naviserver-devel — Developer discussion

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Hi Gustaf

I've already did it (hg clone ...). Very good idea to add this log 
notice (perhaps in all modules), I think I was using 0.2, not 0.4 (I 
didn't check that).

Server log says ...

 >> Notice: nsssl: version 0.4 loaded, based on OpenSSL 1.0.1e 11 Feb 2013

I'll re-test again 
(https://www.ssllabs.com/ssltest/analyze.html?d=cesareox.com&hideResults=on) 
and now (almos) same results as next-scripting.org . My only difference is:

  - Chain Issues Incomplete (I already had this before). I don't know 
who to add ca.pem and intermediate.subclass.pem to certificate. I 
suppose I have to add them to certificate.pem but I didn't try.

Regards,
Cesáreo


El 05/abril/14 15:05, Gustaf Neumann escribió:
> please get nsssl from bitbucket, compile & install, and check, what
> the driver says during startup in the error.log. If you have already the
> tip version of naviserver installed, there is no need to recompile
> naviserver
>
> -g
>
> Am 05.04.14 19:34, schrieb Cesáreo García Rodicio:
>> Dear Gustaf,
>>
>> Yes, I suppose is very rough but to have some reference.
>>
>> My openssl setup (Debian):
>>    >openssl version
>> OpenSSL 1.0.1e 11 Feb 2013
>>
>> It seems to be same version. Might be something with the certificate
>> (mine is StartComm Class 1)?
>>
>> I'll rebuild naviserver. One question, nssl builds from HEAD or I had to
>> change something?
>>
>> Cesáreo
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

please get nsssl from bitbucket, compile & install, and check, what
the driver says during startup in the error.log. If you have already the
tip version of naviserver installed, there is no need to recompile 
naviserver

-g

Am 05.04.14 19:34, schrieb Cesáreo García Rodicio:
> Dear Gustaf,
>
> Yes, I suppose is very rough but to have some reference.
>
> My openssl setup (Debian):
>   >openssl version
> OpenSSL 1.0.1e 11 Feb 2013
>
> It seems to be same version. Might be something with the certificate
> (mine is StartComm Class 1)?
>
> I'll rebuild naviserver. One question, nssl builds from HEAD or I had to
> change something?
>
> Cesáreo

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf,

Yes, I suppose is very rough but to have some reference.

My openssl setup (Debian):
 >openssl version
OpenSSL 1.0.1e 11 Feb 2013

It seems to be same version. Might be something with the certificate 
(mine is StartComm Class 1)?

I'll rebuild naviserver. One question, nssl builds from HEAD or I had to 
change something?

Cesáreo

El 05/abril/14 07:12, Gustaf Neumann escribió:
> Dear Cesáreo,
>
> it is the same grade (which is a very rough and imprecise rating), but
> on your site,
> there is no FS used for any browser. i've now configured the below
> cipher set & protocols on next-scripting.org, and if you compare
> e.g. the output Android 2.3.7, next-scripting has FS, but cesareox not.
>
> Android 2.3.7
> <https://www.ssllabs.com/ssltest/viewClient.html?name=Android&version=2.3.7>
> No SNI ^2 	TLS 1.0 	TLS_DHE_RSA_WITH_AES_128_CBC_SHA (|0x33|) FS 	128
>
>
> Maybe you are using an older version of OpenSSL. I've updated just now
> nsssl
> on bitbucket to report the OpenSSL version number to the log file. On
> next-scripting, it says:
>
>      Notice: nsssl: version 0.4 loaded, based on OpenSSL 1.0.1e-fips 11
> Feb 2013
>
> This is the version number coming with Fedora release 20 (Heisenbug).
> Please check, what you get.
>
> Best regards
> -g
>
> Am 04.04.14 23:00, schrieb Cesáreo García Rodicio:
>>    I get the same A- grade:
>> https://www.ssllabs.com/ssltest/analyze.html?d=cesareox.com  (because of PFS)
>>
>> My ciphers and protocols:
>>
>>         ns_param		ciphers	
>> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>>          ns_param		protocols	"SSLv3, TLSv1"
>>
>> As seen on:
>> https://wiki.mozilla.org/Security/Server_Side_TLS
>>
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

Dear Cesáreo,

it is the same grade (which is a very rough and imprecise rating), but 
on your site,
there is no FS used for any browser. i've now configured the below
cipher set & protocols on next-scripting.org, and if you compare
e.g. the output Android 2.3.7, next-scripting has FS, but cesareox not.

Android 2.3.7 
<https://www.ssllabs.com/ssltest/viewClient.html?name=Android&version=2.3.7> 
No SNI ^2 	TLS 1.0 	TLS_DHE_RSA_WITH_AES_128_CBC_SHA (|0x33|) FS 	128


Maybe you are using an older version of OpenSSL. I've updated just now 
nsssl
on bitbucket to report the OpenSSL version number to the log file. On
next-scripting, it says:

     Notice: nsssl: version 0.4 loaded, based on OpenSSL 1.0.1e-fips 11 
Feb 2013

This is the version number coming with Fedora release 20 (Heisenbug).
Please check, what you get.

Best regards
-g

Am 04.04.14 23:00, schrieb Cesáreo García Rodicio:
>    I get the same A- grade:
> https://www.ssllabs.com/ssltest/analyze.html?d=cesareox.com (because of PFS)
>
> My ciphers and protocols:
>
>         ns_param		ciphers	
> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>          ns_param		protocols	"SSLv3, TLSv1"
>
> As seen on:
> https://wiki.mozilla.org/Security/Server_Side_TLS
>

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf,

  I get the same A- grade: 
https://www.ssllabs.com/ssltest/analyze.html?d=cesareox.com (because of PFS)

My ciphers and protocols:

       ns_param		ciphers	 
"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
        ns_param		protocols	"SSLv3, TLSv1"

As seen on:
https://wiki.mozilla.org/Security/Server_Side_TLS

 > openssl version
OpenSSL 0.9.8y 5 Feb 2013

I've upgraded install-ns.sh (with_postgres=0) and work nice ;-)

Thanks!
Cesáreo

--- side effect of using head version ---

I was using 4.99.5 some days in my production server and I had some 
"Fatal: received fatal signal 11" Errors. But now It seems to work nicely.


El 04/abril/14 15:19, Gustaf Neumann escribió:
> Am 04.04.14 19:32, schrieb Cesáreo García Rodicio:
>> Dear Gustaf,
>>
>> I had tried that (HEAD instead of 4.99.5) BUT not with most recent
>> version from the repository ;-)
>>
>> But it didn't work (it keeps warning me about PFS).
> Note that the nsssl driver does not implement PFS secrecy, but
> configures OpenSSL to use it.
> The achieved levels depend on the version of OpenSSL and the
> configuration parameters
> (mostly the configured ciphers)
>
> See, what we are using (without spending much time to get the perfect
> values)
> on next-scripting.org:
>
> https://www.ssllabs.com/ssltest/analyze.html?d=next-scripting.org
>
> ssllabs gives for this an A- ranking with protocol support 95%, but
> complains
> "The server does not support Forward Secrecy with the reference browsers".
>
> If one scrolls down to the "Handshake Simulation" section, one can see that
> forward secrecy works with the used parameters on most browsers
> except IE6+IE8 on Windows XP,  YandexBot3.0 and Java; the latter fails,
> since we
> use DH paramters > 1024 bits.
>
> We are using the following parameters:
>
>          ns_param      ciphers           "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>          ns_param      protocols          "!SSLv2:!SSLv3"
>
> If someone comes of with a "better" cipher set, let us know.
>> Silly Note about install-ns.sh
>> I have postgres already installed so I remove "postgres and
>> postgres-devel" in install-ns.sh. Perhaps it might be good idea to conf
>> that via something like with_postgres=0 .
> good idea. i've just now updated the install script in the wiki.
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

Am 04.04.14 19:32, schrieb Cesáreo García Rodicio:
> Dear Gustaf,
>
> I had tried that (HEAD instead of 4.99.5) BUT not with most recent
> version from the repository ;-)
>
> But it didn't work (it keeps warning me about PFS).
Note that the nsssl driver does not implement PFS secrecy, but 
configures OpenSSL to use it.
The achieved levels depend on the version of OpenSSL and the 
configuration parameters
(mostly the configured ciphers)

See, what we are using (without spending much time to get the perfect 
values)
on next-scripting.org:

https://www.ssllabs.com/ssltest/analyze.html?d=next-scripting.org

ssllabs gives for this an A- ranking with protocol support 95%, but 
complains
"The server does not support Forward Secrecy with the reference browsers".

If one scrolls down to the "Handshake Simulation" section, one can see that
forward secrecy works with the used parameters on most browsers
except IE6+IE8 on Windows XP,  YandexBot3.0 and Java; the latter fails, 
since we
use DH paramters > 1024 bits.

We are using the following parameters:

        ns_param      ciphers           "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
        ns_param      protocols          "!SSLv2:!SSLv3"

If someone comes of with a "better" cipher set, let us know.
> Silly Note about install-ns.sh
> I have postgres already installed so I remove "postgres and
> postgres-devel" in install-ns.sh. Perhaps it might be good idea to conf
> that via something like with_postgres=0 .
good idea. i've just now updated the install script in the wiki.

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf,

I had tried that (HEAD instead of 4.99.5) BUT not with most recent 
version from the repository ;-)

But it didn't work (it keeps warning me about PFS).

Perhaps it is something with a Certificate Chain Use. How do I conf 
Certification Authority  and Primary Intermediate Server CA ? Is it 
necessary?

Thanks
Cesáreo

----
Silly Note about install-ns.sh
I have postgres already installed so I remove "postgres and 
postgres-devel" in install-ns.sh. Perhaps it might be good idea to conf 
that via something like with_postgres=0 .

El 04/abril/14 13:59, Gustaf Neumann escribió:
> Dear Cesáreo,
>
> If you have the actual version of the installer script from [1], you can
> edit
> the version to get the most recent version from the repository. Set
>      v_ns=HEAD
> and you are done.
>
> all the best
> -gustaf
>
> [1]: http://openacs.org/xowiki/naviserver-openacs
>
> Am 04.04.14 17:56, schrieb Cesáreo García Rodicio:
>> Dear Gustaf
>>
>> I'm installing naviserver with the amazing install-ns.sh script and it
>> doesn't support 4.99.6 and I didn't try to get head version with another
>> method). So I'll wait until 4.99.6 to test the perfect forward issue.
>>
>> I've already done "openssl dhparam 2048 >> server.pem" (it takes a while)
>>
>> Thanks
>> Cesáreo
>>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

Dear Cesáreo,

If you have the actual version of the installer script from [1], you can 
edit
the version to get the most recent version from the repository. Set
    v_ns=HEAD
and you are done.

all the best
-gustaf

[1]: http://openacs.org/xowiki/naviserver-openacs

Am 04.04.14 17:56, schrieb Cesáreo García Rodicio:
> Dear Gustaf
>
> I'm installing naviserver with the amazing install-ns.sh script and it
> doesn't support 4.99.6 and I didn't try to get head version with another
> method). So I'll wait until 4.99.6 to test the perfect forward issue.
>
> I've already done "openssl dhparam 2048 >> server.pem" (it takes a while)
>
> Thanks
> Cesáreo
>

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf

I'm installing naviserver with the amazing install-ns.sh script and it 
doesn't support 4.99.6 and I didn't try to get head version with another 
method). So I'll wait until 4.99.6 to test the perfect forward issue.

I've already done "openssl dhparam 2048 >> server.pem" (it takes a while)

Thanks
Cesáreo



El 31/marzo/14 06:19, Gustaf Neumann escribió:
> You are right, adding the DHE parameters should be mentioned more
> prominently.
> i've added a few lines to the README file.
>
> -gn
>
> Am 29.03.14 15:02, schrieb Cesáreo García Rodicio:
>> Hi Gustaf
>>
>> OK, thanks so much. This PFS issue it's not urgent in my setup. I had
>> missed "" to add DHE ciphers
>>
>> Next week I'll try the head version of NS and check again
>>
>> Thanks so much
>> Cesáreo
>>
>> El 28/marzo/14 17:25, Gustaf Neumann escribió:
>>> Just a short reply:
>>> - yes, forward secrecy is now supported, although i found it hard to
>>> find a cipher
>>>       set that works with all browsers perfectly.
>>> - yes, the .pem file should include the diffie hellman parameters, when
>>> you use *DHE* ciphers.
>>>       The readme on  https://bitbucket.org/naviserver/nsssl shows an
>>> example how to build such
>>>       a .pem file.
>>> - in order to use all functionality on nsssl (e.g. fo ns_ssl), one
>>> should currently use the
>>>       head version of NaviServer (4.99.6) until it is released
>>>
>>> -gustaf
>>>
>>> Am 28.03.14 18:05, schrieb Cesáreo García Rodicio:
>>>> Dear Gustaf
>>>>
>>>> I'm using Qualys' SSL Labs to check my navisver security ratings . My
>>>> server uses a StartSSL™ Free (Class 1)  https://www.startssl.com/?app=39
>>>> and a nssl config file (see below[1])
>>>>
>>>> I get a A- Rating and to get an A Rating I had to solve this forward
>>>> secrecy issue. So
>>>>       - I assume nsssl module supports forward secrecy [2]
>>>>       - My ciphers suite (ns_param ciphers "...") is right [3]
>>>>       - I had to change server.pem (all-in-one private and public keys).
>>>> Does this mean to text-edit server.pem? I couldn't see how to do it in
>>>> the links
>>>>
>>>> Thanks
>>>> Cesáreo
>>>>
>>>>
>>>>
>>>> [1] My  nsssl file conf
>>>>
>>>> ns_section    "ns/server/${server}/module/nsssl"
>>>>             ns_param		certificate	$serverroot/etc/certificado.pem
>>>>             ns_param		ciphers	
>>>> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
>>>> :DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
>>>> :ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA
>>>> 256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>>>>             ns_param		protocols	"SSLv3, TLSv1"
>>>>             ns_param		verify     	0
>>>>
>>>> [1] Is 4.99.6 a typo in https://bitbucket.org/naviserver/nsssl/src ? I
>>>> assume nsssl 0.4 works with naviserver 4.99.5
>>>> [2] As seen on https://wiki.mozilla.org/Security/Server_Side_TLS
>>>>
>>>>
>>>>
>>>> El 27/enero/14 17:42, Gustaf Neumann escribió:
>>>>
>>>>
>>>>> Dear friends,
>>>>>
>>>>> Google has implemented in 2011 "forward secrecy" via ephemeral keys and
>>>>> Diffie-Hellman key exchange in OpenSSL [1].Since this feature of OpenSSL
>>>>> this is easy to use, i added support for forward secrecy to nsssl. One
>>>>> can new use these improved security features by adding DH parameters [2]
>>>>> to the server.pem file (see example in README [3]) and by using the
>>>>> "right" ciphers (*E*DH*, see e.g. [4]).
>>>>>
>>>>> By using these features, a web site can improve its security ratings as
>>>>> measured e.g. by Qualys' SSL Labs.
>>>>>
>>>>> all the best
>>>>> -gustaf neumann
>>>>>
>>>>> [1]
>>>>> http://googleonlinesecurity.blogspot.co.at/2011/11/protecting-data-for-long-term-with.html
>>>>> [2] https://bitbucket.org/naviserver/nsssl/src
>>>>> [3] http://en.wikibooks.org/wiki/OpenSSL/Diffie-Hellman_parameters
>>>>> [4] https://wiki.mozilla.org/Security/Server_Side_TLS
>>>>>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] Congrats and SSL redirect problem with nsssl [SOLVED]

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf,

I remove from nsssl config and it worked (but ServerPort warning keeps). 
I think that nssl using "default configuration" (0.0.0.0:443)

Any way, it is working and an errors (a lot) when using nssopenssl have 
gone now.

"Notice: Using 'ServerPort' in ns/server/openacs/module/nsssl is 
deprecated" keeps logging but it doesn't bother me (perhpas an issue in 
openacs)

Thanks
Cesáreo




El 31/marzo/14 06:12, Gustaf Neumann escribió:
> Dear Cesáreo,
>
> The socket drivers (nssock and nsssl) use three parameters for the
> server endpoint,
> namely
>     - hostname
>     - address
>     - port
>
> One should be able to use e.g. "localhost" as "hostname" and e.g.
> "127.0.0.1" as address.
>
> The use of "ServerPort" as config parameter is deprecated in OpenACS, also
> NaviServer does not evaluate this parameter. The port has to be specified
> via the parameter "port", unless it is the default port.
>
> -gustaf neumann
>
> Am 28.03.14 17:16, schrieb Cesáreo García Rodicio:
>> Hi
>>
>> I solved that REMOVING
>>    >          ns_param		address    	$address
>>    >          ns_param		port       	$httpsport
>>
>> but ... it is the right way to do?
>>
>> Also, I have this log notice (I think it has to be with openacs not
>> naviserver):
>>
>> Notice: Using 'ServerPort' in ns/server/openacs/module/nsssl is deprecated
>>
>> Again, amazing work. I had a lot (a lot) of warnings and errors with
>> nsopenssl/aolserver. They have gone now.
>>
>> Thanks
>> Cesáreo
>>
>>
>>
>>
>> El 28/marzo/14 12:52, Cesáreo García Rodicio escribió:
>>> Hi!
>>>
>>> First of all, congratulation for your amazing work. I'm trying to switch
>>> from aolserver to naviserver in my openacs setup and it works very, very
>>> nice (and fast :-) ).
>>>
>>> I had a litte problem with ssl. I think it is a config problem but with
>>> Aolserver didn't occur and now I don't know what I had to change.
>>>
>>> Problem: https://localhost makes a redirection to https://127.0.0.1 .
>>>
>>> Thanks
>>> Cesáreo
>>>
>>> ---------------
>>> My nsssl conf:
>>> ns_section    "ns/server/${server}/module/nsssl"
>>>            ns_param		address    	$address
>>>            ns_param		port       	$httpsport
>>>            ns_param		certificate	$serverroot/etc/certificado.pem
>>>            ns_param		ciphers		"RC4:HIGH:!aNULL:!MD5;"
>>>            ns_param		protocols	"SSLv3, TLSv1"
>>>            ns_param		verify     	0
>>>
>>>
>>>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

You are right, adding the DHE parameters should be mentioned more 
prominently.
i've added a few lines to the README file.

-gn

Am 29.03.14 15:02, schrieb Cesáreo García Rodicio:
> Hi Gustaf
>
> OK, thanks so much. This PFS issue it's not urgent in my setup. I had
> missed "openssl dhparam 2048 >> server.pem" to add DHE ciphers
>
> Next week I'll try the head version of NS and check again
>
> Thanks so much
> Cesáreo
>
> El 28/marzo/14 17:25, Gustaf Neumann escribió:
>> Just a short reply:
>> - yes, forward secrecy is now supported, although i found it hard to
>> find a cipher
>>      set that works with all browsers perfectly.
>> - yes, the .pem file should include the diffie hellman parameters, when
>> you use *DHE* ciphers.
>>      The readme on  https://bitbucket.org/naviserver/nsssl shows an
>> example how to build such
>>      a .pem file.
>> - in order to use all functionality on nsssl (e.g. fo ns_ssl), one
>> should currently use the
>>      head version of NaviServer (4.99.6) until it is released
>>
>> -gustaf
>>
>> Am 28.03.14 18:05, schrieb Cesáreo García Rodicio:
>>> Dear Gustaf
>>>
>>> I'm using Qualys' SSL Labs to check my navisver security ratings . My
>>> server uses a StartSSL™ Free (Class 1)  https://www.startssl.com/?app=39
>>> and a nssl config file (see below[1])
>>>
>>> I get a A- Rating and to get an A Rating I had to solve this forward
>>> secrecy issue. So
>>>      - I assume nsssl module supports forward secrecy [2]
>>>      - My ciphers suite (ns_param ciphers "...") is right [3]
>>>      - I had to change server.pem (all-in-one private and public keys).
>>> Does this mean to text-edit server.pem? I couldn't see how to do it in
>>> the links
>>>
>>> Thanks
>>> Cesáreo
>>>
>>>
>>>
>>> [1] My  nsssl file conf
>>>
>>> ns_section    "ns/server/${server}/module/nsssl"
>>>            ns_param		certificate	$serverroot/etc/certificado.pem
>>>            ns_param		ciphers	
>>> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
>>> :DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
>>> :ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA
>>> 256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>>>            ns_param		protocols	"SSLv3, TLSv1"
>>>            ns_param		verify     	0
>>>
>>> [1] Is 4.99.6 a typo in https://bitbucket.org/naviserver/nsssl/src ? I
>>> assume nsssl 0.4 works with naviserver 4.99.5
>>> [2] As seen on https://wiki.mozilla.org/Security/Server_Side_TLS
>>>
>>>
>>>
>>> El 27/enero/14 17:42, Gustaf Neumann escribió:
>>>
>>>
>>>> Dear friends,
>>>>
>>>> Google has implemented in 2011 "forward secrecy" via ephemeral keys and
>>>> Diffie-Hellman key exchange in OpenSSL [1].Since this feature of OpenSSL
>>>> this is easy to use, i added support for forward secrecy to nsssl. One
>>>> can new use these improved security features by adding DH parameters [2]
>>>> to the server.pem file (see example in README [3]) and by using the
>>>> "right" ciphers (*E*DH*, see e.g. [4]).
>>>>
>>>> By using these features, a web site can improve its security ratings as
>>>> measured e.g. by Qualys' SSL Labs.
>>>>
>>>> all the best
>>>> -gustaf neumann
>>>>
>>>> [1]
>>>> http://googleonlinesecurity.blogspot.co.at/2011/11/protecting-data-for-long-term-with.html
>>>> [2] https://bitbucket.org/naviserver/nsssl/src
>>>> [3] http://en.wikibooks.org/wiki/OpenSSL/Diffie-Hellman_parameters
>>>> [4] https://wiki.mozilla.org/Security/Server_Side_TLS
>>>>

Re: [naviserver-devel] Congrats and SSL redirect problem with nsssl [SOLVED]

[Gustaf N. <ne...@wu...>]

Dear Cesáreo,

The socket drivers (nssock and nsssl) use three parameters for the 
server endpoint,
namely
   - hostname
   - address
   - port

One should be able to use e.g. "localhost" as "hostname" and e.g. 
"127.0.0.1" as address.

The use of "ServerPort" as config parameter is deprecated in OpenACS, also
NaviServer does not evaluate this parameter. The port has to be specified
via the parameter "port", unless it is the default port.

-gustaf neumann

Am 28.03.14 17:16, schrieb Cesáreo García Rodicio:
> Hi
>
> I solved that REMOVING
>   >          ns_param		address    	$address
>   >          ns_param		port       	$httpsport
>
> but ... it is the right way to do?
>
> Also, I have this log notice (I think it has to be with openacs not
> naviserver):
>
> Notice: Using 'ServerPort' in ns/server/openacs/module/nsssl is deprecated
>
> Again, amazing work. I had a lot (a lot) of warnings and errors with
> nsopenssl/aolserver. They have gone now.
>
> Thanks
> Cesáreo
>
>
>
>
> El 28/marzo/14 12:52, Cesáreo García Rodicio escribió:
>> Hi!
>>
>> First of all, congratulation for your amazing work. I'm trying to switch
>> from aolserver to naviserver in my openacs setup and it works very, very
>> nice (and fast :-) ).
>>
>> I had a litte problem with ssl. I think it is a config problem but with
>> Aolserver didn't occur and now I don't know what I had to change.
>>
>> Problem: https://localhost makes a redirection to https://127.0.0.1 .
>>
>> Thanks
>> Cesáreo
>>
>> ---------------
>> My nsssl conf:
>> ns_section    "ns/server/${server}/module/nsssl"
>>           ns_param		address    	$address
>>           ns_param		port       	$httpsport
>>           ns_param		certificate	$serverroot/etc/certificado.pem
>>           ns_param		ciphers		"RC4:HIGH:!aNULL:!MD5;"
>>           ns_param		protocols	"SSLv3, TLSv1"
>>           ns_param		verify     	0
>>
>>
>>

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Hi Gustaf

OK, thanks so much. This PFS issue it's not urgent in my setup. I had 
missed "openssl dhparam 2048 >> server.pem" to add DHE ciphers

Next week I'll try the head version of NS and check again

Thanks so much
Cesáreo

El 28/marzo/14 17:25, Gustaf Neumann escribió:
> Just a short reply:
> - yes, forward secrecy is now supported, although i found it hard to
> find a cipher
>     set that works with all browsers perfectly.
> - yes, the .pem file should include the diffie hellman parameters, when
> you use *DHE* ciphers.
>     The readme on  https://bitbucket.org/naviserver/nsssl shows an
> example how to build such
>     a .pem file.
> - in order to use all functionality on nsssl (e.g. fo ns_ssl), one
> should currently use the
>     head version of NaviServer (4.99.6) until it is released
>
> -gustaf
>
> Am 28.03.14 18:05, schrieb Cesáreo García Rodicio:
>> Dear Gustaf
>>
>> I'm using Qualys' SSL Labs to check my navisver security ratings . My
>> server uses a StartSSL™ Free (Class 1)  https://www.startssl.com/?app=39
>> and a nssl config file (see below[1])
>>
>> I get a A- Rating and to get an A Rating I had to solve this forward
>> secrecy issue. So
>>     - I assume nsssl module supports forward secrecy [2]
>>     - My ciphers suite (ns_param ciphers "...") is right [3]
>>     - I had to change server.pem (all-in-one private and public keys).
>> Does this mean to text-edit server.pem? I couldn't see how to do it in
>> the links
>>
>> Thanks
>> Cesáreo
>>
>>
>>
>> [1] My  nsssl file conf
>>
>> ns_section    "ns/server/${server}/module/nsssl"
>>           ns_param		certificate	$serverroot/etc/certificado.pem
>>           ns_param		ciphers	
>> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
>> :DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
>> :ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA
>> 256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>>           ns_param		protocols	"SSLv3, TLSv1"
>>           ns_param		verify     	0
>>
>> [1] Is 4.99.6 a typo in https://bitbucket.org/naviserver/nsssl/src ? I
>> assume nsssl 0.4 works with naviserver 4.99.5
>> [2] As seen on https://wiki.mozilla.org/Security/Server_Side_TLS
>>
>>
>>
>> El 27/enero/14 17:42, Gustaf Neumann escribió:
>>
>>
>>> Dear friends,
>>>
>>> Google has implemented in 2011 "forward secrecy" via ephemeral keys and
>>> Diffie-Hellman key exchange in OpenSSL [1].Since this feature of OpenSSL
>>> this is easy to use, i added support for forward secrecy to nsssl. One
>>> can new use these improved security features by adding DH parameters [2]
>>> to the server.pem file (see example in README [3]) and by using the
>>> "right" ciphers (*E*DH*, see e.g. [4]).
>>>
>>> By using these features, a web site can improve its security ratings as
>>> measured e.g. by Qualys' SSL Labs.
>>>
>>> all the best
>>> -gustaf neumann
>>>
>>> [1]
>>> http://googleonlinesecurity.blogspot.co.at/2011/11/protecting-data-for-long-term-with.html
>>> [2] https://bitbucket.org/naviserver/nsssl/src
>>> [3] http://en.wikibooks.org/wiki/OpenSSL/Diffie-Hellman_parameters
>>> [4] https://wiki.mozilla.org/Security/Server_Side_TLS
>>>
>>>
>>>
>>> ------------------------------------------------------------------------------
>>> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>>> Learn Why More Businesses Are Choosing CenturyLink Cloud For
>>> Critical Workloads, Development Environments & Everything In Between.
>>> Get a Quote or Start a Free Trial Today.
>>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> naviserver-devel mailing list
>>> nav...@li...
>>> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>>>
>>>
>> ------------------------------------------------------------------------------
>> _______________________________________________
>> naviserver-devel mailing list
>> nav...@li...
>> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>
>

Re: [naviserver-devel] forward secrecy for nsssl

[Gustaf N. <ne...@wu...>]

Just a short reply:
- yes, forward secrecy is now supported, although i found it hard to 
find a cipher
   set that works with all browsers perfectly.
- yes, the .pem file should include the diffie hellman parameters, when 
you use *DHE* ciphers.
   The readme on  https://bitbucket.org/naviserver/nsssl shows an 
example how to build such
   a .pem file.
- in order to use all functionality on nsssl (e.g. fo ns_ssl), one 
should currently use the
   head version of NaviServer (4.99.6) until it is released

-gustaf

Am 28.03.14 18:05, schrieb Cesáreo García Rodicio:
> Dear Gustaf
>
> I'm using Qualys' SSL Labs to check my navisver security ratings . My
> server uses a StartSSL™ Free (Class 1)  https://www.startssl.com/?app=39
> and a nssl config file (see below[1])
>
> I get a A- Rating and to get an A Rating I had to solve this forward
> secrecy issue. So
>    - I assume nsssl module supports forward secrecy [2]
>    - My ciphers suite (ns_param ciphers "...") is right [3]
>    - I had to change server.pem (all-in-one private and public keys).
> Does this mean to text-edit server.pem? I couldn't see how to do it in
> the links
>
> Thanks
> Cesáreo
>
>
>
> [1] My  nsssl file conf
>
> ns_section    "ns/server/${server}/module/nsssl"
>          ns_param		certificate	$serverroot/etc/certificado.pem
>          ns_param		ciphers	
> "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
> :DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
> :ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA
> 256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
>          ns_param		protocols	"SSLv3, TLSv1"
>          ns_param		verify     	0
>
> [1] Is 4.99.6 a typo in https://bitbucket.org/naviserver/nsssl/src ? I
> assume nsssl 0.4 works with naviserver 4.99.5
> [2] As seen on https://wiki.mozilla.org/Security/Server_Side_TLS
>
>
>
> El 27/enero/14 17:42, Gustaf Neumann escribió:
>
>
>> Dear friends,
>>
>> Google has implemented in 2011 "forward secrecy" via ephemeral keys and
>> Diffie-Hellman key exchange in OpenSSL [1].Since this feature of OpenSSL
>> this is easy to use, i added support for forward secrecy to nsssl. One
>> can new use these improved security features by adding DH parameters [2]
>> to the server.pem file (see example in README [3]) and by using the
>> "right" ciphers (*E*DH*, see e.g. [4]).
>>
>> By using these features, a web site can improve its security ratings as
>> measured e.g. by Qualys' SSL Labs.
>>
>> all the best
>> -gustaf neumann
>>
>> [1]
>> http://googleonlinesecurity.blogspot.co.at/2011/11/protecting-data-for-long-term-with.html
>> [2] https://bitbucket.org/naviserver/nsssl/src
>> [3] http://en.wikibooks.org/wiki/OpenSSL/Diffie-Hellman_parameters
>> [4] https://wiki.mozilla.org/Security/Server_Side_TLS
>>
>>
>>
>> ------------------------------------------------------------------------------
>> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
>> Learn Why More Businesses Are Choosing CenturyLink Cloud For
>> Critical Workloads, Development Environments & Everything In Between.
>> Get a Quote or Start a Free Trial Today.
>> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
>> _______________________________________________
>> naviserver-devel mailing list
>> nav...@li...
>> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>>
>>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel


-- 
Univ.Prof. Dr. Gustaf Neumann
WU Vienna
Institute of Information Systems and New Media
Welthandelsplatz 1, A-1020 Vienna, Austria

Re: [naviserver-devel] forward secrecy for nsssl

[Cesáreo G. R. <ce...@ce...>]

Dear Gustaf

I'm using Qualys' SSL Labs to check my navisver security ratings . My 
server uses a StartSSL™ Free (Class 1)  https://www.startssl.com/?app=39 
and a nssl config file (see below[1])

I get a A- Rating and to get an A Rating I had to solve this forward 
secrecy issue. So
  - I assume nsssl module supports forward secrecy [2]
  - My ciphers suite (ns_param ciphers "...") is right [3]
  - I had to change server.pem (all-in-one private and public keys). 
Does this mean to text-edit server.pem? I couldn't see how to do it in 
the links

Thanks
Cesáreo



[1] My  nsssl file conf

ns_section    "ns/server/${server}/module/nsssl"
        ns_param		certificate	$serverroot/etc/certificado.pem
        ns_param		ciphers	 
"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256
:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384
:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA
256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
        ns_param		protocols	"SSLv3, TLSv1"
        ns_param		verify     	0

[1] Is 4.99.6 a typo in https://bitbucket.org/naviserver/nsssl/src ? I 
assume nsssl 0.4 works with naviserver 4.99.5
[2] As seen on https://wiki.mozilla.org/Security/Server_Side_TLS



El 27/enero/14 17:42, Gustaf Neumann escribió:


> Dear friends,
>
> Google has implemented in 2011 "forward secrecy" via ephemeral keys and
> Diffie-Hellman key exchange in OpenSSL [1].Since this feature of OpenSSL
> this is easy to use, i added support for forward secrecy to nsssl. One
> can new use these improved security features by adding DH parameters [2]
> to the server.pem file (see example in README [3]) and by using the
> "right" ciphers (*E*DH*, see e.g. [4]).
>
> By using these features, a web site can improve its security ratings as
> measured e.g. by Qualys' SSL Labs.
>
> all the best
> -gustaf neumann
>
> [1]
> http://googleonlinesecurity.blogspot.co.at/2011/11/protecting-data-for-long-term-with.html
> [2] https://bitbucket.org/naviserver/nsssl/src
> [3] http://en.wikibooks.org/wiki/OpenSSL/Diffie-Hellman_parameters
> [4] https://wiki.mozilla.org/Security/Server_Side_TLS
>
>
>
> ------------------------------------------------------------------------------
> CenturyLink Cloud: The Leader in Enterprise Cloud Services.
> Learn Why More Businesses Are Choosing CenturyLink Cloud For
> Critical Workloads, Development Environments & Everything In Between.
> Get a Quote or Start a Free Trial Today.
> http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>
>

Re: [naviserver-devel] Congrats and SSL redirect problem with nsssl [SOLVED]

[Cesáreo G. R. <ce...@ce...>]

Hi

I solved that REMOVING
 >          ns_param		address    	$address
 >          ns_param		port       	$httpsport

but ... it is the right way to do?

Also, I have this log notice (I think it has to be with openacs not 
naviserver):

Notice: Using 'ServerPort' in ns/server/openacs/module/nsssl is deprecated

Again, amazing work. I had a lot (a lot) of warnings and errors with 
nsopenssl/aolserver. They have gone now.

Thanks
Cesáreo




El 28/marzo/14 12:52, Cesáreo García Rodicio escribió:
> Hi!
>
> First of all, congratulation for your amazing work. I'm trying to switch
> from aolserver to naviserver in my openacs setup and it works very, very
> nice (and fast :-) ).
>
> I had a litte problem with ssl. I think it is a config problem but with
> Aolserver didn't occur and now I don't know what I had to change.
>
> Problem: https://localhost makes a redirection to https://127.0.0.1 .
>
> Thanks
> Cesáreo
>
> ---------------
> My nsssl conf:
> ns_section    "ns/server/${server}/module/nsssl"
>          ns_param		address    	$address
>          ns_param		port       	$httpsport
>          ns_param		certificate	$serverroot/etc/certificado.pem
>          ns_param		ciphers		"RC4:HIGH:!aNULL:!MD5;"
>          ns_param		protocols	"SSLv3, TLSv1"
>          ns_param		verify     	0
>
>
>
> ------------------------------------------------------------------------------
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

[naviserver-devel] Congrats and SSL redirect problem with nsssl

[Cesáreo G. R. <ce...@ce...>]

Hi!

First of all, congratulation for your amazing work. I'm trying to switch 
from aolserver to naviserver in my openacs setup and it works very, very 
nice (and fast :-) ).

I had a litte problem with ssl. I think it is a config problem but with 
Aolserver didn't occur and now I don't know what I had to change.

Problem: https://localhost makes a redirection to https://127.0.0.1 .

Thanks
Cesáreo

---------------
My nsssl conf:
ns_section    "ns/server/${server}/module/nsssl"
        ns_param		address    	$address
        ns_param		port       	$httpsport
        ns_param		certificate	$serverroot/etc/certificado.pem
        ns_param		ciphers		"RC4:HIGH:!aNULL:!MD5;"
        ns_param		protocols	"SSLv3, TLSv1"
        ns_param		verify     	0

Re: [naviserver-devel] naviserver on the raspberry pi

[Benjamin B. <tek...@ya...>]

Gustaf,

Congratulations!

As an advocate of open source hardware as well as open source software, 
I'm genuinely excited knowing Naviserver works on Arduino open hardware 
(and likely BeagleBoard systems) as well as the closed-licensed 
raspberry pi.

Open hardware configurations with Naviserver could be useful platforms 
for developing low-risk complex robotic systems.

cheers,

Benjamin

On 03/23/2014 01:44 PM, Gustaf Neumann wrote:
> Dear all,
>
> over the weekend, i did some tests with NaviServer on the intel galileo
> board which based on the Intel Quark SoC X1000 (400 MHz), announced last
> year. The same processor is used well in the Intel Edison designed for
> wearable devices, see e.g. [1]. The Galileo board combines an x86
> architecture with Arduino compliance.
>
> Building NaviServer for the Galileo was more tricky since one has
> essentially to cross-compile using the yocto tool chain. The good news
> is that cross-compiling worked nicely when starting from the tar file.
> The measured performance is about half the speed of raspberry, but for
> clicking around it feels quite zippy.
>
> all the best
> -gustaf neumann
>
> [1] https://makeit.intel.com/news
>
> Am 14.01.14 15:42, schrieb Gustaf Neumann:
>> Dear Friends,
>>
>> I did some tests with NaviServer on the raspberry pi (see picture
>> below), which are quite promising. (The raspberry pi is a "
>> credit-card-sized" single-board computer with a ARMv6-compatible
>> processor, costing less than 40 euro at amazon).
>>
>> NaviServer (and Tcl 8.5.15) compiles out of the box (libnsd is 1.9 MB)
>> on 2014-01-07-wheezy-raspbian and runs quite well on the pi as the
>> following test show. All tests were executed with "ab -n 1000 -c 10
>> http://......" where "ab" was executed on my notebook. In test "WLAN",
>> the notebook connected via WLAN to the raspberry pi, in test LAN, both
>> were on the same LAN. For all tests, I've used the unmodified default
>> configuration nsd-config.tcl.
>>                 WLAN      LAN
>> timer2.adp:   214.56    216.22
>> mini.html:    286.13    294.53
>> 5k.html:      245.29    236.09
>>
>> The reported values are "reqs/sec". One can certainly question the
>> usefulness of the number that "ab" returns (which are not  very
>> stable) but overall this tiny machine feels quite fast, when clicking
>> around....
>>
>> all the best
>> -gustaf neumann
>>
>>
>>
>>
>>
>
>
> ------------------------------------------------------------------------------
> Learn Graph Databases - Download FREE O'Reilly Book
> "Graph Databases" is the definitive new guide to graph databases and their
> applications. Written by three acclaimed leaders in the field,
> this first edition is now available. Download your free book today!
> http://p.sf.net/sfu/13534_NeoTech
>
>
>
> _______________________________________________
> naviserver-devel mailing list
> nav...@li...
> https://lists.sourceforge.net/lists/listinfo/naviserver-devel
>

Re: [naviserver-devel] naviserver on the raspberry pi

[Gustaf N. <ne...@wu...>]

Dear all,

over the weekend, i did some tests with NaviServer on the intel galileo 
board which based on the Intel Quark SoC X1000 (400 MHz), announced last 
year. The same processor is used well in the Intel Edison designed for 
wearable devices, see e.g. [1]. The Galileo board combines an x86 
architecture with Arduino compliance.

Building NaviServer for the Galileo was more tricky since one has 
essentially to cross-compile using the yocto tool chain. The good news 
is that cross-compiling worked nicely when starting from the tar file. 
The measured performance is about half the speed of raspberry, but for 
clicking around it feels quite zippy.

all the best
-gustaf neumann

[1] https://makeit.intel.com/news

Am 14.01.14 15:42, schrieb Gustaf Neumann:
> Dear Friends,
>
> I did some tests with NaviServer on the raspberry pi (see picture 
> below), which are quite promising. (The raspberry pi is a " 
> credit-card-sized" single-board computer with a ARMv6-compatible 
> processor, costing less than 40 euro at amazon).
>
> NaviServer (and Tcl 8.5.15) compiles out of the box (libnsd is 1.9 MB) 
> on 2014-01-07-wheezy-raspbian and runs quite well on the pi as the 
> following test show. All tests were executed with "ab -n 1000 -c 10 
> http://......" where "ab" was executed on my notebook. In test "WLAN", 
> the notebook connected via WLAN to the raspberry pi, in test LAN, both 
> were on the same LAN. For all tests, I've used the unmodified default 
> configuration nsd-config.tcl.
>                 WLAN      LAN
> timer2.adp:   214.56    216.22
> mini.html:    286.13    294.53
> 5k.html:      245.29    236.09
>
> The reported values are "reqs/sec". One can certainly question the 
> usefulness of the number that "ab" returns (which are not  very 
> stable) but overall this tiny machine feels quite fast, when clicking 
> around....
>
> all the best
> -gustaf neumann
>
>
>
>
>

[naviserver-devel] fixed a subtle bug in interplay between ns-cache, nsdbi and nsdbipg

[Gustaf N. <ne...@wu...>]

Dear friends,

When runnig nsdbi + nsdbipg for a while on OpenACS.org,
we experienced infrequent crashes. The cause turned out
to be a subtle interaction between ns-cache and nsdbipg
in cache pruning. When the cache becomes full, an call to
Ns_CacheSetValueExpires() calls the pruning code, which
calls eventually CacheUnsetValue, FreeStatement
(in the nsdbi module) and the prepareCloseProc
(in the nsdbipg module, freeing the prepared statement
name).

The problem was that nsdbipg calls during cleanup
Dbi_ExecDirect (in nsdbi), which wants to cache the
prepare info for that cleanup statement, via
Ns_CacheSetValueExpires. Therefore, before the above
Ns_CacheUnsetValue finishes, it is called again with
the still full cache, it wants to prune the cache and calls
Ns_CacheUnsetValue() again and a double free happens
on the statement name in prepareCloseProc
(or maybe later on the the free operation of the statement).

here is the (simplified) call chain:
Ns_CacheSetValueExpires -> Ns_CacheDeleteEntry -> Ns_CacheUnsetValue -> 
FreeStatement -> prepareCloseProc -> Dbi_ExecDirect -> Dbi_Prepare -> 
Ns_CacheSetValueExpires -> Ns_CacheUnsetValue ->  -> FreeStatement -> 
prepareCloseProc -> crash

There are at least two ways to address this problem: (a) to
avoid ns-cache add-operations from a ns-cache freeProc,
or (b) to make CacheUnsetValue more robust in this respect.

I've fixed the problem via (b) since that is more general
(and less work). It is not completely unlikely, that this fixes
as well some other unreported crashes during cache pruning,
some other modules might have similar interactions.

all the best
-gustaf neumann

Re: [naviserver-devel] dbi + timezones

[Gustaf N. <ne...@wu...>]

hard-coding configuration values is seldom the best choice for all 
situations.
None of these are required, neither nspostgres nor nsdbpg set these values,
bot driver work between naviserver and postgres in a large number of 
installations.
If one configures the database with a timezone = 'Europe/Vienna', and 
connects
to the database without having specified anything, this person will expect
to have the configured  timezone respected.

I actually don't care much about client_encoding and datestyle (iso is 
the default, anyhow),
but "timezone" is evil, unless one lives in UTC. It took me some time to 
figure
out, why some queries with time ranges work well nsdbpg and nsora,
but they did not work with dbipg. For a while i suspected problems with
prepared statements and timestamps until i found the hard-coded session 
timezone.

Since you seem to require the session-time-zone, and since it hurts us,
i'll make this configurable when i have the chance.

All the best
-gn

PS: These parameters have nothing to do with the per-page customization.
You do not want alter what "1h ago" means, which is just between nsd and 
postgres,
and not between browser and nsd.

Am 09.02.14 20:47, schrieb Stephen:
> On Sun, Feb 9, 2014 at 1:56 AM, Gustaf Neumann <ne...@wu...> wrote:
>> dbipg does for each session unconditionally
>>
>> set session timezone = 'UTC'
>> set session client_encoding = 'UTF8'
>> set session datestyle = 'ISO'
>>
>> actually, postgresql.conf sets these values, it is confusing, when psql
>> behaves
>> differently from a naviserver session. Are there concerns to remove
>> these settings
>> from the driver?
> Yes.
>
> 'UTF8' is required so that we can feed the tcl core strings in the
> format it expects.
>
> The time stuff is so that no matter which driver you are using, or
> which particular db, or from which machine with whatever environment
> (developer laptop, staging, production), times and dates pop out in a
> predictable format you can feed to clock -format or some templating
> system.
>
> In the end, you often want to customise the format per page or user anyway.

Re: [naviserver-devel] dbi + timezones

[Stephen <yo...@gr...>]

On Sun, Feb 9, 2014 at 1:56 AM, Gustaf Neumann <ne...@wu...> wrote:
> dbipg does for each session unconditionally
>
> set session timezone = 'UTC'
> set session client_encoding = 'UTF8'
> set session datestyle = 'ISO'
>
> actually, postgresql.conf sets these values, it is confusing, when psql
> behaves
> differently from a naviserver session. Are there concerns to remove
> these settings
> from the driver?

Yes.

'UTF8' is required so that we can feed the tcl core strings in the
format it expects.

The time stuff is so that no matter which driver you are using, or
which particular db, or from which machine with whatever environment
(developer laptop, staging, production), times and dates pop out in a
predictable format you can feed to clock -format or some templating
system.

In the end, you often want to customise the format per page or user anyway.

Re: [naviserver-devel] commit/nsdbi: 3 new changesets

[Stephen <yo...@gr...>]

The original test showed a difference of 250% between best and worst. The
new test shows 9%. The difference is:

- the overhead of bulk conversion of kv lists in Tcl removed
- the de-duplication of columns in list result types

In this rather large test, de-duplicating the column keys saved 140,000 Tcl
object allocations (and another 140,000 string allocations).

In this real-world code:

    http://openacs.org/api-doc/proc-view?proc=db_multirow

...db_multirow converts each set-row to an array (like the rest of the
dbi_* procs, it doesn't want sets), and then converts those arrays into
kv-lists for caching. In the common case of a cache hit: the string from
the cache is parsed as nested lists then fed to 'array set'. Arrays (and
dicts, and sets) don't perform de-duplication because in the general case
the keys aren't guaranteed to be common.

dbi_rows' original output was the straight-forward de-duplicated flat rows
and columns lists. It is easy to reason about.

Missing from 'dbi_convert' (or dbi_loop, whatever) is an optional code
block. An optional code block would be:

- convenient
- the obvious place to put code which adds computed columns (see other
thread)
- an opportunity for further optimisation

Apart from not having to traverse the result twice, an optional code block
could create dicts (say) on demand before running the code. Having run the
code, check the ref count: if it's 1 then the code block didn't append the
dict to a list or something and it can be reused, including keys, for the
next block. If the values are also unshared then just set the value
directly. Keep the values in an array for fast lookup without having to
hash the keys each time.

[naviserver-devel] dbi + timezones

[Gustaf N. <ne...@wu...>]

dbipg does for each session unconditionally

set session timezone = 'UTC'
set session client_encoding = 'UTF8'
set session datestyle = 'ISO'

actually, postgresql.conf sets these values, it is confusing, when psql 
behaves
differently from a naviserver session. Are there concerns to remove 
these settings
from the driver?

-gn

Re: [naviserver-devel] commit/nsdbi: 3 new changesets

[Gustaf N. <ne...@wu...>]

>> Without a C implementation only Tcl command dispatch overhead is 
>> being tested.
> ...
> Maybe i find some time-slots towards end of the week or on
> the weekend.

Dear all,

here is the result of todays experiments, which compares the following
structured output formats:

   - list of dicts
   - attribute+value lists, where every single list is converted to a 
dict from tcl
   - attribute+value lists, where every single list is converted to an 
associative array
   - list of lists (every sublist list is a list of values, similar to 
db_list_of_lists on OpenACS)
   - the result is a single dict, as suggested by wiwo
   - the result is a list of ns-sets

These formats are generated either
- directly from dbi_rows ("direct"), or
- dbi returns a flat list, but a separate converter function is called 
("convert"),
   implemented in C.

In each cases, i've tried to optimize the code by e.g. reducing the 
number of
append cases by creating the full list in one step, or by sharing objects
(e.g. the column names in the dict / atttribute+values, etc.)

The results are used on a SQL  query returning 10,000 rows à 14 columns.
The flat list has a length of 140,000 elements.

The performance differences between "direct" and "convert" often small,
larger for "dict" and "sets". If one adds all times, the difference is 9%,
in favor of "direct".

These numbers give no good reason for asking the user to use always two 
commands
instead of a single command.

 From the experiences with the abstraction layer, another disadvantage of
"dbi_rows -colums c {*sql*)" became apparent. In order to define a 
compatible
abstraction for a "db_*"- command one has to use "uplevel" in order to  
resolve
local bind variables. if one uses "uplevel" then the output variable 
passed via
"-columns" clobbers the calling environment. This problem affects all 
"convert"
cases, which requires the "-columns" argument. One implement as well a 
"-uplevel"
argument, of having some convention that "-bind 2" means "uplevel 2", 
but that's
not nice at all. The "direct" variants do not have this problem.

I'll commit the changes to bitbucket later for inspection and comments.
all the best
-gustaf neumann

PS: The wiki on OpenACS.org is now fully based on dbi.




The raw numbers:

		convert		direct
dicts		161102.82	154323.49
avlistd		157773.26	156649.43
avlistsa	153875.77	157220.76
lists		136289.30	138773.77
dict		190415.81	158263.39
sets		201872.61	150604.29


=========================================================
set ::sql {select * from acs_objects limit 10000}


proc convert-dicts {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     foreach d [dbi_convert -result dicts $cols $rows] {
	incr sum [dict get $d object_id]
	incr count
     }
     return [list $count $sum]
}

proc convert-avlistsd {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     foreach d [dbi_convert -result avlists $cols $rows] {
	incr sum [dict get $d object_id]
	incr count
     }
     return [list $count $sum]
}

proc convert-avlistsa {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     foreach d [dbi_convert -result avlists $cols $rows] {
	array set a $d
	incr sum $a(object_id)
	incr count
     }
     return [list $count $sum]
}

proc convert-lists {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     foreach d [dbi_convert -result lists $cols $rows] {
	incr sum [lindex $d 0]
	incr count
     }
     return [list $count $sum]
}

proc convert-dict {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     dict for {k v} [dbi_convert -result dict $cols $rows] {
	incr sum [dict get $v object_id]
	incr count
     }
     return [list $count $sum]
}

proc convert-sets {} {
     set sum 0
     set count 0
     set rows [dbi_rows -columns cols -max 1000000 -- $::sql]
     foreach s [dbi_convert -result sets $cols $rows] {
	incr sum [ns_set get $s object_id]
	incr count
     }
     return [list $count $sum]
}

#########################

proc direct-dicts {} {
     set sum 0
     set count 0
     foreach d [dbi_rows -result dicts -max 1000000 -- $::sql] {
	incr sum [dict get $d object_id]
	incr count
     }
     return [list $count $sum]
}

proc direct-avlistsd {} {
     set sum 0
     set count 0
     foreach d [dbi_rows -result avlists -max 1000000 -- $::sql] {
	incr sum [dict get $d object_id]
	incr count
     }
     return [list $count $sum]
}

proc direct-avlistsa {} {
     set sum 0
     set count 0
     foreach d [dbi_rows -result avlists -max 1000000 -- $::sql] {
	array set a $d
	incr sum $a(object_id)
	incr count
     }
     return [list $count $sum]
}


proc direct-lists {} {
     set sum 0
     set count 0
     foreach d [dbi_rows -result lists -max 1000000 -- $::sql] {
	incr sum [lindex $d 0]
	incr count
     }
     return [list $count $sum]
}

proc direct-dict {} {
     set sum 0
     set count 0
     dict for {k v} [dbi_rows -result dict -max 1000000 -- $::sql] {
	incr sum [dict get $v object_id]
	incr count
     }
     return [list $count $sum]
}

proc direct-sets {} {
     set sum 0
     set count 0
     foreach s [dbi_rows -result sets -max 1000000 -- $::sql] {
	incr sum [ns_set get $s object_id]
	incr count
     }
     return [list $count $sum]
}

lappend _ \n
foreach d {dicts avlistsd avlistsa lists dict sets} {
    set p convert-$d; lappend _ $p [$p] " [time $p 100]" \n
    set p direct-$d; lappend _ $p [$p] " [time $p 100]" \n
}
set _