1  am_J*j"T޸)F File not found. " l=J 4҂P \ w o m޿  #!/usr/bin/bash # SPDX-License-Identifier: LGPL-2.1-or-later set -eu # shellcheck disable=SC2034 # prefix= is set because the default /etc contains "${prefix}" prefix="/usr" COCKPIT_CONFIG="/etc/cockpit" COCKPIT_WS_CERTS_D="${COCKPIT_CONFIG}/ws-certs.d" COCKPIT_RUNTIME_DIR="/run/cockpit" install_cert() { local destination="${COCKPIT_WS_CERTS_D}/$1" mv -Z "$1" "${destination}" # The certificate should be world-readable chmod a+r "${destination}" # Force flush to disk for embedded devices sync "${destination}" } install_key() { local destination="${COCKPIT_WS_CERTS_D}/$1" mv -Z "$1" "${destination}" # Force flush to disk for embedded devices sync "${destination}" } selfsign_sscg() { sscg --quiet \ --lifetime "${DAYS}" \ --cert-key-file "${KEYFILE}" \ --cert-file "${CERTFILE}" \ --ca-file "${CA_FILE}" \ --hostname "${HOSTNAME}" \ --organization "${MACHINE_ID:-unspecified}" \ --subject-alt-name localhost \ --subject-alt-name IP:127.0.0.1/255.255.255.255 } selfsign_openssl() { openssl req -x509 \ -days "${DAYS}" \ -newkey rsa \ -keyout "${KEYFILE}" \ -keyform PEM \ -nodes \ -out "${CERTFILE}" \ -outform PEM \ -subj "${MACHINE_ID:+/O=${MACHINE_ID}}/CN=${HOSTNAME}" \ -addext "subjectAltName=IP:127.0.0.1,DNS:localhost" \ -addext "basicConstraints = critical,CA:TRUE" \ -addext "keyUsage = critical,digitalSignature,cRLSign,keyCertSign,keyEncipherment,keyAgreement" \ -addext "extendedKeyUsage = serverAuth" } cmd_selfsign() { # Common variables used by both methods local MACHINE_ID if [ -e /etc/machine-id ]; then MACHINE_ID="$(tr -d -c '[:xdigit:]' < /etc/machine-id)" fi local HOSTNAME="${HOSTNAME:-$(hostname)}" local CERTFILE="0-self-signed.cert" local KEYFILE="0-self-signed.key" local CA_FILE="0-self-signed-ca.pem" # do not stomp over a partial key -- the admin tried to do something wrong if [ -e "${COCKPIT_WS_CERTS_D}/${KEYFILE}" ] && [ ! -e "${COCKPIT_WS_CERTS_D}/${CERTFILE}" ]; then echo "Error: Found $KEYFILE but no $CERTFILE. Please remove the key file first." >&2 exit 1 fi mkdir -pZ "$COCKPIT_WS_CERTS_D" # We renew certificates up to 30 days before expiry, so give ourselves a # year, plus 30 days. The maximum is variously mentioned to be 397 or 398. local DAYS=395 # If sscg fails, try openssl selfsign_sscg || selfsign_openssl # Install the files and set permissions ($CA_FILE is only created by sscg) test ! -e "${CA_FILE}" || install_cert "${CA_FILE}" install_cert "${CERTFILE}" install_key "${KEYFILE}" } cmd_ipa_request() { local USER="$1" # IPA operations require auth; read password from stdin to avoid quoting issues # if kinit fails, we can't handle this setup, exit cleanly kinit "${USER}@${REALM}" || exit 0 # ensure this gets run with a non-C locale; ipa fails otherwise if [ "$(sh -c 'eval `locale`; echo $LC_CTYPE')" = 'C' ]; then export LC_CTYPE=C.UTF-8 fi # create a kerberos Service Principal Name for cockpit-ws, unless already present ipa service-show "${SERVICE}" || \ ipa service-add --ok-as-delegate=true --ok-to-auth-as-delegate=true --force "${SERVICE}" # add cockpit-ws key, unless already present klist -k "${KEYTAB}" | grep -qF "${SERVICE}" || \ ipa-getkeytab -p "HTTP/${HOST}" -k "${KEYTAB}" # request the certificate and put it into our certificate directory, so that auto-refresh works mkdir -pZ "$COCKPIT_WS_CERTS_D" ipa-getcert request -f "${COCKPIT_WS_CERTS_D}/10-ipa.cert" -k "${COCKPIT_WS_CERTS_D}/10-ipa.key" -K "HTTP/${HOST}" -m 640 -o root:root -M 644 -w -v } cmd_ipa_cleanup() { # clean up keytab if [ -e "${KEYTAB}" ]; then ipa-rmkeytab -k "${KEYTAB}" -p "${SERVICE}"