Updated fds.in (updated and automated certificate handling).

diff --git a/sources/fds.in/c3d/firstboot/scripts/10_setupletsencrypt.sh b/sources/fds.in/c3d/firstboot/scripts/10_setupletsencrypt.sh
new file mode 100755 (executable)
index 0000000..730aadf
--- /dev/null
+++ b/sources/fds.in/c3d/firstboot/scripts/10_setupletsencrypt.sh
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+
+if [ -d /etc/letsencrypt ]
+then
+    mv /etc/letsencrypt /etc/letsencrypt.orig
+fi
+/usr/local/bin/getletsencrypt.sh
+if [ $? -eq 0 ]
+then
+    echo '10 3 * * * root /usr/local/bin/getletsencrypt.sh' >>/etc/crontab
+fi

diff --git a/sources/fds.in/c3d/firstboot/scripts/10_setupds.sh b/sources/fds.in/c3d/firstboot/scripts/20_setupds.sh
similarity index 95%
rename from sources/fds.in/c3d/firstboot/scripts/10_setupds.sh
rename to sources/fds.in/c3d/firstboot/scripts/20_setupds.sh
index b8cd1390d8f7f6669352f38a62cee615259ec6d2..1cf7552737b755d7af262850bfe71ee377b5680a 100755 (executable)
--- a/sources/fds.in/c3d/firstboot/scripts/10_setupds.sh
+++ b/sources/fds.in/c3d/firstboot/scripts/20_setupds.sh
@@ -8,9 +8,6 @@ DATA_PATH=$(realpath $REAL_PATH/../data)
 INSTANCE_NAME=user
 
 
-/usr/local/bin/getletsencrypt.sh
-
-
 /usr/local/bin/restorefds.sh
 if [ $? -eq 0 ]
 then
@@ -60,5 +57,3 @@ ldapmodify -D "cn=Directory Manager" \
 rm --force $LDIF_FILE
 
 /usr/local/bin/replacedirsrvcerts.sh
-
-dsctl $INSTANCE_NAME restart

diff --git a/sources/fds.in/c3d/firstboot/scripts/11_createusers.sh b/sources/fds.in/c3d/firstboot/scripts/21_createusers.sh
similarity index 100%
rename from sources/fds.in/c3d/firstboot/scripts/11_createusers.sh
rename to sources/fds.in/c3d/firstboot/scripts/21_createusers.sh

diff --git a/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/getletsencrypt.sh b/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/getletsencrypt.sh
index 2b9a3bb955c9b5fc79e75d154aa78e9b55f130fd..261e54259b3a45e083810840f370bd25c3bd8663 100755 (executable)
--- a/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/getletsencrypt.sh
+++ b/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/getletsencrypt.sh
@@ -1,15 +1,66 @@
 #!/bin/sh
 
 
-if [ -d /etc/letsencrypt ]
-then
-    rm --force --recursive /etc/letsencrypt.old
-    cp --archive /etc/letsencrypt /etc/letsencrypt.old
-fi
+# cases are:
+# 1: /etc/letsencrypt does not exist
+# 2: /etc/letsencrypt exists
+# 2.1: /etc/letsencrypt.staging does not exist
+# 2.2: /etc/letsencrypt.staging exists
+# 2.2.1: staging differs from current
+# 2.2.2: staging is the same as current
+
+
+LE_DIRECTORY=/etc/letsencrypt
+OLD_LE_DIRECTORY=/etc/letsencrypt.old
+STAGING_DIRECTORY=/etc/letsencrypt.staging
+TMP_DIRECTORY=$(mktemp --directory)
+
 
 /usr/bin/rsync \
     --archive \
     --delete-after \
     --info=STATS \
     pki.in.useribm.hu::letsencrypt \
-    /etc/letsencrypt
+    $TMP_DIRECTORY
+if [ $? -ne 0 ]
+then
+    rm --force --recursive $TMP_DIRECTORY
+    exit 1
+fi
+
+if [ -d $LE_DIRECTORY ]
+then
+    # case 2
+    if [ -d $STAGING_DIRECTORY ]
+    then
+        # case 2.2
+        diff --brief --recursive $STAGING_DIRECTORY $TMP_DIRECTORY
+        DIFFERS=$?
+        if [ $DIFFERS -eq 0 ]
+        then
+            # case 2.2.2
+            rm --force --recursive $OLD_LE_DIRECTORY
+            rm --force --recursive $TMP_DIRECTORY
+            mv $LE_DIRECTORY $OLD_LE_DIRECTORY
+            mv $STAGING_DIRECTORY $LE_DIRECTORY
+            /usr/local/bin/replacedirsrvcerts.sh
+        else
+            # case 2.2.1
+            rm --force --recursive $STAGING_DIRECTORY
+            mv $TMP_DIRECTORY $STAGING_DIRECTORY
+        fi
+    else
+        # case 2.1
+        diff --brief --recursive $LE_DIRECTORY $TMP_DIRECTORY
+        DIFFERS=$?
+        if [ $DIFFERS -eq 0 ]
+        then
+            rm --force --recursive $TMP_DIRECTORY
+        else
+            mv $TMP_DIRECTORY $STAGING_DIRECTORY
+        fi
+    fi
+else
+    # case 1
+    mv $TMP_DIRECTORY $LE_DIRECTORY
+fi

diff --git a/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/replacedirsrvcerts.sh b/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/replacedirsrvcerts.sh
index 097359919feac05aba2f31421e5969ef150d3d67..2edf6248dc736ec75ea7810937ec70873470826b 100755 (executable)
--- a/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/replacedirsrvcerts.sh
+++ b/sources/fds.in/c3d/postinstall/install-data/usr/local/bin/replacedirsrvcerts.sh
@@ -2,6 +2,7 @@
 
 
 INSTANCE_NAME=user
+TMP_PATH=$(mktemp --directory)
 
 
 if [ -d /etc/letsencrypt ]
@@ -9,21 +10,41 @@ then
     LETSENCRYPT_BASE=/etc/letsencrypt
     CERT_PATH=$LETSENCRYPT_BASE/live/useribm
 
-    dsconf $INSTANCE_NAME security ca-certificate list \
-        | grep '^Certificate Name:' | cut -f 2- -d ':' \
-        | while read CA_NAME
+    for CACERT in ca-certificate certificate
     do
-        dsconf $INSTANCE_NAME security ca-certificate del "$CA_NAME"
+        dsconf $INSTANCE_NAME security $CACERT list \
+            | grep '^Certificate Name:' | cut -f 2- -d ':' \
+            | while read CACERT_NAME
+        do
+            dsconf $INSTANCE_NAME security $CACERT del "$CACERT_NAME"
+        done
     done
 
-    dsconf $INSTANCE_NAME security ca-certificate add \
-        --file $CERT_PATH/chain.pem \
-       --name "Let's Encrypt Certificate Authority"
-    dsconf $INSTANCE_NAME security ca-certificate set-trust-flags \
-        "Let's Encrypt Certificate Authority" \
-               --flags "CT,,"
+    CA_SERIAL=0
+    cat $CERT_PATH/chain.pem | while read LINE
+    do
+        echo $LINE | grep 'BEGIN CERTIFICATE'
+        if [ $? -eq 0 ]
+        then
+            CA_SERIAL=$(( $CA_SERIAL + 1 ))
+            CA_FILE=$TMP_PATH/ca${CA_SERIAL}.pem
+        fi
+        echo $LINE >>$CA_FILE
+    done
+    for CERT_FILE in $TMP_PATH/ca*.pem
+    do
+        CERT_SUBJECT=$(openssl x509 -noout -subject -in $CERT_FILE \
+            | sed 's/^.*O \?= \?\([^,]*\), \?CN \?= \?\(.*\)$/\1 \2/')
+        dsconf $INSTANCE_NAME security ca-certificate add \
+            --file $CERT_FILE \
+            --name "$CERT_SUBJECT"
+    done
+    # cannot use dsconf, need key as well
     dsctl $INSTANCE_NAME tls import-server-key-cert \
         $CERT_PATH/cert.pem \
         $CERT_PATH/privkey.pem
 
+    dsctl $INSTANCE_NAME restart
 fi
+
+rm --force --recursive $TMP_PATH

diff --git a/sources/fds.in/envvars b/sources/fds.in/envvars
index 8ee405bae32dc7022f94ceb6748c4aec35785436..968c8bc80ad7b35a00bf4523eff8b0877b57350e 100644 (file)
--- a/sources/fds.in/envvars
+++ b/sources/fds.in/envvars
@@ -1,3 +1,4 @@
 DISTRIBUTION=Fedora
 DISTRIBUTION_VERSION=36
-SPEC_PACKAGES="389-ds-base cockpit cockpit-389-ds openssh-clients openssh-server rsync"
+SPEC_PACKAGES="389-ds-base acl cockpit cockpit-389-ds cronie"
+SPEC_PACKAGES="$SPEC_PACKAGES openssh-clients openssh-server rsync"

diff --git a/sources/sns.in/c3d/postinstall/install-data/var/named/pm.useribm.hu.zonesource b/sources/sns.in/c3d/postinstall/install-data/var/named/pm.useribm.hu.zonesource
index 2b38d412192c4d21057b7fa7e1aabb9c24efcd1e..ebba066432db1ab13d752e9100b60c9abef76b27 100644 (file)
--- a/sources/sns.in/c3d/postinstall/install-data/var/named/pm.useribm.hu.zonesource
+++ b/sources/sns.in/c3d/postinstall/install-data/var/named/pm.useribm.hu.zonesource
@@ -5,9 +5,10 @@ $TTL   86400
                                        7200            ; Retry (2 hours)
                                        2419200         ; Expire (4 weeks)
                                        3600)           ; Minimum (1 hour)
-; 0        1         2
+;          1         2
 ; 12345678901234567890123456
 ; abcdefghijklmnopqrstuvwxyz
+; 123456789
 
 @              IN      NS      pns
 @              IN      MX      10      mx