Re: ZEO SSL support and Daft docs

What will the defaults be regarding things like protocol version and cipher
suites? I would suggest not supporting SSL at all, and only supporting TLS.
It seems like ssl.create_default_context()
<https://docs.python.org/2/library/ssl.html#ssl.create_default_context>
disables
SSLv2 and SSLv3, as well as some weak ciphers, but it might make sense to
provide a stricter default for the ciphersuite list, and to disable
compression (to mitigate attacks like CRIME).  Note that Python >= 2.7.9
and Python >= 3.4 is a requirement for a lot of these options in the ssl
module.

A couple of other thoughts:

- Why not verify hostnames by default? Also, why must the hostname be
explicitly specified? Couldn't it default to the hostname used in the
client config? I suppose that would make it inconvenient for development or
people who specify IP addresses.

- What about logging a warning when the client has SSL enabled but is not
verifying server certificates? I guess this is also useful for development,
but would be worried about forgetting to set this up correctly in
production.

- The description for client authentication seems a bit off. Namely the
line "A client must be configured with one of the certificates supplied
using this setting." You're supplying a CA cert that you trust and that the
client certificate must have been signed with. So that sentence is only
(somewhat) true for self-signed certs.

- The certfile can contain the private key, so maybe the key parameter
should be optional?

- What if I don't want to store the private key unencrypted on the machine?
I'm not sure that adding a password option is a great idea, since it would
be have to be in plaintext, but people might load such secrets at runtime
(e.g., from a service like Confidant or Vault). This could be done with a
configuration option for specifying a callable to retrieve the password.

- It seems like clients can be configured to use the system's CA bundle,
but the same is not mentioned in the description for the server's client
cert configuration. Is that intentional?

On Wed, Jun 22, 2016 at 9:02 AM, Jim Fulton <[email protected]> wrote:

> I have a ZEO SSL prototype working.  I'm about to start working on tests
> for it.
>
> I've updated ZEO documentation:
>
> https://github.com/zopefoundation/ZEO/tree/ssl/doc
>
> To include SSL support and also to give it a major rewrite to make it
> more current and hopefully usable.
>
> Also, this documents *new* configuration tags.  The ZODB package
> provides a zeoclient configuration element. This made sense when ZEO
> was part of ZODB, but not so much any more.  ZEO 5 will provide a new
> clientstorage element and require `
>
>   %import ZEO
>
> to use it, because the configuration support is in the ZEO package,
> where it belongs.  As of ZEO 5, the ZODB-provided zeoclient element
> will be deprecated.
>
> I'm not an SSL expert by any means, so comments, especially wrt SSL are
> welcome.
>
> Jim
>
> --
> Jim Fulton
> http://jimfulton.info
>
> --
> You received this message because you are subscribed to the Google Groups
> "zodb" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to [email protected].
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.