Skip to content

Commit 129d205

Browse files
jonasbardinojonasbardino
authored
Revert "Flexible and dynamic service key/certificate fingerprints in MiGserver.conf" (#172)
Reverts #171 merge directly in edge in order to merge through svn as usual.
2 parents 23ae234 + 14d918f commit 129d205

File tree

5 files changed

+23
-96
lines changed

5 files changed

+23
-96
lines changed

‎mig/install/generateconfs.py

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# generateconfs - create custom MiG server configuration files
7-
# Copyright (C) 2003-2025 The MiG Project
7+
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
88
#
99
# This file is part of MiG.
1010
#
@@ -145,10 +145,7 @@ def main(argv, _generate_confs=generate_confs, _print=print):
145145
'ext_oidc_rewrite_cookie',
146146
'dhparams_path',
147147
'daemon_keycert',
148-
'daemon_keycert_sha256',
149148
'daemon_pubkey',
150-
'daemon_pubkey_md5',
151-
'daemon_pubkey_sha256',
152149
'daemon_show_address',
153150
'alias_field',
154151
'peers_permit',

‎mig/install/migcheckssl-template.sh.cronjob

Lines changed: 4 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,7 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43-
combined_pem_sha256="${combined_pem}.sha256"
4443
combined_pub="${domain_cert_path}/combined.pub"
45-
combined_pub_sha256="${combined_pub}.sha256"
4644
dhparams_pem="${cert_base}/dhparams.pem"
4745
# use git latest or release version of getssl
4846
getssl_version="release"
@@ -281,32 +279,10 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
281279
fi
282280
done
283281
if [ -n "${migrid_subservices}" ]; then
284-
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285-
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286-
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287-
echo "${pem_sha256_fp}"
288-
echo "or point those configuration values to the latest fingerprint file with:"
289-
echo "FILE::${combined_pem_sha256}"
290-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291-
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292-
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293-
pub_md5_fp=${pub_md5_fp/* MD5:/}
294-
pub_md5_fp=${pub_md5_fp/ */}
295-
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296-
echo "${pub_md5_fp}"
297-
echo "or point that configuration value to the latest fingerprint file with:"
298-
echo "FILE::${combined_pub_md5}"
299-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300-
echo "${pub_md5_fp}" > ${combined_pub_md5}
301-
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302-
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303-
pub_sha256_fp=${pub_sha256_fp/ */}
304-
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305-
echo "${pub_sha256_fp}"
306-
echo "or point that configuration value to the latest fingerprint file with:"
307-
echo "FILE::${combined_pub_sha256}"
308-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309-
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
282+
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283+
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284+
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285+
echo "${sha256_fingerprint}"
310286
fi
311287
fi
312288

‎mig/shared/configuration.py

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# configuration - configuration wrapper
7-
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
7+
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
88
#
99
# This file is part of MiG.
1010
#
@@ -1134,8 +1134,7 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
11341134
fingerprint = config.get('GLOBAL', 'user_sftp_key_md5')
11351135
self.user_sftp_key_md5 = fingerprint
11361136
if config.has_option('GLOBAL', 'user_sftp_key_sha256'):
1137-
fingerprint = expand_external_sources(
1138-
logger, config.get('GLOBAL', 'user_sftp_key_sha256'))
1137+
fingerprint = config.get('GLOBAL', 'user_sftp_key_sha256')
11391138
self.user_sftp_key_sha256 = fingerprint
11401139
if config.has_option('GLOBAL', 'user_sftp_key_from_dns'):
11411140
self.user_sftp_key_from_dns = config.getboolean(
@@ -1229,8 +1228,7 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12291228
self.user_davs_key = config.get('GLOBAL',
12301229
'user_davs_key')
12311230
if config.has_option('GLOBAL', 'user_davs_key_sha256'):
1232-
fingerprint = expand_external_sources(
1233-
logger, config.get('GLOBAL', 'user_davs_key_sha256'))
1231+
fingerprint = config.get('GLOBAL', 'user_davs_key_sha256')
12341232
self.user_davs_key_sha256 = fingerprint
12351233
if config.has_option('GLOBAL', 'user_davs_auth'):
12361234
self.user_davs_auth = config.get('GLOBAL',
@@ -1276,8 +1274,7 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12761274
self.user_ftps_key = config.get('GLOBAL',
12771275
'user_ftps_key')
12781276
if config.has_option('GLOBAL', 'user_ftps_key_sha256'):
1279-
fingerprint = expand_external_sources(
1280-
logger, config.get('GLOBAL', 'user_ftps_key_sha256'))
1277+
fingerprint = config.get('GLOBAL', 'user_ftps_key_sha256')
12811278
self.user_ftps_key_sha256 = fingerprint
12821279
if config.has_option('GLOBAL', 'user_ftps_auth'):
12831280
self.user_ftps_auth = config.get('GLOBAL',

‎mig/shared/install.py

Lines changed: 10 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# install - MiG server install helpers
7-
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
7+
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
88
#
99
# This file is part of MiG.
1010
#
@@ -412,10 +412,7 @@ def generate_confs(
412412
ext_oidc_rewrite_cookie='',
413413
dhparams_path='',
414414
daemon_keycert='',
415-
daemon_keycert_sha256=keyword_auto,
416415
daemon_pubkey='',
417-
daemon_pubkey_md5=keyword_auto,
418-
daemon_pubkey_sha256=keyword_auto,
419416
daemon_pubkey_from_dns=False,
420417
daemon_show_address='',
421418
alias_field='',
@@ -733,10 +730,7 @@ def _generate_confs_prepare(
733730
ext_oidc_rewrite_cookie,
734731
dhparams_path,
735732
daemon_keycert,
736-
daemon_keycert_sha256,
737733
daemon_pubkey,
738-
daemon_pubkey_md5,
739-
daemon_pubkey_sha256,
740734
daemon_pubkey_from_dns,
741735
daemon_show_address,
742736
alias_field,
@@ -1005,9 +999,9 @@ def _generate_confs_prepare(
1005999
user_dict['__DHPARAMS_PATH__'] = dhparams_path
10061000
user_dict['__DAEMON_KEYCERT__'] = daemon_keycert
10071001
user_dict['__DAEMON_PUBKEY__'] = daemon_pubkey
1008-
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1009-
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1010-
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
1002+
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
1003+
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1004+
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
10111005
user_dict['__DAEMON_PUBKEY_FROM_DNS__'] = "%s" % daemon_pubkey_from_dns
10121006
user_dict['__SFTP_PORT__'] = "%s" % sftp_port
10131007
user_dict['__SFTP_SUBSYS_PORT__'] = "%s" % sftp_subsys_port
@@ -1931,19 +1925,15 @@ def _generate_confs_prepare(
19311925
openssl dhparam 2048 -out %(__DHPARAMS_PATH__)s""" % user_dict)
19321926
sys.exit(1)
19331927

1934-
# Auto-fill fingerprints if daemon key is set with AUTO fingerprint
1928+
# Auto-fill fingerprints if daemon key is set
19351929
if user_dict['__DAEMON_KEYCERT__']:
19361930
if not os.path.isfile(os.path.expanduser("%(__DAEMON_KEYCERT__)s" %
19371931
user_dict)):
19381932
print("ERROR: requested daemon keycert file not found!")
1939-
print("""You can create it e.g. with:
1940-
openssl genrsa -out %(__DAEMON_KEYCERT__)s 4096""" % user_dict)
1933+
print("""You can create it with:
1934+
openssl genrsa -out %(__DAEMON_KEYCERT__)s 2048""" % user_dict)
19411935
sys.exit(1)
1942-
else:
1943-
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
19441936

1945-
if user_dict['__DAEMON_KEYCERT__'] and keyword_auto in \
1946-
(daemon_keycert_sha256, ):
19471937
key_path = os.path.expanduser(user_dict['__DAEMON_KEYCERT__'])
19481938
openssl_cmd = ["openssl", "x509", "-noout", "-fingerprint", "-sha256",
19491939
"-in", key_path]
@@ -1958,21 +1948,15 @@ def _generate_confs_prepare(
19581948
print("ERROR: failed to extract sha256 fingerprint of %s: %s" %
19591949
(key_path, exc))
19601950
daemon_keycert_sha256 = ''
1961-
if daemon_keycert_sha256 == keyword_auto:
1962-
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1951+
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
19631952
if user_dict['__DAEMON_PUBKEY__']:
19641953
if not os.path.isfile(os.path.expanduser("%(__DAEMON_PUBKEY__)s" %
19651954
user_dict)):
19661955
print("ERROR: requested daemon pubkey file not found!")
19671956
print("""You can create it with:
19681957
ssh-keygen -f %(__DAEMON_KEYCERT__)s -y > %(__DAEMON_PUBKEY__)s""" % user_dict)
19691958
sys.exit(1)
1970-
else:
1971-
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1972-
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
19731959

1974-
if user_dict['__DAEMON_PUBKEY__'] and keyword_auto in \
1975-
(daemon_pubkey_md5, daemon_pubkey_sha256):
19761960
pubkey_path = os.path.expanduser(user_dict['__DAEMON_PUBKEY__'])
19771961
pubkey = read_file(pubkey_path, None)
19781962
if pubkey is None:
@@ -1990,12 +1974,9 @@ def _generate_confs_prepare(
19901974
except Exception as exc:
19911975
print("ERROR: failed to extract fingerprints of %s : %s" %
19921976
(pubkey_path, exc))
1993-
daemon_pubkey_md5 = ''
19941977
daemon_pubkey_sha256 = ''
1995-
if daemon_pubkey_md5 == keyword_auto:
1996-
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1997-
if daemon_pubkey_sha256 == keyword_auto:
1998-
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
1978+
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1979+
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
19991980

20001981
# Enable Debian/Ubuntu specific lines only there
20011982
if user_dict['__DISTRO__'].lower() in ('ubuntu', 'debian'):

‎tests/fixture/confs-stdlocal/migcheckssl

Lines changed: 4 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,7 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43-
combined_pem_sha256="${combined_pem}.sha256"
4443
combined_pub="${domain_cert_path}/combined.pub"
45-
combined_pub_sha256="${combined_pub}.sha256"
4644
dhparams_pem="${cert_base}/dhparams.pem"
4745
# use git latest or release version of getssl
4846
getssl_version="release"
@@ -281,32 +279,10 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
281279
fi
282280
done
283281
if [ -n "${migrid_subservices}" ]; then
284-
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285-
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286-
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287-
echo "${pem_sha256_fp}"
288-
echo "or point those configuration values to the latest fingerprint file with:"
289-
echo "FILE::${combined_pem_sha256}"
290-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291-
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292-
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293-
pub_md5_fp=${pub_md5_fp/* MD5:/}
294-
pub_md5_fp=${pub_md5_fp/ */}
295-
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296-
echo "${pub_md5_fp}"
297-
echo "or point that configuration value to the latest fingerprint file with:"
298-
echo "FILE::${combined_pub_md5}"
299-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300-
echo "${pub_md5_fp}" > ${combined_pub_md5}
301-
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302-
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303-
pub_sha256_fp=${pub_sha256_fp/ */}
304-
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305-
echo "${pub_sha256_fp}"
306-
echo "or point that configuration value to the latest fingerprint file with:"
307-
echo "FILE::${combined_pub_sha256}"
308-
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309-
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
282+
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283+
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284+
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285+
echo "${sha256_fingerprint}"
310286
fi
311287
fi
312288

0 commit comments

Comments
 (0)