freedomboneeee/src/freedombone-clientcert

#!/bin/bash
#
# .---.                  .              .
# |                      |              |
# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
#
#                    Freedom in the Cloud
#
# Generates an email client cert for use with IMAP clients

# See:
#   http://strange.systems/certificate-based-auth-with-dovecot-sendmail
#   http://help.fabasoftfolio.com/index.php?topic=doc/Installation-and-Configuration-of-Fabasoft-Folio-IMAP-Service/client-certificate-authentication.htm

# License
# =======
#
# Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.

USERNAME=

function show_help {
    echo ''
    echo 'freedombone-clientcert -u [username]'
    echo ''
    echo 'Creates email certificates for use with IMAP clients'
    echo ''
    echo '     --help                  Show help'
    echo '  -u --username [name]       Username'
    echo ''
    exit 0
}

while [[ $# > 1 ]]
do
key="$1"

case $key in
    --help)
    show_help
    ;;
    -u|--username)
    shift
    USERNAME="$1"
    ;;
    *)
    # unknown option
    ;;
esac
shift
done

if [ ! $USERNAME ]; then
    echo 'No username specified'
    exit 5748
fi

if [ ! -d /home/$USERNAME ]; then
    echo "User $USERNAME not found"
    exit 76239
fi

if [ -d /home/$USERNAME/emailcert ]; then
    echo 'Client certs were already for created'
    exit 2953
fi

if [ ! -f /etc/dovecot/passwd-file ]; then
    touch /etc/dovecot/passwd-file
fi

# Add a user password
if ! grep -q "$USERNAME:{plain}" $/etc/dovecot/passwd-file; then
  echo "$USERNAME:{plain}::::::nopassword" >> /etc/dovecot/passwd-file
fi

chmod 600 /etc/dovecot/passwd-file

# create a user cert
freedombone-addcert -h $USERNAME

# create a certificate request
openssl req -new -sha256 -key /etc/ssl/private/$USERNAME.key -out /etc/ssl/requests/$USERNAME.csr

# sign the certificate request
openssl ca -config /etc/ssl/dovecot-ca.cnf -in /etc/ssl/requests/$USERNAME.csr -out /etc/ssl/certs/$USERNAME.cer

# move the cert to the user's home
mkdir /home/$USERNAME/emailcert
mv /etc/ssl/certs/$USERNAME.cer /home/$USERNAME/emailcert
cp /etc/ssl/certs/dovecot-ca.crt /home/$USERNAME/emailcert
mv /etc/ssl/private/$USERNAME.key /home/$USERNAME/emailcert
mv /etc/ssl/certs/$USERNAME.crt /home/$USERNAME/emailcert

# set permissions for the user
chmod -R 600 /home/$USERNAME/emailcert
chown -R $USERNAME:$USERNAME /home/$USERNAME/emailcert

shred -zu /etc/ssl/requests/$USERNAME.csr

echo 'Email authentication certificate created. You can obtain it on the client with:'
echo ''
echo "      scp -P 2222 -r $USERNAME@mydomainname:/home/$USERNAME/emailcert ~/"
echo ''

exit 0