mirror of
https://github.com/apache/cloudstack.git
synced 2025-10-26 08:42:29 +01:00
7ce54bf7a8
This introduces a new certificate authority framework that allows pluggable CA provider implementations to handle certificate operations around issuance, revocation and propagation. The framework injects itself to `NioServer` to handle agent connections securely. The framework adds assumptions in `NioClient` that a keystore if available with known name `cloud.jks` will be used for SSL negotiations and handshake. This includes a default 'root' CA provider plugin which creates its own self-signed root certificate authority on first run and uses it for issuance and provisioning of certificate to CloudStack agents such as the KVM, CPVM and SSVM agents and also for the management server for peer clustering. Additional changes and notes: - Comma separate list of management server IPs can be set to the 'host' global setting. Newly provisioned agents (KVM/CPVM/SSVM etc) will get radomized comma separated list to which they will attempt connection or reconnection in provided order. This removes need of a TCP LB on port 8250 (default) of the management server(s). - All fresh deployment will enforce two-way SSL authentication where connecting agents will be required to present certificates issued by the 'root' CA plugin. - Existing environment on upgrade will continue to use one-way SSL authentication and connecting agents will not be required to present certificates. - A script `keystore-setup` is responsible for initial keystore setup and CSR generation on the agent/hosts. - A script `keystore-cert-import` is responsible for import provided certificate payload to the java keystore file. - Agent security (keystore, certificates etc) are setup initially using SSH, and later provisioning is handled via an existing agent connection using command-answers. The supported clients and agents are limited to CPVM, SSVM, and KVM agents, and clustered management server (peering). - Certificate revocation does not revoke an existing agent-mgmt server connection, however rejects a revoked certificate used during SSL handshake. - Older `cloudstackmanagement.keystore` is deprecated and will no longer be used by mgmt server(s) for SSL negotiations and handshake. New keystores will be named `cloud.jks`, any additional SSL certificates should not be imported in it for use with tomcat etc. The `cloud.jks` keystore is stricly used for agent-server communications. - Management server keystore are validated and renewed on start up only, the validity of them are same as the CA certificates. New APIs: - listCaProviders: lists all available CA provider plugins - listCaCertificate: lists the CA certificate(s) - issueCertificate: issues X509 client certificate with/without a CSR - provisionCertificate: provisions certificate to a host - revokeCertificate: revokes a client certificate using its serial Global settings for the CA framework: - ca.framework.provider.plugin: The configured CA provider plugin - ca.framework.cert.keysize: The key size for certificate generation - ca.framework.cert.signature.algorithm: The certificate signature algorithm - ca.framework.cert.validity.period: Certificate validity in days - ca.framework.cert.automatic.renewal: Certificate auto-renewal setting - ca.framework.background.task.delay: CA background task delay/interval - ca.framework.cert.expiry.alert.period: Days to check and alert expiring certificates Global settings for the default 'root' CA provider: - ca.plugin.root.private.key: (hidden/encrypted) CA private key - ca.plugin.root.public.key: (hidden/encrypted) CA public key - ca.plugin.root.ca.certificate: (hidden/encrypted) CA certificate - ca.plugin.root.issuer.dn: The CA issue distinguished name - ca.plugin.root.auth.strictness: Are clients required to present certificates - ca.plugin.root.allow.expired.cert: Are clients with expired certificates allowed UI changes: - Button to download/save the CA certificates. Misc changes: - Upgrades bountycastle version and uses newer classes - Refactors SAMLUtil to use new CertUtils Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
101 lines
4.0 KiB
Bash
Executable File
101 lines
4.0 KiB
Bash
Executable File
#!/bin/bash
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
# or more contributor license agreements. See the NOTICE file
|
|
# distributed with this work for additional information
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
# to you under the Apache License, Version 2.0 (the
|
|
# "License"); you may not use this file except in compliance
|
|
# with the License. You may obtain a copy of the License at
|
|
#
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
#
|
|
# Unless required by applicable law or agreed to in writing,
|
|
# software distributed under the License is distributed on an
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
# KIND, either express or implied. See the License for the
|
|
# specific language governing permissions and limitations
|
|
# under the License.
|
|
|
|
PROPS_FILE="$1"
|
|
KS_FILE="$2"
|
|
MODE="$3"
|
|
CERT_FILE="$4"
|
|
CERT=$(echo "$5" | tr '^' '\n' | tr '~' ' ')
|
|
CACERT_FILE="$6"
|
|
CACERT=$(echo "$7" | tr '^' '\n' | tr '~' ' ')
|
|
PRIVKEY_FILE="$8"
|
|
PRIVKEY=$(echo "$9" | tr '^' '\n' | tr '~' ' ')
|
|
|
|
ALIAS="cloud"
|
|
SYSTEM_FILE="/var/cache/cloud/cmdline"
|
|
|
|
# Find keystore password
|
|
KS_PASS=$(sed -n '/keystore.passphrase/p' "$PROPS_FILE" 2>/dev/null | sed 's/keystore.passphrase=//g' 2>/dev/null)
|
|
|
|
if [ -z "${KS_PASS// }" ]; then
|
|
echo "Failed to find keystore passphrase from file: $PROPS_FILE, quiting!"
|
|
exit 1
|
|
fi
|
|
|
|
# Use a new keystore file
|
|
NEW_KS_FILE="$KS_FILE.new"
|
|
|
|
# Import certificate
|
|
if [ ! -z "${CERT// }" ]; then
|
|
echo "$CERT" > "$CERT_FILE"
|
|
fi
|
|
|
|
# Import ca certs
|
|
if [ ! -z "${CACERT// }" ]; then
|
|
echo "$CACERT" > "$CACERT_FILE"
|
|
fi
|
|
|
|
# Import cacerts into the keystore
|
|
awk '/-----BEGIN CERTIFICATE-----?/{n++}{print > "cloudca." n }' "$CACERT_FILE"
|
|
for caChain in $(ls cloudca.*); do
|
|
keytool -delete -noprompt -alias "$caChain" -keystore "$NEW_KS_FILE" -storepass "$KS_PASS" > /dev/null 2>&1 || true
|
|
keytool -import -noprompt -storepass "$KS_PASS" -trustcacerts -alias "$caChain" -file "$caChain" -keystore "$NEW_KS_FILE" > /dev/null 2>&1
|
|
done
|
|
rm -f cloudca.*
|
|
|
|
# Import private key if available
|
|
if [ ! -z "${PRIVKEY// }" ]; then
|
|
echo "$PRIVKEY" > "$PRIVKEY_FILE"
|
|
# Re-initialize keystore when private key is provided
|
|
keytool -delete -noprompt -alias "$ALIAS" -keystore "$NEW_KS_FILE" -storepass "$KS_PASS" 2>/dev/null || true
|
|
openssl pkcs12 -export -name "$ALIAS" -in "$CERT_FILE" -inkey "$PRIVKEY_FILE" -out "$NEW_KS_FILE.p12" -password pass:"$KS_PASS" > /dev/null 2>&1
|
|
keytool -importkeystore -srckeystore "$NEW_KS_FILE.p12" -destkeystore "$NEW_KS_FILE" -srcstoretype PKCS12 -alias "$ALIAS" -deststorepass "$KS_PASS" -destkeypass "$KS_PASS" -srcstorepass "$KS_PASS" -srckeypass "$KS_PASS" > /dev/null 2>&1
|
|
else
|
|
# Import certificate into the keystore
|
|
keytool -import -storepass "$KS_PASS" -alias "$ALIAS" -file "$CERT_FILE" -keystore "$NEW_KS_FILE" > /dev/null 2>&1 || true
|
|
# Export private key from keystore
|
|
rm -f "$PRIVKEY_FILE"
|
|
keytool -importkeystore -srckeystore "$NEW_KS_FILE" -destkeystore "$NEW_KS_FILE.p12" -deststoretype PKCS12 -srcalias "$ALIAS" -deststorepass "$KS_PASS" -destkeypass "$KS_PASS" -srcstorepass "$KS_PASS" -srckeypass "$KS_PASS" > /dev/null 2>&1
|
|
openssl pkcs12 -in "$NEW_KS_FILE.p12" -nodes -nocerts -nomac -password pass:"$KS_PASS" 2>/dev/null | openssl rsa -out "$PRIVKEY_FILE" > /dev/null 2>&1
|
|
fi
|
|
|
|
# Commit the new keystore
|
|
rm -f "$NEW_KS_FILE.p12"
|
|
mv -f "$NEW_KS_FILE" "$KS_FILE"
|
|
|
|
# Update ca-certs if we're in systemvm
|
|
if [ -f "$SYSTEM_FILE" ]; then
|
|
mkdir -p /usr/local/share/ca-certificates/cloudstack
|
|
cp "$CACERT_FILE" /usr/local/share/ca-certificates/cloudstack/ca.crt
|
|
chmod 755 /usr/local/share/ca-certificates/cloudstack
|
|
chmod 644 /usr/local/share/ca-certificates/cloudstack/ca.crt
|
|
update-ca-certificates > /dev/null 2>&1 || true
|
|
fi
|
|
|
|
# Restart cloud service if we're in systemvm
|
|
if [ "$MODE" == "ssh" ] && [ -f $SYSTEM_FILE ]; then
|
|
/etc/init.d/cloud stop > /dev/null 2>&1
|
|
sleep 2
|
|
/etc/init.d/cloud start > /dev/null 2>&1
|
|
fi
|
|
|
|
# Fix file permission
|
|
chmod 600 $CACERT_FILE
|
|
chmod 600 $CERT_FILE
|
|
chmod 600 $PRIVKEY_FILE
|