Archive for the ‘Security’ Category.

M2Crypto 0.20.1 Fixes Regression in httpslib.ProxyHTTPSConnection

Miloslav Trmac noticed a regression in httpslib.ProxyHTTPSConnection and provided a fix for it, and I’ve just tagged and uploaded the new 0.20.1 version to PyPI. See the 0.20 release announcement for general information about the 0.20 release series.

I’ve also been getting a few requests for help on building M2Crypto on Fedora Core -based systems, so I’ve added some info to the FAQ. Basically there is a fedora_setup.sh wrapper script in the source tarball that you can use instead of the plain setup.py. There are more details about the fedora_setup.sh script, if you are interested.

M2Crypto 0.20

I am pleased to announce M2Crypto 0.20, which has been in development for over nine months. It fixes over 30 bugs, and fixes and new functionality was contributed by more than ten people. Hooah!

The CHANGES file lists the full list of changes, but personally I am most pleased by M2Crypto having reached the magical 80% unit test (code) coverage. Besides that technicality, there are Python 2.6 fixes, threading fixes, added support for RSASSA-PSS signing and verifying, certificates with large serial numbers, and more.

Download from pypi.

Or use easy_install (may not work on all systems): easy_install M2Crypto

M2Crypto is the most complete Python wrapper for OpenSSL featuring RSA, DSA, DH, HMACs, message digests, symmetric ciphers (including AES); SSL functionality to implement clients and servers; HTTPS extensions to Python’s httplib, urllib, and xmlrpclib; unforgeable HMAC’ing AuthCookies for web session management; FTP/TLS client and server; S/MIME; ZServerSSL: A HTTPS server for Zope and ZSmime: An S/MIME messenger for Zope. M2Crypto can also be used to provide SSL for Twisted. Smartcards supported through the Engine API.

M2Crypto 0.20 Beta Cycle Begins

Better late than never… I am announcing the first beta of M2Crypto 0.20 release. M2Crypto is the most complete Python wrapper for OpenSSL.

The 0.20 release has been in development for about nine months. About 30 bugs and new features have been implemented by more than ten people. Unit tests now cover 80% of the code base. Tinderbox is used to automatically test changes on various flavors of Ubuntu, Fedora Core, Redhat and Cygwin. We could use more Tinderbox clients, so please drop me a line if you have some spare machine cycles available.

The release include some fairly significant changes, including tricky ones in threading and so forth. See the CHANGES file for list of changes. Please test your applications, and go file bugs on any issues you notice. I’ll wait for feedback for a week, spin the next beta and so forth until there are no more release blockers found within a beta period.

There are a few issues I feel bad about that did not make the first beta. If you can help create fixes for these, I’d be willing to consider including the fixes in 0.20 if the changes don’t look too scary. Here is my wish list:

Download from pypi.

Or use easy_install (may not work on all systems): easy_install M2Crypto

Simple Website Change Detection System

I happened to read a post on how to detect if someone has changed files on your webserver to serve nebulous scripts and what not. The idea in the post was to compute hashes of the files on your server and then compare periodically that the hashes match. This works against some simple attacks where all the attacker does is modify some of your content files. It won’t work if the attacker has also gotten access to the script doing the checks, or the hashes, and so forth.

As I was reading the post I realized that if you use a version control system like Subversion to publish changes to your site (the live site is a checked out copy), you get this automatically. All you need to do additionally is to set up a cronjob to run svn status (or equivalent if using some other version control system) on the server. svn status does not print anything if there are no changes, but for any added, deleted or changed files or directories it will print one line of output. Of course, this only works for files, not for content coming from databases.

M2Crypto Build Wrapper for Fedora Core -based Distributions

Ever since M2Crypto got support for Elliptic Curves (EC) cryptography, it has been somewhat difficult to build M2Crypto on systems where OpenSSL has been built without EC support. Notably distributions based on Fedora Core, which besides Fedora Core include of course Redhat and CentOS.

Disabled EC support alone wouldn’t be an issue, since normally opensslconf.h defines OPENSSL_NO_EC, but those same systems have also changed OpenSSL build so that instead of opensslconf.h you need to include processor architecture dependent file. And if that wasn’t enough this isn’t actually what you are supposed to be doing, and you will hit a compiler error to notify you of that. The final step in the recipe is to tell SWIG to treat errors as warnings. The distributions make build changes in their own versions of M2Crypto, but unless you know the recipe, you are going to have a hard time building M2Crypto yourself. Miloslav Trma─Ź showed me what kind of changes were needed, and I made a new setup wrapper fedora_setup.sh which should help you get off the ground with M2Crypto if you are having a hard time building it. Let me know if you run into any problems with the setup wrapper.

I am sure the distros did not make these changes just to make it harder to build systems based on OpenSSL, although it sure does feel like that at times. Maybe someone can shed light on why these changes were made in the first place.

My Little Secret

I have been working on an installer system that needs to ask the user a bunch of questions, including passwords, and store the answers in an .ini so that if the user runs the installer again, they will get prefilled answers. After the first installation it should be possible to run the installer in a batch mode since all the answers were recorded. But being security conscious, I did not like all those passwords being stored in plain text.

Luckily for me, I had already implemented almost exactly what I needed in Chandler, namely the password manager feature of Chandler which encrypts account passwords with a master password. I just needed to rip out the Chandler-specific features to get a general purpose encryption and decryption library, which defaults to 256 bit AES (Rijndael) in CBC mode and derives a key from the master password using PBKDF2 algorithm. The encrypted data serializes to just text, which can appear in .ini file. The serialized form does not follow any standards. With a few extra lines of code it can also act as a utility to encrypt and decrypt files. Thus, m2secret was born. It is built using the M2Crypto library.

Here’s how you could use it:

import m2secret
 
# Encrypt
secret = m2secret.Secret()
secret.encrypt('my data', 'my master password')
serialized = secret.serialize()
 
# Decrypt
secret = m2secret.Secret()
secret.deserialize(serialized)
data = secret.decrypt('my master password')
 
assert data == 'my data'

The command line utility is called m2secret.

Installation should be as easy as easy_install m2secret.

Configuration Options in Code or INI Files?

Recently I was admonishing my colleagues for embedding configuration options into Python code. I thought it was commonly accepted that all configuration options should be in text files that are not code. Typically in Python world this seems to be something like INI files, which are parsed to get to the values. Nowadays JSON could also be an option. After polling the opinions of some other colleagues, friends and others, it seems the situation is not as clear as I thought.

I think I have personally embedded configuration options in one case in production code, and felt dirty afterwards. But maybe I have just been living in the past, thinking the thoughts of a C/C++ programmer…

Some of the first things that come to my mind when thinking why configuration options should be in regular text files:

  • Text (INI format especially) is easier to edit than (Python) code
  • It is easier to reload configuration options from a regular text file
  • Code files should be read only
  • If you make a mistake in a code file, you will get an error that only programmers will understand
  • Loading configuration options from a regular text file offers better security

The counter arguments to those could include:

  • It is actually simpler to write complex structures in Python than INI, and you can use all of Python’s power
  • It can be pretty easy to reload Python modules as well (although you have to be careful with imports). Often there is no need to reload options.
  • Of course the code file would be made writable for only a brief period of time
  • If the target audience of the program are programmers, it makes perfect sense to show errors only programmers could understand. And you could even catch some errors and give nicer messages to end users.
  • The configuration file can be edited only by the super users (or the legitimate intended users of the program, and the program can not grant them more power than they would otherwise have)

I can think of a bunch more reasons but they all seem to follow pretty much the same pattern, with same pattern of counter arguments.

So if the intended users of the application were software engineers, systems administrators or others capable of deciphering Python tracebacks, and the program couldn’t grant the user more access to the system than they would otherwise have, I guess I don’t have a strong case against config-in-code.

But in most use cases I think the security implications are actually a pretty strong reason why config should be separate from code. You can lock down code as tightly as your system allows, and you can be as strict about parsing and loading values from text config file as you like. This doesn’t eliminate all security issues from config files, but it adds a layer of protection.

Looking for Volunteers to Run M2Crypto Tinderbox Buildslaves

I have set up a Tinderbox2 instance for M2Crypto. If you are unfamiliar with Tinderbox, it is a tool to do continuous builds and tests, similar to Buildbot.

Now I am looking for people who would be able to run buildslaves. Ideally computers that are online 24/7, able to do a build + test of M2Crypto once an hour, but even once a day would be useful. The computer should have the ability to pull sources from svn and email the build & test log. The build and test cycle takes less than a minute on my laptop, so we are talking minimal resource usage.