freedomboneeee/src/freedombone-clientcert

176 lines
5.0 KiB
Plaintext
Raw Normal View History

#!/bin/bash
#
# .---. . .
# | | |
# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
# | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
# ' ' --' --' -' - -' ' ' -' -' -' ' - --'
#
# Freedom in the Cloud
#
# Generates an email client cert for use with IMAP clients
# See:
# http://strange.systems/certificate-based-auth-with-dovecot-sendmail
# http://help.fabasoftfolio.com/index.php?topic=doc/Installation-and-Configuration-of-Fabasoft-Folio-IMAP-Service/client-certificate-authentication.htm
# License
# =======
#
2016-01-02 22:58:27 +01:00
# Copyright (C) 2015-2016 Bob Mottram <bob@robotics.uk.to>
#
# This program is free software: you can redistribute it and/or modify
2016-02-13 23:09:27 +01:00
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
2016-02-13 23:09:27 +01:00
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
2016-02-13 23:09:27 +01:00
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
2015-11-27 12:42:16 +01:00
PROJECT_NAME='freedombone'
2015-11-27 17:52:23 +01:00
export TEXTDOMAIN=${PROJECT_NAME}-clientcert
2015-11-27 12:42:16 +01:00
export TEXTDOMAINDIR="/usr/share/locale"
USERNAME=
COUNTRY_CODE="US"
AREA="Free Speech Zone"
LOCATION="Freedomville"
ORGANISATION="Freedombone"
UNIT="Freedombone Unit"
EXTENSIONS=""
function show_help {
echo ''
2015-12-08 17:22:48 +01:00
echo $"${PROJECT_NAME}-clientcert -u [username]"
echo ''
2015-11-27 16:29:43 +01:00
echo $'Creates email certificates for use with IMAP clients'
echo ''
2015-11-27 16:29:43 +01:00
echo $' --help Show help'
echo $' -u --username [name] Username'
echo ''
exit 0
}
while [[ $# > 1 ]]
do
key="$1"
case $key in
--help)
show_help
;;
-u|--username)
shift
USERNAME="$1"
;;
*)
# unknown option
;;
esac
shift
done
if [ ! $USERNAME ]; then
2015-11-27 16:29:43 +01:00
echo $'No username specified'
exit 5748
fi
if [ ! -d /home/$USERNAME ]; then
2015-11-27 16:29:43 +01:00
echo $"User $USERNAME not found"
exit 76239
fi
if [ -d /home/$USERNAME/emailcert ]; then
2015-11-27 16:29:43 +01:00
echo $'Client certs were already for created'
exit 2953
fi
if [ ! -f /etc/dovecot/passwd-file ]; then
touch /etc/dovecot/passwd-file
fi
# Add a user password
2015-06-17 22:45:43 +02:00
if ! grep -q "$USERNAME:{plain}" /etc/dovecot/passwd-file; then
echo "$USERNAME:{plain}::::::nopassword" >> /etc/dovecot/passwd-file
fi
chmod 600 /etc/dovecot/passwd-file
# create a user cert
2015-12-08 17:22:48 +01:00
${PROJECT_NAME}-addcert -h $USERNAME --nodh ""
2015-06-17 21:18:48 +02:00
if [ ! -f /etc/ssl/private/$USERNAME.key ]; then
2015-11-27 16:29:43 +01:00
echo $'User certificates were not created'
2015-06-17 21:18:48 +02:00
rm -rf /home/$USERNAME/emailcert
exit 74835
fi
# create a certificate request
2015-06-19 20:40:50 +02:00
openssl req -new -sha256 -subj \
"/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$USERNAME" \
-key /etc/ssl/private/$USERNAME.key \
-out /etc/ssl/requests/$USERNAME.csr
2015-06-17 21:18:48 +02:00
if [ ! -f /etc/ssl/requests/$USERNAME.csr ]; then
2015-11-27 16:29:43 +01:00
echo $'Certificate request was not created'
2015-06-17 21:18:48 +02:00
rm -rf /home/$USERNAME/emailcert
exit 83520
fi
# sign the certificate request
2015-06-17 21:18:48 +02:00
cd /etc/ssl
2015-06-19 20:40:50 +02:00
openssl ca -config /etc/ssl/dovecot-ca.cnf \
-in /etc/ssl/requests/$USERNAME.csr \
-out /etc/ssl/certs/$USERNAME.cer
2015-06-17 21:18:48 +02:00
if [ ! -f /etc/ssl/certs/$USERNAME.cer ]; then
2015-11-27 16:29:43 +01:00
echo $'Authentication certificate was not created'
2015-06-17 21:18:48 +02:00
rm -rf /home/$USERNAME/emailcert
exit 343569
fi
# move the cert to the user's home
mkdir /home/$USERNAME/emailcert
mv /etc/ssl/certs/$USERNAME.cer /home/$USERNAME/emailcert
2015-06-20 17:37:09 +02:00
cp /etc/ssl/certs/dovecot.crt /home/$USERNAME/emailcert
2015-06-20 00:01:28 +02:00
cp /etc/ssl/certs/ca-$HOSTNAME.crt /home/$USERNAME/emailcert
mv /etc/ssl/private/$USERNAME.key /home/$USERNAME/emailcert
mv /etc/ssl/certs/$USERNAME.crt /home/$USERNAME/emailcert
2015-06-19 20:40:50 +02:00
openssl pkcs12 -export -in /home/$USERNAME/emailcert/$USERNAME.cer \
-out /home/$USERNAME/emailcert/$USERNAME.p12 \
-inkey /home/$USERNAME/emailcert/$USERNAME.key \
2015-06-20 00:01:28 +02:00
-certfile /home/$USERNAME/emailcert/ca-$HOSTNAME.crt \
2015-06-19 21:12:22 +02:00
-password pass:""
2015-06-17 22:09:44 +02:00
# make an install script
echo '#!/bin/bash' > /home/$USERNAME/emailcert/install.sh
2015-06-20 17:41:34 +02:00
echo "sudo mv ca-$HOSTNAME.crt /etc/ssl/certs" >> \
/home/$USERNAME/emailcert/install.sh
2015-06-19 20:40:50 +02:00
echo "sudo mv $USERNAME.crt /etc/ssl/certs" >> \
/home/$USERNAME/emailcert/install.sh
2015-06-20 17:41:34 +02:00
echo "sudo mv dovecot.crt /etc/ssl/certs" >> \
/home/$USERNAME/emailcert/install.sh
2015-06-19 20:40:50 +02:00
echo "sudo mv $USERNAME.key /etc/ssl/private" >> \
/home/$USERNAME/emailcert/install.sh
2015-06-17 22:09:44 +02:00
echo 'exit 0' >> /home/$USERNAME/emailcert/install.sh
# set permissions for the user
2015-06-17 21:42:12 +02:00
chmod -R 755 /home/$USERNAME/emailcert
chown -R $USERNAME:$USERNAME /home/$USERNAME/emailcert
2015-06-17 22:09:44 +02:00
chmod +x /home/$USERNAME/emailcert/install.sh
shred -zu /etc/ssl/requests/$USERNAME.csr
2015-11-27 16:29:43 +01:00
echo $'Email authentication certificate created. You can obtain it on the client with:'
echo ''
2015-06-19 20:40:50 +02:00
echo " scp -P 2222 -r $USERNAME@$HOSTNAME:/home/$USERNAME/emailcert ~/"
echo ''
exit 0