Initial commit
This commit is contained in:
commit
d8880d36c7
43
README.md
Normal file
43
README.md
Normal file
@ -0,0 +1,43 @@
|
||||
## dehydrated_cron
|
||||
|
||||
### Das Skript _install_dehydrated.sh_
|
||||
|
||||
* installiert _dehydrated_ aus dem git Repository
|
||||
* erstellt notwendige Verzeichnisse und Konfigurationen
|
||||
* erstellt ein Cron Job Skript _dehydrated_cron.sh_ zur Generierung der Zertifikate
|
||||
* erstellt die Skripte _create_domains_file.sh_, _change_ssl_directives.sh_ und _dh_tlsgen.sh_ im _tools_-Verzeichnis
|
||||
* Konfiguriert einen bereits installierten Apache Webserver
|
||||
|
||||
### Installation
|
||||
Das Skript _install_dehydrated.sh_ auf den Zielrechner kopieren und (als root) ausführen. Die Konfigurationsdateien _config_ und __dehydrated_cron.conf_ im Konfigurationsverzeichnis (default: `/etc/dehydrated`) gegebenenfalls anpassen. **Voreingestellt ist der Testing Modus**
|
||||
|
||||
Alle Verzeichnisse können während der Installation angegeben werden:
|
||||
|
||||
* _DH Install Dir_: hierhin wird das Repository geclont
|
||||
* _DH Conf Dir_: Hier werden die Konfigurationdateien für das dehydrated Skript (_config_) und für den Cron Job (_dehydrated_cron.conf_) hinterlegt.
|
||||
* _DH Base Dir_: das Hauptverzeichnis für dehydrated bzw. Let's Encrypt. Dises Verzeichnis enthält die Accountdaten für den Zugang bei Let's Encrypt, die Zertifikate und Keys, das Skript _hook.sh_ und die Datei _domains.txt_, mit den zu erstellenden Zertifikatsnamen und -aliasen. Im Unterverzeichnis _cron_ liegt das Cronskript _dehydrated_cron.sh_, im Unterverzeichnis tools die Skripte _change_ssl_directives.sh_, _create_domains_file.sh_ und _dh_tlsgen.sh_.
|
||||
|
||||
Während Installation kann angegeben werden, wohin der Cronjob installiert werden soll: in das Verzeichnis `/etc/cron.d/` oder als root cronjob angehängt an die datei `/var/spool/cron/crontabs/root`.
|
||||
|
||||
**Das Installationsskript überschreibt keine vorhandenen Konfigurationen.** In einer Umgebung, in der _dehydrated_cron_ bereits installiert ist werden durch das erneute Ausführen vom _install_dehydrated.sh_ Skripte und das git Repository von _dehydrated_ gegebenenfalls aktualisiert. Haben sich Skripte oder das Repository geändert, so wird eine Sicherung (mit Zeitstempel) erstellt.
|
||||
|
||||
### _dehydrated_cron.sh_
|
||||
Der Cronjob _dehydrated_cron.sh_ erstellt oder eneuert Zertikikate und stellt diese im Verzeichnis _DH_BASE/certs/\<hostname\>/_ zur Verfügung. Soll ein Host für einen bestimmten Service _DANE_ unterstützen, so erstellt der Cronob die notwendigen _TLSA_-Records und veröffentlicht diese im Nameserver. Hierfür ist der zuständige Nameserver entsprechend vorzubereiten/zu konfigurieren (SSH-Zugang, Bereitstellung von Skripten, die die generierten _TLSA_-records dem Zonefile hinzufügen, die Seriennumer erhöhen und die Zone reloaden (s.u. Verzeichnis bind)).
|
||||
|
||||
Ausgeführt auf einer Konsole, ist das Skript informativ, ausgeführt als Cronjob werden nur dann Ausgaben produziert, falls Zertifikate ausgestellt/erneuert wurden oder Fehler aufgetreten sind.
|
||||
|
||||
### Tools
|
||||
Es werden drei Hilfs-Skripte im Verzeichnis _DH_BASE/tools_ zur Verfogung gestellt:
|
||||
* _create_domains_file.sh_: sucht in den VHost Konfigurationen nach Hosts, für die ein Zertifikat erstellt werden kann/soll und trägt common name sowie eventuell alternative names in eine Zeile der Datei _DH_BASE/domains.txt_ ein. Diese Datei wird von _dehydrated_ eingelesen um die entsprechenden Zertifikate zu generieren (falls sie noch nicht existieren oder bald abgelaufen sind).
|
||||
* _change_ssl_directives.sh_: Setzt in den Direktiven `SSLCertificateFile` und `SSLCertificateKeyFile` die entsprchenden Pfade zum Zertifikat/Key
|
||||
* _dh_tlsgen.sh_ : Generiert _TLSA__Records für _hostname:port_. So kann beispielsweise überprüft werden, ob durch den Cronjob die korrekten Records im Nameserver eingetragen wurden.
|
||||
|
||||
***
|
||||
### (Repository-)Verzeichnis tools-bind
|
||||
|
||||
|
||||
In diesem Verzeichnis liegen drei Skripte, die für die Bereitstellung von TLSA Records benötigt werden. Diese Scripte müssen sich auf dem zuständigen Nameserver befinden und über SSH vom Cronjob _dehydrated_cron.sh_ ausgeführt werden können. Entsprechende Parameter können in der Konfigurationsdatei _dehydrated_cron.conf_ angepasst werden. Die ist nur dann notwendig, wenn für einen Service _DANE_ Unterstützung implementiert ist.
|
||||
|
||||
* _bind_get_domain_by_hostname.sh_
|
||||
* _bind_set_renew_tlsa.sh_
|
||||
* _bind_set_new_serial.sh_
|
||||
2744
install_dehydrated.sh
Executable file
2744
install_dehydrated.sh
Executable file
File diff suppressed because it is too large
Load Diff
113
tools-bind/bind_get_domain_by_hostname.sh
Executable file
113
tools-bind/bind_get_domain_by_hostname.sh
Executable file
@ -0,0 +1,113 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# - Bind configuration file containing zone definitions
|
||||
# -
|
||||
ZONE_CONF_FILE=/etc/bind/named.conf.local
|
||||
|
||||
## --
|
||||
## -- End: Variable definitions
|
||||
|
||||
## ***
|
||||
## *** Don't make changes after this line ***
|
||||
## ***
|
||||
|
||||
## --- some functions
|
||||
## ---
|
||||
echononl(){
|
||||
echo X\\c > /tmp/shprompt$$
|
||||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||||
echo -e -n "$*\\c" 1>&2
|
||||
else
|
||||
echo -e -n "$*" 1>&2
|
||||
fi
|
||||
rm /tmp/shprompt$$
|
||||
}
|
||||
|
||||
warn (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
info (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
error(){
|
||||
echo ""
|
||||
echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
echo_ok() {
|
||||
echo -e "\033[75G[ \033[32mok\033[m ]"
|
||||
}
|
||||
echo_failed(){
|
||||
echo -e "\033[75G[ \033[1;31mfailed\033[m ]"
|
||||
}
|
||||
echo_skipped() {
|
||||
echo -e "\033[75G[ \033[33m\033[1mskipped\033[m ]"
|
||||
}
|
||||
|
||||
## ---
|
||||
## --- END: functions
|
||||
|
||||
hostname=$1
|
||||
|
||||
# - Test whether stdout (file descriptor 1) is a terminal or not (e.g. cron
|
||||
# - or if you pipe the output to some other program)
|
||||
#
|
||||
if [[ -t 1 ]] ; then
|
||||
verbose=true
|
||||
else
|
||||
verbose=false
|
||||
fi
|
||||
|
||||
$verbose && echo ""
|
||||
|
||||
|
||||
# - Validate Syntax of given domain
|
||||
# -
|
||||
valid_domain_regex="^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$"
|
||||
$verbose && echononl "\tValidate syntax of given hostname/domain.."
|
||||
if [[ $hostname =~ $valid_domain_regex ]]; then
|
||||
if [[ ! $hostname =~ \. ]]; then
|
||||
$verbose && echo_failed
|
||||
$verbose && error "Invalid hostname/domain given!"
|
||||
exit 10
|
||||
else
|
||||
$verbose && echo_ok
|
||||
fi
|
||||
else
|
||||
$verbose && echo_failed
|
||||
$verbose && error "Invalid hostname/domain given!"
|
||||
exit 10
|
||||
fi
|
||||
|
||||
_failed=false
|
||||
_hostname=$(echo ${hostname//\./\\.})
|
||||
while ! grep -e "$_hostname" $ZONE_CONF_FILE > /dev/null 2>&1 ; do
|
||||
hostname=${hostname#*.}
|
||||
_hostname=$(echo ${hostname//\./\\.})
|
||||
if [[ ! $_hostname =~ \. ]]; then
|
||||
_failed=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if $_failed ; then
|
||||
$verbose && error "hostname \"$1\" not supported by this nameserver!"
|
||||
else
|
||||
domain=$hostname
|
||||
if $verbose ; then
|
||||
info "Domain: $domain"
|
||||
else
|
||||
echo "$domain"
|
||||
fi
|
||||
fi
|
||||
|
||||
$verbose && echo
|
||||
exit 0
|
||||
|
||||
281
tools-bind/bind_set_new_serial.sh
Executable file
281
tools-bind/bind_set_new_serial.sh
Executable file
@ -0,0 +1,281 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# - Sets new serial and reloads zone
|
||||
# -
|
||||
# - Return (Exit) Codes:
|
||||
# - success:
|
||||
# - 0: Serial is replaced and Zone is reloaded
|
||||
# - error:
|
||||
# - 10: Invalid Hostname/Domain given
|
||||
# - 15: Hostname/Domain not supported
|
||||
# - 11: No zonefile found
|
||||
# - 12: Determin new Serial failed
|
||||
# - 13: Increasing Serial failed
|
||||
# - 14: Reloading Zone failed
|
||||
# - 99: Fatal error
|
||||
# -
|
||||
# - usage: ./nd_set_new_serial.sh <hostname|domain>
|
||||
# -
|
||||
# - example: ./nd_set_new_serial.sh a.mx.open.de
|
||||
|
||||
# -
|
||||
|
||||
## -- Variable definitions
|
||||
## --
|
||||
|
||||
# - Bind configuration file containing zone definitions
|
||||
# -
|
||||
ZONE_CONF_FILE=/etc/bind/named.conf.local
|
||||
|
||||
BIND_USER=bind
|
||||
BIND_GROUP=bind
|
||||
|
||||
## --
|
||||
## -- End: Variable definitions
|
||||
|
||||
## ***
|
||||
## *** Don't make changes after this line ***
|
||||
## ***
|
||||
|
||||
## --- some functions
|
||||
## ---
|
||||
echononl(){
|
||||
echo X\\c > /tmp/shprompt$$
|
||||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||||
echo -e -n "$*\\c" 1>&2
|
||||
else
|
||||
echo -e -n "$*" 1>&2
|
||||
fi
|
||||
rm /tmp/shprompt$$
|
||||
}
|
||||
|
||||
fatal(){
|
||||
echo ""
|
||||
echo -e "[ \033[31m\033[1mError\033[m ]: $*"
|
||||
echo ""
|
||||
echo -e "\t\033[31m\033[1mScript is canceled\033[m\033[m"
|
||||
echo ""
|
||||
exit 1
|
||||
}
|
||||
|
||||
warn (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
info (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
ok (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[36m\033[1mOk\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
error(){
|
||||
echo ""
|
||||
echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
echo_ok() {
|
||||
echo -e "\033[75G[ \033[32mok\033[m ]"
|
||||
}
|
||||
echo_failed(){
|
||||
echo -e "\033[75G[ \033[1;31mfailed\033[m ]"
|
||||
}
|
||||
echo_skipped() {
|
||||
echo -e "\033[75G[ \033[33m\033[1mskipped\033[m ]"
|
||||
}
|
||||
|
||||
containsElement () {
|
||||
local e
|
||||
for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
|
||||
return 1
|
||||
}
|
||||
|
||||
## ---
|
||||
## --- END: functions
|
||||
|
||||
# - Parameter "check" can be used, to test whether this script
|
||||
# - is accessable (e.g. from a script on a remote host)
|
||||
# -
|
||||
if [[ "$1" = "check" ]]; then
|
||||
echo "\$1: $1"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
host_name=$1
|
||||
|
||||
|
||||
echo ""
|
||||
|
||||
|
||||
# - Validate Syntax of given domain
|
||||
# -
|
||||
valid_domain_regex="^([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*$"
|
||||
echononl "\tValidate syntax of given domain.."
|
||||
if [[ $host_name =~ $valid_domain_regex ]]; then
|
||||
if [[ ! $host_name =~ \. ]]; then
|
||||
echo_failed
|
||||
error "Invalid hostname/domain \"$1\" given!"
|
||||
exit 10
|
||||
else
|
||||
echo_ok
|
||||
fi
|
||||
else
|
||||
echo_failed
|
||||
error "Invalid hostname/domain ($1) given!"
|
||||
exit 10
|
||||
fi
|
||||
|
||||
|
||||
# - Determin zone (domain)
|
||||
# -
|
||||
_failed=false
|
||||
_host_name=$host_name
|
||||
_tmp_host_name=$(echo ${_host_name//\./\\.})
|
||||
while ! grep -e "$_tmp_host_name" $ZONE_CONF_FILE > /dev/null 2>&1 ; do
|
||||
_host_name=${_host_name#*.}
|
||||
_tmp_host_name=$(echo ${_host_name//\./\\.})
|
||||
if [[ ! $_tmp_host_name =~ \. ]]; then
|
||||
_failed=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if $_failed ; then
|
||||
error "Given hostname/domain \"$1\" not supported by this nameserver!"
|
||||
else
|
||||
domain=$_host_name
|
||||
fi
|
||||
|
||||
|
||||
# - Determine zonefile (by reading bind configuration)
|
||||
# -
|
||||
_found=false
|
||||
declare -i _number=0
|
||||
regex_zone="^[[:space:]]*zone[[:space:]]+\"$_tmp_host_name\""
|
||||
regex_file="^[[:space:]]*file"
|
||||
while IFS='' read -r line || [[ -n "$line" ]] ; do
|
||||
if [[ $line =~ $regex_zone ]]; then
|
||||
_found=true
|
||||
fi
|
||||
if $_found ; then
|
||||
if [[ $line =~ $regex_file ]]; then
|
||||
zone_file=`echo $line | awk '{print$2}'`
|
||||
shopt -s extglob
|
||||
if [[ $zone_file =~ \; ]]; then
|
||||
zone_file=${zone_file%%*(\;)}
|
||||
fi
|
||||
if [[ $zone_file =~ ^\" ]]; then
|
||||
zone_file=${zone_file##*(\")}
|
||||
zone_file=${zone_file%%*(\")}
|
||||
fi
|
||||
shopt -u extglob
|
||||
let number++
|
||||
break
|
||||
fi
|
||||
fi
|
||||
done < $ZONE_CONF_FILE
|
||||
|
||||
zone_file_dir=`dirname $zone_file`
|
||||
|
||||
if [[ $number -eq 0 ]] ; then
|
||||
error "No Zonefile (master) found for domain \"$domain\" ."
|
||||
exit 11
|
||||
fi
|
||||
|
||||
|
||||
echononl "\tBackup existing directory containg zonefiles.."
|
||||
if [[ -d "$zone_file_dir" ]] ; then
|
||||
cp -a $zone_file_dir ${zone_file_dir}.BAK.`date +%Y-%m-%d-%H%M`
|
||||
if [[ $? -eq 0 ]]; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
echo ""
|
||||
exit 99
|
||||
fi
|
||||
else
|
||||
echo_failed
|
||||
error "Zonefile directory not found for domain \"$domain\" ."
|
||||
exit 99
|
||||
fi
|
||||
|
||||
|
||||
# - Determin new serial
|
||||
# -
|
||||
echononl "\tDetermin new serial.."
|
||||
_failed=false
|
||||
declare -i serial_new=`date +%Y%m%d01`
|
||||
serial_cur=`grep -e "^\s*[0-9]\{10\}" $zone_file | grep serial | awk '{print$1}'`
|
||||
if [[ $? -gt 0 ]] ; then
|
||||
_failed=true
|
||||
fi
|
||||
while [ ! $serial_new -gt $serial_cur ]; do
|
||||
let serial_new++
|
||||
done
|
||||
if [[ $? -gt 0 ]] ; then
|
||||
_failed=true
|
||||
fi
|
||||
if $_failed ; then
|
||||
echo_failed
|
||||
error "Determin Serial failed!"
|
||||
exit 12
|
||||
else
|
||||
echo_ok
|
||||
fi
|
||||
|
||||
|
||||
# - Replace serial with the new one
|
||||
# -
|
||||
echononl "\tIncrease serial for zone file \"`basename $zone_file`\".."
|
||||
perl -i -n -p -e "s#^(\s*)\s$serial_cur(.*)#\1 $serial_new\2#" $zone_file > /dev/null 2>&1
|
||||
if [[ $? -eq 0 ]]; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
error "Increasing Serial failed!"
|
||||
exit 13
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echononl "\tCorrect Owner for $zone_file .."
|
||||
chown $BIND_USER:$BIND_GROUP $zone_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
exit 99
|
||||
fi
|
||||
echononl "\tCorrect permissions on $zone_file .."
|
||||
chmod 644 $zone_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
exit 99
|
||||
fi
|
||||
|
||||
|
||||
# - Reload Zone
|
||||
# -
|
||||
echononl "\tReloading zone \"$domain\".."
|
||||
rndc reload $domain > /dev/null 2>&1
|
||||
if [[ $? -eq 0 ]]; then
|
||||
echo_ok
|
||||
info "Serial increased and zone reloaded ($domain)"
|
||||
exit 0
|
||||
else
|
||||
echo_failed
|
||||
error "Increasing Serial failed!"
|
||||
exit 13
|
||||
fi
|
||||
|
||||
echo
|
||||
exit 99
|
||||
351
tools-bind/bind_set_renew_tlsa.sh
Executable file
351
tools-bind/bind_set_renew_tlsa.sh
Executable file
@ -0,0 +1,351 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# - Replaces a TLSA Record
|
||||
# -
|
||||
# - Return (Exit) Codes:
|
||||
# - success:
|
||||
# - 0: TLSA record is up to date
|
||||
# - 1: TLSA record replaced
|
||||
# - 2: New TLSA record written
|
||||
# - error:
|
||||
# - 10: Invalid TLSA record given
|
||||
# - 11: No zonefile for TLSA record found
|
||||
# - 15: Hostname/Domain not supported
|
||||
# - 20: Replacing record failed
|
||||
# 21: Adding Record failed
|
||||
# - 99: Fatal error
|
||||
# -
|
||||
# - example:
|
||||
# - ./replace_dns_tlsa.sh _25._tcp.mail.initiativenserver.de. IN TLSA 3 1 1 aab3a46b387dd543ed8d...
|
||||
|
||||
|
||||
## -- Variable definitions
|
||||
## --
|
||||
|
||||
# - Bind configuration file containing zone definitions
|
||||
# -
|
||||
ZONE_CONF_FILE=/etc/bind/named.conf.local
|
||||
|
||||
BIND_USER=bind
|
||||
BIND_GROUP=bind
|
||||
|
||||
## --
|
||||
## -- End: Variable definitions
|
||||
|
||||
|
||||
## ***
|
||||
## *** Don't make changes after this line ***
|
||||
## ***
|
||||
|
||||
|
||||
## --- some functions
|
||||
## ---
|
||||
echononl(){
|
||||
echo X\\c > /tmp/shprompt$$
|
||||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||||
echo -e -n "$*\\c" 1>&2
|
||||
else
|
||||
echo -e -n "$*" 1>&2
|
||||
fi
|
||||
rm /tmp/shprompt$$
|
||||
}
|
||||
|
||||
warn (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[33m\033[1mWarning\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
info (){
|
||||
echo ""
|
||||
echo -e "\t[ \033[33m\033[1mInfo\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
error(){
|
||||
echo ""
|
||||
echo -e "\t[ \033[31m\033[1mFehler\033[m ]: $*"
|
||||
echo ""
|
||||
}
|
||||
|
||||
echo_ok() {
|
||||
echo -e "\033[75G[ \033[32mok\033[m ]"
|
||||
}
|
||||
echo_failed(){
|
||||
echo -e "\033[75G[ \033[1;31mfailed\033[m ]"
|
||||
}
|
||||
echo_skipped() {
|
||||
echo -e "\033[75G[ \033[33m\033[1mskipped\033[m ]"
|
||||
}
|
||||
|
||||
backup_dir () {
|
||||
dir_to_backup=$1
|
||||
echononl "\tBackup existing directory \"$dir_to_backup\" .."
|
||||
if [[ -d "$dir_to_backup" ]] ; then
|
||||
cp -a $dir_to_backup ${dir_to_backup}.BAK.`date +%Y-%m-%d-%H%M`
|
||||
if [[ $? -eq 0 ]]; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
echo ""
|
||||
exit 99
|
||||
fi
|
||||
else
|
||||
echo_failed
|
||||
error "Directory \"$dir_to_backup\" not found. No Backup written!"
|
||||
exit 99
|
||||
fi
|
||||
|
||||
}
|
||||
|
||||
## ---
|
||||
## --- END: functions
|
||||
|
||||
# - Parameter "check" can be used, to test whether this script
|
||||
# - is accessable (e.g. from a script on a remote host)
|
||||
# -
|
||||
if [[ "$1" = "check" ]]; then
|
||||
echo "\$1: $1"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
|
||||
# - Split given Record into an array
|
||||
# -
|
||||
declare -a record_arr=($@);
|
||||
if [[ ${#record_arr[@]} -eq 7 ]]; then
|
||||
|
||||
record_name=${record_arr[0]}
|
||||
record_ttl=""
|
||||
record_type="${record_arr[1]} ${record_arr[2]} ${record_arr[3]} ${record_arr[4]} ${record_arr[5]}"
|
||||
record_hash=${record_arr[6]}
|
||||
|
||||
elif [[ ${#record_arr[@]} -eq 8 ]]; then
|
||||
|
||||
record_name=${record_arr[0]}
|
||||
record_ttl=${record_arr[1]}
|
||||
record_type="${record_arr[2]} ${record_arr[3]} ${record_arr[4]} ${record_arr[5]} ${record_arr[6]}"
|
||||
record_hash=${record_arr[7]}
|
||||
|
||||
else
|
||||
|
||||
error "Invalid TLSA record given!"
|
||||
exit 10
|
||||
|
||||
fi
|
||||
|
||||
|
||||
# - Split record_name, to get port,protocol,hostnaem,domain
|
||||
# -
|
||||
CUR_IFS=$IFS
|
||||
IFS='\.'
|
||||
declare -a split_record_name_arr=($record_name)
|
||||
IFS=$CUR_IFS
|
||||
|
||||
_port=${split_record_name_arr[0]}
|
||||
port=${_port##*_}
|
||||
_protocol=${split_record_name_arr[1]}
|
||||
protocol=${_protocol##*_}
|
||||
|
||||
hostname="${split_record_name_arr[2]}"
|
||||
declare -i _index=3
|
||||
while [[ $_index -lt ${#split_record_name_arr[@]} ]] ; do
|
||||
hostname="${hostname}.${split_record_name_arr[$_index]}"
|
||||
let _index++
|
||||
done
|
||||
|
||||
|
||||
# - Determin zone (domain)
|
||||
# -
|
||||
_failed=false
|
||||
_hostname=$hostname
|
||||
_tmp_hostname=$(echo ${_hostname//\./\\.})
|
||||
while ! grep -e "$_tmp_hostname" $ZONE_CONF_FILE > /dev/null 2>&1 ; do
|
||||
_hostname=${_hostname#*.}
|
||||
_tmp_hostname=$(echo ${_hostname//\./\\.})
|
||||
if [[ ! $_tmp_hostname =~ \. ]]; then
|
||||
_failed=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
if $_failed ; then
|
||||
error "Given hostname/domain \"$hostname\" not supported by this nameserver!"
|
||||
exit 15
|
||||
else
|
||||
domain=$_hostname
|
||||
fi
|
||||
|
||||
|
||||
# - Determine zonefile (by reading bind configuration)
|
||||
# -
|
||||
_found=false
|
||||
declare -i _number=0
|
||||
regex_zone="^[[:space:]]*zone[[:space:]]+\"$_tmp_hostname\""
|
||||
regex_file="^[[:space:]]*file"
|
||||
while IFS='' read -r line || [[ -n "$line" ]] ; do
|
||||
if [[ $line =~ $regex_zone ]]; then
|
||||
_found=true
|
||||
fi
|
||||
if $_found ; then
|
||||
if [[ $line =~ $regex_file ]]; then
|
||||
zone_file=`echo $line | awk '{print$2}'`
|
||||
shopt -s extglob
|
||||
if [[ $zone_file =~ \; ]]; then
|
||||
zone_file=${zone_file%%*(\;)}
|
||||
fi
|
||||
if [[ $zone_file =~ ^\" ]]; then
|
||||
zone_file=${zone_file##*(\")}
|
||||
zone_file=${zone_file%%*(\")}
|
||||
fi
|
||||
shopt -u extglob
|
||||
let number++
|
||||
break
|
||||
fi
|
||||
fi
|
||||
done < $ZONE_CONF_FILE
|
||||
|
||||
if [[ $number -eq 0 ]] ; then
|
||||
error "No Zonefile (master) found for domain \"$domain\" ."
|
||||
exit 11
|
||||
fi
|
||||
|
||||
zone_file_dir=`dirname $zone_file`
|
||||
|
||||
# - Backup existing zone file directory
|
||||
# -
|
||||
|
||||
|
||||
# - Update/Add TLSA recotd if needed
|
||||
# -
|
||||
if grep -E "^$record_name.+$record_type" $zone_file > /dev/null 2>&1 ; then
|
||||
if [[ -n "$record_ttl" ]]; then
|
||||
search_string="^$record_name\\s+$record_ttl\\s+$record_type"
|
||||
else
|
||||
search_string="^$record_name\\s+$record_type"
|
||||
fi
|
||||
if grep -E "$search_string" $zone_file | grep $record_hash > /dev/null 2>&1 ; then
|
||||
info "TLSA record is already up to date.."
|
||||
echo ""
|
||||
exit 0
|
||||
else
|
||||
_replac_string=${record_arr[@]}
|
||||
# - Backup Zone directory
|
||||
backup_dir $zone_file_dir
|
||||
|
||||
# - Replace TLSA Record
|
||||
echononl "\tGoing to replace TLSA Record.."
|
||||
perl -i -n -p -e "s#^${record_name}.+${record_type}.*#$_replac_string#" $zone_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
echo ""
|
||||
exit 1
|
||||
else
|
||||
echo_failed
|
||||
echo ""
|
||||
exit 20
|
||||
fi
|
||||
fi
|
||||
else
|
||||
warn "No Record for replacing fount in zonefile \"`basename $zone_file`\"!"
|
||||
|
||||
declare -i _count
|
||||
|
||||
search_string="^_${port}\._(tcp|udp)\.$hostname"
|
||||
_count=`grep -Eo "$search_string" $zone_file | wc -l`
|
||||
|
||||
_tlsa_record_found=true
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
|
||||
search_string="^_[0-9]{1,4}\._(tcp|udp)\.$hostname"
|
||||
_count=`grep -Eo "$search_string" $zone_file | wc -l`
|
||||
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
|
||||
search_string="^_[0-9]{1,4}\._(tcp|udp).*TLSA"
|
||||
_count=`grep -Eo "$search_string" $zone_file | wc -l`
|
||||
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
|
||||
_tlsa_record_found=false
|
||||
|
||||
search_string="^[^;].+\s+IN\s+MX"
|
||||
_count=`grep -Eo "$search_string" $zone_file | wc -l`
|
||||
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
search_string="^[^;].+\s+IN\s+NS"
|
||||
_count=`grep -Eo "$search_string" $zone_file | wc -l`
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
error "No place for adding a new TLSA record found. Check manually!"
|
||||
exit 99
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
CUR_IFS=$IFS
|
||||
IFS=''
|
||||
_tmpfile=`mktemp`
|
||||
> $_tmpfile
|
||||
|
||||
# - backup zone directory
|
||||
backup_dir $zone_file_dir
|
||||
|
||||
# - Add new TLSA record
|
||||
echononl "\tAdd new TLSA record to zonefile \"\".."
|
||||
while read -r line || [[ -n "$line" ]]; do
|
||||
|
||||
echo $line >> $_tmpfile
|
||||
|
||||
if echo "$line" | grep -E "$search_string" > /dev/null 2>&1 ; then
|
||||
let _count--
|
||||
fi
|
||||
if [[ $_count -eq 0 ]]; then
|
||||
echo "" >> $_tmpfile
|
||||
if ! $_tlsa_record_found ; then
|
||||
echo ";" >> $_tmpfile
|
||||
echo "; DANE" >> $_tmpfile
|
||||
echo ";" >> $_tmpfile
|
||||
fi
|
||||
echo "${record_arr[@]}" >> $_tmpfile
|
||||
echo "" >> $_tmpfile
|
||||
_count=-1
|
||||
fi
|
||||
done < "$zone_file"
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
rm $_tmpfile
|
||||
exit 21
|
||||
fi
|
||||
|
||||
IFS=$CUR_IFS
|
||||
mv $_tmpfile $zone_file
|
||||
|
||||
# - Set Coorect Owner/Permission
|
||||
echo ""
|
||||
echononl "\tCorrect Owner for $zone_file .."
|
||||
chown $BIND_USER:$BIND_GROUP $zone_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
exit 99
|
||||
fi
|
||||
echononl "\tCorrect permissions on $zone_file .."
|
||||
chmod 644 $zone_file
|
||||
if [[ $? -eq 0 ]] ; then
|
||||
echo_ok
|
||||
else
|
||||
echo_failed
|
||||
exit 99
|
||||
fi
|
||||
|
||||
echo ""
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo
|
||||
exit 99
|
||||
Loading…
Reference in New Issue
Block a user