DCOM authentication level enforcement

[ldariva]

I notice that you use the dll from gray-box (http://gray-box.net/). This dll is not compatible with the nem DCOM patch that force the minimun level of authentication. Is there any other dll that is compatible with this new requirements? I believe that gray-box won't release a new version of this dll as it is a russian based company and may be suffering with the current situation on Europe.

https://support.microsoft.com/en-us/topic/kb5004442-manage-changes-for-windows-dcom-server-security-feature-bypass-cve-2021-26414-f1400b52-c141-43d2-941e-37ed901c769c

[renzop]

Good, point, but I would drop DCOM support anyway. This is a legacy feature from the original OpenOPC. We have never tested it, and what I read about it is that it is quite difficult to configure it.

So the combination of using COM and the OpenOPC 2 gateway you can achieve a similar benefit for the user.

Also I would like to reduce the complexity of OpenOPC2 as much as possible, since there is too much stuff that was added in the original library. Which is hard to test and maintain.

[ldariva]

Yes. After posting the last message I dig a little bit more and I saw that there other classe in this OPC_CLASS entry in windows register. I wonder why we can't use, for example, the Matrikon OPC Explorer class that is there (We use it to test connections and it is conneting to this OPC Server where we apply the DCOM patch. The only thing is that it is working just in the Syncronous mode). I am thinking about this because the Matrikon OPC Explorer must have implemented this CreateBrowser method in some way to work. I wonder if we could use it instead of the Gray-Box dll.

[renzop]

Yea give it a shot, just make sure that we can only use solutions here, were the licence for a particular software fits open source criterias.

[duduyoyo]

It is very hard to get support for dlls released decades ago (like ones from graybox or OPCDAAuto.dll). Vendors wouldn't spend any resource on them if they can't make profit (some vendors may be out of business). DCOM hardening is always a pain for COM-related application like classic OPC, especially if you don't have source code for any wrapper dlls.

Check this out. It provides a unique way to use Python to retrieve OPC DA data without any 3rd party wrapper dll. It is DCOM free so you wouldn't worry like this authentication level issue in future anymore. No gateway service installation either. Hope it can shed some lights on your issue!

[renzop]

Hi @duduyoyo you are right about your first point. And I apreciate that you have your own open OPC Library. If you would like to contribute to OpenOPC2 and make it independent from the dll wrapper... Go on. I opened the discussion Alternatives Open OPC2 So that people can promote their projects. (And don't need to put it in issues etc. :-) )

[duduyoyo]

Thanks for creating a new discussion. It is always beneficial when user has an alternative when one doesn't work. We have the same goal to help user get real value from unsupported legacy OPC in a modern way. You are welcome to promote OpenOPC2 in discussion of my repo in the way you want. Cheers!