commands

   1 #!/bin/bash
   2 com="$SSH_ORIGINAL_COMMAND"
   3 if [[ "$UID" == 0 ]]; then
   4     echo "Run script as non-root-user"
   5     exit
   6 fi
   7 if [[ "$com" == "ask quiz certs" ]]; then
   8     folder=$(mktemp -d)
   9     # In argument 1 is the path of the certificates to update: $1.crt and $1.key
  10     function update_cert {
  11         name=$1
  12         if [[ -f $name.crt ]] && openssl x509 -checkend $((365*24*60*60)) -in $name.crt > /dev/null; then
  13             echo "SKIP $name"
  14         else
  15             echo "ISSUE $name"
  16             openssl req -newkey rsa:4096 -subj "/CN=will-be-ignored" -nodes -out $folder/web.req -keyout $folder/web.key 2>/dev/null
  17             cat $folder/web.req
  18             read -r response
  19             if [[ "$response" == "SUCCESS" ]]; then
  20                 # read certificate count
  21                 read -r len
  22                 printf '' > $folder/web.crt
  23                 for ((i=0;i<len;i++)); do
  24                     # read one certificate
  25                     openssl x509 -out $folder/web1.crt
  26                     cat $folder/web1.crt >> $folder/web.crt
  27                 done
  28                 rm $folder/web1.crt
  29                 crt=$(openssl x509 -in $folder/web.crt -noout -modulus)
  30                 key=$(openssl rsa -in $folder/web.key -noout -modulus)
  31                 if [[ $crt == $key ]]; then
  32                     echo "SUCCESS: $len";
  33                     cp $folder/web.crt $name.crt
  34                     chmod +r $folder/web.key
  35                     cp $folder/web.key $name.key
  36                 else
  37                     echo "MISMATCH";
  38                 fi
  39             else
  40                 printf "%s\n" "$response"
  41             fi
  42         fi
  43     }
  44     update_cert "modules/quiz/files/web"
  45     update_cert "modules/quiz/files/client"
  46     update_cert "modules/gigi/files/gigi"
  47     update_cert "modules/gigi/files/client"
  48     update_cert "modules/gitweb/files/web"
  49     echo "DONE"
  50     [[ -f $folder/web.crt ]] && rm $folder/web.crt
  51     [[ -f $folder/web.req ]] && rm $folder/web.req
  52     [[ -f $folder/web.key ]] && rm $folder/web.key
  53     rmdir $folder
  54 elif [[ "$com" == "reload quiz certs" ]]; then
  55     sudo puppet apply /etc/puppet/code/environments/production/manifests --verbose
  56     sudo lxc-attach -n front-nginx -- puppet agent --verbose --test
  57     sudo lxc-attach -n quiz -- puppet agent --verbose --test
  58     sudo lxc-attach -n gigi -- puppet agent --verbose --test
  59 elif [[ "$com" == "update crls" ]]; then
  60     if ! tar xv -C /data/crl; then
  61         echo "requiring tar"
  62         exit;
  63     fi
  64     echo "Updating crls"
  65     mkdir -p /data/crl/htdocs/g2
  66     for i in /data/crl/*.crl; do
  67         if ! [[ -h /data/crl/htdocs/g2/${i#/data/crl/} ]]; then
  68             ln -vs /data-crl/${i#/data/crl/} /data/crl/htdocs/g2/${i#/data/crl/}
  69         fi
  70     done
  71
  72     for i in  /data/gigi-crl/*/ca.crl; do
  73         j=$(echo $i | sed "s#^/data/gigi-crl/\([a-zA-Z]*\)_\([0-9]*\)_\([0-9]\)/ca.crl#\2/\1-\3.crl#")
  74         mkdir -p /data/crl/htdocs/g2/$(dirname $j)
  75         if ! [[ -h /data/crl/htdocs/g2/$j ]]; then
  76             ln -vs /data-crl-gigi/${i#/data/gigi-crl/} /data/crl/htdocs/g2/$j
  77         fi
  78     done
  79
  80     mkdir -p /data/crl/crt-htdocs/g2
  81     for i in modules/nre/files/config/ca/*; do
  82         [[ $i == *_* ]] && continue
  83         if ! [[ -f /data/crl/crt-htdocs/g2/$(basename $i) ]]; then
  84             cp -v $i /data/crl/crt-htdocs/g2/$(basename $i)
  85         fi
  86     done
  87     for i in  /data/gigi-crl/*/ca.crt; do
  88         j=$(echo $i | sed "s#^/data/gigi-crl/\([a-zA-Z]*\)_\([0-9]*\)_\([0-9]\)/ca.crt#\2/\1-\3.crt#")
  89         mkdir -p /data/crl/crt-htdocs/g2/$(dirname $j)
  90         if ! [[ -h /data/crl/crt-htdocs/g2/$j ]]; then
  91             ln -vs /data-crl-gigi/${i#/data/gigi-crl/} /data/crl/crt-htdocs/g2/$j
  92         fi
  93     done
  94
  95 else
  96     printf "%s\n" $com
  97 fi