Fix certificate generation

Signed-off-by: Alexander Scheel <ascheel@redhat.com>
This commit is contained in:
Alexander Scheel 2020-05-13 10:02:47 -04:00
parent 2b4b411c94
commit c30f7f08df
No known key found for this signature in database
GPG Key ID: C0D6C737D0003143
2 changed files with 32 additions and 38 deletions

View File

@ -1,36 +1,18 @@
From d38836ca4158b42c27f4d7f474e64f4f10aed16d Mon Sep 17 00:00:00 2001
From acaf4be8e301a01041acba189194d9502994611d Mon Sep 17 00:00:00 2001
From: Alexander Scheel <ascheel@redhat.com>
Date: Wed, 8 May 2019 10:29:08 -0400
Date: Wed, 13 May 2020 10:01:47 -0400
Subject: [PATCH] Don't clobber existing files on bootstrap
Signed-off-by: Alexander Scheel <ascheel@redhat.com>
---
raddb/certs/bootstrap | 39 ++++++++++++---------------------------
1 file changed, 12 insertions(+), 27 deletions(-)
raddb/certs/bootstrap | 31 +++++++++++++++----------------
1 file changed, 15 insertions(+), 16 deletions(-)
diff --git a/raddb/certs/bootstrap b/raddb/certs/bootstrap
index 0f719aafd4..be81a2d697 100755
index ede09bc..e555491 100755
--- a/raddb/certs/bootstrap
+++ b/raddb/certs/bootstrap
@@ -13,17 +13,6 @@
umask 027
cd `dirname $0`
-make -h > /dev/null 2>&1
-
-#
-# If we have a working "make", then use it. Otherwise, run the commands
-# manually.
-#
-if [ "$?" = "0" ]; then
- make all
- exit $?
-fi
-
#
# The following commands were created by running "make -n", and edited
# to remove the trailing backslash, and to add "exit 1" after the commands.
@@ -31,52 +20,51 @@ fi
@@ -20,56 +20,55 @@ cd `dirname $0`
# Don't edit the following text. Instead, edit the Makefile, and
# re-generate these commands.
#
@ -44,60 +26,64 @@ index 0f719aafd4..be81a2d697 100755
- fi
+ ln -sf /dev/urandom random
fi
-if [ ! -f server.key ]; then
+if [ ! -e server.key ]; then
openssl req -new -out server.csr -keyout server.key -config ./server.cnf || exit 1
chmod g+r server.key
fi
-if [ ! -f ca.key ]; then
+if [ ! -e ca.key ]; then
openssl req -new -x509 -keyout ca.key -out ca.pem -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf || exit 1
fi
-if [ ! -f index.txt ]; then
+if [ ! -e index.txt ]; then
touch index.txt
fi
-if [ ! -f serial ]; then
+if [ ! -e serial ]; then
echo '01' > serial
fi
-if [ ! -f server.crt ]; then
+if [ ! -e server.crt ]; then
openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf || exit 1
fi
-if [ ! -f server.p12 ]; then
+if [ ! -e server.p12 ]; then
openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
chmod g+r server.p12
fi
-if [ ! -f server.pem ]; then
+if [ ! -e server.pem ]; then
openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` || exit 1
openssl verify -CAfile ca.pem server.pem || exit 1
chmod g+r server.pem
fi
-if [ ! -f ca.der ]; then
+if [ ! -e ca.der ]; then
openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der || exit 1
fi
-if [ ! -f client.key ]; then
+if [ ! -e client.key ]; then
openssl req -new -out client.csr -keyout client.key -config ./client.cnf
chmod g+r client.key
fi
-if [ ! -f client.crt ]; then
+if [ ! -e client.crt ]; then
openssl ca -batch -keyfile ca.key -cert ca.pem -in client.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out client.crt -extensions xpclient_ext -extfile xpextensions -config ./client.cnf
fi
+
+chown root:radiusd dh ca.* client.* server.*
+chmod 644 dh ca.* client.* server.*
--
2.21.0
+chmod 640 dh ca.* client.* server.*
--
2.26.2

View File

@ -1,7 +1,7 @@
Summary: High-performance and highly configurable free RADIUS server
Name: freeradius
Version: 3.0.21
Release: 2%{?dist}
Release: 3%{?dist}
License: GPLv2+ and LGPLv2+
URL: http://www.freeradius.org/
@ -22,6 +22,8 @@ Source104: freeradius-tmpfiles.conf
Patch1: freeradius-Adjust-configuration-to-fit-Red-Hat-specifics.patch
Patch2: freeradius-Use-system-crypto-policy-by-default.patch
Patch3: freeradius-bootstrap-create-only.patch
Patch4: freeradius-no-buildtime-cert-gen.patch
%global docdir %{?_pkgdocdir}%{!?_pkgdocdir:%{_docdir}/%{name}-%{version}}
@ -199,6 +201,8 @@ This plugin provides the REST support for the FreeRADIUS server project.
# mistakenly includes the backup files, especially problematic for raddb config files.
%patch1 -p1
%patch2 -p1
%patch3 -p1
%patch4 -p1
%build
# Force compile/link options, extra security for network facing daemon
@ -831,6 +835,10 @@ exit 0
%attr(640,root,radiusd) %config(noreplace) /etc/raddb/mods-available/rest
%changelog
* Wed May 13 2020 Alexander Scheel <ascheel@redhat.com> - 3.0.21-3
- Fix certificate generation
Resolves: bz#1835249
* Tue Apr 21 2020 Björn Esser <besser82@fedoraproject.org> - 3.0.21-2
- Rebuild (json-c)