[debian-edu-commits] [Git][debian-edu/debian-edu-config][master] 3 commits: Revert "White-space-only change: Fix broken and inconsistent indentations."
Mike Gabriel
gitlab at salsa.debian.org
Sat Aug 10 16:43:57 BST 2019
Mike Gabriel pushed to branch master at Debian Edu / debian-edu-config
Commits:
462aa8d8 by Mike Gabriel at 2019-08-10T15:04:36Z
Revert "White-space-only change: Fix broken and inconsistent indentations."
This reverts commit 5a337615b58be801a13ca639b7f1e9aed6538e16.
- - - - -
fc6222dc by Mike Gabriel at 2019-08-10T15:06:28Z
White-space-only change: Fix broken and inconsistent indentations.
- - - - -
64a19293 by Mike Gabriel at 2019-08-10T15:43:45Z
Fully inline-document fetch-ldap-cert script.
- - - - -
2 changed files:
- debian/changelog
- debian/debian-edu-config.fetch-ldap-cert
Changes:
=====================================
debian/changelog
=====================================
@@ -10,6 +10,7 @@ debian-edu-config (2.10.67) UNRELEASED; urgency=medium
[ Mike Gabriel ]
* Code review debian-edu-config.fetch-ldap-cert:
- White-space-only change: Fix broken and inconsistent indentations.
+ - Fully inline-document fetch-ldap-cert script.
-- Wolfgang Schweer <wschweer at arcor.de> Sat, 10 Aug 2019 14:14:26 +0200
=====================================
debian/debian-edu-config.fetch-ldap-cert
=====================================
@@ -32,9 +32,14 @@ do_start() {
LDAPPORT=636 # ldaps
ERROR=false
+ ###
+ ### PHASE 1: RootCA / bundle-cert / LDAP server cert retrieval
+ ###
+
if [ ! -f $CERTFILE ] && [ -f /etc/nslcd.conf ] &&
grep -q /etc/ssl/certs/debian-edu-server.crt /etc/nslcd.conf ; then
+ # LDAP server host not known/found, bailing out...
if [ -z "$LDAPSERVER" ] ; then
msg="Failed to locate LDAP server"
log_action_begin_msg "$msg"
@@ -45,38 +50,94 @@ do_start() {
[ "$VERBOSE" != no ] && log_action_begin_msg "Fetching LDAP SSL certificate."
+ # do an openssl connect to the LDAP server, and check whether its certificate
+ # has been issued by the "Debian Edu RootCA", if not we are likely dealing with a
+ # pre-Debian Edu 10 (aka buster) TJENER or with some other non-Debian-Edu LDAP
+ # server.
if echo | openssl s_client -connect "$LDAPSERVER:$LDAPPORT" 2>/dev/null | grep RootCA ; then
+ # Since Debian Edu 10, the LDAP certificate (or the RootCA file) is distributed
+ # over http (always via the host serving www.intern, by default: TJENER)
+ #
+ # We do an availability check for the webserver first, to provide proper
+ # error reporting (see below). So, the following check merely discovers,
+ # if the webserver is online at all.
if curl -sfk --head -o /dev/null https://www.intern ; then
+
+ # Now let's see if the webserver has the "Debian Edu RootCA" file.
+ # This has been the case for Debian Edu main servers (TJENER) since
+ # Debian Edu 10.1.
if curl -k https://www.intern/Debian-Edu_rootCA.crt > $ROOTCACRT && \
- grep -q CERTIFICATE $ROOTCACRT ; then
- gnutls-cli --x509cafile $ROOTCACRT --save-cert=$CERTFILE.new $LDAPSERVER < /dev/null
- logger -t fetch-ldap-cert "Fetched rootCA certificate from www.intern."
- else
- rm -f $ROOTCACRT
- if curl -k https://www.intern/debian-edu-bundle.crt > $BUNDLECRT && \
- grep -q CERTIFICATE $BUNDLECRT ; then
- gnutls-cli --x509cafile $BUNDLECRT --save-cert=$CERTFILE.new $LDAPSERVER < /dev/null
- logger -t fetch-ldap-cert "Fetched bundle certificate from www.intern."
+
+ grep -q CERTIFICATE $ROOTCACRT ; then
+
+ # Obtained a RootCA-verified version of the LDAP server's server certificate.
+ gnutls-cli --x509cafile $ROOTCACRT --save-cert=$CERTFILE.new $LDAPSERVER < /dev/null
+ logger -t fetch-ldap-cert "Fetched rootCA certificate from www.intern."
+
+ else
+
+ # If there is no Debian Edu RootCA available on www.intern, fallback to
+ # debian-edu-bundle.crt download (an approach done by a Debian Edu 10.0
+ # main server (aka TJENER) only and changed to RootCA provisioning in
+ # in Debian Edu 10.1.
+
+ # Drop the ROOTCACRT file, as it probably only contains some 404 http
+ # error message in html.
+ rm -f $ROOTCACRT
+
+ # So, now let's see if the webserver has the "debian-edu-bundle.crt"
+ # file. If so (and no Debian Edu RootCA file), then we are likely dealing
+ # with a Debian Edu 10.0 main server.
+ if curl -k https://www.intern/debian-edu-bundle.crt > $BUNDLECRT && \
+ grep -q CERTIFICATE $BUNDLECRT ; then
+
+ # Obtained a self-verified version of the LDAP server's server certificate.
+ # (The BUNDLECERT file should already contain the LDAP server's certificate,
+ # so having this cert file should allow us to successfully and "verified'ly"
+ # connect to the LDAP server and let us retrieve that very same certificate).
+ gnutls-cli --x509cafile $BUNDLECRT --save-cert=$CERTFILE.new $LDAPSERVER < /dev/null
+ logger -t fetch-ldap-cert "Fetched bundle certificate from www.intern."
else
+
+ # We should never get here... If we do anyway, then something went
+ # terribly wrong or the www.intern servicing server is misconfigured.
+
+ # Drop the ROOTCACRT file, as it probably only contains some 404 http
+ # error message in html.
rm -f $BUNDLECRT
+
logger -t fetch-ldap-cert "Failed to fetch certificates from www.intern."
fi
+
fi
+
else
- log_action_end_msg 1
- logger -t fetch-ldap-cert "Failed to connect to www.intern, maybe the web server down."
- ERROR=true
+
+ # Report an error, if www.intern is down http-wise. This can happen and is probably
+ # a temporary problem that needs an admin to fix it.
+ log_action_end_msg 1
+ logger -t fetch-ldap-cert "Failed to connect to www.intern, maybe the web server down."
+ ERROR=true
+
fi
else
+ # Fallback: Fetch LDAP certificate from a pre-Debian-Edu-10 (aka buster) LDAP server
+ # (or some non-Debian-Edu LDAP server)
/usr/share/debian-edu-config/tools/ldap-server-getcert $LDAPSERVER > $CERTFILE.new
chmod 644 $CERTFILE.new
logger -t fetch-ldap-cert "Fetched pre Buster LDAP server certificate."
+ # FIXME: Add some error handling here:
+ # - LDAP server down
+ # - what-not-else...
+
fi
+ # By now, we should have obtained the LDAP server's CERTFILE (verified in two cases (10.0 or 10.1 TJENER),
+ # simply downloaded from the LDAP server itself in the third case (pre-10.0 TJENER)
if test -s $CERTFILE.new ; then
mv $CERTFILE.new $CERTFILE
[ "$VERBOSE" != no ] && log_action_end_msg 0
@@ -86,19 +147,33 @@ do_start() {
logger -t fetch-ldap-cert "Fetched LDAP SSL certificate from $LDAPSERVER."
fi
else
+
+ # We obviously have failed in some other way, if the CERTFILE.new is empty (zero size)
+ # Again, something went awfully wrong, if we end up here...
rm -f $CERTFILE.new
log_action_end_msg 1
logger -t fetch-ldap-cert "Failed to fetch LDAP SSL certificate from $LDAPSERVER."
ERROR=true
+
fi
fi
+ ###
+ ### PHASE 2: Deploy the obtained CERTFILE to LTSP chroots, if any are present.
+ ###
+
if [ -d /opt/ltsp ] ; then
+ # Loop over all to be found LTSP chroots...
for ltsp_chroot in `find /opt/ltsp/ -mindepth 1 -maxdepth 1 -type d`; do
+
+ # Only install the CERTFILE into this chroot, if not already present...
if [ ! -f $ltsp_chroot$CERTFILE ] && [ -f $ltsp_chroot/etc/nslcd.conf ] &&
grep -q /etc/ssl/certs/debian-edu-server.crt $ltsp_chroot/etc/nslcd.conf ; then
+
+ # Copy the obtained CERTFILE into the LTSP chroot (containing the LDAP server's
+ # certificate.
[ "$VERBOSE" != no ] &&
log_action_begin_msg "Copying LDAP SSL certificate to ltsp-chroot $ltsp_chroot "
if test -s $CERTFILE; then
@@ -108,11 +183,21 @@ do_start() {
log_action_end_msg 1
ERROR=true
fi
+
+ # If we retrieved it, we also copy the obtained ROOTCACRT into the LTSP chroot
+ # (containing the self-built rootCA of the Debian Edu site).
log_action_begin_msg "Copying Debian Edu rootCA certificate to ltsp-chroot $ltsp_chroot "
if test -s $ROOTCACRT; then
cp $ROOTCACRT $ltsp_chroot$ROOTCACRT
[ "$VERBOSE" != no ] && log_action_end_msg 0
else
+ # If we talked to a Debian Edu 10.0 main server (aka TJENER) above, then we
+ # don't have the ROOTCACRT. We copy the BUNDLECRT file into the LTSP chroot
+ # instead (containing all certificates ever issued for the Debian Edu site).
+ # This is just a fallback, in fact, we need the Debian Edu RootCA.
+
+ # If you end up here, then please upgrade your Debian Edu 10.0 server to a
+ # a newer version (Debian Edu 10.1 and beyond).
log_action_begin_msg "Copying TLS certificate bundle to ltsp-chroot $ltsp_chroot "
if test -s $BUNDLECRT; then
cp $BUNDLECRT $ltsp_chroot$BUNDLECRT
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/compare/5a337615b58be801a13ca639b7f1e9aed6538e16...64a19293e6291028ed967210e5291e0e1bf5dca9
--
View it on GitLab: https://salsa.debian.org/debian-edu/debian-edu-config/compare/5a337615b58be801a13ca639b7f1e9aed6538e16...64a19293e6291028ed967210e5291e0e1bf5dca9
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-edu-commits/attachments/20190810/f531079e/attachment-0001.html>
More information about the debian-edu-commits
mailing list