Skip to content

Commit dad63b8

Browse files
jonasbardinojonasbardino
committed
Manually merge PR171 for flexible and dynamic service key/certificate fingerprints in MiGserver.conf
git-svn-id: svn+ssh://svn.code.sf.net/p/migrid/code/trunk@6188 b75ad72c-e7d7-11dd-a971-7dbc132099af
1 parent 79f979e commit dad63b8

File tree

5 files changed

+96
-23
lines changed

5 files changed

+96
-23
lines changed

‎mig/install/generateconfs.py

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# generateconfs - create custom MiG server configuration files
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project
88
#
99
# This file is part of MiG.
1010
#
@@ -146,7 +146,10 @@ def main(argv, _generate_confs=generate_confs, _print=print):
146146
'ext_oidc_rewrite_cookie',
147147
'dhparams_path',
148148
'daemon_keycert',
149+
'daemon_keycert_sha256',
149150
'daemon_pubkey',
151+
'daemon_pubkey_md5',
152+
'daemon_pubkey_sha256',
150153
'daemon_show_address',
151154
'alias_field',
152155
'peers_permit',

‎mig/install/migcheckssl-template.sh.cronjob

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43+
combined_pem_sha256="${combined_pem}.sha256"
4344
combined_pub="${domain_cert_path}/combined.pub"
45+
combined_pub_sha256="${combined_pub}.sha256"
4446
dhparams_pem="${cert_base}/dhparams.pem"
4547
# use git latest or release version of getssl
4648
getssl_version="release"
@@ -279,10 +281,32 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
279281
fi
280282
done
281283
if [ -n "${migrid_subservices}" ]; then
282-
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283-
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284-
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285-
echo "${sha256_fingerprint}"
284+
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285+
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286+
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287+
echo "${pem_sha256_fp}"
288+
echo "or point those configuration values to the latest fingerprint file with:"
289+
echo "FILE::${combined_pem_sha256}"
290+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291+
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292+
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293+
pub_md5_fp=${pub_md5_fp/* MD5:/}
294+
pub_md5_fp=${pub_md5_fp/ */}
295+
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296+
echo "${pub_md5_fp}"
297+
echo "or point that configuration value to the latest fingerprint file with:"
298+
echo "FILE::${combined_pub_md5}"
299+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300+
echo "${pub_md5_fp}" > ${combined_pub_md5}
301+
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302+
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303+
pub_sha256_fp=${pub_sha256_fp/ */}
304+
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305+
echo "${pub_sha256_fp}"
306+
echo "or point that configuration value to the latest fingerprint file with:"
307+
echo "FILE::${combined_pub_sha256}"
308+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309+
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
286310
fi
287311
fi
288312

‎mig/shared/configuration.py

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# configuration - configuration wrapper
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
88
#
99
# This file is part of MiG.
1010
#
@@ -1157,7 +1157,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
11571157
fingerprint = config.get('GLOBAL', 'user_sftp_key_md5')
11581158
self.user_sftp_key_md5 = fingerprint
11591159
if config.has_option('GLOBAL', 'user_sftp_key_sha256'):
1160-
fingerprint = config.get('GLOBAL', 'user_sftp_key_sha256')
1160+
fingerprint = expand_external_sources(
1161+
logger, config.get('GLOBAL', 'user_sftp_key_sha256'))
11611162
self.user_sftp_key_sha256 = fingerprint
11621163
if config.has_option('GLOBAL', 'user_sftp_key_from_dns'):
11631164
self.user_sftp_key_from_dns = config.getboolean(
@@ -1251,7 +1252,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12511252
self.user_davs_key = config.get('GLOBAL',
12521253
'user_davs_key')
12531254
if config.has_option('GLOBAL', 'user_davs_key_sha256'):
1254-
fingerprint = config.get('GLOBAL', 'user_davs_key_sha256')
1255+
fingerprint = expand_external_sources(
1256+
logger, config.get('GLOBAL', 'user_davs_key_sha256'))
12551257
self.user_davs_key_sha256 = fingerprint
12561258
if config.has_option('GLOBAL', 'user_davs_auth'):
12571259
self.user_davs_auth = config.get('GLOBAL',
@@ -1297,7 +1299,8 @@ def reload_config(self, verbose, skip_log=False, disable_auth_log=False,
12971299
self.user_ftps_key = config.get('GLOBAL',
12981300
'user_ftps_key')
12991301
if config.has_option('GLOBAL', 'user_ftps_key_sha256'):
1300-
fingerprint = config.get('GLOBAL', 'user_ftps_key_sha256')
1302+
fingerprint = expand_external_sources(
1303+
logger, config.get('GLOBAL', 'user_ftps_key_sha256'))
13011304
self.user_ftps_key_sha256 = fingerprint
13021305
if config.has_option('GLOBAL', 'user_ftps_auth'):
13031306
self.user_ftps_auth = config.get('GLOBAL',

‎mig/shared/install.py

Lines changed: 29 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# --- BEGIN_HEADER ---
55
#
66
# install - MiG server install helpers
7-
# Copyright (C) 2003-2024 The MiG Project lead by Brian Vinter
7+
# Copyright (C) 2003-2025 The MiG Project by the Science HPC Center at UCPH
88
#
99
# This file is part of MiG.
1010
#
@@ -416,7 +416,10 @@ def generate_confs(
416416
ext_oidc_rewrite_cookie='',
417417
dhparams_path='',
418418
daemon_keycert='',
419+
daemon_keycert_sha256=keyword_auto,
419420
daemon_pubkey='',
421+
daemon_pubkey_md5=keyword_auto,
422+
daemon_pubkey_sha256=keyword_auto,
420423
daemon_pubkey_from_dns=False,
421424
daemon_show_address='',
422425
alias_field='',
@@ -734,7 +737,10 @@ def _generate_confs_prepare(
734737
ext_oidc_rewrite_cookie,
735738
dhparams_path,
736739
daemon_keycert,
740+
daemon_keycert_sha256,
737741
daemon_pubkey,
742+
daemon_pubkey_md5,
743+
daemon_pubkey_sha256,
738744
daemon_pubkey_from_dns,
739745
daemon_show_address,
740746
alias_field,
@@ -1003,9 +1009,9 @@ def _generate_confs_prepare(
10031009
user_dict['__DHPARAMS_PATH__'] = dhparams_path
10041010
user_dict['__DAEMON_KEYCERT__'] = daemon_keycert
10051011
user_dict['__DAEMON_PUBKEY__'] = daemon_pubkey
1006-
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
1007-
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1008-
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
1012+
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1013+
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1014+
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
10091015
user_dict['__DAEMON_PUBKEY_FROM_DNS__'] = "%s" % daemon_pubkey_from_dns
10101016
user_dict['__SFTP_PORT__'] = "%s" % sftp_port
10111017
user_dict['__SFTP_SUBSYS_PORT__'] = "%s" % sftp_subsys_port
@@ -1929,15 +1935,19 @@ def _generate_confs_prepare(
19291935
openssl dhparam 2048 -out %(__DHPARAMS_PATH__)s""" % user_dict)
19301936
sys.exit(1)
19311937

1932-
# Auto-fill fingerprints if daemon key is set
1938+
# Auto-fill fingerprints if daemon key is set with AUTO fingerprint
19331939
if user_dict['__DAEMON_KEYCERT__']:
19341940
if not os.path.isfile(os.path.expanduser("%(__DAEMON_KEYCERT__)s" %
19351941
user_dict)):
19361942
print("ERROR: requested daemon keycert file not found!")
1937-
print("""You can create it with:
1938-
openssl genrsa -out %(__DAEMON_KEYCERT__)s 2048""" % user_dict)
1943+
print("""You can create it e.g. with:
1944+
openssl genrsa -out %(__DAEMON_KEYCERT__)s 4096""" % user_dict)
19391945
sys.exit(1)
1946+
else:
1947+
user_dict['__DAEMON_KEYCERT_SHA256__'] = ''
19401948

1949+
if user_dict['__DAEMON_KEYCERT__'] and keyword_auto in \
1950+
(daemon_keycert_sha256, ):
19411951
key_path = os.path.expanduser(user_dict['__DAEMON_KEYCERT__'])
19421952
openssl_cmd = ["openssl", "x509", "-noout", "-fingerprint", "-sha256",
19431953
"-in", key_path]
@@ -1953,15 +1963,21 @@ def _generate_confs_prepare(
19531963
print("ERROR: failed to extract sha256 fingerprint of %s: %s" %
19541964
(key_path, exc))
19551965
daemon_keycert_sha256 = ''
1956-
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
1966+
if daemon_keycert_sha256 == keyword_auto:
1967+
user_dict['__DAEMON_KEYCERT_SHA256__'] = daemon_keycert_sha256
19571968
if user_dict['__DAEMON_PUBKEY__']:
19581969
if not os.path.isfile(os.path.expanduser("%(__DAEMON_PUBKEY__)s" %
19591970
user_dict)):
19601971
print("ERROR: requested daemon pubkey file not found!")
19611972
print("""You can create it with:
19621973
ssh-keygen -f %(__DAEMON_KEYCERT__)s -y > %(__DAEMON_PUBKEY__)s""" % user_dict)
19631974
sys.exit(1)
1975+
else:
1976+
user_dict['__DAEMON_PUBKEY_MD5__'] = ''
1977+
user_dict['__DAEMON_PUBKEY_SHA256__'] = ''
19641978

1979+
if user_dict['__DAEMON_PUBKEY__'] and keyword_auto in \
1980+
(daemon_pubkey_md5, daemon_pubkey_sha256):
19651981
pubkey_path = os.path.expanduser(user_dict['__DAEMON_PUBKEY__'])
19661982
pubkey = read_file(pubkey_path, None)
19671983
if pubkey is None:
@@ -1981,9 +1997,12 @@ def _generate_confs_prepare(
19811997
except Exception as exc:
19821998
print("ERROR: failed to extract fingerprints of %s : %s" %
19831999
(pubkey_path, exc))
2000+
daemon_pubkey_md5 = ''
19842001
daemon_pubkey_sha256 = ''
1985-
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
1986-
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
2002+
if daemon_pubkey_md5 == keyword_auto:
2003+
user_dict['__DAEMON_PUBKEY_MD5__'] = daemon_pubkey_md5
2004+
if daemon_pubkey_sha256 == keyword_auto:
2005+
user_dict['__DAEMON_PUBKEY_SHA256__'] = daemon_pubkey_sha256
19872006

19882007
# Enable Debian/Ubuntu specific lines only there
19892008
if user_dict['__DISTRO__'].lower() in ('ubuntu', 'debian'):

‎tests/fixture/confs-stdlocal/migcheckssl

Lines changed: 28 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,9 @@ server_crt="${domain_cert_path}/server.crt"
4040
server_crt_ca_pem="${domain_cert_path}/server.crt.ca.pem"
4141
server_key_crt_ca_pem="${domain_cert_path}/server.key.crt.ca.pem"
4242
combined_pem="${domain_cert_path}/combined.pem"
43+
combined_pem_sha256="${combined_pem}.sha256"
4344
combined_pub="${domain_cert_path}/combined.pub"
45+
combined_pub_sha256="${combined_pub}.sha256"
4446
dhparams_pem="${cert_base}/dhparams.pem"
4547
# use git latest or release version of getssl
4648
getssl_version="release"
@@ -279,10 +281,32 @@ if [[ ${org_mtime} -ne ${new_mtime} && "${org_chksum}" != "${new_chksum}" ]]; th
279281
fi
280282
done
281283
if [ -n "${migrid_subservices}" ]; then
282-
sha256_fingerprint=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
283-
sha256_fingerprint=${sha256_fingerprint/SHA256 Fingerprint=/}
284-
echo "Please update ftps and davs sha256 fingerprint in MiGserver.conf to:"
285-
echo "${sha256_fingerprint}"
284+
pem_sha256_fp=$(openssl x509 -noout -fingerprint -sha256 -in ${combined_pem})
285+
pem_sha256_fp=${pem_sha256_fp/* Fingerprint=/}
286+
echo "Please manually update ftps/davs sha256 fingerprint in MiGserver.conf to:"
287+
echo "${pem_sha256_fp}"
288+
echo "or point those configuration values to the latest fingerprint file with:"
289+
echo "FILE::${combined_pem_sha256}"
290+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
291+
echo "${pem_sha256_fp}" > ${combined_pem_sha256}
292+
pub_md5_fp=$(ssh-keygen -l -E md5 -f ${combined_pub})
293+
pub_md5_fp=${pub_md5_fp/* MD5:/}
294+
pub_md5_fp=${pub_md5_fp/ */}
295+
echo "Please verify that sftp md5 fingerprint in MiGserver.conf is:"
296+
echo "${pub_md5_fp}"
297+
echo "or point that configuration value to the latest fingerprint file with:"
298+
echo "FILE::${combined_pub_md5}"
299+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
300+
echo "${pub_md5_fp}" > ${combined_pub_md5}
301+
pub_sha256_fp=$(ssh-keygen -l -f ${combined_pub})
302+
pub_sha256_fp=${pub_sha256_fp/* SHA256:/}
303+
pub_sha256_fp=${pub_sha256_fp/ */}
304+
echo "Please verify that sftp sha256 fingerprint in MiGserver.conf is:"
305+
echo "${pub_sha256_fp}"
306+
echo "or point that configuration value to the latest fingerprint file with:"
307+
echo "FILE::${combined_pub_sha256}"
308+
echo "optionally appending '\$\$CACHE_PATH' for memory caching in CACHE_PATH."
309+
echo "${pub_sha256_fp}" > ${combined_pub_sha256}
286310
fi
287311
fi
288312

0 commit comments

Comments
 (0)