67 lines
3.3 KiB
Plaintext
67 lines
3.3 KiB
Plaintext
|
#!/bin/bash
|
||
|
|
#
|
||
|
|
# Set up the openssl certificates for the tog-pegasus cimserver
|
||
|
|
#
|
||
|
|
# Arguments:
|
||
|
|
# If a single host name argument is given that resolves to a host
|
||
|
|
# IP address, then the script will attempt to copy the certificate
|
||
|
|
# files from that host name.
|
||
|
|
#
|
||
|
|
# Without any arguments:
|
||
|
|
#
|
||
|
|
# Modify entries in ssl.cnf, then
|
||
|
|
# Generate a self signed node certificate
|
||
|
|
#
|
||
|
|
PEGASUS_CONFIG_DIR=${PEGASUS_CONFIG_DIR:=/etc/Pegasus}
|
||
|
|
INSTALL_LOG=${INSTALL_LOG:=/var/log/Pegasus/install.log}
|
||
|
|
PEGASUS_SSL_CERT_FILE=${PEGASUS_SSL_CERT_FILE:=server.pem}
|
||
|
|
PEGASUS_SSL_KEY_FILE=${PEGASUS_SSL_KEY_FILE:=file.pem}
|
||
|
|
PEGASUS_SSL_TRUSTSTORE=${PEGASUS_SSL_TRUSTSTORE:=client.pem}
|
||
|
|
cnfChanged=0;
|
||
|
|
if [ ! -e $PEGASUS_CONFIG_DIR/ssl.cnf ]; then
|
||
|
|
mkdir -p ${INSTALL_LOG%/*}
|
||
|
|
mkdir -p $PEGASUS_CONFIG_DIR
|
||
|
|
echo "[ req ]" > $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "distinguished_name = req_distinguished_name" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "prompt = no" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "[ req_distinguished_name ]" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "C = UK" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "ST = Berkshire" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "L = Reading" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "O = The Open Group" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
echo "OU = The OpenPegasus Project" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
DN=`hostname`;
|
||
|
|
if [ -z "$DN" ] || [ "$DN" = "(none)" ]; then
|
||
|
|
DN='localhost.localdomain';
|
||
|
|
fi;
|
||
|
|
FQDN=`{ host -W1 $DN 2>/dev/null || echo "$DN has address "; } | grep 'has address' | head -1 | sed 's/\ .*$//'`;
|
||
|
|
if [ -z "$FQDN" ] ; then
|
||
|
|
FQDN="$DN";
|
||
|
|
fi;
|
||
|
|
# cannot use 'hostname --fqdn' because this can hang indefinitely
|
||
|
|
echo "CN = $FQDN" >> $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
chmod 400 $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
chown root $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
chgrp root $PEGASUS_CONFIG_DIR/ssl.cnf
|
||
|
|
cnfChanged=1;
|
||
|
|
fi
|
||
|
|
if [ $cnfChanged -eq 1 ] || [ ! -e /etc/Pegasus/$PEGASUS_SSL_CERT_FILE ] || [ ! -e /etc/Pegasus/$PEGASUS_SSL_KEY_FILE ] || [ ! -e /etc/Pegasus/$PEGASUS_SSL_TRUSTSTORE ]; then
|
||
|
|
/usr/bin/openssl req -x509 -days 3650 -newkey rsa:2048 \
|
||
|
|
-nodes -config $PEGASUS_CONFIG_DIR/ssl.cnf \
|
||
|
|
-keyout $PEGASUS_CONFIG_DIR/key.pem -out $PEGASUS_CONFIG_DIR/cert.pem 2>>$INSTALL_LOG
|
||
|
|
chmod 700 $PEGASUS_CONFIG_DIR/*.pem
|
||
|
|
cat $PEGASUS_CONFIG_DIR/key.pem > $PEGASUS_CONFIG_DIR/file_2048.pem
|
||
|
|
chmod 400 $PEGASUS_CONFIG_DIR/file_2048.pem
|
||
|
|
cat $PEGASUS_CONFIG_DIR/cert.pem > $PEGASUS_CONFIG_DIR/server_2048.pem
|
||
|
|
chmod 400 $PEGASUS_CONFIG_DIR/server_2048.pem
|
||
|
|
cat $PEGASUS_CONFIG_DIR/cert.pem > $PEGASUS_CONFIG_DIR/client_2048.pem
|
||
|
|
chmod 400 $PEGASUS_CONFIG_DIR/client_2048.pem
|
||
|
|
rm -f $PEGASUS_CONFIG_DIR/key.pem $PEGASUS_CONFIG_DIR/cert.pem
|
||
|
|
cp -fp $PEGASUS_CONFIG_DIR/server_2048.pem $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_CERT_FILE
|
||
|
|
cp -fp $PEGASUS_CONFIG_DIR/file_2048.pem $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_KEY_FILE
|
||
|
|
chmod 400 $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_KEY_FILE
|
||
|
|
chmod 444 $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_CERT_FILE
|
||
|
|
cp -fp $PEGASUS_CONFIG_DIR/client_2048.pem $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_TRUSTSTORE
|
||
|
|
chmod 444 $PEGASUS_CONFIG_DIR/$PEGASUS_SSL_TRUSTSTORE;
|
||
|
|
fi;
|