Add script 'get_all_keys.sh'.
This commit is contained in:
290
get_all_keys.sh
Executable file
290
get_all_keys.sh
Executable file
@@ -0,0 +1,290 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
working_dir="$(dirname $(realpath $0))"
|
||||
|
||||
log_file=$(mktemp)
|
||||
|
||||
# -------------
|
||||
# --- Some functions
|
||||
# -------------
|
||||
clean_up() {
|
||||
|
||||
# Perform program exit housekeeping
|
||||
rm -f "$log_file"
|
||||
exit $1
|
||||
}
|
||||
|
||||
trim() {
|
||||
local var="$*"
|
||||
var="${var#"${var%%[![:space:]]*}"}" # remove leading whitespace characters
|
||||
var="${var%"${var##*[![:space:]]}"}" # remove trailing whitespace characters
|
||||
echo -n "$var"
|
||||
}
|
||||
|
||||
|
||||
is_number() {
|
||||
|
||||
return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
|
||||
|
||||
# - also possible
|
||||
# -
|
||||
#[[ ! -z "${1##*[!0-9]*}" ]] && return 0 || return 1
|
||||
#return $([[ ! -z "${1##*[!0-9]*}" ]])
|
||||
}
|
||||
|
||||
is_int() {
|
||||
return $(test "$@" -eq "$@" > /dev/null 2>&1);
|
||||
}
|
||||
|
||||
echononl(){
|
||||
echo X\\c > /tmp/shprompt$$
|
||||
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
|
||||
echo -e -n "$*\\c" 1>&2
|
||||
else
|
||||
echo -e -n "$*" 1>&2
|
||||
fi
|
||||
rm /tmp/shprompt$$
|
||||
}
|
||||
|
||||
fatal(){
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e "[ \033[31m\033[1mError\033[m ]: $*"
|
||||
echo ""
|
||||
echo -e " \033[31m\033[1mScript was interupted\033[m!"
|
||||
else
|
||||
echo " [ Fatal ]: $*"
|
||||
echo ""
|
||||
echo " Script was terminated...."
|
||||
fi
|
||||
echo ""
|
||||
clean_up 1
|
||||
}
|
||||
|
||||
error (){
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e " [ \033[31m\033[1mError\033[m ]: $*"
|
||||
else
|
||||
echo "[ Error ]: $*"
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
warn (){
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e " [ \033[33m\033[1mWarning\033[m ]: $*"
|
||||
else
|
||||
echo "[ Warning ]: $*"
|
||||
fi
|
||||
echo ""
|
||||
}
|
||||
|
||||
info (){
|
||||
if $terminal ; then
|
||||
echo ""
|
||||
echo -e " [ \033[32m\033[1mInfo\033[m ]: $*"
|
||||
echo ""
|
||||
fi
|
||||
}
|
||||
|
||||
## -
|
||||
containsElement () {
|
||||
local e
|
||||
for e in "${@:2}"; do [[ "$e" == "$1" ]] && return 0; done
|
||||
return 1
|
||||
}
|
||||
|
||||
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Check some prerequisites
|
||||
# -------------
|
||||
|
||||
# - Running in a terminal?
|
||||
# -
|
||||
if [[ -t 1 ]] ; then
|
||||
terminal=true
|
||||
else
|
||||
terminal=false
|
||||
fi
|
||||
|
||||
|
||||
# -------------
|
||||
# --- Read Configurations from $conf_file
|
||||
# -------------
|
||||
|
||||
declare -a conf_file_arr=()
|
||||
declare -a conf_name_arr=()
|
||||
for _conf_file in `ls ${working_dir}/conf/server-*.conf 2>/dev/null` ; do
|
||||
conf_file_arr+=("${_conf_file}")
|
||||
_basename=$(basename $_conf_file)
|
||||
_tmp_name=${_basename%%.*}
|
||||
_tmp_name=${_tmp_name#*-}
|
||||
conf_name_arr+=("$_tmp_name")
|
||||
done
|
||||
|
||||
if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
|
||||
fatal "NO Configuration found!"
|
||||
fi
|
||||
|
||||
|
||||
echo ""
|
||||
|
||||
declare -i i=0
|
||||
|
||||
if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
|
||||
echo ""
|
||||
echo "Which Configuration should be loaded?"
|
||||
echo ""
|
||||
for _conf_file in ${conf_file_arr[@]} ; do
|
||||
echo " [${i}] ${conf_name_arr[${i}]}"
|
||||
(( i++ ))
|
||||
done
|
||||
_OK=false
|
||||
echo
|
||||
echononl "Eingabe: "
|
||||
while ! $_OK ; do
|
||||
read _IN
|
||||
if is_number "$_IN" && [[ -n ${conf_file_arr[$_IN]} ]]; then
|
||||
conf_file=${conf_file_arr[$_IN]}
|
||||
service_name="${conf_name_arr[$_IN]}"
|
||||
_OK=true
|
||||
else
|
||||
echo ""
|
||||
echo -e "\tFalsche Eingabe !"
|
||||
echo ""
|
||||
echononl "Eingabe: "
|
||||
fi
|
||||
done
|
||||
|
||||
else
|
||||
conf_file=${conf_file_arr[0]}
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo -e "\033[32m--\033[m"
|
||||
echo ""
|
||||
|
||||
if [[ -f "$conf_file" ]] ; then
|
||||
source "$conf_file"
|
||||
else
|
||||
warn "No configuration file 'conf_file' for OpenVON Service '$service_name' found.\n Loading defaults.."
|
||||
fi
|
||||
|
||||
if [[ -z "$OPENVPN_BASE_DIR" ]]; then
|
||||
fatal "OpenVPN base diretory not given!"
|
||||
else
|
||||
if [[ ! -d "$OPENVPN_BASE_DIR" ]]; then
|
||||
fatal "OpenVPN base diretory not '$OPENVPN_BASE_DIR' not found!"
|
||||
fi
|
||||
fi
|
||||
[[ -n "$KEY_DIR" ]] || KEY_DIR="${OPENVPN_BASE_DIR}/keys"
|
||||
[[ -n "$CRL_PEM" ]] || CRL_PEM="${KEY_DIR}/crl.pem"
|
||||
|
||||
if [[ ! -d "$KEY_DIR" ]] ; then
|
||||
fatal "Key directory '$KEY_DIR' not found. (See var 'KEY_DIR')"
|
||||
fi
|
||||
if [[ ! -f "$CRL_PEM" ]] ; then
|
||||
fatal "Revokation list '$CRL_PEM' not found. (See var 'CRL_PEM')"
|
||||
fi
|
||||
|
||||
declare -a revoked_serial_arr
|
||||
declare -a revoked_cn_arr
|
||||
|
||||
while read -r _serial ; do
|
||||
revoked_serial_arr+=("$_serial")
|
||||
done < <(openssl crl -inform PEM -text -noout -in $CRL_PEM 2>> $log_file | grep -E "^\s+Serial Number:" | awk '{print$3}')
|
||||
if [[ -s "$log_file" ]]; then
|
||||
fatal "$(cat "$log_file")"
|
||||
fi
|
||||
|
||||
if [[ ${#revoked_serial_arr[@]} -gt 0 ]]; then
|
||||
for _serial in ${revoked_serial_arr[@]} ; do
|
||||
_cn="$(openssl x509 -noout -text -in ${KEY_DIR}/${_serial}.pem 2> $log_file \
|
||||
| grep -i subject | grep CN | grep -o -E "CN\s*=\s*[^/,]+" | cut -d'=' -f2)"
|
||||
if [[ -s "$log_file" ]]; then
|
||||
error "$(cat "$log_file")"
|
||||
else
|
||||
revoked_arr+=("$_serial:$(trim $_cn)")
|
||||
revoked_cn_arr+=("$(trim $_cn)")
|
||||
fi
|
||||
done
|
||||
else
|
||||
info "No revoked keys in \033[1m${KEY_DIR}\033[m for OpenVPN service \033[1m$service_name\033[m exists."
|
||||
fi
|
||||
|
||||
while IFS= read -r -d '' _cert ; do
|
||||
|
||||
_serial="$(basename "$_cert")"
|
||||
_serial="${_serial%.*}"
|
||||
|
||||
_cn="$(openssl x509 -noout -text -in $_cert | grep Subject: | grep -oE "CN\s*=\s*[^,]+" | awk '{print$3}')"
|
||||
all_arr+=("${_serial}:$(trim $_cn)")
|
||||
if ! containsElement "$_cn" "${revoked_cn_arr[@]}" ; then
|
||||
active_arr+=("${_serial}:$(trim $_cn)")
|
||||
fi
|
||||
done < <(find ${KEY_DIR} -name "??\.pem" -print0 | sort -z )
|
||||
|
||||
echo
|
||||
if [[ ${#all_arr[@]} -gt 0 ]]; then
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e "All created Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
|
||||
else
|
||||
echo "All created Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
|
||||
fi
|
||||
echo ""
|
||||
for _val in ${all_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
if $terminal ; then
|
||||
echo -e " Serial: \033[1m${_val_arr[0]}\033[m CN: \033[1m${_val_arr[1]}\033[m"
|
||||
else
|
||||
echo " Serial: ${_val_arr[0]} CN: ${_val_arr[1]}"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo
|
||||
if [[ ${#revoked_arr[@]} -gt 0 ]]; then
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e "Revoked Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
|
||||
else
|
||||
echo "Revoked Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
|
||||
fi
|
||||
echo ""
|
||||
for _val in ${revoked_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
if $terminal ; then
|
||||
echo -e " Serial: \033[1m${_val_arr[0]}\033[m CN: \033[1m${_val_arr[1]}\033[m"
|
||||
else
|
||||
echo " Serial: ${_val_arr[0]} CN: ${_val_arr[1]}"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo
|
||||
if [[ ${#active_arr[@]} -gt 0 ]]; then
|
||||
echo ""
|
||||
if $terminal ; then
|
||||
echo -e "Active Keys for OpenVPN service \033[1m$service_name\033[m in \033[32m\033[1m${KEY_DIR}\033[m:"
|
||||
else
|
||||
echo "Active Keys for OpenVPN service '$service_name' in '${KEY_DIR}':"
|
||||
fi
|
||||
echo ""
|
||||
for _val in ${active_arr[@]} ; do
|
||||
IFS=':' read -a _val_arr <<< "${_val}"
|
||||
if $terminal ; then
|
||||
echo -e " Serial: \033[1m${_val_arr[0]}\033[m CN: \033[1m${_val_arr[1]}\033[m"
|
||||
else
|
||||
echo " Serial: ${_val_arr[0]} CN: ${_val_arr[1]}"
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo
|
||||
exit
|
||||
|
||||
Reference in New Issue
Block a user