Remove Anonymous Diffie-Hellman default configuration

[chris-allan]

Since OMERO 5.6.2 (released in July, 2020) we have been recommending the use of omero certificates to ensure that all OMERO server installations have, at minimum, a self-signed certificate. Consequently, I think it's time we removed the Anonymous Diffie-Hellman (ADH) default configuration from omero-py.

We know that the detection is error prone and that ADH support is not present in newer OpenSSL versions. So this change also helps us seamlessly support newer Linux distributions such as Ubuntu 22.04 as well as CentOS/RHEL/Rocky 9 and allows us to utilize manylinux wheels where OpenSSL version mismatches were making detection an ugly mess.

Cipher suites and minimum TLS version can still be enforced by server configuration.

[chris-allan]

See also:

• Changelog notes for 5.8.0 #248
• Add support for mutliple Ice TLS protocols #251
• Prep and migrate omero-documentation#2142
• Reactivate CentOS8 and Ubuntu 20.04 omero-install#246

/cc @sbesson, @stick, @atTODO

[joshmoore]

I haven't had a chance to look into this more deeply, but it looks like this may be related to all tests failing: https://merge-ci.openmicroscopy.org/jenkins/job/OMERO-test-integration/1241/

[jburel]

It looks like omero-certificates was not installed. I have adjusted the job and restarted it

[sbesson]

👍 might be related to ome/devspace#195 which adds the minimal configuration to use omero certificates on the CI OMERO-test-integration server (currently this is only set for the OMERO-server deployment).

[jburel]

@sbesson I think it is.

[jburel]

https://merge-ci.openmicroscopy.org/jenkins/job/OMERO-test-integration/1249/ is green

[sbesson]

Tested locally on OSX 12.6 using a Python 3.8/OpenSSL 1.1.1q environment for the server:

(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero config get
omero.data.dir=/Users/sbesson/OMERO.repo
(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero admin start
WARNING: Your server has not been configured for production use.
See https://docs.openmicroscopy.org/omero/latest/sysadmins/server-performance.html?highlight=poolsize
for more information.
No descriptor given. Using etc/grid/default.xml
Waiting on startup. Use CTRL-C to exit

And a Python 3.10/OpenSSL 3.0.5 environment for the client with this PR included. Without certificates, a login will fail with a connection error:

(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % pip install git+https://github.com/ome/omero-py@refs/pull/336/merge
Collecting git+https://github.com/ome/omero-py@refs/pull/336/merge
  Cloning https://github.com/ome/omero-py (to revision refs/pull/336/merge) to /private/var/folders/kz/cl8brv1s5z3g520lqnjx63nh0000gn/T/pip-req-build-lizm_12u
  Running command git clone --filter=blob:none --quiet https://github.com/ome/omero-py /private/var/folders/kz/cl8brv1s5z3g520lqnjx63nh0000gn/T/pip-req-build-lizm_12u
  WARNING: Did not find branch or tag 'refs/pull/336/merge', assuming revision or ref.
  Running command git fetch -q https://github.com/ome/omero-py refs/pull/336/merge
  Running command git checkout -q 0820da9ede620adacb5e219a677c6ba4fbac44e4
  Resolved https://github.com/ome/omero-py to commit 0820da9ede620adacb5e219a677c6ba4fbac44e4
  Preparing metadata (setup.py) ... done
Requirement already satisfied: appdirs in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (1.4.4)
Requirement already satisfied: future in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (0.18.2)
Requirement already satisfied: numpy in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (1.23.3)
Requirement already satisfied: Pillow in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (9.2.0)
Requirement already satisfied: PyYAML in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (6.0)
Requirement already satisfied: zeroc-ice<3.7,>=3.6.4 in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (3.6.5)
Requirement already satisfied: requests in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from omero-py==5.12.2.dev0) (2.28.1)
Requirement already satisfied: urllib3<1.27,>=1.21.1 in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from requests->omero-py==5.12.2.dev0) (1.26.12)
Requirement already satisfied: certifi>=2017.4.17 in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from requests->omero-py==5.12.2.dev0) (2022.9.24)
Requirement already satisfied: idna<4,>=2.5 in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from requests->omero-py==5.12.2.dev0) (3.4)
Requirement already satisfied: charset-normalizer<3,>=2 in /opt/miniconda3/envs/omeropy/lib/python3.10/site-packages (from requests->omero-py==5.12.2.dev0) (2.1.1)
Building wheels for collected packages: omero-py
  Building wheel for omero-py (setup.py) ... done
  Created wheel for omero-py: filename=omero_py-5.12.2.dev0-py3-none-any.whl size=2792909 sha256=eb80f95bbe28d3dd13bf252f4ecba8c7ae71bf2cd6fcb03d0c602f07feed463c
  Stored in directory: /private/var/folders/kz/cl8brv1s5z3g520lqnjx63nh0000gn/T/pip-ephem-wheel-cache-ykkmq19z/wheels/ea/27/4d/8caa50cd152019646733624c1d2ef2a1866790acece19777d0
Successfully built omero-py
Installing collected packages: omero-py
Successfully installed omero-py-5.12.2.dev0
(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % python -c 'import omero_version; print(omero_version.omero_version)'
5.12.2.dev0
(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero login root@localhost -w omero                
Previously logged in to localhost:4064 as root
InternalException: Failed to connect: Ice.ConnectionLostException:
recv() returned zero

After enabling self-signed SSL certificates using omero certificates:

(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero admin stop   
Waiting on shutdown. Use CTRL-C to exit
.%                                                                              (omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero certificates
OpenSSL 1.1.1q  5 Jul 2022
certificates created: /Users/sbesson/OMERO.repo/certs/server.pem /Users/sbesson/OMERO.repo/certs/server.p12
(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero config set omero.glacier2.IceSSL.Ciphers
(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero config get 
omero.certificates.commonname=localhost
omero.certificates.key=server.key
omero.certificates.owner=/L=OMERO/O=OMERO.server
omero.data.dir=/Users/sbesson/OMERO.repo
omero.glacier2.IceSSL.CAs=server.pem
omero.glacier2.IceSSL.CertFile=server.p12
omero.glacier2.IceSSL.DefaultDir=/Users/sbesson/OMERO.repo/certs
omero.glacier2.IceSSL.Password=********
omero.glacier2.IceSSL.ProtocolVersionMax=TLS1_2
omero.glacier2.IceSSL.Protocols=TLS1_0,TLS1_1,TLS1_2
(omeroserver) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero admin start
WARNING: Your server has not been configured for production use.
See https://docs.openmicroscopy.org/omero/latest/sysadmins/server-performance.html?highlight=poolsize
for more information.
No descriptor given. Using etc/grid/default.xml
Waiting on startup. Use CTRL-C to exit

both a local connection and a simple import work as expected

(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero login root@localhost -w omero
Previously logged in to localhost:4064 as root
Created session for root@localhost:4064. Idle timeout: 10 min. Current group: system
(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % touch test.fake
(omeropy) sbesson@Sebastiens-MacBook-Pro-2 ~ % omero import test.fake
Downloading https://downloads.openmicroscopy.org/omero/latest/OMERO.java.zip
Using OMERO.java-5.6.5-ice36-b233
Using session for root@localhost:4064. Idle timeout: 10 min. Current group: system
2022-10-12 09:24:41,796 254        [      main] INFO          ome.formats.importer.ImportConfig - OMERO.blitz Version: 5.5.12
2022-10-12 09:24:41,815 273        [      main] INFO          ome.formats.importer.ImportConfig - Bioformats version: 6.10.0 revision: f8b46c2458c43cffdf5bc67cc4bf9dfc6e93167b date: 31 May 2022
2022-10-12 09:24:41,879 337        [      main] INFO   formats.importer.cli.CommandLineImporter - Log levels -- Bio-Formats: ERROR OMERO.importer: INFO
2022-10-12 09:24:42,340 798        [      main] INFO      ome.formats.importer.ImportCandidates - Depth: 4 Metadata Level: MINIMUM
2022-10-12 09:24:42,411 869        [      main] INFO      ome.formats.importer.ImportCandidates - 1 file(s) parsed into 1 group(s) with 1 call(s) to setId in 69ms. (71ms total) [0 unknowns]
2022-10-12 09:24:42,450 908        [      main] INFO       ome.formats.OMEROMetadataStoreClient - Attempting initial SSL connection to localhost:4064
2022-10-12 09:24:42,897 1355       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Insecure connection requested, falling back
2022-10-12 09:24:43,345 1803       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Pinging session every 300s.
2022-10-12 09:24:43,353 1811       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Server: 5.6.5
2022-10-12 09:24:43,353 1811       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Client: 5.5.12
2022-10-12 09:24:43,353 1811       [      main] INFO       ome.formats.OMEROMetadataStoreClient - Java Version: 11.0.15
2022-10-12 09:24:43,353 1811       [      main] INFO       ome.formats.OMEROMetadataStoreClient - OS Name: Mac OS X
2022-10-12 09:24:43,353 1811       [      main] INFO       ome.formats.OMEROMetadataStoreClient - OS Arch: x86_64
2022-10-12 09:24:43,354 1812       [      main] INFO       ome.formats.OMEROMetadataStoreClient - OS Version: 12.6
2022-10-12 09:24:48,816 7274       [2-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - FILESET_UPLOAD_PREPARATION
2022-10-12 09:24:49,233 7691       [2-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - FILESET_UPLOAD_START
2022-10-12 09:24:49,246 7704       [3-thread-1] INFO   ts.importer.transfers.UploadFileTransfer - Transferring /Users/sbesson/test.fake...
2022-10-12 09:24:49,275 7733       [3-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - FILE_UPLOAD_STARTED: /Users/sbesson/test.fake
2022-10-12 09:24:49,310 7768       [3-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - FILE_UPLOAD_COMPLETE: /Users/sbesson/test.fake
2022-10-12 09:24:49,729 8187       [2-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - FILESET_UPLOAD_END
2022-10-12 09:24:49,836 8294       [2-thread-1] INFO   ormats.importer.cli.LoggingImportMonitor - IMPORT_STARTED Logfile: 723
2022-10-12 09:24:50,224 8682       [l.Client-1] INFO   ormats.importer.cli.LoggingImportMonitor - METADATA_IMPORTED Step: 1 of 5  Logfile: 723
2022-10-12 09:24:50,439 8897       [l.Client-0] INFO   ormats.importer.cli.LoggingImportMonitor - PIXELDATA_PROCESSED Step: 2 of 5  Logfile: 723
2022-10-12 09:24:51,004 9462       [l.Client-1] INFO   ormats.importer.cli.LoggingImportMonitor - THUMBNAILS_GENERATED Step: 3 of 5  Logfile: 723
2022-10-12 09:24:51,022 9480       [l.Client-0] INFO   ormats.importer.cli.LoggingImportMonitor - METADATA_PROCESSED Step: 4 of 5  Logfile: 723
2022-10-12 09:24:51,035 9493       [l.Client-1] INFO   ormats.importer.cli.LoggingImportMonitor - OBJECTS_RETURNED Step: 5 of 5  Logfile: 723
2022-10-12 09:24:51,114 9572       [l.Client-0] INFO   ormats.importer.cli.LoggingImportMonitor - IMPORT_DONE Imported file: /Users/sbesson/test.fake
Image:351
Other imported objects:
Fileset:1

==> Summary
1 file uploaded, 1 fileset created, 1 image imported, 0 errors in 0:00:02.309

This confirms the statement that the biggest impact of this change will be for connections to servers where no SSL certificates have been configured as shown by #336 (comment) standard server installation instructions now points to the installation of self-signed certificates via omero certificates across all supported platforms. All production environments managed by OME incl. IDR, the OME demo servers have these certificates configured and there are a few remaining places(like the CI integration server above which are lacking it and should be reviewed.

No objection from my side to moving forward with this change with two additional comments:

• although this is not a breaking change, we will want the release notes to be explicit about the impact of this change and in particular the fact new OMERO.py versions will expect some server-side configuration
• server configuration and hardening:in addition to the installation instructions, I wonder if we should start emitting warnings when starting servers without SSL certificates configured - similar to

  omero-py/src/omero/plugins/admin.py

  Lines 793 to 797 in 689a544

  	self.ctx.out(
  	"WARNING: Your server has not been configured for production "
  	"use.\nSee https://docs.openmicroscopy.org/omero/latest/"
  	"sysadmins/server-performance.html?highlight=poolsize\n"
  	"for more information.")

[will-moore]

Certificates aren't mentioned on https://omero.readthedocs.io/en/stable/sysadmins/unix/server-install-homebrew.html - Are we still supporting that?

[sbesson]

Are we still supporting that?

I was able to start a development server on my Intel OS X laptop following the instructions above. Installing self-signed SSL certificates was definitely a requirement for performing imports and requires some adjustements to the cipher configuration - ome/omero-certificates#24

On M1 laptops, the situation is probably more unclear and in particular, I doubt the zeroc-ice@3.6 formula works at all.

Answering your support question, my personal opinion is that the OS X server deployment workflow is niche (not recommended for production and possibly only used by a handful of devs), fairly brittle and costly to maintain especially the new arm64 architecture. There is a reasonable argument for dropping support and removing it from the installation documentation fully (with an accompanying justification)

[jburel]

https://omero.readthedocs.io/en/stable/sysadmins/unix/server-install-homebrew.html has not been updated for a long time. The last change to https://github.com/ome/omero-install/tree/develop/osx was 5 years ago.
I agree with @sbesson, we should remove it.

[joshmoore]

Generally, 👍 but my primary question is the overall roll out plan. What are the ordered steps?

@sbesson

InternalException: Failed to connect: Ice.ConnectionLostException:
recv() returned zero

Bit of a pondering, but if we think this is going to happen in the wild, I wonder if it's possible to detect that this is due to missing certs and point to a documentation page.

@sbesson although this is not a breaking change,

I'm not sure I agree with that considering pip install -U omero-py could lead to a lock out for a user.

@sbesson I wonder if we should start emitting warnings when starting servers without SSL certificates configured

👍 and/or simply prevent starting the server.

@will-moore Certificates aren't mentioned on ...

As part of the plan, I'd say either it's not possible to get a non-certificated server or every installation instruction needs a clear pointer.

[sbesson]

I'm not sure I agree with that considering pip install -U omero-py could lead to a lock out for a user.

Definitely impactful. Maybe let me rephrase my statement: this PR does not introduce any backwards incompatible API change in the sense that there is not much you can do client-side to fix a connection broken by an upgrade and the issue need to be mitigated server-side. In that sense, I am not convinced incrementing a major version number would help or be meaningful. As you mentioned, being able to catch these exceptions and send a meaningful error message pointing at the certs installation server-side would be a nice to-have.

👍 and/or simply prevent starting the server.

Also a more advanced possibility which goes along the proposal in ome/omero-certificates#26 to make the certificates generation part of the server.

[joshmoore]

In that sense, I am not convinced incrementing a major version number would help or be meaningful.

Agreed, especially since the major version semantics are still unclear here, but I wouldn't put this in a patch release.

[chris-allan]

Bit of a pondering, but if we think this is going to happen in the wild, I wonder if it's possible to detect that this is due to missing certs and point to a documentation page.

Certainly possible to cook up our version of sslpoke but definitely not easy as we'd have to step outside of the Ice black box to do so and the testing would have to be very thorough. It is not even viable at the moment to programmatically interrogate which version of OpenSSL is being used by Ice (it may be different than the one the Python ssl module itself is using; which is always OpenSSL irrespective of platform) or even if OpenSSL is being used by Ice at all (macOS or Windows).

[joshmoore]

Understood, @chris-allan. I was (likely naively) thinking the Ice exception might provide some of this context.

[imagesc-bot]

This pull request has been mentioned on Image.sc Forum. There might be relevant details there:

https://forum.image.sc/t/release-of-omero-py-5-13-0/74237/1

[imagesc-bot]

This pull request has been mentioned on Image.sc Forum. There might be relevant details there:

https://forum.image.sc/t/omero-login-ssl-error-dh-key/79574/12