free
/
freedomboneeee
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Separate command for making self-signed certificates

This commit is contained in:
Bob Mottram 2015-03-31 20:22:42 +01:00
parent ef90cf4c28
commit 9901cdcbb4
5 changed files with 135 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Makefile
View File

@ -16,6 +16,7 @@ install:
install -m 755 src/${APP}-remote ${DESTDIR}${PREFIX}/bin
install -m 755 src/${APP}-config ${DESTDIR}${PREFIX}/bin
install -m 755 src/${APP}-sec ${DESTDIR}${PREFIX}/bin
install -m 755 src/${APP}-addcert ${DESTDIR}${PREFIX}/bin
mkdir -m 755 -p ${DESTDIR}${PREFIX}/share/man/man1
install -m 644 man/${APP}.1.gz ${DESTDIR}${PREFIX}/share/man/man1
install -m 644 man/${APP}-prep.1.gz ${DESTDIR}${PREFIX}/share/man/man1
@ -23,6 +24,7 @@ install:
install -m 644 man/${APP}-remote.1.gz ${DESTDIR}${PREFIX}/share/man/man1
install -m 644 man/${APP}-config.1.gz ${DESTDIR}${PREFIX}/share/man/man1
install -m 644 man/${APP}-sec.1.gz ${DESTDIR}${PREFIX}/share/man/man1
install -m 644 man/${APP}-addcert.1.gz ${DESTDIR}${PREFIX}/share/man/man1
uninstall:
rm -f ${PREFIX}/share/man/man1/${APP}.1.gz
rm -f ${PREFIX}/share/man/man1/${APP}-prep.1.gz
@ -30,6 +32,7 @@ uninstall:
rm -f ${PREFIX}/share/man/man1/${APP}-remote.1.gz
rm -f ${PREFIX}/share/man/man1/${APP}-config.1.gz
rm -f ${PREFIX}/share/man/man1/${APP}-sec.1.gz
rm -f ${PREFIX}/share/man/man1/${APP}-addcert.1.gz
rm -rf ${PREFIX}/share/${APP}
rm -f ${PREFIX}/bin/${APP}
rm -f ${PREFIX}/bin/${APP}-prep
@ -37,6 +40,7 @@ uninstall:
rm -f ${PREFIX}/bin/${APP}-remote
rm -f ${PREFIX}/bin/${APP}-config
rm -f ${PREFIX}/bin/${APP}-sec
rm -f ${PREFIX}/bin/${APP}-addcert
clean:
rm -f \#* \.#* debian/*.substvars debian/*.log
rm -fr deb.* debian/${APP}

1
debian/source/include-binaries vendored
View File

@ -4,3 +4,4 @@ man/freedombone-client.1.gz
man/freedombone-remote.1.gz
man/freedombone-config.1.gz
man/freedombone-sec.1.gz
man/freedombone-addcert.1.gz

BIN
man/freedombone-addcert.1.gz Normal file
View File

Binary file not shown.

65
src/freedombone
View File

@ -1594,7 +1594,7 @@ function create_backup_script {
echo "if [ ! -f $BACKUP_CERTIFICATE ]; then" >> /usr/bin/$BACKUP_SCRIPT_NAME
echo ' echo "Creating backup key"' >> /usr/bin/$BACKUP_SCRIPT_NAME
echo ' makecert backup' >> /usr/bin/$BACKUP_SCRIPT_NAME
echo ' freedombone-addcert -h backup' >> /usr/bin/$BACKUP_SCRIPT_NAME
echo 'fi' >> /usr/bin/$BACKUP_SCRIPT_NAME
echo '' >> /usr/bin/$BACKUP_SCRIPT_NAME
@ -2898,7 +2898,7 @@ function backup_to_friends_servers {
echo "if [ ! -f $BACKUP_CERTIFICATE ]; then" >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
echo ' echo "Creating backup key"' >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
echo ' makecert backup' >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
echo ' freedombone-addcert -h backup' >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
echo 'fi' >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
echo '' >> /usr/bin/$BACKUP_TO_FRIENDS_SCRIPT_NAME
@ -5131,42 +5131,6 @@ function configure_internet_protocol {
echo 'configure_internet_protocol' >> $COMPLETION_FILE
}
function script_to_make_self_signed_certificates {
if grep -Fxq "script_to_make_self_signed_certificates" $COMPLETION_FILE; then
return
fi
echo '#!/bin/bash' > /usr/bin/makecert
echo 'HOSTNAME=$1' >> /usr/bin/makecert
echo 'COUNTRY_CODE="US"' >> /usr/bin/makecert
echo 'AREA="Free Speech Zone"' >> /usr/bin/makecert
echo 'LOCATION="Freedomville"' >> /usr/bin/makecert
echo 'ORGANISATION="Freedombone"' >> /usr/bin/makecert
echo 'UNIT="Freedombone Unit"' >> /usr/bin/makecert
echo 'if ! which openssl > /dev/null ;then' >> /usr/bin/makecert
echo ' echo "$0: openssl is not installed, exiting" 1>&2' >> /usr/bin/makecert
echo ' exit 1' >> /usr/bin/makecert
echo 'fi' >> /usr/bin/makecert
echo 'openssl req -x509 -nodes -days 3650 -sha256 -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" -newkey rsa:4096 -keyout /etc/ssl/private/$HOSTNAME.key -out /etc/ssl/certs/$HOSTNAME.crt' >> /usr/bin/makecert
echo 'openssl dhparam -check -text -5 1024 -out /etc/ssl/certs/$HOSTNAME.dhparam' >> /usr/bin/makecert
echo 'chmod 400 /etc/ssl/private/$HOSTNAME.key' >> /usr/bin/makecert
echo 'chmod 640 /etc/ssl/certs/$HOSTNAME.crt' >> /usr/bin/makecert
echo 'chmod 640 /etc/ssl/certs/$HOSTNAME.dhparam' >> /usr/bin/makecert
echo 'if [ -f /etc/init.d/nginx ]; then' >> /usr/bin/makecert
echo ' /etc/init.d/nginx reload' >> /usr/bin/makecert
echo 'fi' >> /usr/bin/makecert
echo '# add the public certificate to a separate directory' >> /usr/bin/makecert
echo '# so that we can redistribute it easily' >> /usr/bin/makecert
echo 'if [ ! -d /etc/ssl/mycerts ]; then' >> /usr/bin/makecert
echo ' mkdir /etc/ssl/mycerts' >> /usr/bin/makecert
echo 'fi' >> /usr/bin/makecert
echo 'cp /etc/ssl/certs/$HOSTNAME.crt /etc/ssl/mycerts' >> /usr/bin/makecert
echo '# Create a bundle of your certificates' >> /usr/bin/makecert
echo 'cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt' >> /usr/bin/makecert
echo 'tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt' >> /usr/bin/makecert
chmod +x /usr/bin/makecert
echo 'script_to_make_self_signed_certificates' >> $COMPLETION_FILE
}
function configure_email {
if [[ $SYSTEM_TYPE == "$VARIANT_CHAT" || $SYSTEM_TYPE == "$VARIANT_MEDIA" ]]; then
return
@ -5214,7 +5178,7 @@ function configure_email {
# make a tls certificate for email
if [ ! -f /etc/ssl/certs/exim.dhparam ]; then
makecert exim
freedombone-addcert -h exim
check_certificates exim
fi
cp /etc/ssl/private/exim.key /etc/exim4
@ -5440,7 +5404,7 @@ function configure_imap {
fi
if [ ! -f /etc/ssl/certs/dovecot.dhparam ]; then
makecert dovecot
freedombone-addcert -h dovecot
check_certificates dovecot
fi
chown root:dovecot /etc/ssl/certs/dovecot.*
@ -6785,7 +6749,7 @@ quit" > $INSTALL_DIR/batch.sql
configure_php
if [ ! -f /etc/ssl/certs/$OWNCLOUD_DOMAIN_NAME.dhparam ]; then
makecert $OWNCLOUD_DOMAIN_NAME
freedombone-addcert -h $OWNCLOUD_DOMAIN_NAME
check_certificates $OWNCLOUD_DOMAIN_NAME
fi
@ -7028,7 +6992,7 @@ quit" > $INSTALL_DIR/batch.sql
configure_php
if [ ! -f /etc/ssl/certs/$GIT_DOMAIN_NAME.dhparam ]; then
makecert $GIT_DOMAIN_NAME
freedombone-addcert -h $GIT_DOMAIN_NAME
check_certificates $GIT_DOMAIN_NAME
fi
@ -7059,7 +7023,7 @@ function install_xmpp {
fi
if [ ! -f /etc/ssl/certs/xmpp.dhparam ]; then
makecert xmpp
freedombone-addcert -h xmpp
check_certificates xmpp
fi
chown prosody:prosody /etc/ssl/private/xmpp.key
@ -7183,7 +7147,7 @@ function install_irc_server {
fi
if [ ! -f /etc/ssl/certs/ngircd.dhparam ]; then
makecert ngircd
freedombone-addcert -h ngircd
check_certificates ngircd
fi
@ -7273,7 +7237,7 @@ function install_wiki {
rm -rf /var/www/$WIKI_DOMAIN_NAME/htdocs
fi
if [ ! -f /etc/ssl/certs/$WIKI_DOMAIN_NAME.dhparam ]; then
makecert $WIKI_DOMAIN_NAME
freedombone-addcert -h $WIKI_DOMAIN_NAME
check_certificates $WIKI_DOMAIN_NAME
fi
@ -7558,7 +7522,7 @@ function install_blog {
chown -R www-data:www-data /var/www/$FULLBLOG_DOMAIN_NAME/htdocs
if [ ! -f /etc/ssl/certs/$FULLBLOG_DOMAIN_NAME.dhparam ]; then
makecert $FULLBLOG_DOMAIN_NAME
freedombone-addcert -h $FULLBLOG_DOMAIN_NAME
check_certificates $FULLBLOG_DOMAIN_NAME
fi
@ -7923,7 +7887,7 @@ quit" > $INSTALL_DIR/batch.sql
configure_php
if [ ! -f /etc/ssl/certs/$MICROBLOG_DOMAIN_NAME.dhparam ]; then
makecert $MICROBLOG_DOMAIN_NAME
freedombone-addcert -h $MICROBLOG_DOMAIN_NAME
check_certificates $MICROBLOG_DOMAIN_NAME
fi
@ -8191,7 +8155,7 @@ quit" > $INSTALL_DIR/batch.sql
configure_php
if [ ! -f /etc/ssl/certs/$REDMATRIX_DOMAIN_NAME.dhparam ]; then
makecert $REDMATRIX_DOMAIN_NAME
freedombone-addcert -h $REDMATRIX_DOMAIN_NAME
check_certificates $REDMATRIX_DOMAIN_NAME
fi
@ -8508,7 +8472,7 @@ function install_mediagoblin {
echo '}' >> /etc/nginx/sites-available/$MEDIAGOBLIN_DOMAIN_NAME
if [ ! -f /etc/ssl/certs/$MEDIAGOBLIN_DOMAIN_NAME.dhparam ]; then
makecert $MEDIAGOBLIN_DOMAIN_NAME
freedombone-addcert -h $MEDIAGOBLIN_DOMAIN_NAME
check_certificates $MEDIAGOBLIN_DOMAIN_NAME
fi
@ -8917,7 +8881,7 @@ function install_voip {
# Make an ssl cert for the server
if [ ! -f /etc/ssl/certs/mumble.dhparam ]; then
makecert mumble
freedombone-addcert -h mumble
check_certificates mumble
fi
@ -9034,7 +8998,6 @@ remove_instructions_from_motd
check_hwrng
search_for_attached_usb_drive
regenerate_ssh_keys
script_to_make_self_signed_certificates
create_upgrade_script
route_outgoing_traffic_through_tor
install_watchdog_script

116
src/freedombone-addcert Executable file
View File

@ -0,0 +1,116 @@
#!/bin/bash
# A script for creating self-signed certificates on Debian
# License
# =======
#
# Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
HOSTNAME=
COUNTRY_CODE="US"
AREA="Free Speech Zone"
LOCATION="Freedomville"
ORGANISATION="Freedombone"
UNIT="Freedombone Unit"
function show_help {
echo ''
echo 'freedombone-addcert -h [hostname] -c [country code] -a [area] -l [location]'
echo ' -o [organisation] -u [unit]'
echo ''
echo 'Creates a self-signed certificate for the given hostname'
echo ''
echo ' --help Show help'
echo ' -h --hostname [name] Hostname'
echo ' -c --country [code] Optional country code (eg. US, GB, etc)'
echo ' -a --area [description] Optional area description'
echo ' -l --location [locn] Optional location name'
echo ' -o --organisation [name] Optional organisation name'
echo ' -u --unit [name] Optional unit name'
echo ''
exit 0
}
while [[ $# > 1 ]]
do
key="$1"
case $key in
--help)
show_help
;;
-h|--hostname)
shift
HOSTNAME="$1"
;;
-c|--country)
shift
COUNTRY_CODE="$1"
;;
-a|--area)
shift
AREA="$1"
;;
-l|--location)
shift
LOCATION="$1"
;;
-o|--organisation)
shift
ORGANISATION="$1"
;;
-u|--unit)
shift
UNIT="$1"
;;
*)
# unknown option
;;
esac
shift
done
if [ ! $HOSTNAME ]; then
echo 'No hostname specified'
exit 5748
fi
if ! which openssl > /dev/null ;then
echo "$0: openssl is not installed, exiting" 1>&2
exit 5689
fi
openssl req -x509 -nodes -days 3650 -sha256 -subj "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$HOSTNAME" -newkey rsa:4096 -keyout /etc/ssl/private/$HOSTNAME.key -out /etc/ssl/certs/$HOSTNAME.crt
openssl dhparam -check -text -5 1024 -out /etc/ssl/certs/$HOSTNAME.dhparam
chmod 400 /etc/ssl/private/$HOSTNAME.key
chmod 640 /etc/ssl/certs/$HOSTNAME.crt
chmod 640 /etc/ssl/certs/$HOSTNAME.dhparam
if [ -f /etc/init.d/nginx ]; then
/etc/init.d/nginx reload
fi
# add the public certificate to a separate directory
# so that we can redistribute it easily
if [ ! -d /etc/ssl/mycerts ]; then
mkdir /etc/ssl/mycerts
fi
cp /etc/ssl/certs/$HOSTNAME.crt /etc/ssl/mycerts
# Create a bundle of your certificates
cat /etc/ssl/mycerts/*.crt > /etc/ssl/freedombone-bundle.crt
tar -czvf /etc/ssl/freedombone-certs.tar.gz /etc/ssl/mycerts/*.crt
exit 0