conf, but are using an exim version older than 4.86.2, or else the keep_environment=PWD will break the setup as it's not a backwards compatible variable for 4.86.0.

The default exim.conf 2.2 with new installs does not have it, as the pre-compiled exim binaries are typically a bit oldler, so a post-install exim compile and ./build exim_conf would be recommended. We may address this policy (possibly updating the default binaries where applicable).

The changes were a bit messy, as there are several versions/scenarios I had to take into account, so please let me know if I've missed anything
If everything worked correctly (and you have exim 4.86.2 and SB 4.3 or 4.4), you should see the keep_environment=PWD in the /etc/exim.conf.variables.conf after all is done.
If your exim is older, you shouldn't see it anywhere.
For SB4.2.5, it should be in /etc/exim.conf under #EDIT#20

John

if i have SB 2.1.1 is it necessary add manually keep_environment=PWD in exim.conf?

Thanks
regards

ju5t · Mar 5, 2016

DirectAdmin Support said:
After exim is comipled and the exim.conf updated, we want to ensure we see this somewhere:

Code:

keep_environment=PWD

so the exim.pl isn't broken.
4.3+ should have it in /etc/exim.variables.conf
4.2 should have it in /etc/exim.conf
2.x will need to add it manually.

Why did you decide not to update the configuration for 2.x users?

I wrote a simple Ansible playbook (ref: https://gist.github.com/ju5t/62aca37fbb92b2908966) to update all servers at once, but as nielsh said this doesn't solve it for new installations.

bobsthename · Mar 6, 2016

I have updated but 2 servers wont start exim with the errors in panic.log:-
main option "srs_config" unknown
2016-03-06 10:45:01 Exim configuration error in line 1 of /etc/exim.srs.conf:
main option "srs_config" unknown

Exim 4.86.2 - SECURITY

Administrator

Super Moderator

Verified User

Administrator

Verified User

Verified User

Super Moderator

Verified User

Super Moderator

Verified User

Super Moderator

Verified User

Super Moderator

Administrator

Verified User

Verified User

Verified User

Verified User

Verified User

Verified User