mirror of
https://github.com/gocsaf/csaf.git
synced 2025-12-22 05:40:11 +01:00
69f0f3499a
* Adjust provider and aggregator to copy the used openpgp pubkey into a locally provided directory `openpgp` beside the `prodiver-metadata.json`. This more robust and self-reliant than using a public pubkey server, which is the reason why the CSAF 2.0 csd02 mentions it as example in "7.1.20 Requirement 20: Public OpenPGP Key". * Improve aggregator by removing a typo `aggreator` from one written paths. (Done with this change as it also affects the openpgp/ paths writing.) solve #85
113 lines
3.5 KiB
Bash
Executable file
113 lines
3.5 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
#
|
|
# This file is Free Software under the MIT License
|
|
# without warranty, see README.md and LICENSES/MIT.txt for details.
|
|
#
|
|
# SPDX-License-Identifier: MIT
|
|
#
|
|
# SPDX-FileCopyrightText: 2022 German Federal Office for Information Security (BSI) <https://www.bsi.bund.de>
|
|
# Software-Engineering: 2022 Intevation GmbH <https://intevation.de>
|
|
|
|
# This script sets up the csaf_provider and writes the required nginx configurations.
|
|
# It creates the initial folders and uploads some example files to the csaf_provider with the help of `uploadToProvider.sh`
|
|
|
|
set -e
|
|
|
|
sudo chgrp -R www-data /var/www
|
|
sudo chmod -R g+ws /var/www
|
|
|
|
export NGINX_CONFIG_PATH=/etc/nginx/sites-available/default
|
|
export DNS_NAME=csaf.data.security.localhost
|
|
|
|
sudo cp /usr/share/doc/fcgiwrap/examples/nginx.conf /etc/nginx/fcgiwrap.conf
|
|
|
|
echo '
|
|
# Include this file on your nginx.conf to support debian cgi-bin scripts using
|
|
# fcgiwrap
|
|
location /cgi-bin/ {
|
|
# Disable gzip (it makes scripts feel slower since they have to complete
|
|
# before getting gzipped)
|
|
gzip off;
|
|
|
|
# Set the root to /usr/lib (inside this location this means that we are
|
|
# giving access to the files under /usr/lib/cgi-bin)
|
|
root /usr/lib;
|
|
|
|
# Fastcgi socket
|
|
fastcgi_pass unix:/var/run/fcgiwrap.socket;
|
|
|
|
# Fastcgi parameters, include the standard ones
|
|
include /etc/nginx/fastcgi_params;
|
|
|
|
fastcgi_split_path_info ^(.+\.go)(.*)$;
|
|
|
|
# Adjust non standard parameters (SCRIPT_FILENAME)
|
|
fastcgi_param SCRIPT_FILENAME /usr/lib$fastcgi_script_name;
|
|
|
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
|
fastcgi_param CSAF_CONFIG /usr/lib/csaf/config.toml;
|
|
|
|
fastcgi_param SSL_CLIENT_VERIFY $ssl_client_verify;
|
|
fastcgi_param SSL_CLIENT_S_DN $ssl_client_s_dn;
|
|
fastcgi_param SSL_CLIENT_I_DN $ssl_client_i_dn;
|
|
}
|
|
' | sudo tee /etc/nginx/fcgiwrap.conf
|
|
|
|
sudo sed -i "/^server {/a include fcgiwrap.conf;" $NGINX_CONFIG_PATH
|
|
|
|
echo "
|
|
# For atomic directory switches
|
|
disable_symlinks off;
|
|
|
|
# directory listings
|
|
autoindex on;
|
|
" > locationConfig.txt
|
|
sudo sed -i "/^\s*location \/ {/r locationConfig.txt" $NGINX_CONFIG_PATH # Insert config inside location{}
|
|
./DNSConfigForItest.sh
|
|
sudo systemctl reload nginx
|
|
|
|
# assuming that we are in a checked out version in the docs/scripts directory
|
|
# and we want to build the version that is currently checked out
|
|
pushd ../..
|
|
|
|
export PATH=$PATH:/usr/local/go/bin
|
|
make build_linux
|
|
# Place the binary under the corresponding path.
|
|
sudo mkdir -p /usr/lib/cgi-bin/
|
|
sudo chgrp www-data /usr/lib/cgi-bin/
|
|
sudo chmod o-rwx /usr/lib/cgi-bin/
|
|
sudo cp bin-linux-amd64/csaf_provider /usr/lib/cgi-bin/csaf_provider.go
|
|
|
|
sudo mkdir /usr/lib/csaf/
|
|
sudo chgrp www-data /usr/lib/csaf/
|
|
sudo chmod g+s,o-rwx /usr/lib/csaf/
|
|
sudo touch /usr/lib/csaf/config.toml
|
|
sudo chgrp www-data /usr/lib/csaf/config.toml
|
|
sudo chmod g+r,o-rwx /usr/lib/csaf/config.toml
|
|
|
|
sudo cp docs/test-keys/*.asc /usr/lib/csaf/
|
|
sudo chgrp www-data /usr/lib/csaf/private.asc
|
|
sudo chmod o-rwx /usr/lib/csaf/private.asc
|
|
|
|
# Configuration file
|
|
echo '
|
|
# upload_signature = true
|
|
openpgp_private_key = "/usr/lib/csaf/private.asc"
|
|
openpgp_public_key = "/usr/lib/csaf/public.asc"
|
|
#tlps = ["green", "red"]
|
|
canonical_url_prefix = "https://localhost:8443"
|
|
#no_passphrase = true
|
|
' | sudo tee --append /usr/lib/csaf/config.toml
|
|
|
|
# Create the Folders
|
|
curl https://localhost:8443/cgi-bin/csaf_provider.go/create --cert-type p12 --cert ~/devca1/testclient1.p12 --insecure
|
|
|
|
popd
|
|
|
|
# Upload files
|
|
./uploadToProvider.sh
|
|
|
|
# Test resolving DNS record
|
|
curl https://$DNS_NAME --insecure
|
|
|
|
./testChecker.sh
|