free
/
freedomboneeee
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Don't pin certs 

The guidelines on how to do this properly are just too confusing
This commit is contained in:
Bob Mottram 2016-08-10 10:27:14 +01:00
parent f25602ccd1
commit 0b6a12080d
4 changed files with 140 additions and 129 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

261
src/freedombone-addcert
View File

@ -38,6 +38,9 @@ COMPLETION_FILE=$HOME/${PROJECT_NAME}-completed.txt
source /usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-git source /usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-git
# Don't pin certs by default
PIN_CERTS=
HOSTNAME= HOSTNAME=
LETSENCRYPT_HOSTNAME= LETSENCRYPT_HOSTNAME=
COUNTRY_CODE="US" COUNTRY_CODE="US"
@ -59,40 +62,40 @@ MY_MIRRORS_PASSWORD=
function read_repo_servers { function read_repo_servers {
if [ -f $CONFIGURATION_FILE ]; then if [ -f $CONFIGURATION_FILE ]; then
if grep -q "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_SERVER=$(grep "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_SERVER=$(grep "FRIENDS_MIRRORS_SERVER" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_SSH_PORT=$(grep "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_SSH_PORT=$(grep "FRIENDS_MIRRORS_SSH_PORT" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then if grep -q "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then
MY_MIRRORS_PASSWORD=$(grep "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}') MY_MIRRORS_PASSWORD=$(grep "MY_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
if grep -q "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then if grep -q "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE; then
FRIENDS_MIRRORS_PASSWORD=$(grep "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}') FRIENDS_MIRRORS_PASSWORD=$(grep "FRIENDS_MIRRORS_PASSWORD" $CONFIGURATION_FILE | awk -F '=' '{print $2}')
fi fi
fi fi
if [ ! $FRIENDS_MIRRORS_SERVER ]; then if [ ! $FRIENDS_MIRRORS_SERVER ]; then
return return
fi fi
if [ ${#FRIENDS_MIRRORS_SERVER} -lt 2 ]; then if [ ${#FRIENDS_MIRRORS_SERVER} -lt 2 ]; then
return return
fi fi
MAIN_COMMAND=/usr/local/bin/${PROJECT_NAME} MAIN_COMMAND=/usr/local/bin/${PROJECT_NAME}
if [ ! -f $MAIN_COMMAND ]; then if [ ! -f $MAIN_COMMAND ]; then
MAIN_COMMAND=/usr/bin/${PROJECT_NAME} MAIN_COMMAND=/usr/bin/${PROJECT_NAME}
fi fi
REPOS=($(cat ${MAIN_COMMAND} | grep "_REPO=\"" | uniq -u | sed 's|${PROJECT_NAME}|'"${PROJECT_NAME}"'|g')) REPOS=($(cat ${MAIN_COMMAND} | grep "_REPO=\"" | uniq -u | sed 's|${PROJECT_NAME}|'"${PROJECT_NAME}"'|g'))
for line in "${REPOS[@]}" for line in "${REPOS[@]}"
do do
repo_name=$(echo "$line" | awk -F '=' '{print $1}') repo_name=$(echo "$line" | awk -F '=' '{print $1}')
mirrors_name=$(echo "$repo_name" | sed "s|_REPO||g" | awk '{print tolower($0)}') mirrors_name=$(echo "$repo_name" | sed "s|_REPO||g" | awk '{print tolower($0)}')
friends_repo_url="ssh://mirrors@${FRIENDS_MIRRORS_SERVER}:${FRIENDS_MIRRORS_SSH_PORT}/home/mirrors/${mirrors_name}" friends_repo_url="ssh://mirrors@${FRIENDS_MIRRORS_SERVER}:${FRIENDS_MIRRORS_SSH_PORT}/home/mirrors/${mirrors_name}"
${repo_name}="${friends_repo_url}" ${repo_name}="${friends_repo_url}"
done done
} }
@ -125,69 +128,73 @@ do
key="$1" key="$1"
case $key in case $key in
--help) --help)
show_help show_help
;; ;;
-h|--hostname) -h|--hostname)
shift shift
HOSTNAME="$1" HOSTNAME="$1"
;; ;;
-e|--letsencrypt) -e|--letsencrypt)
shift shift
LETSENCRYPT_HOSTNAME="$1" LETSENCRYPT_HOSTNAME="$1"
;; ;;
--email) --email)
shift shift
MY_EMAIL_ADDRESS="$1" MY_EMAIL_ADDRESS="$1"
;; ;;
-s|--server) -s|--server)
shift shift
LETSENCRYPT_SERVER="$1" LETSENCRYPT_SERVER="$1"
;; ;;
-c|--country) -c|--country)
shift shift
COUNTRY_CODE="$1" COUNTRY_CODE="$1"
;; ;;
-a|--area) -a|--area)
shift shift
AREA="$1" AREA="$1"
;; ;;
-l|--location) -l|--location)
shift shift
LOCATION="$1" LOCATION="$1"
;; ;;
-o|--organisation) -o|--organisation)
shift shift
ORGANISATION="$1" ORGANISATION="$1"
;; ;;
-u|--unit) -u|--unit)
shift shift
UNIT="$1" UNIT="$1"
;; ;;
--ca) --ca)
shift shift
EXTENSIONS="-extensions v3_ca" EXTENSIONS="-extensions v3_ca"
ORGANISATION="Freedombone-CA" ORGANISATION="Freedombone-CA"
;; ;;
--nodh) --nodh)
shift shift
NODH="true" NODH="true"
;; ;;
--dhkey) --dhkey)
shift shift
DH_KEYLENGTH=${1} DH_KEYLENGTH=${1}
;; ;;
*) --pin)
# unknown option shift
;; PIN_CERTS=${1}
;;
*)
# unknown option
;;
esac esac
shift shift
done done
if [ ! $HOSTNAME ]; then if [ ! $HOSTNAME ]; then
if [ ! $LETSENCRYPT_HOSTNAME ]; then if [ ! $LETSENCRYPT_HOSTNAME ]; then
echo $'No hostname specified' echo $'No hostname specified'
exit 5748 exit 5748
fi fi
fi fi
@ -207,35 +214,35 @@ function add_cert_letsencrypt {
# obtain the email address for the admin user # obtain the email address for the admin user
if [ ! $MY_EMAIL_ADDRESS ]; then if [ ! $MY_EMAIL_ADDRESS ]; then
if [ -f $CONFIGURATION_FILE ]; then if [ -f $CONFIGURATION_FILE ]; then
if grep -q "MY_EMAIL_ADDRESS=" $CONFIGURATION_FILE; then if grep -q "MY_EMAIL_ADDRESS=" $CONFIGURATION_FILE; then
MY_EMAIL_ADDRESS=$(cat $CONFIGURATION_FILE | grep "MY_EMAIL_ADDRESS=" | awk -F '=' '{print $2}') MY_EMAIL_ADDRESS=$(cat $CONFIGURATION_FILE | grep "MY_EMAIL_ADDRESS=" | awk -F '=' '{print $2}')
fi
fi fi
fi fi
fi
if [ ! $MY_EMAIL_ADDRESS ]; then if [ ! $MY_EMAIL_ADDRESS ]; then
if [ -f $COMPLETION_FILE ]; then if [ -f $COMPLETION_FILE ]; then
if grep -q "Admin user:" $COMPLETION_FILE; then if grep -q "Admin user:" $COMPLETION_FILE; then
ADMIN_USER=$(cat $COMPLETION_FILE | grep "Admin user" | awk -F ':' '{print $2}') ADMIN_USER=$(cat $COMPLETION_FILE | grep "Admin user" | awk -F ':' '{print $2}')
MY_EMAIL_ADDRESS=$ADMIN_USER@$HOSTNAME MY_EMAIL_ADDRESS=$ADMIN_USER@$HOSTNAME
fi
fi fi
fi fi
fi
if [ ! -d $INSTALL_DIR ]; then if [ ! -d $INSTALL_DIR ]; then
mkdir -p $INSTALL_DIR mkdir -p $INSTALL_DIR
fi fi
cd $INSTALL_DIR cd $INSTALL_DIR
# obtain the repo # obtain the repo
if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then
git_clone $LETSENCRYPT_REPO ${INSTALL_DIR}/letsencrypt git_clone $LETSENCRYPT_REPO ${INSTALL_DIR}/letsencrypt
if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then if [ ! -d ${INSTALL_DIR}/letsencrypt ]; then
exit 76283 exit 76283
fi fi
else else
cd ${INSTALL_DIR}/letsencrypt cd ${INSTALL_DIR}/letsencrypt
git_pull $LETSENCRYPT_REPO git_pull $LETSENCRYPT_REPO
fi fi
# stop the web server # stop the web server
@ -244,38 +251,38 @@ function add_cert_letsencrypt {
cd ${INSTALL_DIR}/letsencrypt cd ${INSTALL_DIR}/letsencrypt
./letsencrypt-auto certonly --server $LETSENCRYPT_SERVER --standalone -d $LETSENCRYPT_HOSTNAME --renew-by-default --agree-tos --email $MY_EMAIL_ADDRESS ./letsencrypt-auto certonly --server $LETSENCRYPT_SERVER --standalone -d $LETSENCRYPT_HOSTNAME --renew-by-default --agree-tos --email $MY_EMAIL_ADDRESS
if [ ! "$?" = "0" ]; then if [ ! "$?" = "0" ]; then
echo $"Failed to install letsencrypt for domain $LETSENCRYPT_HOSTNAME" echo $"Failed to install letsencrypt for domain $LETSENCRYPT_HOSTNAME"
systemctl start nginx systemctl start nginx
exit 63216 exit 63216
fi fi
# replace some legacy filenames # replace some legacy filenames
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.bundle.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME
sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME sed -i "s|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.crt|ssl_certificate /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem|g" /etc/nginx/sites-available/$LETSENCRYPT_HOSTNAME
# link the private key # link the private key
if [ -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ]; then if [ -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ]; then
if [ ! -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old ]; then if [ ! -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old ]; then
mv /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old mv /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key.old
else else
rm -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key rm -f /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key
fi fi
fi fi
ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/privkey.pem /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/privkey.pem /etc/ssl/private/${LETSENCRYPT_HOSTNAME}.key
# link the public key # link the public key
if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ]; then if [ -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ]; then
if [ ! -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old ]; then if [ ! -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old ]; then
mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old mv /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem.old
else else
rm -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem rm -f /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
fi fi
fi fi
ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem ln -s /etc/letsencrypt/live/${LETSENCRYPT_HOSTNAME}/fullchain.pem /etc/ssl/certs/${LETSENCRYPT_HOSTNAME}.pem
@ -283,44 +290,48 @@ function add_cert_letsencrypt {
systemctl start nginx systemctl start nginx
${PROJECT_NAME}-pin-cert $LETSENCRYPT_HOSTNAME if [ $PIN_CERTS ]; then
if [ ! "$?" = "0" ]; then ${PROJECT_NAME}-pin-cert $LETSENCRYPT_HOSTNAME
echo $"Certificate for $LETSENCRYPT_HOSTNAME could not be pinned" if [ ! "$?" = "0" ]; then
exit 62878 echo $"Certificate for $LETSENCRYPT_HOSTNAME could not be pinned"
exit 62878
fi
fi fi
} }
function add_cert_selfsigned { function add_cert_selfsigned {
if [[ $ORGANISATION == "Freedombone-CA" ]]; then if [[ $ORGANISATION == "Freedombone-CA" ]]; then
CERTFILE="ca-$HOSTNAME" CERTFILE="ca-$HOSTNAME"
fi fi
openssl req -x509 ${EXTENSIONS} -nodes -days 3650 -sha256 \ openssl req -x509 ${EXTENSIONS} -nodes -days 3650 -sha256 \
-subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \ -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" \
-newkey rsa:4096 -keyout /etc/ssl/private/${CERTFILE}.key \ -newkey rsa:4096 -keyout /etc/ssl/private/${CERTFILE}.key \
-out /etc/ssl/certs/${CERTFILE}.crt -out /etc/ssl/certs/${CERTFILE}.crt
chmod 400 /etc/ssl/private/${CERTFILE}.key chmod 400 /etc/ssl/private/${CERTFILE}.key
chmod 640 /etc/ssl/certs/${CERTFILE}.crt chmod 640 /etc/ssl/certs/${CERTFILE}.crt
cp /etc/ssl/certs/${CERTFILE}.crt /etc/ssl/mycerts cp /etc/ssl/certs/${CERTFILE}.crt /etc/ssl/mycerts
${PROJECT_NAME}-pin-cert $CERTFILE if [ $PIN_CERTS ]; then
if [ ! "$?" = "0" ]; then ${PROJECT_NAME}-pin-cert $CERTFILE
echo $"Certificate for $CERTFILE could not be pinned" if [ ! "$?" = "0" ]; then
exit 62879 echo $"Certificate for $CERTFILE could not be pinned"
exit 62879
fi
fi fi
} }
function generate_dh_params { function generate_dh_params {
if [ ! $NODH ]; then if [ ! $NODH ]; then
if [ ! -f /etc/ssl/certs/${CERTFILE}.dhparam ]; then if [ ! -f /etc/ssl/certs/${CERTFILE}.dhparam ]; then
${PROJECT_NAME}-dhparam -h ${CERTFILE} --fast yes ${PROJECT_NAME}-dhparam -h ${CERTFILE} --fast yes
fi fi
fi fi
} }
function restart_web_server { function restart_web_server {
if [ -f /etc/init.d/nginx ]; then if [ -f /etc/init.d/nginx ]; then
/etc/init.d/nginx reload /etc/init.d/nginx reload
fi fi
} }
@ -332,9 +343,9 @@ function make_cert_bundle {
function create_cert { function create_cert {
if [ $LETSENCRYPT_HOSTNAME ]; then if [ $LETSENCRYPT_HOSTNAME ]; then
add_cert_letsencrypt add_cert_letsencrypt
else else
add_cert_selfsigned add_cert_selfsigned
fi fi
} }

4
src/freedombone-renew-cert
View File

@ -69,7 +69,7 @@ function renew_letsencrypt {
ln -s /etc/letsencrypt/live/${HOSTNAME}/privkey.pem /etc/ssl/private/${HOSTNAME}.key ln -s /etc/letsencrypt/live/${HOSTNAME}/privkey.pem /etc/ssl/private/${HOSTNAME}.key
ln -s /etc/letsencrypt/live/${HOSTNAME}/fullchain.pem /etc/ssl/certs/${HOSTNAME}.pem ln -s /etc/letsencrypt/live/${HOSTNAME}/fullchain.pem /etc/ssl/certs/${HOSTNAME}.pem
${PROJECT_NAME}-pin-cert $HOSTNAME ${PROJECT_NAME}-pin-cert $HOSTNAME remove
} }
function renew_startssl { function renew_startssl {
@ -169,7 +169,7 @@ function renew_startssl {
echo $"/etc/ssl/certs/$HOSTNAME.new.crt then run this command again." echo $"/etc/ssl/certs/$HOSTNAME.new.crt then run this command again."
echo '' echo ''
${PROJECT_NAME}-pin-cert $HOSTNAME ${PROJECT_NAME}-pin-cert $HOSTNAME remove
} }
while [[ $# > 1 ]] while [[ $# > 1 ]]

2
src/freedombone-restore-local
View File

@ -723,7 +723,7 @@ set_user_permissions
backup_unmount_drive backup_unmount_drive
# ensure that all TLS certificates are pinned # ensure that all TLS certificates are pinned
${PROJECT_NAME}-pin-cert all #${PROJECT_NAME}-pin-cert all
echo $"Restore from USB drive is complete. You can now unplug it." echo $"Restore from USB drive is complete. You can now unplug it."

2
src/freedombone-restore-remote
View File

@ -655,7 +655,7 @@ restore_apps remote
set_user_permissions set_user_permissions
# ensure that all TLS certificates are pinned # ensure that all TLS certificates are pinned
${PROJECT_NAME}-pin-cert all #${PROJECT_NAME}-pin-cert all
echo $"*** Remote restore was successful ***" echo $"*** Remote restore was successful ***"