hcoop-all-db-backup: update backup script

[hcoop/scripts.git] / ca-install

#!/bin/bash
#
# Install a signed certificate, placing a complimentary copy in the
# member's homedir.  Validation is done on the certificate before
# allowing it to be installed.  Also grant member domtool permissions
# for the certificate.
#
# If the certificate comes from the member's home directory, then
# don't place an extra copy there.
#
# Run this on an administrative node while holding admin tokens.
#
# Usage: ca-install member domain cert-file.pem [key-file.pem]

function usage () {
    echo "Usage: ca-install member domain cert-file.pem [key-file.pem] [intermediate-chain.pem]"
    exit 1
}

# Check arguments
if test -n "$6"; then
    echo "Error: Too many arguments."
    usage
elif test -z "$3"; then
    echo "Error: Not enough arguments."
    usage
else
    MEMBER=$1
    DOMAIN=$2
    CERT=$3
    KEY=$4
    CHAIN=$5
fi

WEBSERVERS="shelob.hcoop.net minsky.hcoop.net"

function verify_cert () {
    if test -z "$2" || test -n "$3"; then
        echo "Bad programming."
        exit 1
    fi
    local CERT=$1
    local KEY=$2
    local MOD1=$(openssl x509 -noout -modulus -in "$CERT" 2>&1)
    if test $(echo "$MOD1" | wc -c) -lt 500; then
        echo "Error: Bad x509 part in certificate."
        exit 1
    fi
    local MOD2=$(openssl rsa -noout -modulus -in "$KEY" 2>&1)
    if test $(echo "$MOD2" | wc -c) -lt 500; then
        echo "Error: Bad RSA part in certificate or key."
        exit 1
    fi
    if test "$MOD1" != "$MOD2"; then
        echo "Error: x509 and RSA parts in certificate do not match."
        exit 1
    fi
}

function verify_chain () {
    if test -z "$1" || test -n "$2"; then
	echo "Bad programming."
	exit 1
    fi
    # just make sure the intermediate chain contains a cert, might be
    # nice if this checked if it was used to sign the user's cert
    local CERT=$1
    local MOD1=$(openssl x509 -noout -modulus -in "$CERT" 2>&1)
    if test $(echo "$MOD1" | wc -c) -lt 500; then
        echo "Error: Bad x509 part in intermediate chain."
        exit 1
    fi
}

# Make sure we run this from an admin host...
if test "$(hostname -s)" != "gibran"; then
    echo "Error: This script must be run from gibran."
    exit 1
fi

# Sanity-check some paths
if test ! -f "$CERT"; then
    echo "Error: Nonexistent or unreadable cert $CERT."
    exit 1
fi
if test -n "$KEY" && test ! -f "$KEY"; then
    echo "Error: Nonexistent or unreadable key $KEY."
    exit 1
fi
if test -n "$CHAIN" && test ! -f "$CHAIN"; then
    echo "Error: Nonexistent or unreadable intermediate chain $CHAIN."
    exit 1
fi    

# Check for valid username
if ! getent passwd "$MEMBER" > /dev/null; then
    echo "Error: Invalid user \"$MEMBER\"."
    exit 1
fi

# Figure out destination for complimentary copy
APACHE_DEST=/etc/apache2/ssl/user/$DOMAIN.pem
MEMBERHOME=$(getent passwd $MEMBER | cut -d':' -f 6)
if test -n "$KEY"; then
    DEST="$(dirname $KEY)/$DOMAIN.pem"
else
    DEST=
fi

# Perform complimentary copy
if test -z "$DEST"; then
    echo "No key specified, so skipping complimentary copy."
elif echo "$CERT" | grep "^$MEMBERHOME" > /dev/null; then
    echo "Member already has a cert, skipping the complimentary copy."
elif test -f "$DEST"; then
    echo "Not overwriting existing file $DEST."
else
    echo "Copying signed certificate to member's home directory ..."
    cp "$CERT" "$DEST"
    chown $MEMBER:nogroup "$DEST"
fi
echo

# Determine whether we need to concatenate a private key
if openssl rsa -noout -check -in "$CERT" > /dev/null; then
    KEY=
else
    if test -z "$KEY"; then
        echo "Error: No RSA private key is included with this certificate."
        exit 1
    fi
fi

# Verify certificate and key
echo "Validating certificate ..."
if test -z "$KEY"; then
    verify_cert "$CERT" "$CERT"
else
    verify_cert "$CERT" "$KEY"
fi
if test -n "$CHAIN"; then
    verify_chain "$CHAIN"
fi
echo "Certificate passed validatation."
echo

# Copy complete certificate to webserver
if test -z "$KEY"; then
    echo "Installing certificate to Apache SSL directory ..."
    for WEBSERVER in $WEBSERVERS; do
	< "$CERT" ssh $WEBSERVER sudo tee "$APACHE_DEST" > /dev/null
    done
else
    echo "Installing certificate and key to Apache SSL directory ..."
    for WEBSERVER in $WEBSERVERS; do
	cat "$CERT" "$KEY" "$CHAIN" | ssh $WEBSERVER sudo tee "$APACHE_DEST" > /dev/null
    done
fi
for WEBSERVER in $WEBSERVERS; do
    ssh $WEBSERVER sudo chmod 400 "$APACHE_DEST" > /dev/null
done
echo

# Grant Domtool permissions
echo "Granting member Domtool permissions for the certificate ..."
domtool-admin grant $MEMBER cert "$APACHE_DEST"
echo

echo "Restarting apache ..."
for WEBSERVER in $WEBSERVERS; do
    ssh $WEBSERVER sudo apache2ctl graceful
done
echo

# Tell admin what to do
echo "Done.  Tell $MEMBER that the certificate is available for use at"
echo "  $APACHE_DEST"