Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Support SSL and self-signed certs #9

Closed
jacob-meacham opened this issue Feb 12, 2017 · 1 comment
Closed

Support SSL and self-signed certs #9

jacob-meacham opened this issue Feb 12, 2017 · 1 comment
Assignees
Milestone

Comments

@jacob-meacham
Copy link

jacob-meacham commented Feb 12, 2017

First off, this is a great tool!

I had a couple of issues when running it, which I'll split up into two separate tickets. The first is that I was not able to connect to a DB that requires an SSL connection without making a change to testers.py#Tester#get_connection to

return pymongo.MongoClient(fqdn, port, serverSelectionTimeoutMS=1000, ssl=True, ssl_cert_reqs=ssl.CERT_NONE)

pymongo does support passing these params in the uri (see http://api.mongodb.com/python/current/examples/tls.html) but mongoaudit seems to be stripping them out.

I also found the serverSelectionTimeout of 1 ms to be too short. I'm happy to make these changes - let me know if you have a preferred approach - I would change the uri parsing so that the extra parameters are not stripped.

@aesedepece
Copy link
Member

Hi @jacob-meacham,

TLS/SSL is now supported and implemented by three different tests:

  1. Check if TLS/SSL support is available
  2. Check if TLS/SSL is enabled
  3. Check if server certificate is completely valid (not self-signed)

We would love you to test the patch and confirm if it works for you. Feel free to reopen this issue if it does not!

Thanks a lot for your interest in mongoaudit and for your valuable feedback.

# for free to join this conversation on GitHub. Already have an account? # to comment
Projects
None yet
Development

No branches or pull requests

2 participants