Author: jdsn
Date: Mon Feb 4 21:34:12 2008
New Revision: 44141
URL: http://svn.opensuse.org/viewcvs/yast?rev=44141&view=rev
Log:
crl export cron support, export script, various small fixes
Added:
trunk/ca-management/scripts/exportCRL.pl (with props)
Modified:
trunk/ca-management/scripts/Makefile.am
trunk/ca-management/src/crlExport.ycp
trunk/ca-management/yast2-ca-management.spec.in
Modified: trunk/ca-management/scripts/Makefile.am
URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/scripts/Makefile.am?rev=44141&r1=44140&r2=44141&view=diff
==============================================================================
--- trunk/ca-management/scripts/Makefile.am (original)
+++ trunk/ca-management/scripts/Makefile.am Mon Feb 4 21:34:12 2008
@@ -5,7 +5,7 @@
bindir = ${exec_prefix}/bin
sysconfdir = /etc
-bin_SCRIPTS = generateCRL.pl
+bin_SCRIPTS = generateCRL.pl exportCRL.pl
sysconf_DATA = generateCRL.conf
Added: trunk/ca-management/scripts/exportCRL.pl
URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/scripts/exportCRL.pl?rev=44141&view=auto
==============================================================================
--- trunk/ca-management/scripts/exportCRL.pl (added)
+++ trunk/ca-management/scripts/exportCRL.pl Mon Feb 4 21:34:12 2008
@@ -0,0 +1,105 @@
+#! /usr/bin/perl -w
+
+BEGIN {
+ push @INC, '/usr/share/YaST2/modules/';
+}
+
+use strict;
+use Config::IniFiles;
+use Getopt::Long;
+use YaPI::CaManagement;
+
+
+# adapt to export to local files as well
+# improve to use new exportcrl.conf files
+
+
+my $config = '/etc/generateCRL.conf';
+my $help = undef;
+
+my @toDo = ();
+
+Getopt::Long::Configure("no_ignore_case", "no_auto_abbrev");
+my $result = GetOptions ("config|c=s" => \$config,
+ "help|?|h" => \$help);
+
+if($help || !$result) {
+ print "usage: generateCRL.pl [-c path] \n";
+ print "\n";
+ print "-c, --config Path to configfile (default: /etc/generateCRL.conf)\n";
+ print "-?, --help, -h This help\n";
+ exit;
+}
+
+my $cfg = new Config::IniFiles( -file => $config );
+if(!defined $cfg) {
+ die "Can not read the configfile:\n @Config::IniFiles::errors\n";
+}
+
+@toDo = $cfg->Sections();
+
+foreach my $gencrl (@toDo) {
+
+ print "Process '$gencrl' ... ";
+ my $ret = doit($gencrl);
+ if($ret eq "") {
+ print "done\n";
+ } else {
+ print "failed\n$ret\n";
+ }
+}
+
+
+sub doit {
+ my $caName = shift;
+
+ my $caPasswd = $cfg->val($caName, "caPasswd");
+ my $host = $cfg->val($caName, "ldapHostname");
+ my $port = $cfg->val($caName, "ldapPort", 389);
+ my $destDN = $cfg->val($caName, "destinationDN");
+ my $bindDN = $cfg->val($caName, "bindDN");
+ my $ldapPasswd = $cfg->val($caName, "ldapPasswd");
+ my $err;
+ my $msg;
+
+ my $res = YaPI::CaManagement->ReadCRLDefaults({caName => $caName});
+ if( not defined $res ) {
+ $err = YaPI::CaManagement->Error();
+ $msg = $err->{summary};
+ $msg .= "[".$err->{description}."]" if(defined $err->{description});
+ return $msg;
+ }
+
+ my $data = {
+ 'caName' => $caName,
+ 'caPasswd' => $caPasswd,
+ 'days' => $res->{days}
+ };
+
+ $res = YaPI::CaManagement->AddCRL($data);
+ if( not defined $res ) {
+ $err = YaPI::CaManagement->Error();
+ $msg = $err->{summary};
+ $msg .= "[".$err->{description}."]" if(defined $err->{description});
+ return $msg;
+ }
+
+ $data = {
+ caName => $caName,
+ ldapHostname => $host,
+ ldapPort => $port,
+ destinationDN => $destDN,
+ BindDN => $bindDN,
+ ldapPasswd => $ldapPasswd
+ };
+
+ $res = YaPI::CaManagement->ExportCRLToLDAP($data);
+ if( not defined $res ) {
+ $err = YaPI::CaManagement->Error();
+ $msg = $err->{summary};
+ $msg .= "[".$err->{description}."]" if(defined $err->{description});
+ return $msg;
+ }
+
+ return "";
+}
Modified: trunk/ca-management/src/crlExport.ycp
URL: http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/src/crlExport.ycp?rev=44141&r1=44140&r2=44141&view=diff
==============================================================================
--- trunk/ca-management/src/crlExport.ycp (original)
+++ trunk/ca-management/src/crlExport.ycp Mon Feb 4 21:34:12 2008
@@ -45,8 +45,8 @@
boolean ldap_active = false; // default off
symbol fileformat = `ffpem; // default is pem
string crlfile = ""; // is set from inside the export function
-integer intervalDays = 30;
-integer intervalHours = 0;
+integer intervalAtHour = 0;
+integer intervalHours = 0;
map ldapCred = $[ "hostname":"", "port":"", "dn":"",
"binddn":"", "password":"" ];
@@ -63,8 +63,8 @@
// Translators: window caption
_("Security Information"),
// Translators: long help text - security information
- `RichText(_("Warning!<br>Activating the automatic creation and export of a CRL will write the CA password to a config file on disk. The password will be stored there in plain text as it is needed to create a CRL. The file will only be readable for the root user.<br>Please note that this is a security risk if there are more people that have root access. They all will be able to read the CA password.")),
- 50, 20
+ `RichText(_("Warning!<br>Activating the automatic creation and export of a CRL will write the CA password to a configuration file on disk. The password will be stored there in plain text as it is needed to create a CRL. The file will only be readable for the root user.")),
+ 50, 12
);
seenSecurityInfo = true;
}
@@ -88,8 +88,9 @@
// write settings to the UI
UI::ChangeWidget(`id(`mode_periodically), `Value, periodic);
UI::ChangeWidget(`id(`periodicInterval), `Enabled, periodic);
- UI::ChangeWidget(`id(`interval_days), `Value, intervalDays);
+ UI::ChangeWidget(`id(`interval_athour), `Value, intervalAtHour);
UI::ChangeWidget(`id(`interval_hours), `Value, intervalHours);
+ UI::ChangeWidget(`id(`atHourSetting), `Enabled, intervalHours == 24 ? true:false);
UI::ChangeWidget(`id(`exportFile), `Value, file_active);
UI::ChangeWidget(`id(`exportLDAP), `Value, ldap_active);
@@ -118,7 +119,7 @@
define void readSettings(string ca)
{
- string crlConf = sformat("/var/lib/CAM/%1/crl-export.conf", ca);
+ string crlConf = sformat("/var/lib/CAM/%1/exportcrl.conf", deletechars(ca, " "));
if (SCR::Execute(.target.bash, sformat("[ -f %1 ]", crlConf) ) == 0 )
{
SCR::RegisterAgent( .temp_crlexport_agent, `ag_ini(
@@ -126,10 +127,12 @@
periodic = SCR::Read(.temp_crlexport_agent.periodic) == "true" ? true:false;
if (periodic) seenSecurityInfo = true;
- integer getDays = (integer) SCR::Read(.temp_crlexport_agent.interval_days);
- intervalDays = getDays != nil ? getDays:intervalDays;
- integer getHours = (integer) SCR::Read(.temp_crlexport_agent.interval_hours);
- intervalHours = getHours != nil ? getHours:intervalHours;
+ integer getAtHour = tointeger( (string)SCR::Read(.temp_crlexport_agent.interval_athour));
+ intervalAtHour = getAtHour != nil ? getAtHour:intervalAtHour;
+ integer getHours = tointeger( (string)SCR::Read(.temp_crlexport_agent.interval_hours));
+ intervalHours = getHours != nil ? getHours:intervalHours;
+ if (intervalHours != 24) intervalAtHour = 0;
+
file_active = SCR::Read(.temp_crlexport_agent.export_file) == "true" ? true:false;
ldap_active = SCR::Read(.temp_crlexport_agent.export_ldap) == "true" ? true:false;
string getCrlfile = (string) SCR::Read(.temp_crlexport_agent.crlfilename);
@@ -156,7 +159,7 @@
define void writeSettings(string ca)
{
- string crlConf = sformat("/var/lib/CAM/%1/crl-export.conf", ca);
+ string crlConf = sformat("/var/lib/CAM/%1/exportcrl.conf", deletechars(ca, " "));
if (! (SCR::Execute(.target.bash, sformat("[ -f %1 ]", crlConf) ) == 0))
{
SCR::Execute(.target.bash, sformat("umask 0077 && touch %1", crlConf) );
@@ -168,8 +171,8 @@
SCR::Write(.temp_crlexport_agent.periodic, periodic ? "true":"false");
SCR::Write(.temp_crlexport_agent.capassword, periodic ? getPassword(ca):"" );
- SCR::Write(.temp_crlexport_agent.interval_days, sformat("%1", intervalDays));
- SCR::Write(.temp_crlexport_agent.interval_hours, sformat("%1",intervalHours));
+ SCR::Write(.temp_crlexport_agent.interval_athour, intervalHours == 24 ? "0":sformat("%1", intervalAtHour));
+ SCR::Write(.temp_crlexport_agent.interval_hours, sformat("%1", intervalHours));
SCR::Write(.temp_crlexport_agent.export_file, file_active == true ? "true":"false");
SCR::Write(.temp_crlexport_agent.export_ldap, ldap_active == true ? "true":"false");
@@ -201,12 +204,12 @@
string caption = _("Export CRL");
// this default can only be set inside this function
- crlfile = sformat("/var/lib/CAM/%1/crl/crl.pem", ca);
+ crlfile = sformat("/var/lib/CAM/%1/crl/crl.pem", deletechars(ca, " "));
string help_para1 = sformat("<p><b>%1</b></p>", caption);
string help_para2 = _("<p>Export the CRL of this CA once by selecting <b>Export once</b>.</p>");
- string help_para3 = _("<p>To setup a repeated recreation of the CRL select <b>Repeated recreation and export</b>. In this case set the interval for the recreation in <b>Periodic interval</b>. The interval is the sum of days and hours you set. To export every few hours set days to 0 and hours to the hourly interval. Please make sure you read and understood the <b>Security Information</b>.</p>");
+ string help_para3 = _("<p>To setup a repeated recreation of the CRL select <b>Repeated recreation and export</b>. In this case set the interval for the recreation in <b>Periodic interval</b>. If you set the interval to 24 hours you can additionally select the hour when the export should happen. Please make sure you read and understood the <b>Security Information</b>.</p>");
string help_para4 = _("<p>You can activate an export of the CRL to a local file or to a LDAP server or both. Setup the respective parameters in <b>Export to local file</b> and <b>Export to LDAP</b>.</p>");
string helptext = help_para1 + help_para2 + help_para3 + help_para4;
@@ -244,9 +247,13 @@
`HBox(
`VBox(`Label(_("Periodic interval")), `VSpacing(1)),
`HSpacing(3),
- `HSquash( `IntField( `id(`interval_days), "&days", 0, 100, 30 )),
- `Label("+"),
- `HSquash( `IntField( `id(`interval_hours), "&hours", 0, 23, 0 )),
+ //`HSquash( `IntField( `id(`interval_days), "&days", 0, 100, 30 )),
+ // Translators: this is used to express a setting of "every XX hour(s)"
+ `Label(_("every")),
+ `HSquash( `IntField( `id(`interval_hours), `opt(`notify), "&hour(s)", 1, 24, 12 )),
+ // Translators: in case "every XX hour(s)" is set to 24, the user can set "at XX o'clock"
+ `HBox(`id(`atHourSetting), `Label(_("at")),
+ `HSquash( `IntField( `id(`interval_athour), "&o'clock", 0, 23, 3 ))),
`HSpacing(3),
`VBox( `VSpacing(1), `PushButton(`id(`securityInfo), _("&Security Information")) )
)
@@ -321,6 +328,11 @@
string newfile = regexpsub(crlfile, formatstr, outputstr);
if (newfile != nil && newfile != "") crlfile = newfile;
}
+ if (ui == `interval_hours || ui == `interval_athour)
+ {
+ intervalHours = (integer) UI::QueryWidget(`id(`interval_hours), `Value);
+ intervalAtHour= (integer) UI::QueryWidget(`id(`interval_athour), `Value);
+ }
if (ui == `securityInfo)
{
showSecurityInfo();
@@ -330,7 +342,7 @@
updateEnabled();
fileformat = (symbol) UI::QueryWidget(`id(`fileformat), `Value);
crlfile = (string) UI::QueryWidget(`id(`crlfile), `Value);
- intervalDays = (integer) UI::QueryWidget(`id(`interval_days), `Value);
+ intervalAtHour= (integer) UI::QueryWidget(`id(`interval_athour), `Value);
intervalHours = (integer) UI::QueryWidget(`id(`interval_hours), `Value);
ldapCred["hostname"] = (string) UI::QueryWidget(`id(`hostname), `Value);
ldapCred["port"] = (string) UI::QueryWidget(`id(`port), `Value);
@@ -338,13 +350,66 @@
ldapCred["binddn"] = (string) UI::QueryWidget(`id(`binddn), `Value);
ldapCred["password"] = (string) UI::QueryWidget(`id(`ldapPassword), `Value);
cleanLdapCred();
-
writeSettings(ca);
- // else export the crl once
- // exportOnce(ca, `file)
- // exportOnce(ca, `ldap)
- // TODO : setup Cronjob when periodically is configured
+ string cronConfFile = sformat("/etc/cron.d/yast2-ca-mgm-exportcrl-%1",ca);
+
+ if (!periodic)
+ {
+ if (file_active)
+ {
+ string exportFormat = "PEM";
+ if (fileformat == `ffder) exportFormat = "DER";
+ string strret = (string) YaPI::CaManagement::ExportCRL ($[ "caName": ca, "caPasswd" : getPassword(ca),
+ "exportFormat" : exportFormat, "destinationFile" : crlfile]);
+ y2milestone ("ExportCRL(%1) returned %2", $["caName": ca, "exportFormat" : exportFormat, "destinationFile" : crlfile], ret);
+ if (strret == nil || strret != "1")
+ {
+ if ( Popup::YesNoHeadline(_("Export to file failed"), _("Do you want to retry?")) )
+ {
+ ui = `retry;
+ }
+ }
+ else { Popup::Message(_("Saved to file successfully")); }
+ }
+
+ if (ldap_active)
+ {
+ boolean boolret = (boolean) YaPI::CaManagement::ExportCRLToLDAP ($[ "caName": ca,
+ "ldapHostname" : ldapCred["hostname"]:"", "ldapPort" : ldapCred["port"]:"",
+ "destinationDN" : ldapCred["dn"]:"", "BindDN" : ldapCred["binddn"]:"",
+ "ldapPasswd" : ldapCred["ldap_password"]:"" ]);
+ if (boolret)
+ {
+ Popup::Message(_("Saved to LDAP successfully."));
+ }
+ else
+ {
+ if ( Popup::YesNoHeadline(_("Export to LDAP failed"), _("Do you want to retry?")) )
+ {
+ ui = `retry;
+ }
+ }
+ }
+
+ // Remove the cronjob if the setting was reset
+ SCR::Execute(.target.remove, cronConfFile);
+ }
+ else
+ {
+ string configString = sformat("## Configuration of a cron job to export the CRL of the CA: %1", ca);
+ configString = configString + "\n##";
+ configString = configString + "\n## Created by yast2-ca-management";
+ configString = configString + "\n## Changes to this file will be overwritten by yast2-ca-management";
+ configString = configString + sformat("\n## Either use yast or change settings here AND in /var/lib/CAM/%1/exportcrl.conf", deletechars(ca, " "));
+ configString = configString + "\n\n\n";
+ string hourset = intervalHours == 24 ? sformat("%1",intervalAtHour) : sformat("*/%1",intervalHours);
+ configString = configString + sformat("* %1 * * * root /usr/bin/exportCRL.pl -c /var/lib/CAM/%2/exportcrl.conf", hourset, deletechars(ca, " "));
+ if ( SCR::Execute(.target.bash, sformat("cat > %1 <http://svn.opensuse.org/viewcvs/yast/trunk/ca-management/yast2-ca-management.spec.in?rev=44141&r1=44140&r2=44141&view=diff
==============================================================================
--- trunk/ca-management/yast2-ca-management.spec.in (original)
+++ trunk/ca-management/yast2-ca-management.spec.in Mon Feb 4 21:34:12 2008
@@ -41,4 +41,5 @@
@schemadir@/autoyast/rnc/ca_mgm.rnc
%doc @docdir@
/usr/bin/generateCRL.pl
+/usr/bin/exportCRL.pl
%attr(600, root, root) %config(noreplace) /etc/generateCRL.conf
--
To unsubscribe, e-mail: yast-commit+unsubscribe@opensuse.org
For additional commands, e-mail: yast-commit+help@opensuse.org
