156 lines
6.4 KiB
Plaintext
156 lines
6.4 KiB
Plaintext
|
#!/bin/bash
|
||
|
|
|
||
|
|
# variables
|
||
|
|
LABEL="DATA"
|
||
|
|
DATABASE_PASS=$(head -c 300 /dev/urandom | tr -cd 'a-zA-Z0-9' | head -c 16)
|
||
|
|
PI_SECRET_KEY=$(head -c 300 /dev/urandom | tr -cd 'a-zA-Z0-9' | head -c 16)
|
||
|
|
PI_PEPPER=$(head -c 300 /dev/urandom | tr -cd 'a-zA-Z0-9' | head -c 16)
|
||
|
|
ADMIN_PASS="privacyidea"
|
||
|
|
TLD="example.com"
|
||
|
|
HOST="privacyidea"
|
||
|
|
ORGNAME="privacyIDEA example"
|
||
|
|
|
||
|
|
# start
|
||
|
|
set -e
|
||
|
|
|
||
|
|
[ -e /01firstboot ] && exit 0
|
||
|
|
[ -e /02firstboot ] || exit 0
|
||
|
|
|
||
|
|
# privacyIDEA configuration
|
||
|
|
if [ ! -d "/$LABEL/etc/privacyidea" ]; then
|
||
|
|
echo 'Create privacyIDEA configfile...'
|
||
|
|
mkdir -p /$LABEL/etc/privacyidea
|
||
|
|
chown privacyidea /$LABEL/etc/privacyidea
|
||
|
|
cp /etc/privacyidea/pi.cfg /$LABEL/etc/privacyidea/pi.cfg.orig
|
||
|
|
mv /etc/privacyidea/pi.cfg /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
ln -s /$LABEL/etc/privacyidea/pi.cfg /etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^SUPERUSER_REALM = .*/SUPERUSER_REALM = ['admin']/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^SQLALCHEMY_DATABASE_URI = .*/SQLALCHEMY_DATABASE_URI = 'mysql:\/\/pi:$DATABASE_PASS@localhost\/pi'/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^SECRET_KEY = .*/SECRET_KEY = '$PI_SECRET_KEY'/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^PI_PEPPER = .*/PI_PEPPER = \"$PI_PEPPER\"/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^PI_ENCFILE = .*/PI_ENCFILE = '\/etc\/privacyidea\/enckey'/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^PI_AUDIT_KEY_PRIVATE = .*/PI_AUDIT_KEY_PRIVATE = '\/etc\/privacyidea\/private.pem'/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
sed -i "s/^PI_AUDIT_KEY_PUBLIC = .*/PI_AUDIT_KEY_PUBLIC = '\/etc\/privacyidea\/public.pem'/" /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
echo "SQLALCHEMY_TRACK_MODIFICATIONS = False" >> /$LABEL/etc/privacyidea/pi.cfg
|
||
|
|
|
||
|
|
echo 'Create privacyIDEA encryption and audit keys...'
|
||
|
|
rm -rf /etc/privacyidea/enckey
|
||
|
|
pi-manage create_enckey
|
||
|
|
mv /etc/privacyidea/enckey /$LABEL/etc/privacyidea/enckey
|
||
|
|
chown privacyidea /$LABEL/etc/privacyidea/enckey
|
||
|
|
ln -s /$LABEL/etc/privacyidea/enckey /etc/privacyidea/enckey
|
||
|
|
|
||
|
|
rm -rf /etc/privacyidea/public.pem /etc/privacyidea/private.pem
|
||
|
|
pi-manage create_audit_keys
|
||
|
|
mv /etc/privacyidea/private.pem /$LABEL/etc/privacyidea/private.pem
|
||
|
|
mv /etc/privacyidea/public.pem /$LABEL/etc/privacyidea/public.pem
|
||
|
|
chown privacyidea /$LABEL/etc/privacyidea/*.pem
|
||
|
|
ln -s /$LABEL/etc/privacyidea/private.pem /etc/privacyidea/private.pem
|
||
|
|
ln -s /$LABEL/etc/privacyidea/public.pem /etc/privacyidea/public.pem
|
||
|
|
else
|
||
|
|
if [ ! -L /etc/privacyidea/pi.cfg ]; then
|
||
|
|
rm -rf /$LABEL/etc/privacyidea/pi.cfg.orig
|
||
|
|
mv /etc/privacyidea/pi.cfg /$LABEL/etc/privacyidea/pi.cfg.orig
|
||
|
|
else
|
||
|
|
rm -rf /etc/privacyidea/pi.cfg
|
||
|
|
fi
|
||
|
|
ln -s /$LABEL/etc/privacyidea/pi.cfg /etc/privacyidea/pi.cfg
|
||
|
|
|
||
|
|
rm -rf /etc/privacyidea/enckey
|
||
|
|
ln -s /$LABEL/etc/privacyidea/enckey /etc/privacyidea/enckey
|
||
|
|
|
||
|
|
rm -rf /etc/privacyidea/public.pem /etc/privacyidea/private.pem
|
||
|
|
ln -s /$LABEL/etc/privacyidea/private.pem /etc/privacyidea/private.pem
|
||
|
|
ln -s /$LABEL/etc/privacyidea/public.pem /etc/privacyidea/public.pem
|
||
|
|
fi
|
||
|
|
|
||
|
|
|
||
|
|
# Database
|
||
|
|
systemctl stop mariadb
|
||
|
|
if [ ! -d "/$LABEL/var/lib/mysql/pi" ]; then
|
||
|
|
echo 'Initialize MariaDB...'
|
||
|
|
mkdir -p "/$LABEL/var/lib"
|
||
|
|
rm -rf "/$LABEL/var/lib/mysql"
|
||
|
|
if [ ! -L /var/lib/mysql ]; then
|
||
|
|
rm -rf "/$LABEL/var/lib/mysql.orig"
|
||
|
|
cp -a "/var/lib/mysql" "/$LABEL/var/lib/mysql.orig"
|
||
|
|
mv "/var/lib/mysql" "/$LABEL/var/lib/mysql"
|
||
|
|
ln -s "/$LABEL/var/lib/mysql" "/var/lib/mysql"
|
||
|
|
elif [ -d "/$LABEL/var/lib/mysql.orig" ]; then
|
||
|
|
cp -a "/$LABEL/var/lib/mysql.orig" "/$LABEL/var/lib/mysql"
|
||
|
|
rm -rf "/var/lib/mysql"
|
||
|
|
ln -s "/$LABEL/var/lib/mysql" "/var/lib/mysql"
|
||
|
|
else
|
||
|
|
echo '### ERROR initialize database !!! ###'
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
systemctl start mariadb
|
||
|
|
sleep 5
|
||
|
|
|
||
|
|
echo 'Create privacyIDEA database...'
|
||
|
|
mysql -u root -e "CREATE USER 'pi'@'localhost' IDENTIFIED BY '$DATABASE_PASS'"
|
||
|
|
mysql -u root -e "CREATE DATABASE pi DEFAULT CHARACTER SET latin1 COLLATE latin1_swedish_ci;"
|
||
|
|
mysql -u root -e "GRANT ALL PRIVILEGES ON pi.* TO 'pi'@'localhost' IDENTIFIED by '$DATABASE_PASS';"
|
||
|
|
mysql -u root -e "FLUSH PRIVILEGES;"
|
||
|
|
|
||
|
|
pi-manage createdb
|
||
|
|
pi-manage admin add -p "$ADMIN_PASS" admin
|
||
|
|
|
||
|
|
else
|
||
|
|
echo 'Start MariaDB...'
|
||
|
|
if [ ! -L /var/lib/mysql ]; then
|
||
|
|
rm -rf "/$LABEL/var/lib/mysql.orig"
|
||
|
|
mv "/var/lib/mysql" "/$LABEL/var/lib/mysql.orig"
|
||
|
|
else
|
||
|
|
rm -f "/var/lib/mysql"
|
||
|
|
fi
|
||
|
|
ln -s "/$LABEL/var/lib/mysql" "/var/lib/mysql"
|
||
|
|
systemctl start mariadb
|
||
|
|
fi
|
||
|
|
|
||
|
|
if [ -x "/$LABEL/etc/ssl/cert-renew.sh" ]; then
|
||
|
|
# angepaßtes Zertifikat vorhanden (kein example)
|
||
|
|
if [ ! -L /etc/ssl/cert-renew.sh ]; then
|
||
|
|
rm -f "/$LABEL/etc/ssl/cert-renew.sh.orig"
|
||
|
|
mv "/etc/ssl/cert-renew.sh" "/$LABEL/etc/ssl/cert-renew.sh.orig"
|
||
|
|
else
|
||
|
|
rm -f "/etc/ssl/cert-renew.sh"
|
||
|
|
fi
|
||
|
|
ln -s "/$LABEL/etc/ssl/cert-renew.sh" "/etc/ssl/cert-renew.sh"
|
||
|
|
else
|
||
|
|
echo 'Create example certificate...'
|
||
|
|
mkdir -p "/$LABEL/CERTS/KEYS/"
|
||
|
|
mkdir -p "/$LABEL/CERTS/$HOST.$TLD"
|
||
|
|
echo "FQDN = $HOST.$TLD" > "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
echo "ORGNAME = $ORGNAME" >> "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
echo "ALTNAMES = DNS:$HOST.$TLD , DNS:$TLD" >> "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
echo -e "\n[ req ]\ndefault_bits = 4096\ndefault_md = sha256\nprompt = no\nencrypt_key = no\ndistinguished_name = dn\nreq_extensions = req_ext\ndefault_keyfile = ../KEYS/\$FQDN-key.pem\n" >> "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
echo -e "\n[ dn ]\nC = DE\nO = \$ORGNAME\nCN = \$FQDN\n" >> "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
echo -e "\n[ req_ext ]\nsubjectAltName = \$ALTNAMES" >> "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf"
|
||
|
|
openssl req -x509 -new -config "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD.cnf" -out "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD-cert.pem" -keyout "/$LABEL/CERTS/KEYS/$HOST.$TLD-key.pem"
|
||
|
|
cp "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD-cert.pem" "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD-fullchain.pem"
|
||
|
|
touch "/$LABEL/CERTS/$HOST.$TLD/$HOST.$TLD-chain.pem"
|
||
|
|
fi
|
||
|
|
|
||
|
|
rm -rf /etc/ssl/apache2
|
||
|
|
mkdir -p /etc/ssl
|
||
|
|
ln -sf "/$LABEL/etc/ssl/apache2" "/etc/ssl/apache2"
|
||
|
|
|
||
|
|
/etc/ssl/cert-renew.sh
|
||
|
|
|
||
|
|
systemctl enable mariadb
|
||
|
|
systemctl enable freeradius
|
||
|
|
systemctl enable apache2
|
||
|
|
|
||
|
|
systemctl restart freeradius
|
||
|
|
systemctl restart apache2
|
||
|
|
|
||
|
|
echo
|
||
|
|
echo "Success!"
|
||
|
|
echo "Do not forget to upgrade the MySQL database and the privacyIDEA Schema:"
|
||
|
|
echo " # mysql_upgrade"
|
||
|
|
echo " # privacyidea-schema-upgrade /usr/lib/privacyidea/migrations"
|
||
|
|
echo
|
||
|
|
|
||
|
|
rm /02firstboot
|