OCS unix agent : check SSL certificate

[Stéphane Urbanovski]

Hello

It is possible to check SSL certificate by using HTTPS_CA_DIR environment var : this force the server to provide a valid certificate.
However the client does not check if the server name correspond with the certificate CN.

This patch fix this point (v1.1):

--- /lib/Ocsinventory/Agent/Network.pm.orig 2009-11-23 16:53:57.000000000 +0100
+++ /lib/Ocsinventory/Agent/Network.pm 2009-11-23 17:01:46.000000000 +0100
@@ -73,6 +73,14 @@
$req->header('Pragma' => 'no-cache', 'Content-type',
'application/x-compress');

+ # Check server name against provided SSL certificate
+ if ( $self->{URI} =~ /^https:\/\/([^\/]+).*$/ ) {
+ my $cn = $1;
+ $cn =~ s/([\-\.])/\\$1/g;
+ $req->header('If-SSL-Cert-Subject' => '/CN='.$cn);
+ $logger->debug ("Validating Cert CN=".$cn);
+ }
+
$logger->debug ("sending XML");

#############

[Gonéri Le Bouder]

Post by Stéphane Urbanovski
Hello
It is possible to check SSL certificate by using HTTPS_CA_DIR environment
var : this force the server to provide a valid certificate.
However the client does not check if the server name correspond with the certificate CN.

Hi Stéphane,

Thank you for this patch! I don't think we can accept in a stable
release since it'll silently break some user installation.
We can include it in the 2.0 branch but I don't know if we should add
a "--https-check" parameter or turns it as default. Any opinion?

For the record, the hostname check is already done for the software
deployment module.

Best regards,

[Stéphane Urbanovski]

Post by Gonéri Le Bouder

Post by Stéphane Urbanovski
Hello
It is possible to check SSL certificate by using HTTPS_CA_DIR environment
var : this force the server to provide a valid certificate.
However the client does not check if the server name correspond with the certificate CN.

Hi Stéphane,
Thank you for this patch! I don't think we can accept in a stable
release since it'll silently break some user installation.

yes, it's a risk.

Post by Gonéri Le Bouder
We can include it in the 2.0 branch but I don't know if we should add
a "--https-check" parameter or turns it as default. Any opinion?

It is also possible to trigger the https strictness check only if HTTPS_CA_DIR or HTTPS_CA_FILE is defined, so you have much fewer chance to break current installation.

Post by Gonéri Le Bouder
For the record, the hostname check is already done for the software
deployment module.

We are planing to deploy ocs in servers context. That's why we are more picky with SSL check and why we are not planing to use software deployment.

[Gonéri Le Bouder]

Post by Stéphane Urbanovski

Post by Gonéri Le Bouder

Post by Stéphane Urbanovski
Hello
It is possible to check SSL certificate by using HTTPS_CA_DIR environment
var : this force the server to provide a valid certificate.
However the client does not check if the server name correspond with the
certificate CN.

Hi Stéphane,
Thank you for this patch! I don't think we can accept in a stable
release since it'll silently break some user installation.

yes, it's a risk.

Post by Gonéri Le Bouder
We can include it in the 2.0 branch but I don't know if we should add
a "--https-check" parameter or turns it as default. Any opinion?

It is also possible to trigger the https strictness check only if
HTTPS_CA_DIR or HTTPS_CA_FILE is defined, so you have much fewer chance to
break current installation.

Yes, but there is still a risk. BTW I commited your patch on the 2.x
so it won't get lost.
http://bazaar.launchpad.net/~ocsinventory-dev/ocsinventory-unix-agent/2.x/revision/1036

Post by Stéphane Urbanovski

Post by Gonéri Le Bouder
For the record, the hostname check is already done for the software
deployment module.

We are planing to deploy ocs in servers context. That's why we are more
picky with SSL check and why we are not planing to use software deployment.

Software deployment can be usefull for server too :)

[Stéphane Urbanovski]

Hello

Here is a patch that fix many html issues in 1.3beta3

Regards

[Erwan GOALOU]

thanks you for this patch!!! But, it was better if you propose it on
launchpad. Can you do that? "PROPOSAL TO MERGE"

--Erwan

Post by Stéphane Urbanovski
Hello
Here is a patch that fix many html issues in 1.3beta3
Regards
--
Stéphane Urbanovski

[Stéphane Urbanovski]

Post by Erwan GOALOU
thanks you for this patch!!! But, it was better if you propose it on
launchpad. Can you do that? "PROPOSAL TO MERGE"

done :
https://bugs.launchpad.net/ocsinventory-ocsreports/+bug/489213


By the way :

What is this line used for in index.php ? (and after </html> !)
<script language='javascript'>wait(0);</script>


Is there a plan to use gettext instead of this strange translation mechanism ?