freedombone-clientcert 4.9KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Generates an email client cert for use with IMAP clients
  12. # See:
  13. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail
  14. # http://help.fabasoftfolio.com/index.php?topic=doc/Installation-and-Configuration-of-Fabasoft-Folio-IMAP-Service/client-certificate-authentication.htm
  15. # License
  16. # =======
  17. #
  18. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  19. #
  20. # This program is free software: you can redistribute it and/or modify
  21. # it under the terms of the GNU General Public License as published by
  22. # the Free Software Foundation, either version 3 of the License, or
  23. # (at your option) any later version.
  24. #
  25. # This program is distributed in the hope that it will be useful,
  26. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  27. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  28. # GNU General Public License for more details.
  29. #
  30. # You should have received a copy of the GNU General Public License
  31. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  32. USERNAME=
  33. COUNTRY_CODE="US"
  34. AREA="Free Speech Zone"
  35. LOCATION="Freedomville"
  36. ORGANISATION="Freedombone"
  37. UNIT="Freedombone Unit"
  38. EXTENSIONS=""
  39. function show_help {
  40. echo ''
  41. echo 'freedombone-clientcert -u [username]'
  42. echo ''
  43. echo 'Creates email certificates for use with IMAP clients'
  44. echo ''
  45. echo ' --help Show help'
  46. echo ' -u --username [name] Username'
  47. echo ''
  48. exit 0
  49. }
  50. while [[ $# > 1 ]]
  51. do
  52. key="$1"
  53. case $key in
  54. --help)
  55. show_help
  56. ;;
  57. -u|--username)
  58. shift
  59. USERNAME="$1"
  60. ;;
  61. *)
  62. # unknown option
  63. ;;
  64. esac
  65. shift
  66. done
  67. if [ ! $USERNAME ]; then
  68. echo 'No username specified'
  69. exit 5748
  70. fi
  71. if [ ! -d /home/$USERNAME ]; then
  72. echo "User $USERNAME not found"
  73. exit 76239
  74. fi
  75. if [ -d /home/$USERNAME/emailcert ]; then
  76. echo 'Client certs were already for created'
  77. exit 2953
  78. fi
  79. if [ ! -f /etc/dovecot/passwd-file ]; then
  80. touch /etc/dovecot/passwd-file
  81. fi
  82. # Add a user password
  83. if ! grep -q "$USERNAME:{plain}" /etc/dovecot/passwd-file; then
  84. echo "$USERNAME:{plain}::::::nopassword" >> /etc/dovecot/passwd-file
  85. fi
  86. chmod 600 /etc/dovecot/passwd-file
  87. # create a user cert
  88. freedombone-addcert -h $USERNAME --nodh ""
  89. if [ ! -f /etc/ssl/private/$USERNAME.key ]; then
  90. echo 'User certificates were not created'
  91. rm -rf /home/$USERNAME/emailcert
  92. exit 74835
  93. fi
  94. # create a certificate request
  95. openssl req -new -sha256 -subj \
  96. "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$USERNAME" \
  97. -key /etc/ssl/private/$USERNAME.key \
  98. -out /etc/ssl/requests/$USERNAME.csr
  99. if [ ! -f /etc/ssl/requests/$USERNAME.csr ]; then
  100. echo 'Certificate request was not created'
  101. rm -rf /home/$USERNAME/emailcert
  102. exit 83520
  103. fi
  104. # sign the certificate request
  105. cd /etc/ssl
  106. openssl ca -config /etc/ssl/dovecot-ca.cnf \
  107. -in /etc/ssl/requests/$USERNAME.csr \
  108. -out /etc/ssl/certs/$USERNAME.cer
  109. if [ ! -f /etc/ssl/certs/$USERNAME.cer ]; then
  110. echo 'Authentication certificate was not created'
  111. rm -rf /home/$USERNAME/emailcert
  112. exit 343569
  113. fi
  114. # move the cert to the user's home
  115. mkdir /home/$USERNAME/emailcert
  116. mv /etc/ssl/certs/$USERNAME.cer /home/$USERNAME/emailcert
  117. cp /etc/ssl/certs/dovecot.crt /home/$USERNAME/emailcert
  118. cp /etc/ssl/certs/ca-$HOSTNAME.crt /home/$USERNAME/emailcert
  119. mv /etc/ssl/private/$USERNAME.key /home/$USERNAME/emailcert
  120. mv /etc/ssl/certs/$USERNAME.crt /home/$USERNAME/emailcert
  121. openssl pkcs12 -export -in /home/$USERNAME/emailcert/$USERNAME.cer \
  122. -out /home/$USERNAME/emailcert/$USERNAME.p12 \
  123. -inkey /home/$USERNAME/emailcert/$USERNAME.key \
  124. -certfile /home/$USERNAME/emailcert/ca-$HOSTNAME.crt \
  125. -password pass:""
  126. # make an install script
  127. echo '#!/bin/bash' > /home/$USERNAME/emailcert/install.sh
  128. echo "sudo mv ca-$HOSTNAME.crt /etc/ssl/certs" >> \
  129. /home/$USERNAME/emailcert/install.sh
  130. echo "sudo mv $USERNAME.crt /etc/ssl/certs" >> \
  131. /home/$USERNAME/emailcert/install.sh
  132. echo "sudo mv dovecot.crt /etc/ssl/certs" >> \
  133. /home/$USERNAME/emailcert/install.sh
  134. echo "sudo mv $USERNAME.key /etc/ssl/private" >> \
  135. /home/$USERNAME/emailcert/install.sh
  136. echo 'exit 0' >> /home/$USERNAME/emailcert/install.sh
  137. # set permissions for the user
  138. chmod -R 755 /home/$USERNAME/emailcert
  139. chown -R $USERNAME:$USERNAME /home/$USERNAME/emailcert
  140. chmod +x /home/$USERNAME/emailcert/install.sh
  141. shred -zu /etc/ssl/requests/$USERNAME.csr
  142. echo 'Email authentication certificate created. You can obtain it on the client with:'
  143. echo ''
  144. echo " scp -P 2222 -r $USERNAME@$HOSTNAME:/home/$USERNAME/emailcert ~/"
  145. echo ''
  146. exit 0