2022-08-29 01:04:37 -06:00
|
|
|
#!/bin/bash
|
|
|
|
# FILE: wgapi:back/lib/ssl/peer/add
|
|
|
|
# DESCRIPTION: Create SSL certs for a new host
|
2022-08-29 11:42:13 -06:00
|
|
|
# USAGE: add hostname username ipstring
|
2022-09-06 20:57:41 -06:00
|
|
|
# ERRORS:
|
|
|
|
# 3: Bad usage
|
|
|
|
# 4: config file not found
|
|
|
|
# 5: openssl or config not found
|
|
|
|
# 6: not root
|
|
|
|
# 7: openssl failed
|
2022-10-20 19:12:36 -06:00
|
|
|
# 8: failed to set permissions
|
2022-08-29 01:04:37 -06:00
|
|
|
|
2022-09-06 20:57:41 -06:00
|
|
|
CONFIG_FILE='/etc/wgapi/config'
|
2022-09-10 11:14:07 -06:00
|
|
|
if ! [ ${#} -eq 3 ]; then
|
2022-09-10 10:54:30 -06:00
|
|
|
printf 'ERROR! Invalid number of arguments to %s: %s\n' "${0}" "${*}" >>"${LOGFILE}"
|
|
|
|
exit 3
|
2022-09-10 16:38:11 -06:00
|
|
|
fi; if ! [ -f "${CONFIG_FILE}" ]; then
|
|
|
|
printf 'ERROR! %s couldnt find %s\n' "${0}" "${CONFIG_FILE}" >>"${LOGFILE}"
|
2022-09-10 10:54:30 -06:00
|
|
|
exit 4
|
2022-09-10 16:38:11 -06:00
|
|
|
fi; if ! [ -x '/usr/bin/openssl' ]; then
|
2022-09-10 10:54:30 -06:00
|
|
|
printf 'ERROR! /usr/bin/openssl not found!\n' >>"${LOGFILE}"
|
|
|
|
exit 5
|
2022-09-10 16:38:11 -06:00
|
|
|
fi; if ! [ -f '/etc/ssl/openssl.cnf' ]; then
|
2022-09-10 10:54:30 -06:00
|
|
|
printf 'ERROR! /etc/ssl/openssl.cnf not found!\n' >>"${LOGFILE}"
|
|
|
|
exit 5
|
2022-09-10 11:23:11 -06:00
|
|
|
fi
|
2022-09-06 20:57:41 -06:00
|
|
|
source "${CONFIG_FILE}"
|
2022-08-29 11:42:13 -06:00
|
|
|
|
2022-09-09 20:02:39 -06:00
|
|
|
hostname="${1}"
|
|
|
|
username="${2}"
|
|
|
|
ipstring="${3}"
|
|
|
|
|
2022-09-10 11:32:12 -06:00
|
|
|
# Make a directory for the new files
|
2022-09-10 19:13:47 -06:00
|
|
|
if ! sudo mkdir "${SSL_CONFIG_DIR:?}/${username:?}/${hostname:?}/"; then
|
|
|
|
printf 'Failed to create directory %s/%s/%s/:\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-10 11:32:12 -06:00
|
|
|
exit 7
|
|
|
|
fi
|
|
|
|
|
2022-08-29 11:42:13 -06:00
|
|
|
# Generate key
|
2022-09-10 11:50:07 -06:00
|
|
|
if ! sudo /usr/bin/openssl genrsa -out "${SSL_CONFIG_DIR:?}/${username:?}/${hostname:?}/server.key" >>/dev/null 2>&1; then
|
|
|
|
printf 'Failed to generate SSL key %s/%s/%s/server.key\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-09-10 12:00:30 -06:00
|
|
|
fi
|
2022-09-10 12:04:43 -06:00
|
|
|
if ! sudo [ -f "${SSL_CONFIG_DIR}/${username}/${hostname}/server.key" ]; then
|
2022-09-10 11:50:07 -06:00
|
|
|
printf 'SSL key %s/%s/%s/server.key was not generated!\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-10 12:02:59 -06:00
|
|
|
printf "${SSL_CONFIG_DIR}/${username}/${hostname}/server.key\n" >>"${LOGFILE}"
|
|
|
|
ls "${SSL_CONFIG_DIR}/${username}/${hostname}/" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-09-10 12:00:30 -06:00
|
|
|
fi
|
|
|
|
if ! sudo chmod 400 "${SSL_CONFIG_DIR}/${username}/${hostname}/server.key" >>"${LOGFILE}" 2>&1; then
|
2022-09-10 11:50:07 -06:00
|
|
|
printf 'Failed to chmod SSL key %s/%s/%s/server.key\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-09-10 11:14:07 -06:00
|
|
|
fi
|
2022-08-29 11:42:13 -06:00
|
|
|
|
2022-09-10 13:30:39 -06:00
|
|
|
# Generate config
|
2022-09-10 13:32:48 -06:00
|
|
|
san="
|
|
|
|
[SAN]
|
2022-09-10 13:33:40 -06:00
|
|
|
subjectAltName = DNS:${hostname}.${username}.${TLD},DNS:*.${hostname}.${username}.${TLD}"
|
2022-09-10 12:54:31 -06:00
|
|
|
[ "${ipstring}" != "" ] && san="${san},${ipstring}"
|
2022-09-10 13:30:39 -06:00
|
|
|
if ! printf '%s\n' "${san}" | sudo cat '/etc/ssl/openssl.cnf' /dev/stdin \
|
2022-09-10 14:31:29 -06:00
|
|
|
| sudo tee "${SSL_CONFIG_DIR}/${username}/${hostname}.cnf" >/dev/null; then
|
2022-09-10 13:30:39 -06:00
|
|
|
printf 'Failed to generate %s/%s/%s.cnf\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
|
|
|
exit 7
|
|
|
|
fi
|
|
|
|
|
|
|
|
# Generate CSR
|
2022-09-10 13:32:48 -06:00
|
|
|
if ! sudo /usr/bin/openssl req -new -sha256 -reqexts SAN -extensions SAN \
|
2022-08-29 11:42:13 -06:00
|
|
|
-key "${SSL_CONFIG_DIR}/${username}/${hostname}/server.key" \
|
2022-09-08 21:15:30 -06:00
|
|
|
-out "${SSL_CONFIG_DIR}/${username}/${hostname}.csr" \
|
2022-09-10 13:32:48 -06:00
|
|
|
-config "${SSL_CONFIG_DIR}/${username}/${hostname}.cnf" \
|
2022-08-29 11:42:13 -06:00
|
|
|
-subj "/O=${SSL_ORG}/OU=${username}/CN=${hostname}.${username}.${TLD}" \
|
2022-09-10 13:37:56 -06:00
|
|
|
>/dev/null 2>&1; then
|
2022-09-10 12:32:24 -06:00
|
|
|
printf 'Failed to generate %s/%s/%s.csr\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-09-10 11:14:07 -06:00
|
|
|
fi
|
2022-09-10 12:35:00 -06:00
|
|
|
|
2022-08-29 11:42:13 -06:00
|
|
|
# Generate cert
|
2022-09-10 11:14:07 -06:00
|
|
|
if ! sudo /usr/bin/openssl x509 -req -sha256 -extensions SAN -CAcreateserial \
|
2022-08-29 11:42:13 -06:00
|
|
|
-extfile "${SSL_CONFIG_DIR}/${username}/${hostname}.cnf" \
|
|
|
|
-in "${SSL_CONFIG_DIR}/${username}/${hostname}.csr" \
|
|
|
|
-CA "${SSL_CA_CERT}" -CAkey "${SSL_CA_KEY}" \
|
|
|
|
-passin "pass:${SSL_CA_PASS}" \
|
2022-09-08 21:15:30 -06:00
|
|
|
-out "${SSL_CONFIG_DIR}/${username}/${hostname}/server.crt" \
|
2022-09-10 13:37:56 -06:00
|
|
|
-days "${SSL_DAYS}" >/dev/null 2>&1; then
|
2022-10-20 19:12:36 -06:00
|
|
|
printf 'ERROR! Failed to generate SSL cert %s/%s/server.crt\n' "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-09-10 12:04:43 -06:00
|
|
|
fi; if ! sudo [ -f "${SSL_CONFIG_DIR:?}/${username:?}/${hostname:?}/server.crt" ]; then
|
2022-10-20 19:12:36 -06:00
|
|
|
printf 'ERROR! SSL key %s/%s/server.crt was not generated!\n' "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-09-09 20:02:39 -06:00
|
|
|
exit 7
|
2022-10-21 12:42:34 -06:00
|
|
|
fi; if ! sudo chmod 640 "${SSL_CONFIG_DIR}/${username}/${hostname}/server.crt" "${SSL_CONFIG_DIR}/${username}/${hostname}/server.key"; then
|
2022-10-21 12:07:26 -06:00
|
|
|
printf 'ERROR! Failed to chmod SSL cert %s/%s/server.*\n' "${username}" "${hostname}" >>"${LOGFILE}"
|
2022-10-20 19:12:36 -06:00
|
|
|
exit 8
|
2022-10-20 19:18:28 -06:00
|
|
|
fi & if ! sudo chgrp -R www-data "${SSL_CONFIG_DIR}/${username}/"; then
|
2022-10-20 21:42:01 -06:00
|
|
|
printf 'ERROR! Failed to set group of %s!\n' "${SSL_CONFIG_DIR}/${username}/" >>"${LOGFILE}"
|
2022-10-20 19:23:01 -06:00
|
|
|
exit 8
|
|
|
|
fi
|
2022-08-29 11:42:13 -06:00
|
|
|
|
|
|
|
# Remove old files
|
2022-09-10 13:30:39 -06:00
|
|
|
if ! sudo rm "${SSL_CONFIG_DIR}/${username}/${hostname}.cnf" "${SSL_CONFIG_DIR}/${username}/${hostname}.csr" 2>/dev/null; then
|
|
|
|
printf 'Failed to remove old SSL config files %s/%s/%s.cnf\n' "${SSL_CONFIG_DIR}" "${username}" "${hostname}" >>"${LOGFILE}"
|
|
|
|
exit 7
|
|
|
|
fi
|