[debian-edu-commits] debian-edu/ 05/08: Adjust sbin/snakeoil-on-ice as only the /etc/skel location on the main server seems to be useful for the certificate override file.
Wolfgang Schweer
schweer-guest at moszumanska.debian.org
Mon Aug 8 16:47:21 UTC 2016
This is an automated email from the git hooks/post-receive script.
schweer-guest pushed a commit to branch schweer-foo
in repository debian-edu-config.
commit 0d7eec60d3d8940001d594e19f0ddb8bde589f4a
Author: Wolfgang Schweer <wschweer at arcor.de>
Date: Wed Jul 20 15:28:49 2016 +0200
Adjust sbin/snakeoil-on-ice as only the /etc/skel location on the main server seems to be useful for the certificate override file.
(cherry picked from commit c27e60f4044a70e0f539bd989704995cbb80bfe9)
---
sbin/snakeoil-on-ice | 119 +++++++++------------------------------------------
1 file changed, 20 insertions(+), 99 deletions(-)
diff --git a/sbin/snakeoil-on-ice b/sbin/snakeoil-on-ice
old mode 100644
new mode 100755
index 9911065..bc8529a
--- a/sbin/snakeoil-on-ice
+++ b/sbin/snakeoil-on-ice
@@ -1,7 +1,7 @@
#!/bin/bash
#
# Set up Firefox to accept the default ssl certificate created by debian-edu-config
-# for new users and new Firefox profiles.
+# for new users.
#
# Author: Oded Naveh
# Date: 03-06-2009
@@ -17,93 +17,35 @@ set -e
echo "info: Running $0"
-SERVERS='www:443 www:631 backup:443'
-
-## FIXME: Why is resolv.conf empty or missing? Because network
-## was started in the chroot (target)?
-## Try to find the DNS from the leases file, if that fails use
-## default DNS:
-if [ ! -s /etc/resolv.conf ] ; then
- DNS="10.0.2.2"
- LEASEDIR=/var/lib/dhcp/
- if [ -d $LEASEDIR ] ; then
- LEASEFILE=$LEASEDIR`ls -tr -1 $LEASEDIR | tail -n 1`
- if [ -r $LEASEFILE ] ; then
- if DNSLEASE=`cat $LEASEFILE | grep domain-name-servers | \
- tail -n 1 | \
- grep -o "[0-9]\+\.[0-9]\+\.[0-9]\+\.[0-9]\+"` ; then
- DNS=$DNSLEASE
- echo "info: Found leases file and domain-name-server: $DNS."
- else
- echo "info: Could not extract DNS from leases file."
- fi
- fi
- fi
- echo "info: Create temporary /etc/resolv.conf with DNS: $DNS."
- cat >> /etc/resolv.conf <<EOF
-## This is a temporary resolv.conf created by $0.
-## If you find it after installation, something went wrong. Try to replace it
-## by a symlink: /etc/resolv.conf -> /etc/resolvconf/run/resolv.conf, i.e.:
-## rm /etc/resolv.conf; ln -s /etc/resolvconf/run/resolv.conf /etc/resolv.conf
-nameserver $DNS
-search intern
-EOF
-fi
# On main server read local certificate
-# otherwise fetch the certificate over ssl.
if [[ $PROFILE =~ Main-Server ]]; then
- CERT=/etc/ssl/certs/ssl-cert-snakeoil.pem;
-elif (ping -c 1 www > /dev/null); then
- CERT=$(tempfile -p fetch -s cert)
- echo | openssl s_client -connect www:443 2>/dev/null | \
- sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > $CERT;
+ :
else
- echo 'error: can not find SSL certificate for http://www'
- exit 1;
+ echo 'Not running on main server; exiting'
+ exit 1;
fi
+CERT=/etc/ssl/certs/ssl-cert-snakeoil.pem;
+SERVERS='www:443 www:631 backup:443'
-# Write the override entries in the default profile.
-# These will be copied to new Firefox profiles.
+# The override entries will go into cert_override.txt in the skel directory.
+# This override file will be copied to the firefox profile for new users.
+# If users create another profile they'll have to do it themselves.
-OVERRIDE_FILE=/etc/firefox-esr/profile/cert_override.txt
+OVERRIDE_FILE=/tmp/cert_override.txt
SED_SERVERS=$(echo $SERVERS | sed 's/ /\\|/g')
FINGERPRINT=$(openssl x509 -in $CERT -noout -sha256 -fingerprint | sed 's/SHA256 Fingerprint=//')
OVERRIDE_STRING="OID.2.16.840.1.101.3.4.2.1 $FINGERPRINT MU AAAAAAAAAAAAAAAJAAAAGgDgwHd5q3rzhTAYMRYwFAYDVQQDEw10amVuZXIuaW50 ZXJu" # Bogus database key (A.*Ju)
-if [ -f $OVERRIDE_FILE ]; then
- sed "/$SED_SERVERS/ s/..\(:..\)\{31\}/$FINGERPRINT/" $OVERRIDE_FILE > $OVERRIDE_FILE.temp;
- if cmp $OVERRIDE_FILE $OVERRIDE_FILE.temp ; then
- cat <<-EOF 1>&2
- info: File $OVERRIDE_FILE
- info: already up to date. No need to do anything, exiting.
- EOF
- rm $OVERRIDE_FILE.temp
- exit 0
- else
- cp --backup=numbered $OVERRIDE_FILE /var/backups/cert_override
- echo -e "warning: Found old $OVERRIDE_FILE," \
- "\n\tcreated versioned backup in /var/backups/cert_override.x."
- fi
-else
- [ -d "$(dirname $OVERRIDE_FILE)" ] || mkdir -p "$(dirname $OVERRIDE_FILE)"
- echo -e '# PSM Certificate Override Settings file\n# This is a generated file! Do not edit.\n' > $OVERRIDE_FILE.temp;
-fi
+echo -e '# PSM Certificate Override Settings file\n# This is a generated file! Do not edit.\n' > $OVERRIDE_FILE;
for server in $SERVERS ; do
- if ! (grep -q $server $OVERRIDE_FILE.temp); then
- echo "$server $OVERRIDE_STRING" >> $OVERRIDE_FILE.temp;
- fi;
+ echo "$server $OVERRIDE_STRING" >> $OVERRIDE_FILE;
done
-chmod a+r $OVERRIDE_FILE.temp
-mv $OVERRIDE_FILE.temp $OVERRIDE_FILE
-
-
-# On main server also check /etc/skel/ for default profile.
-# This will be copied to new users home directories.
+chmod a+r $OVERRIDE_FILE
if [[ $PROFILE =~ Main-Server ]]; then
TEMPLATE_DIR=/etc/skel/.mozilla/firefox
@@ -111,12 +53,11 @@ if [[ $PROFILE =~ Main-Server ]]; then
# Check/copy the override file.
- if ! cmp $TEMPLATE_PROF/cert_override.txt $OVERRIDE_FILE ; then
- [ -d $TEMPLATE_PROF ] || mkdir -p $TEMPLATE_PROF
- rm -f $TEMPLATE_PROF/cert_override.txt
- cp $OVERRIDE_FILE $TEMPLATE_PROF/cert_override.txt
- chmod a+r $TEMPLATE_PROF/cert_override.txt
- fi
+[ -d $TEMPLATE_PROF ] || mkdir -p $TEMPLATE_PROF
+rm -f $TEMPLATE_PROF/cert_override.txt
+cp $OVERRIDE_FILE $TEMPLATE_PROF/cert_override.txt
+chmod a+r $TEMPLATE_PROF/cert_override.txt
+echo "info: $TEMPLATE_PROF/cert_override.txt generated"
# Check/make access to the profile enabled in profiles.ini.
@@ -138,25 +79,5 @@ if [[ $PROFILE =~ Main-Server ]]; then
fi;
fi
-for ROOT in `find /opt/ltsp/ -mindepth 1 -maxdepth 1 -type d`; do
- if [ ! -d "$ROOT$(dirname $OVERRIDE_FILE)" ] ; then
- continue # Only process LTSP chroots with firefox installed
- fi
- # Make sure self signed SSL certificate for internal web site also
- # work on diskless workstations.
- if [ -f $OVERRIDE_FILE ] ; then
- mkdir -p $(dirname $ROOT$OVERRIDE_FILE)
- if cp $OVERRIDE_FILE $ROOT$OVERRIDE_FILE ; then
- chmod a+r $ROOT$OVERRIDE_FILE
- else
-cat 1>&2 <<EOF
-error: Can't copy the new Firefox override settings to LTSP.
-error: Firefox profiles created on a thin client will not accept
-error: the new certificate
-EOF
- fi
- else
- error "Fail to find Firefox certificate override file."
- fi
- ls -l $ROOT$OVERRIDE_FILE |sed "s%^%info: $0: snakeoil-on-ice: %"
-done
+# Cleanup
+rm $OVERRIDE_FILE
--
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/debian-edu/debian-edu-config.git
More information about the debian-edu-commits
mailing list