Re: ZEO SSL support and Daft docs

OK, based on the comments so far (thanks!), I'm inclined to do the following:

- Use ssl.create_default_context to create SSL contexts.  This seems
to use the most secure settings for the platform.

- Clients verify certs by default, servers don't. This is the default
provided by create_default_context.

- Options to check client certs either by providing certs or by
requiring signed certs.

- No option to disable server cert checking initially.

- Server hostname checking on by default.

- I'll add support for a password-retrieval function.

These are more or less the most restrictive choices and thus seem
safest by default. I have no idea if these are the best choices, but
we can change his later if we want.

Jim

On Wed, Jun 22, 2016 at 12:02 PM, Jim Fulton <[email protected]> wrote:
> I have a ZEO SSL prototype working.  I'm about to start working on tests for it.
>
> I've updated ZEO documentation:
>
> https://github.com/zopefoundation/ZEO/tree/ssl/doc
>
> To include SSL support and also to give it a major rewrite to make it
> more current and hopefully usable.
>
> Also, this documents *new* configuration tags.  The ZODB package
> provides a zeoclient configuration element. This made sense when ZEO
> was part of ZODB, but not so much any more.  ZEO 5 will provide a new
> clientstorage element and require `
>
>   %import ZEO
>
> to use it, because the configuration support is in the ZEO package,
> where it belongs.  As of ZEO 5, the ZODB-provided zeoclient element
> will be deprecated.
>
> I'm not an SSL expert by any means, so comments, especially wrt SSL are welcome.
>
> Jim
>
> --
> Jim Fulton
> http://jimfulton.info



-- 
Jim Fulton
http://jimfulton.info

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.