Server uses a self signed CA, plist set to ignore, still showing issues.

[lucid772]

Please see the comments and issue at lindegroup/autopkgr#178 (comment)

[eahrold]

I may have stumbled on to a suspicious character.
http://bugs.python.org/msg128635

[eahrold]

And this makes it seem unavoidable.
https://github.com/kennethreitz/requests/issues/2022

[sheagcraig]

Two different issues here.

For some reason it really does seem to be ignoring the JSS_VERIFY_SSL setting. It shouldn't bother with it at all.

I suppose if you're up for it, you could double-check and do this in terminal:

cd /Library/Python/2.7/site-packages
python

# Now in python interpreter

>>> import jss

# Make a JSS object to test SSL being turned off with:

>>> j = jss.JSS(url='https://yoururlandport:8443', user='privilegedusername', password='password', ssl_verify=False)

>>> j.Package()

# Should return the packages on your JSS (no tracebacks...)

(Replace the URL, user, and password parameters with the correct data ;)
If it spews out the traceback about the SSL again, clearly something is broken that I'm missing in the configuration code.

As for the actual SSL issue, I suggest looking here:
https://github.com/sheagcraig/python-jss#ssl-errors

and adding/upgrading the packages mentioned to see if the problem magically vanishes. I don't know if that will help, but based on the requests issue #2022, it may.

Just in case you're like, "huh?":

sudo easy_install pyOpenSSL
sudo easy_install ndg-httpsclient
sudo easy_install pyasn1

Feel free to use pip if you have it.

[lucid772]

Even after I install each of the recommended easy_installs, I get the following result in terminal:

Traceback (most recent call last):
File "", line 1, in
File "jss/jss.py", line 377, in Package
return self.factory.get_object(Package, data)
File "jss/jss.py", line 451, in get_object
result = self.jss.get(url)
File "jss/jss.py", line 193, in get
response = self.session.get(url)
File "jss/contrib/requests/sessions.py", line 460, in get
return self.request('GET', url, *_kwargs)
File "jss/contrib/requests/sessions.py", line 448, in request
resp = self.send(prep, *_send_kwargs)
File "jss/contrib/requests/sessions.py", line 554, in send
r = adapter.send(request, **kwargs)
File "jss/contrib/requests/adapters.py", line 417, in send
raise SSLError(e, request=request)
jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

[sheagcraig]

?Geez. So it looks like it's not ignoring the verify settings.

---

From: lucid772 notifications@github.com
Sent: Friday, October 31, 2014 12:09 PM
To: sheagcraig/jss-autopkg-addon
Cc: Shea Craig
Subject: Re: [jss-autopkg-addon] Server uses a self signed CA, plist set to ignore, still showing issues. (#9)

Even after I install each of the recommended easy_installs, I get the following result in terminal:

Traceback (most recent call last):
File "", line 1, in
File "jss/jss.py", line 377, in Package
return self.factory.get_object(Package, data)
File "jss/jss.py", line 451, in get_object
result = self.jss.get(url)
File "jss/jss.py", line 193, in get
response = self.session.get(url)
File "jss/contrib/requests/sessions.py", line 460, in get
return self.request('GET', url, *_kwargs)
File "jss/contrib/requests/sessions.py", line 448, in request
resp = self.send(prep, *_send_kwargs)
File "jss/contrib/requests/sessions.py", line 554, in send
r = adapter.send(request, **kwargs)
File "jss/contrib/requests/adapters.py", line 417, in send
raise SSLError(e, request=request)
jss.contrib.requests.exceptions.SSLError: [Errno 1] _ssl.c:504: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-61284113.

This communication (including any attachments) is intended for the use of the intended recipient(s) only and may contain information that is confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication. Any views or opinions presented are solely those of the author.

[sheagcraig]

Can you verify the session verify setting is True (after setting up the JSS object as per the above instructions):

>>> j.session.verify
True

[lucid772]

As you can likely guess, it is returning False.

Note that I tried this by direct JSS IP, CNAME, and FQDN with the same result.

[sheagcraig]

What...

That's definitely an issue with Requests then. I'll see if there's an update that needs to get applied or any issues filed on that. As you can imagine, with verify=False it should be ignoring SSL entirely. Or at least that was my understanding of it.

[lucid772]

I agree with you, which makes it even worse when I get that silly "SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" error after it tells me that. Additionally, while I am the one working on this, I know three others that are having the same issue personally.

Is there a better way, IE simply apply an SSL cert to tomcat? I am able to do this, but I am worried about that meaning I will need to re-enroll all my devices as well :(

Thanks again for all the help.

[sheagcraig]

?Having to re-enroll all of your devices is not trivial! That being said, I would think you would want SSL on just to be safe.

I think the safest thing to do is to set up a testing server and ensure that adding the cert would solve it. I wouldn't force a re-enrollment unless you were sure that you wanted to go that route.

---

From: lucid772 notifications@github.com
Sent: Friday, October 31, 2014 12:40 PM
To: sheagcraig/jss-autopkg-addon
Cc: Shea Craig
Subject: Re: [jss-autopkg-addon] Server uses a self signed CA, plist set to ignore, still showing issues. (#9)

I agree with you, which makes it even worse when I get that silly "SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure" error after it tells me that. Additionally, while I am the one working on this, I know three others that are having the same issue personally.

Is there a better way, IE simply apply an SSL cert to tomcat? I am able to do this, but I am worried about that meaning I will need to re-enroll all my devices as well :(

Thanks again for all the help.

Reply to this email directly or view it on GitHubhttps://github.com//issues/9#issuecomment-61289513.

This communication (including any attachments) is intended for the use of the intended recipient(s) only and may contain information that is confidential, privileged or legally protected. Any unauthorized use or dissemination of this communication is strictly prohibited. If you have received this communication in error, please immediately notify the sender by return e-mail message and delete all copies of the original communication. Any views or opinions presented are solely those of the author.

[lucid772]

Sorry if I implied somehow it was trivial... but yes I would setup a test environment first. I do think this issue may need to be solved for other though, as it appears to clearly be ignoring the plist settings as mentioned prior.

I should note that this is not constant... Autopkgr DID run complete twice in the past without issue. Maybe I should reinstall and see if I get any difference in the result?

[eahrold]

These two seem to indicate that the issue is server side not client side

https://github.com/kennethreitz/requests/issues/2022
http://bugs.python.org/msg128635

[sheagcraig]

@lucid772 I'm at a loss on this one. It looks like it's an issue with Requests, as @eahrold has referenced above.

Now, that being said, while developing python-jss I used to have each API call perform a single GET, rather than what it is doing now, which is to use a session. When I would pull, for example, the full data on all of our policies (a ton of repeated GET requests), I would get the same SSL handshake error that you're experiencing, intermittently. I used to handle it by just waiting a couple of seconds and retrying, until it worked. However, once I started to use a session, it went away.

Of course, that was with verify=True.

Also, in those circumstances, it was definitely a 1/100 thing. It sounds like it happens every time you run.

[systemheld]

This issue is called by the fact that JAMF has disabled SSLv3 on JSS 9.61 to address the Poodle Attack. To fix that, simply go to /Library/Python/2.7/site-packages/jss/contrib/requests/packages/urllib3/util/ssl_.py and import PROTOCOL_TLSv1 in addition to PROTOCOL_SSLv23. Now go to line 86 and change return PROTOCOL_SSLv23 to return PROTOCOL_TLSv1.