blob: b4f457d17c94077c32a21b0ef5a0d892aa6348bc (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
|
#!/bin/sh
#
# This script creates the certificate that partimaged needs for SSL-encrypted
# client connections.
# The script will ask a few questions for which the default answer would
# suffice, but you may enter whatever you like better.
# The script will also ask for a passphrase to protect the partimaged key with.
# Do not choose a passphrase that is too short (less than 6 characters)!
#
opensslpath="/usr/bin/openssl"
partconfdir="/etc/partimaged"
partuser=partimag
# Create certificate for SSL connections
if test -x ${opensslpath} ; then
if test ! -f ${partconfdir}/partimaged.cert ; then
echo "===================================================="
echo "generating certificate for partimage/partimaged ssl:"
echo "===================================================="
echo "You will be asked for a passphrase twice. The passphrases must match"
echo "and will be used to create the key certificate for partimaged."
echo "Write this passphrase down or memorize it!"
echo ""
mkdir -p ${partconfdir} >/dev/null
touch ${partconfdir}/privkey.pem
rm -f ${partconfdir}/privkey.pem
${opensslpath} req -new -x509 -outform PEM \
-keyout ${partconfdir}/privkey.pem > ${partconfdir}/partimaged.csr
${opensslpath} rsa -in ${partconfdir}/privkey.pem \
-out ${partconfdir}/partimaged.key
rm -f ${partconfdir}/privkey.pem
${opensslpath} x509 -in ${partconfdir}/partimaged.csr -out \
${partconfdir}/partimaged.cert -signkey ${partconfdir}/partimaged.key
rm ${partconfdir}/partimaged.csr
chmod 600 ${partconfdir}/partimaged.key
chmod 600 ${partconfdir}/partimaged.cert
chown ${partuser}:root ${partconfdir}/partimaged.key
chown ${partuser}:root ${partconfdir}/partimaged.cert
else
echo "Found existing certificate; no new certificate will be generated."
fi
else
echo "SSL support not found; no certificate can be generated."
fi
|
