AttributeError: 'module' object has no attribute 'SSL_ST_INIT'

[bobbypratama]

Installing on ubuntu 16.04.6 LTS (GNU/Linux 4.4.0-148-generic x86_64) gave me error like this

Setting up dh-make (2.201605~xenial1) ...
Setting up grr-server (3.2.4-6) ...
#################################################################
Running grr_config_updater initialize
To avoid this prompting, set DEBIAN_FRONTEND=noninteractive
#################################################################
Traceback (most recent call last):
File "/usr/share/grr-server/bin/grr_config_updater", line 11, in
sys.exit(ConfigUpdater())
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/distro_entry.py", line 23, in ConfigUpdater
from grr_response_server.bin import config_updater
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/bin/config_updater.py", line 16, in
from grr_response_server import server_plugins
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/server_plugins.py", line 26, in
from grr_response_server import output_plugins
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/output_plugins/init.py", line 11, in
from grr_response_server.output_plugins import bigquery_plugin
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/output_plugins/bigquery_plugin.py", line 21, in
from grr_response_server import bigquery
File "/usr/share/grr-server/local/lib/python2.7/site-packages/grr_response_server/bigquery.py", line 12, in
from googleapiclient import discovery
File "/usr/share/grr-server/local/lib/python2.7/site-packages/googleapiclient/discovery.py", line 56, in
from googleapiclient import _auth
File "/usr/share/grr-server/local/lib/python2.7/site-packages/googleapiclient/_auth.py", line 27, in
import oauth2client.client
File "/usr/share/grr-server/local/lib/python2.7/site-packages/oauth2client/client.py", line 45, in
from oauth2client import crypt
File "/usr/share/grr-server/local/lib/python2.7/site-packages/oauth2client/crypt.py", line 45, in
from oauth2client import _openssl_crypt
File "/usr/share/grr-server/local/lib/python2.7/site-packages/oauth2client/_openssl_crypt.py", line 16, in
from OpenSSL import crypto
File "/usr/lib/python2.7/dist-packages/OpenSSL/init.py", line 8, in
from OpenSSL import rand, crypto, SSL
File "/usr/lib/python2.7/dist-packages/OpenSSL/SSL.py", line 118, in
SSL_ST_INIT = _lib.SSL_ST_INIT
AttributeError: 'module' object has no attribute 'SSL_ST_INIT'
dpkg: error processing package grr-server (--configure):
subprocess installed post-installation script returned error exit status 1
Setting up dh-strip-nondeterminism (0.015-1) ...
Processing triggers for libc-bin (2.23-0ubuntu11) ...
Errors were encountered while processing:
grr-server
N: Can't drop privileges for downloading as file '/root/grr-server_3.2.4-6_amd64.deb' couldn't be accessed by user '_apt'. - pkgAcquire::Run (13: Permission denied)
E: Sub-process /usr/bin/dpkg returned an error code (1)

[dotalchemy]

sudo apt install python-pip

sudo pip install -U pyopenssl

I ran into this yesterday, updating pyOpenSSL seemed to be the solution.

[mbushkov]

@bobbypratama , I noticed that you were installing version 3.2.4.6. Does the same happen with the 3.3.0.0?
@dotalchemy , thanks for the hint! What GRR server version were you trying to install when you encountered the issue?

[dotalchemy]

@mbushkov 3.3.0.0 pulled from the amd64.deb release on GitHub, OS running Ubuntu 16.04.6 LTS - it was a clean build via ISO, though admittedly the initial iso was Ubuntu 16.04.3 LTS.

[dotalchemy]

Done a little more playing, this should probably be closed as it's not a GRR issue.

From a minimal install of Xenial...

• apt update && apt upgrade
• apt install python
• apt install mysql-server
• install GRR per docs

I suspect my encounter with this a couple of days ago and the OP's encounter is more down to Xenial not having Python installed by default.

[dotalchemy]

Bah, disregard - I didn't get the error during install of GRR, but the grr-server wouldn't start and the same errors as above could be found in /var/log/syslog

sudo apt install python-pip
sudo pip install pyopenssl==16.2.0

That fixes - it seems there's a version dependency of at least 16.2.0 on pyOpenSSL

[bobbypratama]

Right now, i am using Grr 3.3.0.0.

Admittedly, my Ubuntu was upgraded from previous LTS version to 16.04.6 LTS version. After checking my pyopenssl, it seems the version stuck in 0.15.1 even after apt update && apt upgrade

pip list
Package Version

---

....
pyOpenSSL 0.15.1
....

so, i do install pyopenssl as instructed above
pip install pyOpenSSL==16.2.0

Then Grr works file.

Thanks Guys

[dotalchemy]

Yeah, looks like that's the default version in Xenial

https://launchpad.net/ubuntu/+source/pyopenssl

@mbushkov might be worth throwing pyOpenSSL 16.2.0 up there as a dependency on the docs?

[ogarod]

The GRR server's Python environment is self-contained, and should not be dependent on system-wide Python packages (with the exception of python-mysqldb, which is an explicitly configured deb dependency). Ordinarily, GRR does not have a pyopenssl dependency. However, if the package is already installed outside GRR's virtualenv (/usr/share/grr-server), it will be conditionally imported in oauth2client code:

File /usr/share/grr-server/local/lib/python2.7/site-packages/oauth2client/crypt.py , line 44-52:

try:
    from oauth2client import _openssl_crypt
    OpenSSLSigner = _openssl_crypt.OpenSSLSigner
    OpenSSLVerifier = _openssl_crypt.OpenSSLVerifier
    pkcs12_key_as_pem = _openssl_crypt.pkcs12_key_as_pem
except ImportError:  # pragma: NO COVER                                                                                                                                                                                                                                                   
    OpenSSLVerifier = None
    OpenSSLSigner = None
    pkcs12_key_as_pem = _bad_pkcs12_key_as_pem

This is most probably something we did not anticipate.

One workaround, as @dotalchemy suggested, would be to update pyopenssl globally. In general though, we recommend using virtualenvs wherever possible, to avoid these sorts of version conflicts (i.e avoid system-wide installations of Python packages).

I have updated our troubleshooting documentation accordingly.