Re: Re: ZEO SSL support and Daft docs

On Thu, Jun 23, 2016 at 11:11 AM, Julien Muchembled <[email protected]> wrote:
> In NEO but it applies also to ZEO, client nodes (like zopes) have the potential to do enough damage so other nodes have to trust them.
> Which means we treat a NEO cluster as _single_ application, that consists of master/storage/admin nodes but also client nodes.
> And from SSL point of view, all nodes are equal in NEO: there's no only-client or only-server auth.
>
> ssl.create_default_context didn't really fit for us. We somehow copied and pasted, with the following changes:
> - OP_CIPHER_SERVER_PREFERENCE and _RESTRICTED_SERVER_CIPHERS like CLIENT_AUTH
> - verify_mode = CERT_REQUIRED like SERVER_AUTH
> - no check_hostname
>
> We also enable VERIFY_X509_STRICT and CRL check if there's one.
>
> All nodes must be configured with a ca, cert and key. System certs ignored.
>
> About the TLS version, we force the use of the maximum TLS version supported by the platform, to ensure all nodes use the same as expected when setting up them (IOW, no downgrade). So NEO is usable with TLS 1.0, but it won't mix TLS 1.0 & TLS 1.2.
>
> The resulting code is quite small:
>   https://lab.nexedi.com/nexedi/neoppod/blob/master/neo/lib/app.py

This makes a lot of sense to me in the context of ZEO, at least as I
would imagine using it in a private setting.

I don't like the idea of using ssl module underware
(_RESTRICTED_SERVER_CIPHERS). Why not just call
create_default_context(ssl.Purpose.CLIENT_AUTH) and then turn on
CERT_REQUIRED?

I can also imagine hosted ZEO, where the server is authenticated via
signed certificates and server_hostname, and clients are authenticated
via uploaded unsigned certs.

If I image real hard, in a highly distributed organization, I can
imagine servers and clients being authenticated via signed certs and
clients clients authenticating servers via server hostname and servers
authenticating clients via host name or some other cert data that's
validated in the signing process.  I guess I can see this in the
hosted ZEO case as well.

(I have a lot of trouble imaging a situation where servers would want
to authenticate clients based on signed certs without using additional
cert data.)

I'm really interested to hear how people think they're use SSL with ZEO.

Jim

-- 
Jim Fulton
http://jimfulton.info

-- 
You received this message because you are subscribed to the Google Groups "zodb" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
For more options, visit https://groups.google.com/d/optout.