Subversion Repositories ALCASAR

Rev

Rev 1736 | Rev 1743 | Go to most recent revision | Only display areas with differences | Ignore whitespace | Details | Blame | Last modification | View Log

Rev 1736 Rev 1740
1 
#!/bin/sh
 1 
#!/bin/sh
2 
 
 2 
 
3 
# alcasar-importcert.sh
 3 
# alcasar-importcert.sh
4 
# by Raphaël, Hugo, Clément, Bettyna & rexy
 4 
# by Raphaël, Hugo, Clément, Bettyna & rexy
5 
 
 5 
 
6 
# This script is distributed under the Gnu General Public License (GPL)
 6 
# This script is distributed under the Gnu General Public License (GPL)
7 
 
 7 
 
8 
# Script permettant
 8 
# Script permettant
9 
# - d'importer des certificats sur Alcasar
 9 
# - d'importer des certificats sur Alcasar
10 
# - de revenir au certificat par default
 10 
# - de revenir au certificat par default
11 
 
 11 
 
12 
# This script allows
 12 
# This script allows
13 
# - to import a certificate in Alcasar
 13 
# - to import a certificate in Alcasar
14 
# - to go back to the default certificate
 14 
# - to go back to the default certificate
15 
 
 15 
 
16 
SED="/bin/sed -ri"
 16 
SED="/bin/sed -ri"
17 
DIR_CERT="/etc/pki/tls"
 17 
DIR_CERT="/etc/pki/tls"
18 
CONF_FILE="/usr/local/etc/alcasar.conf"
 18 
CONF_FILE="/usr/local/etc/alcasar.conf"
19 
PRIVATE_IP_MASK=`grep PRIVATE_IP $CONF_FILE|cut -d"=" -f2`
 19 
PRIVATE_IP_MASK=`grep PRIVATE_IP $CONF_FILE|cut -d"=" -f2`
20 
PRIVATE_IP=`echo $PRIVATE_IP_MASK | cut -d"/" -f1`
 20 
PRIVATE_IP=`echo $PRIVATE_IP_MASK | cut -d"/" -f1`
21 
 
 21 
 
22 
usage="Usage: alcasar-importcert.sh -i /path/to/certificate.crt -k /path/to/privatekey.key (-c /path/to/serverchain.crt) || alcasar-importcert.sh -d (Cette utilisation permet de revenir au certificat par default)"
 22 
usage="Usage: alcasar-importcert.sh -i /path/to/certificate.crt -k /path/to/privatekey.key (-c /path/to/serverchain.crt) || alcasar-importcert.sh -d (Cette utilisation permet de revenir au certificat par default)"
23 
nb_args=$#
 23 
nb_args=$#
24 
arg1=$1
 24 
arg1=$1
25 
 
 25 
 
26 
 
 26 
 
27 
function defaultNdd()
 27 
function defaultNdd()
28 
{
 28 
{
29 
	$SED 's/^DOMAIN=.*/DOMAIN=localdomain/g' /usr/local/etc/alcasar.conf
 29 
	$SED 's/^DOMAIN=.*/DOMAIN=localdomain/g' /usr/local/etc/alcasar.conf
30 
	$SED 's/\.([a-zA-Z][a-zA-Z0-9-]+(\.[a-z]{2,4})?)/.localdomain/g' /etc/hosts
 30 
	$SED 's/\.([a-zA-Z][a-zA-Z0-9-]+(\.[a-z]{2,4})?)/.localdomain/g' /etc/hosts
31 
	$SED 's/alcasar\.([a-zA-Z0-9-]+(\.[a-z]{2,4})?)/alcasar.localdomain/g' /etc/chilli.conf
 31 
	$SED 's/alcasar\.([a-zA-Z0-9-]+(\.[a-z]{2,4})?)/alcasar.localdomain/g' /etc/chilli.conf
32 
	$SED 's/^domain.*/domain\t\tlocaldomain/g' /etc/chilli.conf
 32 
	$SED 's/^domain.*/domain\t\tlocaldomain/g' /etc/chilli.conf
33 
	$SED 's/^ServerName.*/ServerName alcasar.localdomain/g' /etc/httpd/conf/httpd.conf
 33 
	$SED 's/^ServerName.*/ServerName alcasar.localdomain/g' /etc/httpd/conf/httpd.conf
34 
	$SED "s/^domain=.*/domain=localdomain/g" /etc/dnsmasq.conf /etc/dnsmasq-blackhole.conf /etc/dnsmasq-blacklist.conf /etc/dnsmasq-whitelist.conf
 34 
	$SED "s/^domain=.*/domain=localdomain/g" /etc/dnsmasq.conf /etc/dnsmasq-blackhole.conf /etc/dnsmasq-blacklist.conf /etc/dnsmasq-whitelist.conf
- 
 
 35 
	hostnamectl set-hostname alcasar.localdomain
- 
 
 36 
	$SED "s/^\tAuthName.*/\tAuthName alcasar.localdomain/g" /etc/httpd/conf/webapps.d/alcasar.conf
- 
 
 37 
	$SED "s/^\tErrorDocument.*/\tErrorDocument 404 https:\/\/alcasar.localdomain\//g" /etc/httpd/conf/webapps.d/alcasar.conf
35 
}
 38 
}
36 
 
 39 
 
37 
function defaultCert()
 40 
function defaultCert()
38 
{
 41 
{
39 
	cd $DIR_CERT
 - 
 
40 
	rm private/alcasar.key
 - 
 
41 
	rm certs/alcasar.crt
 - 
 
42 
	mv certs/alcasar.crt.old certs/alcasar.crt
 42 
	mv -f $DIR_CERT/certs/alcasar.crt.old $DIR_CERT/certs/alcasar.crt
43 
	mv private/alcasar.key.old private/alcasar.key
 43 
	mv -f $DIR_CERT/private/alcasar.key.old $DIR_CERT/private/alcasar.key
44 
	if [ -f certs/server-chain.crt.old ]
 44 
	if [ -f $DIR_CERT/certs/server-chain.crt.old ]
45 
	then
 45 
	then
46 
		rm certs/server-chain.crt
 46 
		mv $DIR_CERT/certs/server-chain.crt.old $DIR_CERT/certs/server-chain.crt
- 
 
 47 
	else
47 
		mv certs/server-chain.crt.old certs/server-chain.crt
 48 
		rm -f $DIR_CERT/certs/server-chain.crt
48 
	fi
 49 
	fi
49 
}
 50 
}
50 
 
 51 
 
51 
function domainName() # change the domain name in the conf files
 52 
function domainName() # change the domain name in the conf files
52 
{
 53 
{
53 
 
 54 
 
54 
	fqdn=$(openssl x509 -noout -subject -in $cert | sed -n '/^subject/s/^.*CN=//p')
 55 
	fqdn=$(openssl x509 -noout -subject -in $cert | sed -n '/^subject/s/^.*CN=//p')
55 
	hostname=`echo $fqdn | awk -F'.' '{ print $1 }'`
 56 
	hostname=`echo $fqdn | awk -F'.' '{ print $1 }'`
56 
	domain=`echo $fqdn | awk -F'.' '{$1="";OFS=".";print $0}' |sed 's/^.//'`
 57 
	domain=`echo $fqdn | awk -F'.' '{$1="";OFS=".";print $0}' |sed 's/^.//'`
57 
	echo "fqdn=$fqdn hostname=$hostname domain=$domain"
 58 
	echo "fqdn=$fqdn hostname=$hostname domain=$domain"
58 
	if [ "$fqdn" != "" ]
 59 
	if [ "$fqdn" != "" ]
59 
	then
 60 
	then
60 
		$SED "s/^DOMAIN=.*/DOMAIN=$domain/g" /usr/local/etc/alcasar.conf
 61 
		$SED "s/^DOMAIN=.*/DOMAIN=$domain/g" /usr/local/etc/alcasar.conf
61 
		cat <<EOF > /etc/hosts
 62 
		cat <<EOF > /etc/hosts
62 
127.0.0.1	localhost
 63 
127.0.0.1	localhost
63 
$PRIVATE_IP	$fqdn $hostname
 64 
$PRIVATE_IP	$fqdn $hostname
64 
EOF
 65 
EOF
65 
		$SED "s/^domain.*/domain\t\t$domain/g" /etc/chilli.conf
 66 
		$SED "s/^domain.*/domain\t\t$domain/g" /etc/chilli.conf
66 
		$SED "s/^locationname.*/locationname\t$fqdn/g" /etc/chilli.conf
 67 
		$SED "s/^locationname.*/locationname\t$fqdn/g" /etc/chilli.conf
67 
		$SED "s/^uamserver.*/uamserver\thttps:\/\/$fqdn\/intercept.php/g" /etc/chilli.conf
 68 
		$SED "s/^uamserver.*/uamserver\thttps:\/\/$fqdn\/intercept.php/g" /etc/chilli.conf
68 
		$SED "s/^radiusnasid.*/radiusnasid\t$fqdn/g" /etc/chilli.conf
 69 
		$SED "s/^radiusnasid.*/radiusnasid\t$fqdn/g" /etc/chilli.conf
69 
		$SED "s/^uamallowed.*/uamallowed\t$hostname,$fqdn/g" /etc/chilli.conf
 70 
		$SED "s/^uamallowed.*/uamallowed\t$hostname,$fqdn/g" /etc/chilli.conf
70 
		$SED "s/^ServerName.*/ServerName $fqdn/g" /etc/httpd/conf/httpd.conf
 71 
		$SED "s/^ServerName.*/ServerName $fqdn/g" /etc/httpd/conf/httpd.conf
71 
		$SED "s/^domain=.*/domain=$domain/g" /etc/dnsmasq.conf /etc/dnsmasq-blackhole.conf /etc/dnsmasq-blacklist.conf /etc/dnsmasq-whitelist.conf
 72 
		$SED "s/^domain=.*/domain=$domain/g" /etc/dnsmasq.conf /etc/dnsmasq-blackhole.conf /etc/dnsmasq-blacklist.conf /etc/dnsmasq-whitelist.conf
- 
 
 73 
		hostnamectl set-hostname $fqdn
- 
 
 74 
		$SED "s/^\tAuthName.*/\tAuthName $fqdn/g" /etc/httpd/conf/webapps.d/alcasar.conf
- 
 
 75 
		$SED "s/^\tErrorDocument.*/\tErrorDocument 404 https:\/\/$fqdn\//g" /etc/httpd/conf/webapps.d/alcasar.conf
72 
	fi
 76 
	fi
73 
}
 77 
}
74 
 
 78 
 
75 
function certImport()
 79 
function certImport()
76 
{
 80 
{
77 
	cd $DIR_CERT
 - 
 
78 
 
 - 
 
79 
	if [ ! -f "/etc/pki/tls/certs/alcasar.crt.old" ]
 81 
	if [ ! -f "$DIR_CERT/certs/alcasar.crt.old" ]
80 
	then
 82 
	then
81 
		echo "Backup of old cert (alcasar.crt)"
 83 
		echo "Backup of old cert (alcasar.crt)"
82 
		mv certs/alcasar.crt certs/alcasar.crt.old
 84 
		mv $DIR_CERT/certs/alcasar.crt $DIR_CERT/certs/alcasar.crt.old
83 
	fi
 85 
	fi
84 
	if [ ! -f "/etc/pki/tls/private/alcasar.key.old" ]
 86 
	if [ ! -f "$DIR_CERT/private/alcasar.key.old" ]
85 
	then
 87 
	then
86 
		echo "Backup of old private key (alcasar.key)"
 88 
		echo "Backup of old private key (alcasar.key)"
87 
		mv private/alcasar.key private/alcasar.key.old
 89 
		mv $DIR_CERT/private/alcasar.key $DIR_CERT/private/alcasar.key.old
88 
	fi
 90 
	fi
- 
 
 91 
	cp $cert $DIR_CERT/certs/alcasar.crt
- 
 
 92 
	cp $key $DIR_CERT/private/alcasar.key
89 
 
 93 
 
90 
	cp $cert certs/alcasar.crt
 - 
 
91 
	cp $key private/alcasar.key
 - 
 
92 
 
 - 
 
93 
	chown root:apache certs/alcasar.crt
 94 
	chown root:apache $DIR_CERT/certs/alcasar.crt
94 
	chown root:apache private/alcasar.key
 95 
	chown root:apache $DIR_CERT/private/alcasar.key
95 
 
 - 
 
96 
	chmod 750 certs/alcasar.crt
 - 
 
97 
	chmod 750 private/alcasar.key
 - 
 
98 
 
 96 
 
- 
 
 97 
	chmod 750 $DIR_CERT/certs/alcasar.crt
- 
 
 98 
	chmod 750 $DIR_CERT/private/alcasar.key
99 
	if [ "$sc" != "" ]
 99 
	if [ "$sc" != "" ]
100 
	then
 100 
	then
101 
		echo "cert-chain exists"
 101 
		echo "cert-chain exists"
102 
		if [ ! -f "/etc/pki/tls/certs/server-chain.crt.old" ]
 102 
		if [ ! -f "$DIR_CERT/certs/server-chain.crt.old" ]
103 
		then
 103 
		then
104 
			echo "Backup of old cert-chain (server-chain.crt)"
 104 
			echo "Backup of old cert-chain (server-chain.crt)"
105 
			mv certs/server-chain.crt certs/server-chain.crt.old
 105 
			mv $DIR_CERT/certs/server-chain.crt $DIR_CERT/certs/server-chain.crt.old
106 
		fi
 106 
		fi
107 
		cp $sc certs/server-chain.crt
 107 
		cp $sc $DIR_CERT/certs/server-chain.crt
108 
		chown root:apache certs/server-chain.crt
 108 
		chown root:apache $DIR_CERT/certs/server-chain.crt
109 
		chmod 750 certs/server-chain.crt
 109 
		chmod 750 $DIR_CERT/certs/server-chain.crt
110 
	fi
 110 
	fi
111 
}
 111 
}
112 
 
 112 
 
113 
 
 113 
 
114 
if [ $nb_args -eq 0 ]
 114 
if [ $nb_args -eq 0 ]
115 
then
 115 
then
116 
	echo "$usage"
 116 
	echo "$usage"
117 
	exit 1
 117 
	exit 1
118 
fi
 118 
fi
119 
 
 119 
 
120 
case $arg1 in
 120 
case $arg1 in
121 
	-\? | -h* | --h*)
 121 
	-\? | -h* | --h*)
122 
		echo "$usage"
 122 
		echo "$usage"
123 
		exit 0
 123 
		exit 0
124 
		;;
 124 
		;;
125 
	-i)
 125 
	-i)
126 
		arg3=$3
 126 
		arg3=$3
127 
		arg5=$5
 127 
		arg5=$5
128 
		cert=$2
 128 
		cert=$2
129 
		key=$4
 129 
		key=$4
130 
		sc=$6
 130 
		sc=$6
131 
 
 131 
 
132 
		if [ "$cert" == "" ] || [ "$key" == "" ]
 132 
		if [ "$cert" == "" ] || [ "$key" == "" ]
133 
		then
 133 
		then
134 
			echo "$usage"
 134 
			echo "$usage"
135 
			exit 1
 135 
			exit 1
136 
		fi
 136 
		fi
137 
 
 137 
 
138 
		if [ ! -f "$cert" -o ! -f "$key" ]
 138 
		if [ ! -f "$cert" -o ! -f "$key" ]
139 
		then
 139 
		then
140 
			echo "Certificate and/or private key not found"
 140 
			echo "Certificate and/or private key not found"
141 
			exit 1
 141 
			exit 1
142 
		fi
 142 
		fi
143 
 
 143 
 
144 
		if [ ${cert: -4} != ".crt" ]
 144 
		if [ ${cert: -4} != ".crt" ]
145 
		then
 145 
		then
146 
			echo "Invalid certificate file"
 146 
			echo "Invalid certificate file"
147 
			exit 1
 147 
			exit 1
148 
		fi
 148 
		fi
149 
 
 149 
 
150 
		if [ ${key: -4} != ".key" ]
 150 
		if [ ${key: -4} != ".key" ]
151 
		then
 151 
		then
152 
			echo "Invalid private key"
 152 
			echo "Invalid private key"
153 
			exit 1
 153 
			exit 1
154 
		fi
 154 
		fi
155 
 
 155 
 
156 
		if [ "$arg5" != "-c" ] || [ ! -f "$sc" ]
 156 
		if [ "$arg5" != "-c" ] || [ ! -f "$sc" ]
157 
		then
 157 
		then
158 
			echo "No server-chain given"
 158 
			echo "No server-chain given"
159 
			echo "Importing certificate $cert with private key $key"
 159 
			echo "Importing certificate $cert with private key $key"
160 
			sc=""
 160 
			sc=""
161 
		else
 161 
		else
162 
			echo "Importing certificate $cert with private key $key and server-chain $sc"
 162 
			echo "Importing certificate $cert with private key $key and server-chain $sc"
163 
		fi
 163 
		fi
164 
 
 - 
 
165 
		domainName $cert
 164 
		domainName $cert
166 
		certImport $cert $key $sc
 165 
		certImport $cert $key $sc
167 
		for services in chilli httpd dnsmasq dnsmasq-blackhole dnsmasq-blacklist dnsmasq-whitelist
 166 
		for services in chilli httpd dnsmasq dnsmasq-blackhole dnsmasq-blacklist dnsmasq-whitelist
168 
			do
 167 
		do
169 
				systemctl restart $services
 168 
			echo "restarting $services"; systemctl restart $services; sleep 1
170 
			done
 169 
		done
171 
		;;
 170 
		;;
172 
	-d)
 171 
	-d)
173 
		if [ -f "/etc/pki/tls/certs/alcasar.crt.old" -a -f "/etc/pki/tls/private/alcasar.key.old" ]
 172 
		if [ -f "/etc/pki/tls/certs/alcasar.crt.old" -a -f "/etc/pki/tls/private/alcasar.key.old" ]
174 
		then
 173 
		then
175 
			echo "Restoring default certificate"
 174 
			echo "Restoring default certificate"
176 
			defaultCert
 175 
			defaultCert
177 
			defaultNdd
 176 
			defaultNdd
178 
			systemctl restart chilli.service
 177 
			for services in chilli httpd dnsmasq dnsmasq-blackhole dnsmasq-blacklist dnsmasq-whitelist
- 
 
 178 
			do
179 
			systemctl restart httpd.service
 179 
				echo "restarting $services"; systemctl restart $services; sleep 1
- 
 
 180 
			done
180 
		fi
 181 
		fi
181 
		;;
 182 
		;;
182 
	*)
 183 
	*)
183 
		echo "$usage"
 184 
		echo "$usage"
184 
		;;
 185 
		;;
185 
esac
 186 
esac
186 
 
 187