|
@@ -131,105 +131,105 @@ aDWQRvTrh5+SQAlDi0gcbNeImgAu1e44K8kZDab8Am5HlVjkR1Z36aqeMFDidlaU
|
131
|
131
|
'
|
132
|
132
|
|
133
|
133
|
function show_help {
|
134
|
|
- echo ''
|
135
|
|
- echo $"${PROJECT_NAME}-dhparam -h [hostname] -l [length in bits] --recalc [yes|no] --fast [yes|no]"
|
136
|
|
- echo ''
|
137
|
|
- exit 0
|
|
134
|
+ echo ''
|
|
135
|
+ echo $"${PROJECT_NAME}-dhparam -h [hostname] -l [length in bits] --recalc [yes|no] --fast [yes|no]"
|
|
136
|
+ echo ''
|
|
137
|
+ exit 0
|
138
|
138
|
}
|
139
|
139
|
|
140
|
140
|
function calc_dh {
|
141
|
|
- if [[ $FAST == 'yes' ]]; then
|
142
|
|
- DHGROUP=$(( ( RANDOM % 4 ) + 14 ))
|
143
|
|
- if [[ ${DHGROUP} == 14 ]]; then
|
144
|
|
- echo "$BETTERCRYPTO_GROUP14" > ${1}
|
145
|
|
- else
|
146
|
|
- if [[ ${DHGROUP} == 15 ]]; then
|
147
|
|
- echo "$BETTERCRYPTO_GROUP15" > ${1}
|
148
|
|
- else
|
149
|
|
- if [[ ${DHGROUP} == 16 ]]; then
|
150
|
|
- echo "$BETTERCRYPTO_GROUP16" > ${1}
|
151
|
|
- else
|
152
|
|
- if [[ ${DHGROUP} == 17 ]]; then
|
153
|
|
- echo "$BETTERCRYPTO_GROUP17" > ${1}
|
154
|
|
- else
|
155
|
|
-
|
156
|
|
- echo "$BETTERCRYPTO_GROUP18" > ${1}
|
157
|
|
- fi
|
158
|
|
- fi
|
159
|
|
- fi
|
160
|
|
- fi
|
161
|
|
- else
|
162
|
|
- openssl dhparam -check -text $KEYLENGTH -out ${1}
|
163
|
|
- if [ ! "$?" = "0" ]; then
|
164
|
|
- exit 3674
|
165
|
|
- fi
|
166
|
|
- fi
|
167
|
|
- chmod 640 ${1}
|
|
141
|
+ if [[ $FAST == 'yes' ]]; then
|
|
142
|
+ DHGROUP=$(( ( RANDOM % 4 ) + 14 ))
|
|
143
|
+ if [[ ${DHGROUP} == 14 ]]; then
|
|
144
|
+ echo "$BETTERCRYPTO_GROUP14" > ${1}
|
|
145
|
+ else
|
|
146
|
+ if [[ ${DHGROUP} == 15 ]]; then
|
|
147
|
+ echo "$BETTERCRYPTO_GROUP15" > ${1}
|
|
148
|
+ else
|
|
149
|
+ if [[ ${DHGROUP} == 16 ]]; then
|
|
150
|
+ echo "$BETTERCRYPTO_GROUP16" > ${1}
|
|
151
|
+ else
|
|
152
|
+ if [[ ${DHGROUP} == 17 ]]; then
|
|
153
|
+ echo "$BETTERCRYPTO_GROUP17" > ${1}
|
|
154
|
+ else
|
|
155
|
+
|
|
156
|
+ echo "$BETTERCRYPTO_GROUP18" > ${1}
|
|
157
|
+ fi
|
|
158
|
+ fi
|
|
159
|
+ fi
|
|
160
|
+ fi
|
|
161
|
+ else
|
|
162
|
+ openssl dhparam -check -text $KEYLENGTH -out ${1}
|
|
163
|
+ if [ ! "$?" = "0" ]; then
|
|
164
|
+ exit 3674
|
|
165
|
+ fi
|
|
166
|
+ fi
|
|
167
|
+ chmod 640 ${1}
|
168
|
168
|
}
|
169
|
169
|
|
170
|
170
|
function regenerate_dh_keys {
|
171
|
|
- for file in /etc/ssl/mycerts/*
|
172
|
|
- do
|
173
|
|
- if [[ -f $file ]]; then
|
174
|
|
- filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
|
175
|
|
- if [ -f $filename ]; then
|
176
|
|
- calc_dh $filename
|
177
|
|
- echo $"Recalculated DH params for $filename"
|
178
|
|
- fi
|
179
|
|
- fi
|
180
|
|
- done
|
|
171
|
+ for file in /etc/ssl/mycerts/*
|
|
172
|
+ do
|
|
173
|
+ if [[ -f $file ]]; then
|
|
174
|
+ filename=/etc/ssl/certs/$(echo $file | awk -F '/etc/ssl/mycerts/' '{print $2}' | awk -F '.crt' '{print $1}').dhparam
|
|
175
|
+ if [ -f $filename ]; then
|
|
176
|
+ calc_dh $filename
|
|
177
|
+ echo $"Recalculated DH params for $filename"
|
|
178
|
+ fi
|
|
179
|
+ fi
|
|
180
|
+ done
|
181
|
181
|
}
|
182
|
182
|
|
183
|
183
|
while [[ $# > 1 ]]
|
184
|
184
|
do
|
185
|
|
- key="$1"
|
186
|
|
-
|
187
|
|
- case $key in
|
188
|
|
- --help)
|
189
|
|
- show_help
|
190
|
|
- ;;
|
191
|
|
- -h|--hostname)
|
192
|
|
- shift
|
193
|
|
- HOSTNAME="$1"
|
194
|
|
- ;;
|
195
|
|
- -l|--dhkey)
|
196
|
|
- shift
|
197
|
|
- KEYLENGTH=${1}
|
198
|
|
- ;;
|
199
|
|
- --recalc)
|
200
|
|
- shift
|
201
|
|
- RECALCULATE=${1}
|
202
|
|
- ;;
|
203
|
|
- --fast)
|
204
|
|
- shift
|
205
|
|
- if [[ ${1} == $"yes" || ${1} == $"y" ]]; then
|
206
|
|
- FAST='yes'
|
207
|
|
- fi
|
208
|
|
- ;;
|
209
|
|
- *)
|
210
|
|
- # unknown option
|
211
|
|
- ;;
|
212
|
|
- esac
|
213
|
|
- shift
|
|
185
|
+ key="$1"
|
|
186
|
+
|
|
187
|
+ case $key in
|
|
188
|
+ --help)
|
|
189
|
+ show_help
|
|
190
|
+ ;;
|
|
191
|
+ -h|--hostname)
|
|
192
|
+ shift
|
|
193
|
+ HOSTNAME="$1"
|
|
194
|
+ ;;
|
|
195
|
+ -l|--dhkey)
|
|
196
|
+ shift
|
|
197
|
+ KEYLENGTH=${1}
|
|
198
|
+ ;;
|
|
199
|
+ --recalc)
|
|
200
|
+ shift
|
|
201
|
+ RECALCULATE=${1}
|
|
202
|
+ ;;
|
|
203
|
+ --fast)
|
|
204
|
+ shift
|
|
205
|
+ if [[ ${1} == $"yes" || ${1} == $"y" ]]; then
|
|
206
|
+ FAST='yes'
|
|
207
|
+ fi
|
|
208
|
+ ;;
|
|
209
|
+ *)
|
|
210
|
+ # unknown option
|
|
211
|
+ ;;
|
|
212
|
+ esac
|
|
213
|
+ shift
|
214
|
214
|
done
|
215
|
215
|
|
216
|
216
|
if [[ $RECALCULATE == "yes" || $RECALCULATE == "y" ]]; then
|
217
|
|
- regenerate_dh_keys
|
218
|
|
- exit 0
|
|
217
|
+ regenerate_dh_keys
|
|
218
|
+ exit 0
|
219
|
219
|
fi
|
220
|
220
|
|
221
|
221
|
if [ ! $HOSTNAME ]; then
|
222
|
|
- echo $'No hostname specified'
|
223
|
|
- exit 5728
|
|
222
|
+ echo $'No hostname specified'
|
|
223
|
+ exit 5728
|
224
|
224
|
fi
|
225
|
225
|
|
226
|
226
|
if ! which openssl > /dev/null ;then
|
227
|
|
- echo $"$0: openssl is not installed, exiting" 1>&2
|
228
|
|
- exit 5689
|
|
227
|
+ echo $"$0: openssl is not installed, exiting" 1>&2
|
|
228
|
+ exit 5689
|
229
|
229
|
fi
|
230
|
230
|
|
231
|
231
|
if [ ! -d /etc/ssl/mycerts ]; then
|
232
|
|
- mkdir -p /etc/ssl/mycerts
|
|
232
|
+ mkdir -p /etc/ssl/mycerts
|
233
|
233
|
fi
|
234
|
234
|
|
235
|
235
|
calc_dh /etc/ssl/certs/$HOSTNAME.dhparam
|