Skip to content

Commit 3832fc8

Browse files
jonasbardinojonasbardino
committed
Merge remote-tracking branch 'origin/master' into edge
2 parents 129d205 + d84c62c commit 3832fc8

File tree

7 files changed

+148
-40
lines changed

7 files changed

+148
-40
lines changed

‎mig/install/generateconfs.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# generateconfs - create custom MiG server configuration files
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project
88
#
99
# This file is part of MiG.
1010
#
@@ -145,7 +145,10 @@ def main(argv, _generate_confs=generate_confs, _print=print):
145145
'ext_oidc_rewrite_cookie',
146146
'dhparams_path',
147147
'daemon_keycert',
148+
'daemon_keycert_sha256',
148149
'daemon_pubkey',
150+
'daemon_pubkey_md5',
151+
'daemon_pubkey_sha256',
149152
'daemon_show_address',
150153
'alias_field',
151154
'peers_permit',

‎mig/install/migcheckssl-template.sh.cronjob

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43+
combined_pem_sha256="${combined_pem}.sha256"
4344
combined_pub="${domain_cert_path}/combined.pub"
45+
combined_pub_sha256="${combined_pub}.sha256"
4446
dhparams_pem="${cert_base}/dhparams.pem"
4547
# use git latest or release version of getssl
4648
getssl_version="release"
@@ -279,10 +281,32 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
279281
fi
280282
done
281283
if [ -n "${migrid_subservices}" ]; then
282-
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283-
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284-
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285-
echo "${sha256_fingerprint}"
284+
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285+
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286+
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287+
echo "${pem_sha256_fp}"
288+
echo "or point those configuration values to the latest fingerprint file with:"
289+
echo "FILE::${combined_pem_sha256}"
290+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291+
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292+
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293+
pub_md5_fp=${pub_md5_fp/* MD5:/}
294+
pub_md5_fp=${pub_md5_fp/ */}
295+
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296+
echo "${pub_md5_fp}"
297+
echo "or point that configuration value to the latest fingerprint file with:"
298+
echo "FILE::${combined_pub_md5}"
299+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300+
echo "${pub_md5_fp}" > ${combined_pub_md5}
301+
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302+
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303+
pub_sha256_fp=${pub_sha256_fp/ */}
304+
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305+
echo "${pub_sha256_fp}"
306+
echo "or point that configuration value to the latest fingerprint file with:"
307+
echo "FILE::${combined_pub_sha256}"
308+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309+
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
286310
fi
287311
fi
288312

‎mig/shared/configuration.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# configuration - configuration wrapper
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
88
#
99
# This file is part of MiG.
1010
#
@@ -1134,7 +1134,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
11341134
fingerprint = config.get('GLOBAL', 'user_sftp_key_md5')
11351135
self.user_sftp_key_md5 = fingerprint
11361136
if config.has_option('GLOBAL', 'user_sftp_key_sha256'):
1137-
fingerprint = config.get('GLOBAL', 'user_sftp_key_sha256')
1137+
fingerprint = expand_external_sources(
1138+
logger, config.get('GLOBAL', 'user_sftp_key_sha256'))
11381139
self.user_sftp_key_sha256 = fingerprint
11391140
if config.has_option('GLOBAL', 'user_sftp_key_from_dns'):
11401141
self.user_sftp_key_from_dns = config.getboolean(
@@ -1228,7 +1229,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12281229
self.user_davs_key = config.get('GLOBAL',
12291230
'user_davs_key')
12301231
if config.has_option('GLOBAL', 'user_davs_key_sha256'):
1231-
fingerprint = config.get('GLOBAL', 'user_davs_key_sha256')
1232+
fingerprint = expand_external_sources(
1233+
logger, config.get('GLOBAL', 'user_davs_key_sha256'))
12321234
self.user_davs_key_sha256 = fingerprint
12331235
if config.has_option('GLOBAL', 'user_davs_auth'):
12341236
self.user_davs_auth = config.get('GLOBAL',
@@ -1274,7 +1276,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12741276
self.user_ftps_key = config.get('GLOBAL',
12751277
'user_ftps_key')
12761278
if config.has_option('GLOBAL', 'user_ftps_key_sha256'):
1277-
fingerprint = config.get('GLOBAL', 'user_ftps_key_sha256')
1279+
fingerprint = expand_external_sources(
1280+
logger, config.get('GLOBAL', 'user_ftps_key_sha256'))
12781281
self.user_ftps_key_sha256 = fingerprint
12791282
if config.has_option('GLOBAL', 'user_ftps_auth'):
12801283
self.user_ftps_auth = config.get('GLOBAL',

‎mig/shared/install.py

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# install - MiG server install helpers
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
88
#
99
# This file is part of MiG.
1010
#
@@ -412,7 +412,10 @@ def generate_confs(
412412
ext_oidc_rewrite_cookie='',
413413
dhparams_path='',
414414
daemon_keycert='',
415+
daemon_keycert_sha256=keyword_auto,
415416
daemon_pubkey='',
417+
daemon_pubkey_md5=keyword_auto,
418+
daemon_pubkey_sha256=keyword_auto,
416419
daemon_pubkey_from_dns=False,
417420
daemon_show_address='',
418421
alias_field='',
@@ -730,7 +733,10 @@ def _generate_confs_prepare(
730733
ext_oidc_rewrite_cookie,
731734
dhparams_path,
732735
daemon_keycert,
736+
daemon_keycert_sha256,
733737
daemon_pubkey,
738+
daemon_pubkey_md5,
739+
daemon_pubkey_sha256,
734740
daemon_pubkey_from_dns,
735741
daemon_show_address,
736742
alias_field,
@@ -999,9 +1005,9 @@ def _generate_confs_prepare(
9991005
user_dict['__DHPARAMS_PATH__'] = dhparams_path
10001006
user_dict['__DAEMON_KEYCERT__'] = daemon_keycert
10011007
user_dict['__DAEMON_PUBKEY__'] = daemon_pubkey
1002-
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
1003-
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1004-
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
1008+
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1009+
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1010+
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
10051011
user_dict['__DAEMON_PUBKEY_FROM_DNS__'] = "%s" % daemon_pubkey_from_dns
10061012
user_dict['__SFTP_PORT__'] = "%s" % sftp_port
10071013
user_dict['__SFTP_SUBSYS_PORT__'] = "%s" % sftp_subsys_port
@@ -1925,15 +1931,19 @@ def _generate_confs_prepare(
19251931
openssl dhparam 2048 -out %(__DHPARAMS_PATH__)s""" % user_dict)
19261932
sys.exit(1)
19271933

1928-
# Auto-fill fingerprints if daemon key is set
1934+
# Auto-fill fingerprints if daemon key is set with AUTO fingerprint
19291935
if user_dict['__DAEMON_KEYCERT__']:
19301936
if not os.path.isfile(os.path.expanduser("%(__DAEMON_KEYCERT__)s" %
19311937
user_dict)):
19321938
print("ERROR: requested daemon keycert file not found!")
1933-
print("""You can create it with:
1934-
openssl genrsa -out %(__DAEMON_KEYCERT__)s 2048""" % user_dict)
1939+
print("""You can create it e.g. with:
1940+
openssl genrsa -out %(__DAEMON_KEYCERT__)s 4096""" % user_dict)
19351941
sys.exit(1)
1942+
else:
1943+
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
19361944

1945+
if user_dict['__DAEMON_KEYCERT__'] and keyword_auto in \
1946+
(daemon_keycert_sha256, ):
19371947
key_path = os.path.expanduser(user_dict['__DAEMON_KEYCERT__'])
19381948
openssl_cmd = ["openssl", "x509", "-noout", "-fingerprint", "-sha256",
19391949
"-in", key_path]
@@ -1948,15 +1958,21 @@ def _generate_confs_prepare(
19481958
print("ERROR: failed to extract sha256 fingerprint of %s: %s" %
19491959
(key_path, exc))
19501960
daemon_keycert_sha256 = ''
1951-
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1961+
if daemon_keycert_sha256 == keyword_auto:
1962+
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
19521963
if user_dict['__DAEMON_PUBKEY__']:
19531964
if not os.path.isfile(os.path.expanduser("%(__DAEMON_PUBKEY__)s" %
19541965
user_dict)):
19551966
print("ERROR: requested daemon pubkey file not found!")
19561967
print("""You can create it with:
19571968
ssh-keygen -f %(__DAEMON_KEYCERT__)s -y > %(__DAEMON_PUBKEY__)s""" % user_dict)
19581969
sys.exit(1)
1970+
else:
1971+
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1972+
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
19591973

1974+
if user_dict['__DAEMON_PUBKEY__'] and keyword_auto in \
1975+
(daemon_pubkey_md5, daemon_pubkey_sha256):
19601976
pubkey_path = os.path.expanduser(user_dict['__DAEMON_PUBKEY__'])
19611977
pubkey = read_file(pubkey_path, None)
19621978
if pubkey is None:
@@ -1974,9 +1990,12 @@ def _generate_confs_prepare(
19741990
except Exception as exc:
19751991
print("ERROR: failed to extract fingerprints of %s : %s" %
19761992
(pubkey_path, exc))
1993+
daemon_pubkey_md5 = ''
19771994
daemon_pubkey_sha256 = ''
1978-
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1979-
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
1995+
if daemon_pubkey_md5 == keyword_auto:
1996+
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1997+
if daemon_pubkey_sha256 == keyword_auto:
1998+
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
19801999

19812000
# Enable Debian/Ubuntu specific lines only there
19822001
if user_dict['__DISTRO__'].lower() in ('ubuntu', 'debian'):

‎state/wwwpublic/index-erda.dk-ucph-science.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@
4646
/* We assume UCPH users here and leave external users to FAQ entry */
4747
function login(user) {
4848
if (user == "extoid") {
49-
window.open('https://erda.dk', '_blank');
49+
window.open('https://oid.erda.dk', '_blank');
5050
} else if (user == "extoidc") {
5151
window.open('https://oidc.erda.dk', '_blank');
5252
} else if (user == "extcert") {

‎state/wwwpublic/index-ui.erda.dk-user-friendly.html

Lines changed: 51 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@
4646
<link rel="icon" type="image/vnd.microsoft.icon"
4747
href="/images/skin/erda-user-friendly/favicon.ico"/>
4848

49+
<!-- site-specific variables used to adjust displayed information -->
50+
<script type="text/javascript" src="/images/site-conf.js"></script>
51+
4952
<script type="text/javascript" src="/assets/vendor/jquery/js/jquery.js"></script>
5053
<script type="text/javascript" src="/assets/vendor/jquery-ui/js/jquery-ui.js"></script>
5154
<script type="text/javascript" src="/images/lib/country-dropdown/js/msdropdown/jquery.dd.min.js"></script>
@@ -69,26 +72,39 @@
6972
/* We assume UCPH users here and leave external users to FAQ entry */
7073
function login(user) {
7174
if (user == "extoid") {
72-
window.open('https://ui.erda.dk', '_blank');
73-
} else if (user == "cert") {
75+
window.open('https://ui-oid.erda.dk', '_blank');
76+
} else if (user == "extoidc") {
77+
window.open('https://ui-oidc.erda.dk', '_blank');
78+
} else if (user == "extcert") {
7479
window.open('https://ui-cert.erda.dk', '_blank');
7580
} else if (user == "migoid") {
7681
window.open('https://ui-ext.erda.dk', '_blank');
82+
} else if (user == "migcert") {
83+
window.open('https://ui-cert.erda.dk', '_blank');
7784
} else {
78-
window.open('https://ui-sid.erda.dk/cgi-sid/login.py', '_blank');
85+
window.open('https://ui-sid.erda.dk/cgi-sid/login.py',
86+
'_blank');
7987
}
8088
}
8189
function signup(user) {
8290
if (user == "extoid") {
83-
window.open('https://ui-sid.erda.dk/cgi-sid/signup.py?show=kitoid',
91+
window.open('https://ui-oid.erda.dk/wsgi-bin/autocreate.py',
92+
'_blank');
93+
} else if (user == "extoidc") {
94+
window.open('https://ui-oidc.erda.dk/wsgi-bin/autocreate.py',
8495
'_blank');
85-
} else if (user == "cert") {
86-
window.open('https://ui-sid.erda.dk/cgi-sid/signup.py?show=extcert',
96+
} else if (user == "extcert") {
97+
window.open('https://ui-cert.erda.dk/wsgi-bin/extcert.py',
8798
'_blank');
8899
} else if (user == "migoid") {
89-
window.open('https://ui-sid.erda.dk/cgi-sid/reqoid.py', '_blank');
100+
window.open('https://ui-sid.erda.dk/cgi-sid/reqoid.py',
101+
'_blank');
102+
} else if (user == "migcert") {
103+
window.open('https://ui-cert.erda.dk/cgi-sid/reqcert.py',
104+
'_blank');
90105
} else {
91-
window.open('https://ui-sid.erda.dk/cgi-sid/signup.py', '_blank');
106+
window.open('https://ui-sid.erda.dk/cgi-sid/signup.py',
107+
'_blank');
92108
}
93109
}
94110

@@ -104,11 +120,11 @@
104120
supported_languages.push($(this).val());
105121
}
106122
});
107-
console.log("found supported langs: "+supported_languages);
123+
//console.debug("found supported langs: "+supported_languages);
108124
if (locale && supported_languages.indexOf(locale) >= 0) {
109125
user_lang = locale;
110126
} else {
111-
console.log(locale+" not supported - fall back to: "+default_lang);
127+
console.warn(locale+" not supported - fall back to: "+default_lang);
112128
user_lang = default_lang;
113129
}
114130

@@ -154,6 +170,29 @@
154170
$("#langselect").val(user_lang);
155171
switch_language(user_lang);
156172
$("#langselect").msDropdown().fadeIn(500);
173+
174+
var auth_methods = lookup_site_conf('auth_methods', ['extoid', 'migoid', 'extcert']);
175+
var query = window.location.search;
176+
const urlParams = new URLSearchParams(query);
177+
var show = [];
178+
var quicktabs = ['extoid', 'extoidc', 'migoid', 'extcert'];
179+
urlParams.forEach((value, key) => {
180+
//console.log("Found "+value+" in "+key);
181+
if (quicktabs.indexOf(value) >= 0) {
182+
show.push(value);
183+
}
184+
});
185+
if (!urlParams.get('show')) {
186+
if (auth_methods.length > 0) {
187+
//console.log("show auth_methods: " + auth_methods);
188+
show = auth_methods;
189+
} else {
190+
//console.log("show quicktabs: " + quicktabs);
191+
show = quicktabs;
192+
}
193+
} else {
194+
//console.log("show urlparams: " + show);
195+
}
157196
});
158197
</script>
159198

@@ -249,13 +288,9 @@ <h3>Site Status</h3>
249288
<div class="col-12 align-self-center">
250289
<h1>Keep everything organized with ERDA</h1>
251290
<p class="sub-title">ERDA - Electronic Research Data Archive is a storage, sharing and archiving facility provided by University of Copenhagen to employees and students.</p>
252-
<button style="color: #fff; background-color: #46743C; border-radius: 30px; width: 120px; height: 40px;" value="log in" onClick="login('extoid');">Log in</button>
291+
<button style="color: #fff; background-color: #46743C; border-radius: 30px; width: 120px; height: 40px;" value="log in" onClick="login('extoidc');">Log in</button>
253292
<div id="signupform" class="hidden">
254-
<form method='post' action='https://ui.erda.dk/wsgi-bin/autocreate.py'>
255-
<!-- IMPORTANT: openid.ku.dk fails if we change these to https -->
256-
<input type='hidden' name='openid.ns' value='http://specs.openid.net/auth/2.0' />
257-
<input type='hidden' name='openid.ns.sreg' value='http://openid.net/extensions/sreg/1.1' />
258-
<input type='hidden' name='openid.sreg.required' value='nickname,fullname,email,o,ou,country,state,role' />
293+
<form method='post' action='https://ui-oidc.erda.dk/wsgi-bin/autocreate.py'>
259294
<input class="signupbutton" type="submit" value="sign up" />
260295

261296
</form>

‎tests/fixture/confs-stdlocal/migcheckssl

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43+
combined_pem_sha256="${combined_pem}.sha256"
4344
combined_pub="${domain_cert_path}/combined.pub"
45+
combined_pub_sha256="${combined_pub}.sha256"
4446
dhparams_pem="${cert_base}/dhparams.pem"
4547
# use git latest or release version of getssl
4648
getssl_version="release"
@@ -279,10 +281,32 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
279281
fi
280282
done
281283
if [ -n "${migrid_subservices}" ]; then
282-
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283-
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284-
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285-
echo "${sha256_fingerprint}"
284+
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285+
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286+
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287+
echo "${pem_sha256_fp}"
288+
echo "or point those configuration values to the latest fingerprint file with:"
289+
echo "FILE::${combined_pem_sha256}"
290+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291+
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292+
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293+
pub_md5_fp=${pub_md5_fp/* MD5:/}
294+
pub_md5_fp=${pub_md5_fp/ */}
295+
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296+
echo "${pub_md5_fp}"
297+
echo "or point that configuration value to the latest fingerprint file with:"
298+
echo "FILE::${combined_pub_md5}"
299+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300+
echo "${pub_md5_fp}" > ${combined_pub_md5}
301+
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302+
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303+
pub_sha256_fp=${pub_sha256_fp/ */}
304+
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305+
echo "${pub_sha256_fp}"
306+
echo "or point that configuration value to the latest fingerprint file with:"
307+
echo "FILE::${combined_pub_sha256}"
308+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309+
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
286310
fi
287311
fi
288312

0 commit comments

Comments
 (0)