Server uses a self signed CA, plist set to ignore, still showing issues.

[lucid772]

Please see the comments and issue at lindegroup/autopkgr#178 (comment)

[eahrold]

I may have stumbled on to a suspicious character.
http://bugs.python.org/msg128635

[eahrold]

And this makes it seem unavoidable.
https://github.com/kennethreitz/requests/issues/2022

[sheagcraig]

Two different issues here.

For some reason it really does seem to be ignoring the JSS_VERIFY_SSL setting. It shouldn't bother with it at all.

I suppose if you're up for it, you could double-check and do this in terminal:

cd /Library/Python/2.7/site-packages
python

# Now in python interpreter

>>> import jss

# Make a JSS object to test SSL being turned off with:

>>> j = jss.JSS(url='https://yoururlandport:8443', user='privilegedusername', password='password', ssl_verify=False)

>>> j.Package()

# Should return the packages on your JSS (no tracebacks...)

(Replace the URL, user, and password parameters with the correct data ;)
If it spews out the traceback about the SSL again, clearly something is broken that I'm missing in the configuration code.

As for the actual SSL issue, I suggest looking here:
https://github.com/sheagcraig/python-jss#ssl-errors

and adding/upgrading the packages mentioned to see if the problem magically vanishes. I don't know if that will help, but based on the requests issue #2022, it may.

Just in case you're like, "huh?":

sudo easy_install pyOpenSSL
sudo easy_install ndg-httpsclient
sudo easy_install pyasn1

Feel free to use pip if you have it.

[lucid772]

Even after I install each of the recommended easy_installs, I get the following result in terminal:

Traceback (most recent call last):
File "", line 1, in
File "jss/jss.py", line 377, in Package
return self.factory.get_object(Package, data)
File "jss/jss.py", line 451, in get_object
result = self.jss.get(url)
File "jss/jss.py", line 193, in get
response = self.session.get(url)
File "jss/contrib/requests/sessions.py", line 460, in get
return self.request('GET', url, *_kwargs)
File "jss/contrib/requests/sessions.py", line 448, in request
resp = self.send(prep, *_send_kwargs)
File "jss/contrib/requests/sessions.py", line 554, in send
r = adapter.send(request, **kwargs)
File "jss/contrib/requests/adapters.py", line 417, in send
raise SSLError(e, request=request)
jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

[sheagcraig]

?Geez. So it looks like it's not ignoring the verify settings.

---

From: lucid772 notifications@github.com
Sent: Friday, October 31, 2014 12:09 PM
To: sheagcraig/jss-autopkg-addon
Cc: Shea Craig
Subject: Re: [jss-autopkg-addon] Server uses a self signed CA, plist set to ignore, still showing issues. (#9)

Even after I install each of the recommended easy_installs, I get the following result in terminal:

Traceback (most recent call last):
File "", line 1, in
File "jss/jss.py", line 377, in Package
return self.factory.get_object(Package, data)
File "jss/jss.py", line 451, in get_object
result = self.jss.get(url)
File "jss/jss.py", line 193, in get
response = self.session.get(url)
File "jss/contrib/requests/sessions.py", line 460, in get
return self.request('GET', url, *_kwargs)
File "jss/contrib/requests/sessions.py", line 448, in request
resp = self.send(prep, *_send_kwargs)
File "jss/contrib/requests/sessions.py", line 554, in send
r = adapter.send(request, **kwargs)
File "jss/contrib/requests/adapters.py", line 417, in send
raise SSLError(e, request=request)
jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-61284113.

This communication (including any attachments) is intended for the use of the intended recipient(s) only and may contain information that is confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication. Any views or opinions presented are solely those of the author.

[sheagcraig]

Can you verify the session verify setting is True (after setting up the JSS object as per the above instructions):

>>> j.session.verify
True

[lucid772]

As you can likely guess, it is returning False.

Note that I tried this by direct JSS IP, CNAME, and FQDN with the same result.

[sheagcraig]

What...

That's definitely an issue with Requests then. I'll see if there's an update that needs to get applied or any issues filed on that. As you can imagine, with verify=False it should be ignoring SSL entirely. Or at least that was my understanding of it.

[lucid772]

I agree with you, which makes it even worse when I get that silly "SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" error after it tells me that. Additionally, while I am the one working on this, I know three others that are having the same issue personally.

Is there a better way, IE simply apply an SSL cert to tomcat? I am able to do this, but I am worried about that meaning I will need to re-enroll all my devices as well :(

Thanks again for all the help.

[sheagcraig]

?Having to re-enroll all of your devices is not trivial! That being said, I would think you would want SSL on just to be safe.

I think the safest thing to do is to set up a testing server and ensure that adding the cert would solve it. I wouldn't force a re-enrollment unless you were sure that you wanted to go that route.

---

From: lucid772 notifications@github.com
Sent: Friday, October 31, 2014 12:40 PM
To: sheagcraig/jss-autopkg-addon
Cc: Shea Craig
Subject: Re: [jss-autopkg-addon] Server uses a self signed CA, plist set to ignore, still showing issues. (#9)

I agree with you, which makes it even worse when I get that silly "SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" error after it tells me that. Additionally, while I am the one working on this, I know three others that are having the same issue personally.

Is there a better way, IE simply apply an SSL cert to tomcat? I am able to do this, but I am worried about that meaning I will need to re-enroll all my devices as well :(

Thanks again for all the help.

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-61289513.

This communication (including any attachments) is intended for the use of the intended recipient(s) only and may contain information that is confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication. Any views or opinions presented are solely those of the author.

[lucid772]

Sorry if I implied somehow it was trivial... but yes I would setup a test environment first. I do think this issue may need to be solved for other though, as it appears to clearly be ignoring the plist settings as mentioned prior.

I should note that this is not constant... Autopkgr DID run complete twice in the past without issue. Maybe I should reinstall and see if I get any difference in the result?

[eahrold]

These two seem to indicate that the issue is server side not client side

https://github.com/kennethreitz/requests/issues/2022
http://bugs.python.org/msg128635

[sheagcraig]

@lucid772 I'm at a loss on this one. It looks like it's an issue with Requests, as @eahrold has referenced above.

Now, that being said, while developing python-jss I used to have each API call perform a single GET, rather than what it is doing now, which is to use a session. When I would pull, for example, the full data on all of our policies (a ton of repeated GET requests), I would get the same SSL handshake error that you're experiencing, intermittently. I used to handle it by just waiting a couple of seconds and retrying, until it worked. However, once I started to use a session, it went away.

Of course, that was with verify=True.

Also, in those circumstances, it was definitely a 1/100 thing. It sounds like it happens every time you run.

[systemheld]

This issue is called by the fact that JAMF has disabled SSLv3 on JSS 9.61 to address the Poodle Attack. To fix that, simply go to /Library/Python/2.7/site-packages/jss/contrib/requests/packages/urllib3/util/ssl_.py and import PROTOCOL_TLSv1 in addition to PROTOCOL_SSLv23. Now go to line 86 and change return PROTOCOL_SSLv23 to return PROTOCOL_TLSv1.

[lucid772]

Great news! Thank you everyone for looking into this. Do you know the file path on linux for these changes? (Ubuntu specifically if that helps).

[sheagcraig]

?So that worked? That would be great news!

---

From: lucid772 notifications@github.com
Sent: Monday, November 3, 2014 10:44 AM
To: sheagcraig/jss-autopkg-addon
Cc: Shea Craig
Subject: Re: [jss-autopkg-addon] Server uses a self signed CA, plist set to ignore, still showing issues. (#9)

Great news! Thank you everyone for looking into this.

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-61496848.

This communication (including any attachments) is intended for the use of the intended recipient(s) only and may contain information that is confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication. Any views or opinions presented are solely those of the author.

[lucid772]

Found it at /usr/local/lib/python2.7...

Will update with results as soon as I am finished.

[lucid772]

Correction, I appear to have no idea where the file you are referencing is located in linux. If anyone can advise that would be great.

The file I did locate is at /usr/lib/python2.7/ssl.py However, the changes you have asked me to make do not exist (The return statements do not exist)

[eahrold]

@lucid772 You're not looking on your server, your looking on the mac where autopkg/AutoPKGr is running

[lucid772]

This is now solved. Thanks again for all the help (Yes, changing the local files repaired the issue).

I will note that I updated from Casper 9.31 to 9.61 while using this product, which would explain the mid use break. I am glad we are able to flag the issue so that we can possibly repair this for future versions without requiring the manual change.

[sheagcraig]

@ocoda
Can you send a pull request for TLS imports above?

[tep74]

I also recently updated to 9.61, and experienced the same issue. The above fix worked for me too. Thanks!

[systemheld]

@sheagcraig
opened a pull request on your python-jss repo.

[rtrouton]

I'm using Casper 9.52 and experiencing the same errors on every run. Updating /Library/Python/2.7/site-packages/jss/contrib/requests/packages/urllib3/util/ssl_.py with ocoda's fix (#9 (comment)) did not address it.

[systemheld]

as JAMF disabled SSLv3 on 9.61, I'm pretty sure, that your are have another issue. Could you send a stack trace (i.e. run autopkg from shell) please?

[gerardweese]

I also received the following error:

jss.contrib.requests.exceptions.SSLERROR: [ERRNO 1] _ssl.c:504 error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure.

I followed @ocoda steps to edit ssl_.py to resolve the error but I now receive the following when testing with "autopkgr run -v Firefox.jss"

UnboundLocalError: local variable 'password' referenced before assignment

Any thoughts?

[rtrouton]

In fact, I was having another issue. Bad recipe was causing the error to be thrown. Now that the recipe is fixed, no more errors.

[eahrold]

Here is where the file is now

/Library/Python/2.7/site-packages/python_jss-0.4.3-py2.7.egg/jss/contrib/requests/packages/urllib3/util/ssl_.py

[krispayne]

Maybe this isn't the place, but could someone point me in the right direction for re-packaing the egg once I open to switch back to TLS?

[sheagcraig]

Hey @krispayne: First off, sweet beard.

So I changed the way python-jss was getting packaged up. I failed to test fully on a clean install, and the egg is basically zipped up. I have since replaced the original installer package with a new one that installs the egg unzipped.

Further, @ocoda pointed out that just yesterday Requests added the relevant urllib3 release that solves the SSL/TLS issue.

I can't yet comment on whether it will ultimately solve your issue, but I'm going to update everything and release it this morning. Please let me know if it works!

[krispayne]

Thanks @sheagcraig! Do you know when you expect to publish the update?

[sheagcraig]

Well, I thought it was going to be about 4 hours ago... Then I started fixing more stuff. Definitely this afternoon.

[sheagcraig]

Alright folks-update is out with requests 2.5, which should hopefully solve all of your 9.61 TLS/SSL woes.

Please report back with your findings!

[krispayne]

• Installed latest release
• Removed python_jss-0.4.3-py2.7.egg from site-packages
• Relaunched AutoPKGr
• Ran Check Recipies
  +[ERROR] jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Do I still need to go into the ssl_.py and edit the TLS settings?

[krispayne]

• Manually removed JSSImporter.py
• Manually removed python_jss-0.4.4-py2.7.egg
• Relaunched AutoPKGr, confirm JSS importer not installed.
• Closed AutoPKGr, reinstall latest release of jss-autopkg
• Check Recipes
• [ERROR] jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

[krispayne]

• Quit AutoPKGr
• defaults write com.github.autopkg JSS_VERIFY_SSL -bool false
• Relaunch AutoPKgr
• Check Recipes
• [ERROR] jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

[sheagcraig]

Looks like we might have to reach in anyways? @ocoda?

[sheagcraig]

@krispayne Quick question: Did you notice whether you had multiple python-jss egg files in your site packages folder after the new installer? I can see where the old, "orphaned" one might get in the way, and I might need to clean it out with the postinstall script.

Also, can you just be extra doubly sure and do this from the python interpretor:

import jss
jss.requests.__version__

Should be '2.5.0'.

[krispayne]

Python 2.7.5 (default, Mar 9 2014, 22:15:05)
[GCC 4.2.1 Compatible Apple LLVM 5.0 (clang-500.0.68)] on darwin
Type "help", "copyright", "credits" or "license" for more information.

import jss
jss.requests.version
'2.5.0'

In my first attempt, installing over the previous, like an upgrade, the older, 0.4.3 python-jss was orphaned. I removed it and it still didn't fly. So that's when I removed all the aspects, and installed it again, but still, no dice.

[jridsdale]

I've just spun this up in a fresh Mavericks VM, same error.

--J.

t: @james_ridsdale

Sent from my iPhone.

On 3 Dec 2014, at 21:01, Kris Payne notifications@github.com wrote:

Python 2.7.5 (default, Mar 9 2014, 22:15:05)
[GCC 4.2.1 Compatible Apple LLVM 5.0 (clang-500.0.68)] on darwin
Type "help", "copyright", "credits" or "license" for more information.

import jss
jss.requests.version
'2.5.0'

In my first attempt, installing over the previous, like an upgrade, the older, 0.4.3 python-jss was orphaned. I removed it and it still didn't fly. So that's when I removed all the aspects, and installed it again, but still, no dice.

—
Reply to this email directly or view it on GitHub.

[sheagcraig]

I would like this to go away. Can you give the suggestion from @ocoda above a go:

"This issue is called by the fact that JAMF has disabled SSLv3 on JSS 9.61 to address the Poodle Attack. To fix that, simply go to /Library/Python/2.7/site-packages/jss/contrib/requests/packages/urllib3/util/ssl_.py and import PROTOCOL_TLSv1 in addition to PROTOCOL_SSLv23. Now go to line 86 and change return PROTOCOL_SSLv23 to return PROTOCOL_TLSv1."

The path is a little different, but should be easy to locate nestled within the egg.

Specifically, with this version of requests:
line 15 should read

    from ssl import wrap_socket, CERT_NONE, PROTOCOL_TLSv1

line 149 should read

        return PROTOCOL_TLSv1

If this works I'll roll with it just to make these issues go away IF it doesn't impact < 9.61 users. Otherwise, we'll have to craft a way to switch based on JSS version.

[krispayne]

• edited ssl_.py
• Relaunched AutoPKGr
• Checked Recipes
• No Errors.
  :-)

JSS 9.61

[krispayne]

@sheagcraig sidenote, did you used to live in Massachusetts?

[rtrouton]

I had the same results as krispayne, though with Casper 9.62 instead of 9.61. Once I edited ssl_.py to replace PROTOCOL_SSLv23 with PROTOCOL_TLSv1, I was good to go.

[systemheld]

damn! really hoped it could be that easy.

For now I would hardcode the PROTOCOL_TLSv1 into urllib3. When anyone in here got some time you could try one of these:

https://github.com/kennethreitz/requests/issues/749#issuecomment-17406518
http://stackoverflow.com/questions/26733462/ssl-and-tls-in-python-requests

The solution mentioned by hobarrera seems reasonable, but I haven't tested it.

[sheagcraig]

Agreed @ocoda. I'm going to just add it to the release checklist from now on to make sure that it's in place.

I need to set up a few different test environments so I can automate all of this prior to releasing.

If anyone can figure out a way using introspection or parameters to requests to configure away the need to actually change the requests code, I'd be much obliged. Seems like an icky way to do things.

@krispayne I was wondering if you were that Kris Payne. Small world!

[sheagcraig]

@ocoda

kennethreitz/requests#749 looking at hobarrera's solution executes on my machine. Don't know yet whether it solves anything. I need to try on a clean machine and see if it works.

The second link you provided seems like another way to do this, although again, way over my head. I'm going to do a release with the edits you proposed just to get this working for folks, and then set up some tests and test environments to dig into the above options.

[jwzg]

Take a look at the bottom at the syntax error. This popped up when I hardcoded TLS_v1.

12/4/14 8:43:31.299 AM AutoPkgr[9919]: (FULL AUTOPKG TRACEBACK) File "/usr/local/bin/autopkg", line 30, in <module> import autopkglib.github File "/Library/AutoPkg/autopkglib/__init__.py", line 614, in <module> import_processors() File "/Library/AutoPkg/autopkglib/__init__.py", line 522, in import_processors mydirname + '.' + name, fromlist=[name]), name) File "/Library/AutoPkg/autopkglib/JSSImporter.py", line 24, in <module> import jss File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/__init__.py", line 24, in <module> from jss import * File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/jss.py", line 29, in <module> from . import distribution_points File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/distribution_points.py", line 31, in <module> import casper File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/casper.py", line 28, in <module> from .contrib import requests File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/__init__.py", line 53, in <module> from .packages.urllib3.contrib import pyopenssl File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/__init__.py", line 3, in <module> from . import urllib3 File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/urllib3/__init__.py", line 10, in <module> from .connectionpool import ( File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/urllib3/connectionpool.py", line 31, in <module> from .connection import ( File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/urllib3/connection.py", line 45, in <module> from .util.ssl_ import ( File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/urllib3/util/__init__.py", line 5, in <module> from .ssl_ import ( File "/Library/Python/2.7/site-packages/python_jss-0.4.4-py2.7.egg/jss/contrib/requests/packages/urllib3/util/ssl_.py", line 15 from ssl import wrap socket, CERT_NONE, PROTOCOL_TLSv1 ^ SyntaxError: invalid syntax

[sheagcraig]

Yep: somehow the underscore got removed from "wrap_socket". Add that back in and you should be good to go.

py2.7.egg/jss/contrib/requests/packages/urllib3/util/ssl_.py", line 15

from ssl import wrap socket, CERT_NONE, PROTOCOL_TLSv1
^
SyntaxError: invalid syntax

...and I can see why. You cut and pasted my comment above. Sorry about that. I've corrected it above too.

[jwzg]

Thanks, but check out the code you put in above.

[sheagcraig]

@jzwg Thanks-caught that and edited it. We ran out of coffee at work today!

The next release will add this in for you too, so hopefully nobody else will have to goof around editing deep into the python morass.

[krispayne]

@sheagcraig The one and only! Very small world.

[sheagcraig]

@ocoda Just wanted to let you know that I discovered there is a built-in way in requests to use TLS over SSLv23: http://docs.python-requests.org/en/latest/user/advanced/#transport-adapters

Here is python-jss' usage of it:
https://github.com/sheagcraig/python-jss/blob/master/jss/tlsadapter.py

[systemheld]

@sheagcraig Thanks for pointing out, that will make things a lot easier in some of my scripts!