Re: Pyro4 and connection authentication

Hi Irmen,

Well, a little background on our use of Pyro: cylc controls
distributed suites of inter-dependent cycling tasks for weather and
climate forecasting applications. A running suite is a Pyro server,
and we have various CLI and GUI clients for monitoring, interacting
with, and controlling suites; and running tasks also communicate
progress to their parent suite via Pyro.  Connection authentication is
important because without it anyone on the network could, in
principle, interfere with suites owned by other users - which would
not be good in an operational forecasting context..  Cylc currently
uses Pyro3 rather minimally as a nice lightweight object oriented RPC
mechanism (with connection authentication).  We once used the Pyro
Nameserver, but now every suite listens on a dedicated port (not that
the nameserver caused any trouble, but forecasters want their critical
operational suites to be entirely independent for maximum robustness),

When I started developing cylc I knew (and still know) next to nothing
about networking, but Pyro allowed me to get the required
client/server functionality working very quickly and easily in spite
of my ignorance :-)

> Is it important to you that Pyro itself provides the feature? (or can you
> move to a different security layer such as SSH)?

I don't think it particularly matters how we get the required
functionality, it's just that Pyro3's built-in connection
authentication seemed to be sufficient for our purposes and was very
easy to use.  Are you able to give any pointers or advice on how to
"move to a different security layer" on top of Pyro?

> What are your experiences with the implementation as it is in Pyro3?

One cylc developer has suggested that an public/private key pair
mechanism might be "more secure" and more familiar to users.  But we
have not seen any problems with the Pyro3 implementation, and given
that the passphrase is apparently never sent unencrypted over the
network I think it is probably secure enough for our purposes.

> Do you think the API should be the same (or at least similar)?

I don't really have a strong opinion on this. If you had good reasons
to change the API it would probably be easy enough for us to adapt.

> Have you looked at the HMAC key that Pyro4 can require for 'authorized'
> connections? How useful (or silly) is that for your situation?

My impression is that this is "less secure" than the Pyro3 connection
authentication as the key goes over the wire unencrypted - is that
right?  If so, it may still be sufficient as an interim measure
(although we would probably just stick with Pyro3 for a while longer).

Hilary


On 26 June 2012 06:34, Irmen de Jong <[email protected]> wrote:
>
>
> On 25 jun 2012, at 03:17, Hilary Oliver wrote:
>
> > Hi Irmen,
> >
> > Firstly, thanks for your excellent work - Pyro3 has served us well for
> > several years now in the cylc suite engine
> > (http://hjoliver.github.com/cylc/).
>
> Great, I am glad you like it and that Pyro has been useful to you!
>
> > Planning for the future, I figure we'll need to upgrade to Pyro4 at some
> > point, but unfortunately the operation of cylc currently depends quite
> > critically on the "connection authentication" mechanism of Pyro3 (or at
> > least it will do, from the upcoming release onward). I note you posted to
> > pyro-core about a year ago that this was on the To Do list for Pyro4.  Is
> > that still the case?
>
> More or less... the To do list is available in the subversion repository
> (TODO.txt). The item is still on that list. However, I wanted to build it
> upon a new way of 'hooking' into the server.
>
> That new hook methodology has never been implemented thus far, and you're
> one of the very few that actually inquires about the authentication feature.
>
> Thus! I would like to ask you a few questions about it :-)
>
> Is it important to you that Pyro itself provides the feature? (or can you
> move to a different security layer such as SSH)?
> What are your experiences with the implementation as it is in Pyro3?
> Do you think the API should be the same (or at least similar)?
> Have you looked at the HMAC key that Pyro4 can require for 'authorized'
> connections? How useful (or silly) is that for your situation?
>
> >  If so, do you have a rough estimate of when this feature might be
> > available in Pyro4?
>
> Sorry, no, but you've sparked my interest again. I may well consider
> implementing it without the 'nice hook mechanism' that I talked about
> earlier, just to make it available in Pyro4.
>
> To be honest, the other uses for the server hook mechanism are obscure at
> best right now.
>
>
> Greetings,
>
> Irmen de Jong
>
>
>
> ------------------------------------------------------------------------------
> Live Security Virtual Conference
> Exclusive live event will cover all the ways today's security and
> threat landscape has changed and how IT managers can respond. Discussions
> will include endpoint security, mobile security and the latest in malware
> threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
> _______________________________________________
> Pyro-core mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/pyro-core

------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and 
threat landscape has changed and how IT managers can respond. Discussions 
will include endpoint security, mobile security and the latest in malware 
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/