~poptart/hosaka-pki

3e7aaa515a8f42df89b0e4840f6aaf6616a928f5 — terrorbyte 1 year, 11 months ago 568ad52
Screw it, I'll make it a real project
7 files changed, 149 insertions(+), 0 deletions(-)

M .gitignore
A Makefile
A README.md
A config.def
A config.mk
A hosaka-pki.sh
A openssl.cnf.tmpl
M .gitignore => .gitignore +1 -0
@@ 3,3 3,4 @@ outgoing/
private/
certs/
*.pem
config

A Makefile => Makefile +27 -0
@@ 0,0 1,27 @@
include config.mk

all: check

check:
	shellcheck -a -x -s sh ./hosaka-pki.sh

config:
	@sed -e "s%SSLDIR%${SSLDIR}%g" \
		-e "s%SSHDIR%${SSHDIR}%g" \
		< config.def > config

install:
	@printf "installing hosaka-pki"
	@mkdir -p "${CONFIGDIR}" "${CONFIGDIR}/ssl" \
		"${CONFIGDIR}/ssh" "${CONFIGDIR}/util"
	@chown 0700 "${CONFIGDIR}/ssl" "${CONFIGDIR}/ssh"
	@cp -f config "${CONFIGDIR}
	@cp -f hosaka-pki.sh ${PREFIX}/bin/hosaka-pki
	@chown 755 ${PREFIX}/bin/hosaka-pki
	@printf "hosaka-pki installed into: ${CONFIGDIR}\\n"

clean:
	@printf "cleaning"

.PHONY:
	all clean install check

A README.md => README.md +18 -0
@@ 0,0 1,18 @@
hosaka-pki
==========
A set of shell scripts for configuring multiple kinds of common PKI
systems. Currently the config supports:

* SSL/TLS via the `openssl(1)` command
* SSH via OpenSSH > 8.0

The goals are to attempt to shorten the nightmare of remember a ton of
PKI commands and to encourage secure defaults. New versions never have
guarentees about compatability.


SSL/TLS PKI
-----------

OpenSSH PKI
-----------

A config.def => config.def +4 -0
@@ 0,0 1,4 @@
#This is the hosaka-pki configuration file. It is parsed by the PKI shell 
#script and functions a KEY=VALUE pair set of settings
SSL_CA_DIR="SSLDIR"
SSH_CA_DIR="SSHDIR"

A config.mk => config.mk +6 -0
@@ 0,0 1,6 @@
VERSION = 0.0.1
PREFIX = /usr/local
MANPREFIX = ${PREFIX}/share/man
CONFIGDIR = /etc/hosaka/pki
SSHDIR = /etc/ssh
SSLDIR = /etc/ssl

A hosaka-pki.sh => hosaka-pki.sh +0 -0
A openssl.cnf.tmpl => openssl.cnf.tmpl +93 -0
@@ 0,0 1,93 @@
[ ca ]
default_ca = CA_default

[ CA_default ]
dir = /home/ca/ssl
certs = $dir/certs
crl_dir = $dir/crl
new_certs_dir = $dir/new
database = $dir/index.txt
serial = $dir/serial
RANDFILE = $dir/private/.rand
private_key = $dir/private/ca.key.pem
certificate = $dir/certs/ca.cert.pem
crlnumber         = $dir/crlnumber
crl               = $dir/crl/ca.crl.pem
crl_extensions    = crl_ext
default_crl_days  = 30
default_md        = sha256
name_opt          = ca_default
cert_opt          = ca_default
default_days      = 375
preserve          = no
policy            = policy_strict

[ policy_strict ]
countryName             = match
stateOrProvinceName     = match
organizationName        = match
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ policy_loose ]
countryName             = optional
stateOrProvinceName     = optional
localityName            = optional
organizationName        = optional
organizationalUnitName  = optional
commonName              = supplied
emailAddress            = optional

[ req ]
distinguished_name  = req_distinguished_name
string_mask         = utf8only
default_md          = sha256
x509_extensions     = v3_ca

[ req_distinguished_name ]
countryName                     = Country Name (2 letter code)
stateOrProvinceName             = State or Province Name
localityName                    = Locality Name
0.organizationName              = Organization Name
organizationalUnitName          = Organizational Unit Name
commonName                      = Common Name

countryName_default             = HX 
stateOrProvinceName_default     = Cyberspace 
localityName_default            = NULL
0.organizationName_default      = Hosaka Corporation 
organizationalUnitName_default = Crypto Munitions Bureau

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ v3_intermediate_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical, CA:true, pathlen:0
keyUsage = critical, digitalSignature, cRLSign, keyCertSign

[ usr_cert ]
basicConstraints = CA:FALSE
nsCertType = client, email
nsComment = "OpenSSL Generated Client Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer
keyUsage = critical, nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = clientAuth, emailProtection

[ server_cert ]
basicConstraints = CA:FALSE
nsCertType = server
nsComment = "Generated Server Certificate"
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid,issuer:always
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth

[ crl_ext ]
authorityKeyIdentifier=keyid:always