apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity
cloudstack/scripts/installer/windows/acs.wxs
Rohit Yadav 7ce54bf7a8 CLOUDSTACK-9993: Securing Agents Communications (#2239) 
This introduces a new certificate authority framework that allows
pluggable CA provider implementations to handle certificate operations
around issuance, revocation and propagation. The framework injects
itself to `NioServer` to handle agent connections securely. The
framework adds assumptions in `NioClient` that a keystore if available
with known name `cloud.jks` will be used for SSL negotiations and
handshake.

This includes a default 'root' CA provider plugin which creates its own
self-signed root certificate authority on first run and uses it for
issuance and provisioning of certificate to CloudStack agents such as
the KVM, CPVM and SSVM agents and also for the management server for
peer clustering.

Additional changes and notes:
- Comma separate list of management server IPs can be set to the 'host'
  global setting. Newly provisioned agents (KVM/CPVM/SSVM etc) will get
  radomized comma separated list to which they will attempt connection
  or reconnection in provided order. This removes need of a TCP LB on
  port 8250 (default) of the management server(s).
- All fresh deployment will enforce two-way SSL authentication where
  connecting agents will be required to present certificates issued
  by the 'root' CA plugin.
- Existing environment on upgrade will continue to use one-way SSL
  authentication and connecting agents will not be required to present
  certificates.
- A script `keystore-setup` is responsible for initial keystore setup
  and CSR generation on the agent/hosts.
- A script `keystore-cert-import` is responsible for import provided
  certificate payload to the java keystore file.
- Agent security (keystore, certificates etc) are setup initially using
  SSH, and later provisioning is handled via an existing agent connection
  using command-answers. The supported clients and agents are limited to
  CPVM, SSVM, and KVM agents, and clustered management server (peering).
- Certificate revocation does not revoke an existing agent-mgmt server
  connection, however rejects a revoked certificate used during SSL
  handshake.
- Older `cloudstackmanagement.keystore` is deprecated and will no longer
  be used by mgmt server(s) for SSL negotiations and handshake. New
  keystores will be named `cloud.jks`, any additional SSL certificates
  should not be imported in it for use with tomcat etc. The `cloud.jks`
  keystore is stricly used for agent-server communications.
- Management server keystore are validated and renewed on start up only,
  the validity of them are same as the CA certificates.

New APIs:
- listCaProviders: lists all available CA provider plugins
- listCaCertificate: lists the CA certificate(s)
- issueCertificate: issues X509 client certificate with/without a CSR
- provisionCertificate: provisions certificate to a host
- revokeCertificate: revokes a client certificate using its serial

Global settings for the CA framework:
- ca.framework.provider.plugin: The configured CA provider plugin
- ca.framework.cert.keysize: The key size for certificate generation
- ca.framework.cert.signature.algorithm: The certificate signature algorithm
- ca.framework.cert.validity.period: Certificate validity in days
- ca.framework.cert.automatic.renewal: Certificate auto-renewal setting
- ca.framework.background.task.delay: CA background task delay/interval
- ca.framework.cert.expiry.alert.period: Days to check and alert expiring certificates

Global settings for the default 'root' CA provider:
- ca.plugin.root.private.key: (hidden/encrypted) CA private key
- ca.plugin.root.public.key: (hidden/encrypted) CA public key
- ca.plugin.root.ca.certificate: (hidden/encrypted) CA certificate
- ca.plugin.root.issuer.dn: The CA issue distinguished name
- ca.plugin.root.auth.strictness: Are clients required to present certificates
- ca.plugin.root.allow.expired.cert: Are clients with expired certificates allowed

UI changes:
- Button to download/save the CA certificates.

Misc changes:
- Upgrades bountycastle version and uses newer classes
- Refactors SAMLUtil to use new CertUtils

Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
2017-08-28 12:15:11 +02:00

308 lines
16 KiB
XML
Raw Blame History

<!-- Licensed to the Apache Software Foundation (ASF) under one or more contributor
license agreements. See the NOTICE file distributed with this work for additional
information regarding copyright ownership. The ASF licenses this file to
you under the Apache License, Version 2.0 (the "License"); you may not use
this file except in compliance with the License. You may obtain a copy of
the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required
by applicable law or agreed to in writing, software distributed under the
License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS
OF ANY KIND, either express or implied. See the License for the specific
language governing permissions and limitations under the License. -->
<Wix xmlns='http://schemas.microsoft.com/wix/2006/wi' xmlns:fire='http://schemas.microsoft.com/wix/FirewallExtension' xmlns:util='http://schemas.microsoft.com/wix/UtilExtension'>
<Product Name='!(loc.ProductName)' Id='eea70ed5-5950-4f01-b4aa-4a07636359bb'
UpgradeCode='d6208c34-7b50-4512-b19e-b904dcc1373e' Language='1033'
Codepage='1252' Version='4.4.0' Manufacturer='!(loc.ProductManufacturer)'>
<Package Id='*' Keywords='Installer' Description="!(loc.PackageDescription)"
Comments='!(loc.PackageComments)'
Manufacturer='!(loc.PackageManufacturer)' Languages='1033' Compressed='yes'
SummaryCodepage='1252' Platform="x64" InstallerVersion="500" />
<Media Id='1' Cabinet='Sample.cab' EmbedCab='yes' DiskPrompt="CD-ROM #1" />
<Property Id='DiskPrompt' Value="Apache Cloud Stack Installation program" />
<!-- Get JAVA_HOME here -->
<Property Id='JAVA_HOME'>
<RegistrySearch Id="JavaHomeSearch" Name="JavaHome"
Root="HKLM" Key="SOFTWARE\JavaSoft\Java Development Kit\1.7"
Type="raw" Win64="yes" />
</Property>
<Condition
Message="!(loc.Java7ConditionMessage)"><![CDATA[(Installed OR JAVA_HOME)]]></Condition>
<!-- Get Tomcat6 installation path -->
<Property Id='TOMCATDIRECTORY'>
<RegistrySearch Id="TomcatSearch" Name="InstallPath"
Root="HKLM" Key="SOFTWARE\Apache Software Foundation\Tomcat\6.0\Tomcat6"
Type="raw" Win64="yes" />
</Property>
<Condition
Message="!(loc.Tomcat6ConditionMessage)"><![CDATA[(Installed OR TOMCATDIRECTORY)]]></Condition>
<!-- Get Python installation path -->
<Property Id='PYTHON_HOME'>
<RegistrySearch Id="PythonSearch" Root="HKLM"
Key="SOFTWARE\Python\PythonCore\2.7\InstallPath" Type="raw"
Win64="yes" />
</Property>
<Condition
Message="!(loc.Python2ConditionMessage)"><![CDATA[(Installed OR PYTHON_HOME)]]></Condition>
<!-- Get 7Z installation path -->
<Property Id='SEVENZ_HOME'>
<RegistrySearch Id="SecenZSearch" Name="Path" Root="HKLM"
Key="SOFTWARE\7-Zip" Type="raw" Win64="yes" />
</Property>
<Property Id='MYSQL'>
<RegistrySearch Id="MySqlSearch" Name="Location" Root="HKLM" Key="SOFTWARE\Wow6432Node\MySQL AB\MySQL Server 5.1" Type="raw" Win64="yes" />
</Property>
<Condition Message="!(loc.SevenZConditionMessage)"><![CDATA[(Installed OR SEVENZ_HOME)]]></Condition>
<!-- Properties for Database Related Information to be collected -->
<Property Id="DB_USERNAME" Value="cloud" />
<Property Id="DB_PASSWORD" Value="cloud" Hidden="yes"/>
<Property Id="DB_HOSTNAME" Value="localhost" />
<Property Id="DB_PORT" Value="3306" />
<Property Id="DB_ROOT_PASSWORD" Hidden="yes"/>
<Directory Id='TARGETDIR' Name='SourceDir'>
<Directory Id='ProgramFilesFolder' Name='PFiles'>
<Directory Id='Acme' Name='Apache'>
<Directory Id='INSTALLDIR' Name='CS'>
<Component Id='MainExecutable'
Guid='5980d204-a63a-45db-a7e8-cbd50b2d314b'>
<CreateFolder />
<Environment Id="CLOUDSTACK_HOME" Action="set"
Name="CLOUDSTACK_HOME" Permanent="no" System="yes"
Value="[INSTALLDIR]." />
<Environment Id="CATALINA_BASE" Action="set"
Name="CATALINA_BASE" Permanent="no" System="yes"
Value="[INSTALLDIR]." />
<Environment Id="CATALINA_OPTS" Action="set"
Name="CATALINA_OPTS" Permanent="no" System="yes"
Value="-XX:MaxPermSize=512m -Xmx1024m -Xms256m" />
<Environment Id="Path" Action="set" Name="Path"
Permanent="no" System="yes" Part="last"
Value="[JAVA_HOME]bin;[PYTHON_HOME];[SEVENZ_HOME];[ProgramFilesFolder]cdrtools;[MYSQL]bin;[INSTALLDIR]scripts" />
<Environment Id="PATHEXT" Action="set" Name="PATHEXT"
Permanent="no" System="yes" Part="last"
Value=".py" />
</Component>
<Component Id='setuptools' Guid='019a51dd-7fc4-4d6c-9277-13cc7b600789'>
<File Id="ez_setup" Source="ez_setup.py" />
</Component>
</Directory>
</Directory>
</Directory>
<Directory Id="ProgramMenuFolder" Name="Programs">
<Directory Id="ProgramMenuDir" Name="ACS">
<Component Id="ProgramMenuDir" Guid="69932d81-ea9c-4a74-9013-7da61f291090">
<RemoveFolder Id='ProgramMenuDir' On='uninstall' />
<RegistryValue Root='HKCU'
Key='Software\[Manufacturer]\[ProductName]' Type='string'
Value='' KeyPath='yes' />
</Component>
</Directory>
</Directory>
</Directory>
<Property Id='TOMCATIMAGEPATH'>
<RegistrySearch Id="TomcatImagePath" Name="ImagePath"
Root="HKLM" Key="SYSTEM\CurrentControlSet\Services\Tomcat6"
Type="raw" Win64="yes" />
</Property>
<util:Group Id="Administrators" Name="Administrators"/>
<Component Id="ServiceInstaller" Directory="INSTALLDIR"
Guid="dfebb4bb-cac0-4cef-aa91-342bafa18349">
<util:User Id="AccountCreation" CreateUser="yes" FailIfExists="no" Name="cloud" Password="C!0ud" RemoveOnUninstall="yes" UpdateIfExists="yes" LogonAsService="yes">
<util:GroupRef Id="Administrators" />
</util:User>
<File Id='ACSServiceEXEFile' Name='start.exe' Source='start.bat'
KeyPath='yes' />
<ServiceInstall Id='InstallACSService' Name='ACSService'
Description='ACS Service' ErrorControl='normal' Start='auto'
Type='ownProcess' Vital='yes'>
<util:PermissionEx User="cloud" GenericAll="yes" ServiceStart="yes" ServiceStop="yes" ServicePauseContinue="yes" ServiceInterrogate="yes" ServiceChangeConfig="yes" ServiceEnumerateDependents="yes"
ServiceQueryConfig="yes" ServiceQueryStatus="yes" ServiceUserDefinedControl="yes" />
</ServiceInstall>
<ServiceControl Id='UninstallACSService' Name='ACSService'
Remove='uninstall' Wait='yes' />
<RegistryValue Root='HKLM'
Key='SYSTEM\CurrentControlSet\Services\ACSService' Name="ImagePath"
Type='expandable' Value='[TOMCATIMAGEPATH]' />
</Component>
<DirectoryRef Id="INSTALLDIR">
<Directory Id="CSMANAGEMENT" Name="cloudstack-management">
<Directory Id="WEBAPPS" Name="webapps">
<Component Id="webappsFolder" Guid="53c03092-438f-4da1-b14d-ceee90c79de0">
<CreateFolder />
</Component>
</Directory>
</Directory>
</DirectoryRef>
<DirectoryRef Id="WEBAPPS">
<Component Id="copyToConf" Guid="99da8926-1eec-4a7f-ac7f-1326d8e73ea0"
KeyPath="yes">
<File Id="server.xml" Source="client\WEB-INF\classes\server-nonssl.xml"
Checksum="no">
<CopyFile Id="copyServerXML" DestinationName="server.xml"
DestinationDirectory="CONF" />
</File>
<File Id="tomcat6.conf" Source="client\WEB-INF\classes\tomcat6-nonssl.conf"
Checksum="no">
<CopyFile Id="copyTomcat6ConfXML" DestinationName="tomcat6.conf"
DestinationDirectory="CONF" />
</File>
<File Id="web.xml" Source="client\WEB-INF\classes\web.xml"
Checksum="no">
<CopyFile Id="copyWebXML" DestinationName="web.xml"
DestinationDirectory="CONF" />
</File>
<File Id="log4j_cloud.xml" Source="client\WEB-INF\classes\log4j-cloud.xml"
Checksum="no">
<CopyFile Id="log4j_cloudxml" DestinationName="log4j-cloud.xml"
DestinationDirectory="CONF" />
</File>
<File Id="environment.properties" Source="client\WEB-INF\classes\environment.properties"
Checksum="no">
<CopyFile Id="environmentproperties" DestinationName="environment.properties"
DestinationDirectory="CONF" />
</File>
<File Id="classpath.conf" Source="client\WEB-INF\classes\classpath.conf"
Checksum="no">
<CopyFile Id="classpathconf" DestinationName="classpath.conf"
DestinationDirectory="CONF" />
</File>
<File Id="catalina.properties" Source="client\WEB-INF\classes\catalina.properties"
Checksum="no">
<CopyFile Id="catalinaproperties" DestinationName="catalina.properties"
DestinationDirectory="CONF" />
</File>
<File Id="tomcat_users.xml" Source="client\WEB-INF\classes\tomcat-users.xml"
Checksum="no">
<CopyFile Id="tomcat_usersxml" DestinationName="tomcat-users.xml"
DestinationDirectory="CONF" />
</File>
<File Id="catalina.policy" Source="client\WEB-INF\classes\catalina.policy"
Checksum="no">
<CopyFile Id="catalinapolicy" DestinationName="catalina.policy"
DestinationDirectory="CONF" />
</File>
<File Id="db.properties" Source="client\WEB-INF\classes\db.properties"
Checksum="no">
<CopyFile Id="dbproperties" DestinationName="db.properties"
DestinationDirectory="LIB" />
</File>
</Component>
</DirectoryRef>
<DirectoryRef Id="CSMANAGEMENT">
<Directory Id="CONF" Name="conf">
<Component Id="confFolder" Guid="ad227f7d-6808-4bdf-8ac6-3b2954d51b96">
<CreateFolder />
</Component>
</Directory>
</DirectoryRef>
<DirectoryRef Id="CSMANAGEMENT">
<Directory Id="LIB" Name="lib">
<Component Id="libFolder" Guid="d338841e-2ea4-48b3-ab48-9c42e2961600">
<CreateFolder />
</Component>
</Directory>
</DirectoryRef>
<Component Id="firewallRules" Guid="2d056999-8191-41a0-94e0-e6dfcc188417"
Directory="INSTALLDIR">
<CreateFolder />
<fire:FirewallException Id="p_8080" Name="port_8080"
Description="for cloudstack management server" Port="8080"
Profile="all" Protocol="tcp" Scope="any" />
<fire:FirewallException Id="p_8096" Name="port_8096"
Description="for cloudstack management server admin" Port="8096"
Profile="all" Protocol="tcp" Scope="any" />
<fire:FirewallException Id="p_8787" Name="port_8787"
Description="for cloudstack management server" Port="8787"
Profile="all" Protocol="tcp" Scope="any" />
<fire:FirewallException Id="p_9090" Name="port_9090"
Description="for cloudstack management server" Port="9090"
Profile="all" Protocol="tcp" Scope="any" />
<fire:FirewallException Id="p_3922" Name="port_3922"
Description="for cloudstack management server" Port="3922"
Profile="all" Protocol="tcp" Scope="any" />
<fire:FirewallException Id="p_8250" Name="port_8250"
Description="for cloudstack management server" Port="8250"
Profile="all" Protocol="tcp" Scope="any" />
</Component>
<!-- Updating Tomcat's catalina base -->
<CustomAction Id="TomcatPath" Property="TOMCATDIRECTORY1"
Value="[TOMCATDIRECTORY]\bin\Tomcat6.exe">
</CustomAction>
<CustomAction Id="UpdateTomcatCatalinaBase"
ExeCommand='//US//Tomcat6 --JvmOptions=-Dcatalina.base=[CSMANAGEMENT];-Djava.io.tmpdir=[CSMANAGEMENT]\temp;-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager;-Dcatalina.home="[TOMCATDIRECTORY]";-Xms512m;-Xmx1024m;-XX:MaxPermSize=512m;-Duser.name=cloud'
Property="TOMCATDIRECTORY1" Execute="deferred" Return="check" />
<CustomAction Id="UpdateTomcatClassPath"
ExeCommand='//US//Tomcat6 --Classpath="[TOMCATDIRECTORY]\bin\bootstrap.jar";"[TOMCATDIRECTORY]\bin\tomcat-juli.jar";[CSMANAGEMENT]\conf;[CSMANAGEMENT]\lib;[CSMANAGEMENT]\setup'
Property="TOMCATDIRECTORY1" Execute="deferred" Return="check" />
<CustomAction Id="CopySitePackages" Directory='INSTALLDIR'
ExeCommand='[SystemFolder]cmd.exe /c xcopy /S "[INSTALLDIR]\python-site-packages" [PYTHON_HOME]\Lib\site-packages'
Execute="deferred" Return="check"/>
<CustomAction Id="DeleteDirectory" Directory='INSTALLDIR'
ExeCommand='[SystemFolder]cmd.exe /c RD /S /Q "[INSTALLDIR]\python-site-packages"'
Execute="deferred" Return="check" />
<CustomAction Id="DeleteFiles" Directory='CSMANAGEMENT'
ExeCommand='[SystemFolder]cmd.exe /c del "[CSMANAGEMENT]\webapps\client\WEB-INF\classes\db.properties" "[CSMANAGEMENT]\webapps\client\WEB-INF\classes\log4j*.xml"'
Execute="deferred" Return="check" />
<CustomAction Id="SetuptoolsInstallation" Directory='INSTALLDIR'
ExeCommand='[PYTHON_HOME]\python "[INSTALLDIR]\ez_setup.py"'
Execute="deferred" Return="check" />
<CustomAction Id="DbHostWithPort" Execute="immediate" Property="DB_HOSTNAME" Value="[DB_HOSTNAME]:[DB_PORT]" />
<CustomAction Id="DeployDB" Directory='CSMANAGEMENT'
ExeCommand='[PYTHON_HOME]\python "[INSTALLDIR]\scripts\cloud-setup-databases" [DB_USERNAME]:[DB_PASSWORD]@[DB_HOSTNAME] --deploy-as=root:[DB_ROOT_PASSWORD] -c "[CSMANAGEMENT]\lib" -f "[CSMANAGEMENT]\setup" -j "[CSMANAGEMENT]\webapps\client\WEB-INF\lib\jasypt-1.9.2.jar" -n "[CSMANAGEMENT]\lib\key" -b "[MYSQL]\bin"'
Execute="deferred" Return="check" Impersonate="no"/>
<CustomAction Id="SetupDatabases" Directory='CSMANAGEMENT'
ExeCommand='[PYTHON_HOME]\python "[INSTALLDIR]\scripts\cloud-setup-databases" [DB_USERNAME]:[DB_PASSWORD]@[DB_HOSTNAME] -c "[CSMANAGEMENT]\lib" -f "[CSMANAGEMENT]\setup" -j "[CSMANAGEMENT]\webapps\client\WEB-INF\lib\jasypt-1.9.2.jar" -n "[CSMANAGEMENT]\lib\key" -b "[MYSQL]\bin"'
Execute="deferred" Return="check" Impersonate="no"/>
<InstallExecuteSequence>
<InstallServices Sequence="4990"></InstallServices>
<Custom Action="TomcatPath" Before="UpdateTomcatClassPath">NOT Installed</Custom>
<Custom Action="UpdateTomcatClassPath" Before="UpdateTomcatCatalinaBase">NOT Installed
</Custom>
<Custom Action="UpdateTomcatCatalinaBase" Before="DeleteFiles">NOT
Installed</Custom>
<Custom Action="DeleteFiles" Before="SetuptoolsInstallation">NOT Installed</Custom>
<Custom Action="SetuptoolsInstallation" Before="GenerateSSLKey">NOT Installed</Custom>
<Custom Action="GenerateSSLKey" After="PublishProduct">NOT Installed
</Custom>
<Custom Action="CopySitePackages" After="GenerateSSLKey">NOT Installed</Custom>
<Custom Action="DeleteDirectory" After="CopySitePackages">NOT Installed</Custom>
<Custom Action="DbHostWithPort" After="InstallFiles"><![CDATA[DB_PORT]]></Custom>
<Custom Action="DeployDB" After="DeleteDirectory">(NOT Installed) AND (CREATE_DATABASE = "1")
</Custom>
<Custom Action="SetupDatabases" After="DeleteDirectory">(NOT Installed) AND (<![CDATA[CREATE_DATABASE <> "1"]]>)
</Custom>
</InstallExecuteSequence>
<Feature Id='Complete' Title='!(loc.ProductName)' Description='!(loc.FeatureDescription2)'
Display='expand' Level='1' ConfigurableDirectory='INSTALLDIR'>
<Feature Id='MainProgram' Title='!(loc.FeatureTitle1)' Description='!(loc.FeatureDescription1)'
Level='1'>
<ComponentRef Id='webappsFolder' />
<ComponentGroupRef Id='ClientPath' />
<ComponentGroupRef Id='SetupPath' />
<ComponentGroupRef Id='UtilitiesPath' />
<ComponentGroupRef Id='PythonSitePackagesPath' />
<ComponentRef Id='ProgramMenuDir' />
<ComponentRef Id='confFolder' />
<ComponentRef Id='libFolder' />
<ComponentRef Id='copyToConf' />
<ComponentRef Id='firewallRules' />
<ComponentRef Id='MainExecutable' />
<ComponentRef Id='setuptools' />
<ComponentRef Id='ServiceInstaller' />
</Feature>
</Feature>
<UIRef Id="WixUI_Mondo_Custom" />
<UIRef Id="WixUI_ErrorProgressText" />
</Product>
</Wix>
Reference in New Issue View Git Blame Copy Permalink