| chat.freenode.net #tryton log beginning Sat Aug 13 00:00:02 CEST 2011 | ||
| 2011-08-13 00:33 -!- Ildin_(~chatzilla@184-76-111-12.war.clearwire-wmx.net) has joined #tryton | ||
| 2011-08-13 01:13 -!- alimon(alimon@187.156.94.122) has joined #tryton | ||
| 2011-08-13 01:30 -!- elbenfreund(~elbenfreu@g225208201.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 01:45 -!- elbenfreund(~elbenfreu@g225208201.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 02:10 -!- elbenfreund(~elbenfreu@g225208201.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 03:54 -!- ikks(~ikks@190.27.84.116) has joined #tryton | ||
| 2011-08-13 04:40 -!- lem0na(~lem0na@95.87.233.210) has joined #tryton | ||
| 2011-08-13 04:41 -!- alimon(~alimon@187.156.94.122) has joined #tryton | ||
| 2011-08-13 05:15 -!- yangoon(~mathiasb@p54B4FCCC.dip.t-dialin.net) has joined #tryton | ||
| 2011-08-13 06:53 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 08:51 -!- cedk(~ced@gentoo/developer/cedk) has joined #tryton | ||
| 2011-08-13 10:18 -!- FWiesing(~franz@mail.tryton.at) has joined #tryton | ||
| 2011-08-13 11:59 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 12:15 -!- pjstevns(~pjstevns@helpoort.xs4all.nl) has joined #tryton | ||
| 2011-08-13 12:15 -!- pjstevns(~pjstevns@helpoort.xs4all.nl) has left #tryton | ||
| 2011-08-13 13:04 -!- yangoon(~mathiasb@p54B4FCCC.dip.t-dialin.net) has left #tryton | ||
| 2011-08-13 13:05 -!- yangoon(~mathiasb@p54B4FCCC.dip.t-dialin.net) has joined #tryton | ||
| 2011-08-13 13:14 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 14:19 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 14:31 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 14:59 -!- ikks(~ikks@186.28.69.11) has joined #tryton | ||
| 2011-08-13 15:07 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 16:49 -!- ciupicri(~ciupicri@81.180.234.249) has joined #tryton | ||
| 2011-08-13 17:17 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton | ||
| 2011-08-13 17:30 -!- alimon(~alimon@187.156.94.122) has joined #tryton | ||
| 2011-08-13 17:43 -!- serpent223(~digger@teralink.net) has joined #tryton | ||
| 2011-08-13 18:15 -!- alimon(~alimon@187.156.94.122) has joined #tryton | ||
| 2011-08-13 19:11 -!- pjstevns(~pjstevns@helpoort.xs4all.nl) has joined #tryton | ||
| 2011-08-13 19:11 -!- pjstevns(~pjstevns@helpoort.xs4all.nl) has left #tryton | ||
| 2011-08-13 19:42 -!- elbenfreund(~elbenfreu@f055208249.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 19:48 <version2beta> cedk: Got time for more security discussion? This time about the SSL communication between client and server - looking for clarification on how it works. | ||
| 2011-08-13 19:48 <cedk> version2beta: ok | ||
| 2011-08-13 19:50 <version2beta> cedk: The client has a ca_cert file available and the built-in ssl library accepts it if it's there. I can't tell (due to my own python ignorance) on the server if it's pysocket.py or xmlrpc.py that's responsible for setting up the connection. pysocket.py uses the ssl library built in beginning in 2.6, and xmlrpc.py uses the OpenSSL library. So I'm wondering if either of them are already able to validate the identity of the (client) peer? | ||
| 2011-08-13 19:53 <cedk> version2beta: on the server side all SSL connection is managed by OpenSSL module | ||
| 2011-08-13 19:53 <cedk> version2beta: and no the server doesn't validate the identity of the client because it is done with the login/password | ||
| 2011-08-13 19:54 <version2beta> cedk: what does pysocket.py do? Is that only used when the client and server are on the same machine? Please forgive my ignorance - long time since I programmed sockets. | ||
| 2011-08-13 19:55 <version2beta> cedk: It appears that the client is already capable of using an X509 certificate, which would (with username/password) provide two-factor authentication, right? | ||
| 2011-08-13 19:55 <cedk> version2beta: pysocket implement the netrpc protocol | ||
| 2011-08-13 19:55 <version2beta> cedk: pysocket - thank you. | ||
| 2011-08-13 19:55 <cedk> version2beta: no the client doesn't use X509 certificate | ||
| 2011-08-13 19:56 <cedk> version2beta: it has a CA file to check the certificate of the server | ||
| 2011-08-13 19:56 <cedk> version2beta: if you really want this kind of auth, I suggest you to use a VPN | ||
| 2011-08-13 19:57 <version2beta> cedk: Ah - I see, yes, it's ca_certs that are set, not certfile. | ||
| 2011-08-13 19:58 <version2beta> cedk: Yes, I would use a VPN for this level of auth. Still working on yesterday's conversation and exploring whether the presence of pki key pairs might be used for two-factor authentication. | ||
| 2011-08-13 20:00 <version2beta> cedk: Thank you for your help. | ||
| 2011-08-13 20:00 <cedk> version2beta: I guess you could patch the client to use a certificate and the server to validate it | ||
| 2011-08-13 20:01 <version2beta> cedk: Patching isn't nice - breaks updates too much. I'd either want to convince you to support it, or make it work as a plugin (no idea if that's even possible.) ;-) | ||
| 2011-08-13 20:05 <cedk> version2beta: indeed I don't understand the requirement, the current design is the common way which is used for net-banking etc. | ||
| 2011-08-13 20:07 -!- bechamel(~user@host-85-201-144-79.brutele.be) has joined #tryton | ||
| 2011-08-13 20:10 <version2beta> cedk: For network communication I have no problem with it at all. I might choose a VPN only to limit the publicly accessible ports. For files, though, I feel confident that the appropriate level of security is that the decryption key does not live on the same server as the encrypted files, and that decryption of the files (not access to decrypted files) must be limited by the user's access rights. I know it goes further than many systems would, but it's | ||
| 2011-08-13 20:10 <version2beta> really the basis of GPG. | ||
| 2011-08-13 20:11 <version2beta> cedk: But we had that conversation yesterday, and I got a lot out of it. I appreciate your feedback. Today's question really was just a tangent. | ||
| 2011-08-13 20:11 <version2beta> cedk: Now I need to go pick up the kids. ;-) | ||
| 2011-08-13 20:17 <cedk> version2beta: ok indeed I'm just affraid that the GUI will become complicate with such feature but if you can do it simple why not | ||
| 2011-08-13 20:43 -!- elbenfreund(~elbenfreu@f055208249.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 21:32 -!- elbenfreund(~elbenfreu@f055208249.adsl.alicedsl.de) has joined #tryton | ||
| 2011-08-13 22:46 -!- okko1(~okko@dhcp-077-251-140-095.chello.nl) has joined #tryton |
Generated by irclog2html.py 2.17.3 by Marius Gedminas - find it at https://mg.pov.lt/irclog2html/!