freedombone-clientcert 5.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. #!/bin/bash
  2. # _____ _ _
  3. # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
  4. # | __| _| -_| -_| . | . | | . | . | | -_|
  5. # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
  6. #
  7. # Freedom in the Cloud
  8. #
  9. # Generates an email client cert for use with IMAP clients
  10. # See:
  11. # http://strange.systems/certificate-based-auth-with-dovecot-sendmail
  12. # http://help.fabasoftfolio.com/index.php?topic=doc/Installation-and-Configuration-of-Fabasoft-Folio-IMAP-Service/client-certificate-authentication.htm
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015-2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. PROJECT_NAME='freedombone'
  31. export TEXTDOMAIN=${PROJECT_NAME}-clientcert
  32. export TEXTDOMAINDIR="/usr/share/locale"
  33. USERNAME=
  34. COUNTRY_CODE="US"
  35. AREA="Free Speech Zone"
  36. LOCATION="Freedomville"
  37. ORGANISATION="Freedombone"
  38. UNIT="Freedombone Unit"
  39. EXTENSIONS=""
  40. function show_help {
  41. echo ''
  42. echo $"${PROJECT_NAME}-clientcert -u [username]"
  43. echo ''
  44. echo $'Creates email certificates for use with IMAP clients'
  45. echo ''
  46. echo $' --help Show help'
  47. echo $' -u --username [name] Username'
  48. echo ''
  49. exit 0
  50. }
  51. while [ $# -gt 1 ]
  52. do
  53. key="$1"
  54. case $key in
  55. --help)
  56. show_help
  57. ;;
  58. -u|--username)
  59. shift
  60. USERNAME="$1"
  61. ;;
  62. *)
  63. # unknown option
  64. ;;
  65. esac
  66. shift
  67. done
  68. if [ ! "$USERNAME" ]; then
  69. echo $'No username specified'
  70. exit 5748
  71. fi
  72. if [ ! -d "/home/$USERNAME" ]; then
  73. echo $"User $USERNAME not found"
  74. exit 76239
  75. fi
  76. if [ -d "/home/$USERNAME/emailcert" ]; then
  77. echo $'Client certs were already for created'
  78. exit 2953
  79. fi
  80. if [ ! -f /etc/dovecot/passwd-file ]; then
  81. touch /etc/dovecot/passwd-file
  82. fi
  83. # Add a user password
  84. if ! grep -q "$USERNAME:{plain}" /etc/dovecot/passwd-file; then
  85. echo "$USERNAME:{plain}::::::nopassword" >> /etc/dovecot/passwd-file
  86. fi
  87. chmod 600 /etc/dovecot/passwd-file
  88. # create a user cert
  89. "${PROJECT_NAME}-addcert" -h "$USERNAME" --nodh ""
  90. if [ ! -f "/etc/ssl/private/$USERNAME.key" ]; then
  91. echo $'User certificates were not created'
  92. rm -rf "/home/$USERNAME/emailcert"
  93. exit 74835
  94. fi
  95. # create a certificate request
  96. openssl req -new -sha256 -subj \
  97. "/O=$ORGANISATION/OU=$UNIT/C=$COUNTRY_CODE/ST=$AREA/L=$LOCATION/CN=$USERNAME" \
  98. -key "/etc/ssl/private/$USERNAME.key" \
  99. -out "/etc/ssl/requests/$USERNAME.csr"
  100. if [ ! -f "/etc/ssl/requests/$USERNAME.csr" ]; then
  101. echo $'Certificate request was not created'
  102. rm -rf "/home/$USERNAME/emailcert"
  103. exit 83520
  104. fi
  105. # sign the certificate request
  106. cd /etc/ssl || exit 742742542
  107. openssl ca -config /etc/ssl/dovecot-ca.cnf \
  108. -in "/etc/ssl/requests/$USERNAME.csr" \
  109. -out "/etc/ssl/certs/$USERNAME.cer"
  110. if [ ! -f "/etc/ssl/certs/$USERNAME.cer" ]; then
  111. echo $'Authentication certificate was not created'
  112. rm -rf "/home/$USERNAME/emailcert"
  113. exit 343569
  114. fi
  115. # move the cert to the user's home
  116. mkdir "/home/$USERNAME/emailcert"
  117. # shellcheck disable=SC2086
  118. mv /etc/ssl/certs/$USERNAME.cer /home/$USERNAME/emailcert
  119. cp "/etc/ssl/certs/dovecot.crt" "/home/$USERNAME/emailcert"
  120. cp "/etc/ssl/certs/ca-$HOSTNAME.crt" "/home/$USERNAME/emailcert"
  121. # shellcheck disable=SC2086
  122. mv /etc/ssl/private/$USERNAME.key /home/$USERNAME/emailcert
  123. # shellcheck disable=SC2086
  124. mv /etc/ssl/certs/$USERNAME.crt /home/$USERNAME/emailcert
  125. openssl pkcs12 -export -in "/home/$USERNAME/emailcert/$USERNAME.cer" \
  126. -out "/home/$USERNAME/emailcert/$USERNAME.p12" \
  127. -inkey "/home/$USERNAME/emailcert/$USERNAME.key" \
  128. -certfile "/home/$USERNAME/emailcert/ca-$HOSTNAME.crt" \
  129. -password pass:""
  130. # make an install script
  131. { echo '#!/bin/bash';
  132. echo "sudo mv ca-$HOSTNAME.crt /etc/ssl/certs";
  133. echo "sudo mv $USERNAME.crt /etc/ssl/certs";
  134. echo "sudo mv dovecot.crt /etc/ssl/certs";
  135. echo "sudo mv $USERNAME.key /etc/ssl/private";
  136. echo 'exit 0'; } > "/home/$USERNAME/emailcert/install.sh"
  137. # set permissions for the user
  138. chmod -R 755 "/home/$USERNAME/emailcert"
  139. chown -R "$USERNAME":"$USERNAME" "/home/$USERNAME/emailcert"
  140. chmod +x "/home/$USERNAME/emailcert/install.sh"
  141. shred -zu "/etc/ssl/requests/$USERNAME.csr"
  142. echo $'Email authentication certificate created. You can obtain it on the client with:'
  143. echo ''
  144. echo " scp -P 2222 -r $USERNAME@$HOSTNAME:/home/$USERNAME/emailcert ~/"
  145. echo ''
  146. exit 0