Ruby and OpenSSL with SSH keys

One of the challenges of dealing with encryption is the management of keys. We have a SSH key, a PGP key (probably multiple), maybe a OpenSSL cert, perhaps another cert somewhere for S/MIME and maybe a ton more for various other purposes. This post is basically an addendum to my last File Encryption in Ruby with OpenSSL, but I will step through the code using an SSH key instead. This will minimize the amount of keys you have to manage and it will utilize a key that many people have readily available to them without the need to create yet another encryption key.

SSH Keys

On the chance that you do not have an ssh key (you really should you know) or you are using DSA keys you will need to create an RSA key with ssh-keygen.

home$ ssh-keygen -t rsa -b 2048 -N 'mypass'

Loading the SSH key in Ruby

Loading the SSH/RSA key is relatively straight forward. Instead of pointing to our generated RSA key from the last posting we will simply point it to the path of our SSH/RSA key and load it with the password we supplied during the ssh-keygen step. I will demonstrate in an irb session.

# Require the OpenSSL library
irb> require 'openssl'
# Load the SSH key from the default location (Linux/UNIX)
irb> key = OpenSSL::PKey::RSA.new(File.read("#{ENV['HOME']}/.ssh/id_rsa"),'mypass')

The generated public SSH/RSA key is not stored in PEM format so you cannot consume it with OpenSSL, but you can generate it from the private key and store it alongside the SSH formatted one.

# Write the PEM encoded public key alongside the SSH public key
irb> File.open("#{ENV['HOME']}/.ssh/id_rsa.pub.pem") do |f|
irb>     f.write(key.public_key.to_pem)
irb> end

So there you go. You can now load your SSH key for encryption/decryption purposes with the OpenSSL library and you won't have to worry about managing keys. All else remains the same and you can do everything that was done in my previous OpenSSL/Ruby posting.

Cheers!

File Encryption in Ruby with OpenSSL

Disclaimer: I am far from an expert on cryptography so there are probably a million things wrong with this. Any constructive criticism is always welcome... but be gentle ;-)

REQUIRED: Ruby 1.9 *because of new hash syntax.

For Starters....

I am often torn when programming between using libraries and following the DIY approach. On one hand you can accomplish a lot in a short time by including libraries that have the functionality you need and just bridging the gaps, but I am often left with the feeling of some loss-of-control and bloat. Obviously some library usage is inevitable, but I do like to take a minimalist approach to including external libraries because the management burden of updating libraries, the effort to make various libraries play together and because moving library-heavy applications between platforms can be... interesting. Most of all I like the learning that takes place when building it yourself. It was for this reason that I decided to see if I could effectively utilize the OpenSSL library that is typically part of a Ruby installation to create my own higher-level encryption/decryption class. Before we dive in I would like to layout the details of the application.

Password Management App

I have for years maintained a PGP encrypted file for my account passwords. I had the desire to centralize this and make it more web accessible. In order to do this I wanted assurance that the data was not only encrypted on the wire via SSL, but also at rest. I looked at various Ruby PGP/GPG libraries, but all of the ones I surveyed were wrappers around the GPG binary itself which didn't make it very web host friendly ( I planned on hosting it on Heroku with a Couchdb backend on Cloudant). That was when I decided to look at OpenSSL for file encryption since it is typically part of a Ruby installation and was available on Heroku. I also had the need for public-key encryption so a password store could be shared between two or more people (I share some accounts with my partner).

Take One... RSA

I thought I could simply use RSA encryption to meet all my needs and at first it worked quite well. Creating keys was straight forward and encryption/decryption worked well. One caveat is that the string passed to the FileEncryptor#encrypt_string method cannot be larger than the key size + PKCS padding size (11 bytes). So for a 128 byte (1024 bit) key the string should only be 117 bytes (see String#size).



This seemed to work quite well until I remembered that I needed to have the encrypted data be readable by multiple parties. I then had to change my approach and decided to use a symmetric AES key that is then shared between the multiple parties and each person encrypts the key with their RSA public key.

Take Two... RSA + AES

In order to accomplish secure use of the AES key we start out the same way as the previous solution by creating a RSA key. It will only be used to secure AES keys that we use to protect certain data stores. So if I have a data store I want to share with my brother I encrypt the data store with an AES key then I encrypt that key with my public RSA key and my brother's public RSA key. Now both he and I can access anything in that store and the AES key is still secure from prying eyes. Here is an overview of the steps taken before I post the code.

1. Create a RSA key-pair
2. Create an AES key to encrypt the data store
3. Encrypt the AES key with your RSA public key
4. To give access to the data store encrypt the AES key with the person's public RSA key send them back the cipher-text.

And here is the class I wrote to make this work:



Below is a demonstration of the use of this class to accomplish the needs I had for my password protector application. I am aware that this class needs some refactoring and it's a bit annoying to have to pass the AES key file to the methods, but logically it is working the way I had hoped.

fe = Encryptor.new('mysecret')

aesfile = 'aeskey.sec'

fe.gen_aes_key(aesfile)

etxt = fe.aes_encrypt('this is a test', aesfile)

txt = fe.aes_decrypt(etxt, aesfile)

pub_key = < Assume I got someone's public RSA Key somehow >

fe.give_aes_key(aesfile, pub_key)

Like I mentioned, this code needs to be cleaned up a bit, but it gives me all of the functionality I need to build my application and it doesn't require any external libraries except OpenSSL and YAML which are typically standard in any Ruby installation.

Hopefully someone finds this post useful and if you have any additions, corrections, criticisms please post them below. Feedback is always welcome.

Cheers!

Using Ruby with Zenoss - Part 2

This is the second installment of Using Ruby with Zenoss.  This posting will mainly focus on using the library.  If you have not read Part 1, I would strongly recommend going there first in order to make sure your environment is set up correctly.

In creating the Zenoss library for Ruby I have tried to keep the interface to the programmer fairly similar to the Python API.  It is somewhat simplified because the depth of modules and classes don't map one-for-one to a REST client world.  There is still much to be in its implementation, but here are a few examples of what you can do with the library today.

Requiring the gem

!!! You need to have at least version 0.0.4 of the gem installed. !!!

Make sure you add this to any of the following examples:

require 'rubygems' # if you're using gems
require 'zenoss'

Getting Started

You need to tell zenoss_client where to point and how to authenticate. To do that use the following code:

# Set the base uri that we talk to Zenoss with. Your host will
# be unique but the port will probably be 8080 unless you proxy
# it through 80.
Zenoss.uri 'https://:/zport/dmd/'

# Add the appropriate credentials
Zenoss.set_auth('user','pass')

Getting a list of devices

Now that we're set up we can get down to it. One of the primary things that I find myself doing is managing devices through the REST interface. You need a starting point so let's get the base Device class ( /zport/dmd/Devices ):

devices = Zenoss.devices

You can think of the 'Zenoss' object as a slimmed down equivalent of 'dmd' in the zendmd Python interface.

If you want to start at a DeviceClass deeper in the tree you can do so by passing the path to DeviceClass:

linux = Zenoss::Model::DeviceClass.new('/Devices/Server/Linux/')

Once you have your DeviceClass you can list the devices beneath it like so:

subdevs = linux.get_sub_devices

Device Info

Using the Device Array from the last step, we'll take the first device and get some information from it.

mydev = subdevs.first

# Get the status id
mydev.get_status

# Get the icon associated with this status
mydev.get_status_img_src(mydev.get_status)

# Get uptime
mydev.sys_uptime

# Fetch some RRD Values
dps = mydev.get_rrd_data_points
dsnames = []
dsnames << dps[1].name
dsnames << dps[2].name
mydev.get_rrd_values(dsnames)
# => {"laLoadInt1_laLoadInt1"=>"252.27000000000001", "laLoadInt15_laLoadInt15"=>"255.86000000000001"}

Systems

The library has basic support for Systems now. It's mainly just the ability to create and delete subsystems. More support is forthcoming.

# Fetch the base '/Systems' System
systems = Zenoss.systems

# Create a new subsystem
ltst = systems.add_subsystem('linuxtst')

# delete the newly created System
ltst.delete!

That's it, go play

That's a quick introduction to the Zenoss Ruby library. I'm adding new functionality all the time so check for updates often. The code is up on github at http://github.com/zenchild/zenoss_client so if you want to fork it and help out with development you're welcome to do so. If you're not interested in developing it but would like to see a feature added please comment below or open up a ticket on github and I'll get to it as time allows. I hope you find the library useful.

Addendum: The RDocs are available at http://rdoc.info/projects/zenchild/zenoss_client

Cheers,

Dan

Using Ruby with Zenoss - Part 1

I have been using Zenoss now for over a year and for the most part have been quite happy with it. It's quite customizable and you can find a way to pretty much monitor anything if you put some thought into it. However, my one point of contention has been with the REST interface. Most things work as you would expect, but somethings blow up and don't give you a very good reason except for a nice Zope stack-trace.  Prior to using Zenoss, I had very little experience with Zope so some of my issues were simply just lack of knowledge of how REST methods were called from within it.  I wrongly thought that there was a translation layer that sat between the web user and the back-end to marshal and unmarshal datatypes.  This does not seem to be what is going on.  So if I can sum up all of the issues that I struggled with it's this:

•  If the Python method you're calling on the back-end is expecting something other than a string you're probably going to have issues.

So, coupled with my poor knowledge of Zope and my frustration on how to call REST methods in a consistent way, I decided to create a library for Zenoss in Ruby.  My goal was to create that middle layer to correctly marshal and unmarshal data-types.

I chose Ruby because I find it a fun language to program in and well, I guess that pretty much sums it up ;-)

 In order for the library to work there is one thing that you need to do on the Zenoss/Zope side.  To marshal data-types into Python you most certainly need to do it in Python so we have to add a custom script to Zope.

1. Go to the Zope Management page:
• http://zenoss:8080/zport/dmd/manage
2.  Select "Script (Python)" from the upper-right drop-down
• ID = callZenossMethod
• "Add and Edit"
• Title = "Work around for unsupported Zenoss methods"
• Parameter List = methodName
• Clear out the code contents from the text box and cut-and-paste the code found here:
• http://gist.github.com/343627
• "Save Changes"

Once the custom Python is in place simply install the ruby gem:

• gem install -r zenoss_client

That's it, you should be ready to roll.  Check back here soon for the second part of this post for example usage of the zenoss_client library.

---

addendum: Link to zenoss_client source code: zenoss_client

Closing Javascript Alerts in Selenium Tests

I have been plagued some time now with a problem in my Selenium testing, the dreaded modal Javascript alert generated from the "onload" event (See the Selenium FAQ for more info). OK, maybe dreaded is a bit strong of a word, but it has been quite frustrating in trying to automate vendor provided code that we cannot change. Finally there is a fix.

Jason Huggins, the creator of Selenium, presented at JSConf 2009 and demonstrated a way around Javascript alerts that Selenium cannot handle. After speaking with Jason, he provided me with the original code snippet from Aaron Boodman and I have created a Firefox extension for general use that can be downloaded from my Github site.

The magic happens in a function called alertClose. If all you need to do is close an alert it should work unmodified for you. If you need to do something a little more exotic you may need to edit the subject.location which specifies what types of windows it closes. By default it points to chrome://global/content/commonDialog.xul, which is the chrome type for alert boxes. There is a Mozillazine article that has a listing of the various types of chrome windows if you need to customize.



So there you have it. A very simple way to get around Javascript alerts. Hopefully this solution is only temporary and the new WebDriver code being integrated into Selenium 2 will work around it in a more elegant way.

Converting from Soap4r to Handsoap

A neat little project was mentioned to me the other day in a conversation on GitHub with user JRun. It's called Handsoap and it has some very interesting features that look to make programming SOAP clients a bit easier.  I've had a couple days to look at it and decided to try and port some code to it.  My first impressions have been fairly positive.  It gives you tremendous power on how you handle your SOAP requests and responses, but I find it just as cumbersome as Soap4r in it's handling of complex types.  I think Soap4r might gain out in this category just by the shear amount of code that gets generated for you.  That said, Handsoap is fast, simple and I will probably use it in future projects that require SOAP.

One thing I did find much easier to deal with is SOAP headers.  In Soap4r I had to create an entire class just to add an element to the SOAP header.  This was required for my Viewpoint project to add the RequestServerVersion element to the header.  With Handsoap all I had to do was add the following to the 'on_create_document' hook:


header = doc.find('Header')
header.add('t:RequestServerVersion') {|rsv|
rsv.set_attr('Version','Exchange2007_SP1')
}


If you have programmed with Soap4r before I would encourage you to give Handsoap a try.

Convert your Exchange Calendar to iCalendar with Ruby

This example is one that is already in the README, but I thought I'd post it here anyway.  The reasons for converting an Exchange calendar to ical may be many so I won't surmise why you want to do this.  I for one use it to export out to my Orage calendar.

So without further ado ...