globus_simple_ca-3.5/ 0000775 0000764 0000764 00000000000 12225656002 011703 5 0000000 0000000 globus_simple_ca-3.5/globus_automake_pre 0000644 0000764 0000764 00000001200 12225575522 015573 0000000 0000000 ## Special globus installation directories
setupdir = @setupdir@
## setup = [ DATA,PROGRAMS,SCRIPTS ]
testdir = @testdir@
## test = [ DATA,PROGRAMS,SCRIPTS ]
scriptsysconfdir = ${sysconfdir}
## scriptsysconf = [ PROGRAMS,SCRIPTS ]
flavorincludedir = @flavorincludedir@
## flavorinclude = [ HEADERS ]
pkgdir = @pkgdir@
## pkg = [ DATA ]
aclocaldir = @aclocaldir@
## aclocal = [ DATA ]
amdirdir = ${datadir}/globus_amdir
## amdir = [ DATA ]
perlmoduledir = @perlmoduledir@
## perlmodule = [ DATA ]
doxygendir = @doxygendir@
## doxygen = [ DATA ]
docdir = @docdir@
## doc = [ DATA ]
LINK_BAK = orig
AUTOMAKE_OPTIONS=no-dependencies
globus_simple_ca-3.5/grid-ca-sign.1 0000666 0000764 0000764 00000007723 11612350776 014174 0000000 0000000 '\" t
.\" Title: grid-ca-sign
.\" Author: University of Chicago
.\" Generator: DocBook XSL Stylesheets v1.75.2
.\" Date: 07/22/2011
.\" Manual: Globus Commands
.\" Source: Globus Toolkit 5.2.0
.\" Language: English
.\"
.TH "GRID\-CA\-SIGN" "1" "07/22/2011" "Globus Toolkit 5.2.0" "Globus Commands"
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
grid-ca-sign \- Sign a certificate with a SimpleCA for use on a grid
.SH "SYNOPSIS"
.HP \w'\fBgrid\-ca\-sign\fR\ 'u
\fBgrid\-ca\-sign\fR [\-help] [\-h] [\-usage] [\-version] [\-versions]
.HP \w'\fBgrid\-ca\-sign\fR\ 'u
\fBgrid\-ca\-sign\fR \-in\ \fIREQUEST\fR \-out\ \fICERTIFICATE\fR
.br
[\-force] [\-dir\ \fIDIRECTORY\fR]
.br
[\-openssl\-help] [\fIOPENSSL\-OPTIONS\fR]
.SH "DESCRIPTION"
.PP
The
\fBgrid\-ca\-sign\fR
program signs a certificate based on a request file with a CA certificate created by
\fBgrid\-ca\-create\fR\&. The new certificate is written to a file\&. If the CA has already signed a certificate with the same subject name as contained in the certificate request, it will refuse to sign the new request unless the
\fB\-force\fR
option is provided on the command\-line\&.
.PP
If run as a privileged user,
\fBgrid\-ca\-sign\fR
uses the CA certificate and configuration located in
\fB${localstatedir}\fR/lib/globus/simple_ca
to sign the certificate\&. For a non\-privileged user,
\fBgrid\-ca\-sign\fR
uses the CA certificate and configuration located in
\fB$HOME\fR/\&.globus/simpleCA\&. The
\fBgrid\-ca\-sign\fR
program an use a different CA configuration and certificate by using the
\fB\-dir\fR
option\&.
.PP
The full set of command\-line options to
\fBgrid\-ca\-sign\fR
follows\&. In addition to these, unknown options will be passed to the
\fBopenssl\fR
command when creating the self\-signed certificate\&.
.PP
\fB\-help\fR, \fB\-h\fR, \fB\-usage\fR
.RS 4
Display the command\-line options to
\fBgrid\-ca\-sign\fR
and exit\&.
.RE
.PP
\fB\-version\fR, \fB\-versions\fR
.RS 4
Display the version number of the
\fBgrid\-ca\-sign\fR
command\&. The second form includes details about the package containing
\fBgrid\-ca\-sign\fR\&.
.RE
.PP
\fB\-in \fR\fB\fIREQUEST\fR\fR
.RS 4
Sign the request contained in the
\fIREQUEST\fR
file\&.
.RE
.PP
\fB\-out \fR\fB\fICERTIFICATE\fR\fR
.RS 4
Write the signed request to the
\fICERTIFICATE\fR
file\&.
.RE
.PP
\fB\-force\fR
.RS 4
Revoke any previously issued certificate with the same subject name as in the certificate request and issue a new certificate\&. Otherwise,
\fBgrid\-ca\-sign\fR
will refuse to sign the request\&.
.RE
.PP
\fB\-dir \fR\fB\fIDIRECTORY\fR\fR
.RS 4
Sign the certificate using the Simple CA certificate and configuration located in
\fIDIRECTORY\fR
instead of the default\&.
.RE
.PP
\fB\-openssl\-help\fR
.RS 4
Print the command\-line options available for the
\fBopenssl ca\fR
command\&.
.RE
.SH "EXAMPLES"
.PP
Sign a certificate request using the simple CA in
\fB$HOME\fR/SimpleCA
.sp
.if n \{\
.RS 4
.\}
.nf
% \fBgrid\-ca\-sign\fR \fB\-in usercert_request\&.pem \-out usercert\&.pem\fR \fB\-dir \fR\fB\fB$HOME\fR\fR\fB/SimpleCA\fR
To sign the request
please enter the password for the CA key:
The new signed certificate is at: /home/juser/\&.globus/simpleCA/newcerts/01\&.pem
.fi
.if n \{\
.RE
.\}
.sp
.SH "ENVIRONMENT VARIABLES"
.PP
The following environment variables affect the execution of
\fBgrid\-ca\-sign\fR:
.PP
\fBGLOBUS_LOCATION\fR
.RS 4
Non\-standard installation path of the Globus toolkit\&.
.RE
.SH "SEE ALSO"
.PP
\fBgrid-cert-request\fR(1),
\fBgrid-ca-create\fR(1),
\fBgrid-default-ca\fR(1),
\fBgrid-ca-package\fR(1)
.SH "AUTHOR"
.PP
\fBUniversity of Chicago\fR
globus_simple_ca-3.5/grid-ca-package-manual.xml 0000666 0000764 0000764 00000014230 11612350776 016531 0000000 0000000
grid-ca-package">
]>
University of Chicago&cmdname;1Globus Toolkitversion&cmdname;Prepare a CA certificate, configuration, and policy for distribution
&cmd;
-help-h-usage-version-versions
&cmd;
-ca HASH-g-b-r-dDescription
The &cmd; utility creates a tarball containing an RPM spec file and
the files needed to use a CA with grid tools. It optionally will also
create a GPT package for distributing a CA.
By default, the &cmd; utility displays a list of installed grid CA and
prompts for which CA to package. It then creates a tarball containing
the CA certificate, signing policy, CA configuration files, and an
spec script to generate a binary RPM package containing the CA. If the
CA hash is known prior to running &cmd;, it may provided as an argument
to the parameter to avoid prompting.
In addition to generating a spec script and tarball, &cmd; creates a
GPT package if either the or
options are used on the command-line. These packages may be used to
distribute a CA and configuration to systems which do not support RPM
packages.
The &cmd; utility writes the package tarballs to the current working
directory.
The full set of command-line options to &cmd; follows.
Display the command-line options to
&cmd; and exit.Display the version number of the &cmd;
command. The second form includes more
details.Use the CA whose name matches the hash
string CA. When invoked with this option,
&cmd; runs non-interactively.Create a GPT binary package in addition to
the RPM script tarball. This package may be installed on other
systems using the gpt-install
program.Create a GPT binary package with GPT metadata
located in the path expected by GPT 3.2 (used in Globus
2.0.0-5.0.x) instead of
${datadir}/globus/packages
as used in Globus 5.2.x. This option overrides the
command-line option.Create a binary RPM package for the
CA. This option currently only works on RPM-based
distributions.Create a binary Debian package for the CA.
This option currently only works on Debian-based
distributions.ExamplesPackage a Simple CA with hash 0146c503% &cmd;
Creating RPM source tarball... done
globus_simple_ca_0146c503.tar.gzEnvironment Variables
The following environment variables affect the execution of &cmd;:
GLOBUS_LOCATIONNon-standard installation path of the
Globus toolkit.See Alsogrid-cert-request1,
grid-ca-sign1,
grid-default-ca1,
grid-ca-create1
globus_simple_ca-3.5/install-sh 0000755 0000764 0000764 00000022021 12225655772 013637 0000000 0000000 #!/bin/sh
# install - install a program, script, or datafile
scriptversion=2005-05-14.22
# This originates from X11R5 (mit/util/scripts/install.sh), which was
# later released in X11R6 (xc/config/util/install.sh) with the
# following copyright and license.
#
# Copyright (C) 1994 X Consortium
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to
# deal in the Software without restriction, including without limitation the
# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
# sell copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#
# Except as contained in this notice, the name of the X Consortium shall not
# be used in advertising or otherwise to promote the sale, use or other deal-
# ings in this Software without prior written authorization from the X Consor-
# tium.
#
#
# FSF changes to this file are in the public domain.
#
# Calling this script install-sh is preferred over install.sh, to prevent
# `make' implicit rules from creating a file called install from it
# when there is no Makefile.
#
# This script is compatible with the BSD install script, but was written
# from scratch. It can only install one file at a time, a restriction
# shared with many OS's install programs.
# set DOITPROG to echo to test this script
# Don't use :- since 4.3BSD and earlier shells don't like it.
doit="${DOITPROG-}"
# put in absolute paths if you don't have them in your path; or use env. vars.
mvprog="${MVPROG-mv}"
cpprog="${CPPROG-cp}"
chmodprog="${CHMODPROG-chmod}"
chownprog="${CHOWNPROG-chown}"
chgrpprog="${CHGRPPROG-chgrp}"
stripprog="${STRIPPROG-strip}"
rmprog="${RMPROG-rm}"
mkdirprog="${MKDIRPROG-mkdir}"
chmodcmd="$chmodprog 0755"
chowncmd=
chgrpcmd=
stripcmd=
rmcmd="$rmprog -f"
mvcmd="$mvprog"
src=
dst=
dir_arg=
dstarg=
no_target_directory=
usage="Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
or: $0 [OPTION]... SRCFILES... DIRECTORY
or: $0 [OPTION]... -t DIRECTORY SRCFILES...
or: $0 [OPTION]... -d DIRECTORIES...
In the 1st form, copy SRCFILE to DSTFILE.
In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
In the 4th, create DIRECTORIES.
Options:
-c (ignored)
-d create directories instead of installing files.
-g GROUP $chgrpprog installed files to GROUP.
-m MODE $chmodprog installed files to MODE.
-o USER $chownprog installed files to USER.
-s $stripprog installed files.
-t DIRECTORY install into DIRECTORY.
-T report an error if DSTFILE is a directory.
--help display this help and exit.
--version display version info and exit.
Environment variables override the default commands:
CHGRPPROG CHMODPROG CHOWNPROG CPPROG MKDIRPROG MVPROG RMPROG STRIPPROG
"
while test -n "$1"; do
case $1 in
-c) shift
continue;;
-d) dir_arg=true
shift
continue;;
-g) chgrpcmd="$chgrpprog $2"
shift
shift
continue;;
--help) echo "$usage"; exit $?;;
-m) chmodcmd="$chmodprog $2"
shift
shift
continue;;
-o) chowncmd="$chownprog $2"
shift
shift
continue;;
-s) stripcmd=$stripprog
shift
continue;;
-t) dstarg=$2
shift
shift
continue;;
-T) no_target_directory=true
shift
continue;;
--version) echo "$0 $scriptversion"; exit $?;;
*) # When -d is used, all remaining arguments are directories to create.
# When -t is used, the destination is already specified.
test -n "$dir_arg$dstarg" && break
# Otherwise, the last argument is the destination. Remove it from $@.
for arg
do
if test -n "$dstarg"; then
# $@ is not empty: it contains at least $arg.
set fnord "$@" "$dstarg"
shift # fnord
fi
shift # arg
dstarg=$arg
done
break;;
esac
done
if test -z "$1"; then
if test -z "$dir_arg"; then
echo "$0: no input file specified." >&2
exit 1
fi
# It's OK to call `install-sh -d' without argument.
# This can happen when creating conditional directories.
exit 0
fi
for src
do
# Protect names starting with `-'.
case $src in
-*) src=./$src ;;
esac
if test -n "$dir_arg"; then
dst=$src
src=
if test -d "$dst"; then
mkdircmd=:
chmodcmd=
else
mkdircmd=$mkdirprog
fi
else
# Waiting for this to be detected by the "$cpprog $src $dsttmp" command
# might cause directories to be created, which would be especially bad
# if $src (and thus $dsttmp) contains '*'.
if test ! -f "$src" && test ! -d "$src"; then
echo "$0: $src does not exist." >&2
exit 1
fi
if test -z "$dstarg"; then
echo "$0: no destination specified." >&2
exit 1
fi
dst=$dstarg
# Protect names starting with `-'.
case $dst in
-*) dst=./$dst ;;
esac
# If destination is a directory, append the input filename; won't work
# if double slashes aren't ignored.
if test -d "$dst"; then
if test -n "$no_target_directory"; then
echo "$0: $dstarg: Is a directory" >&2
exit 1
fi
dst=$dst/`basename "$src"`
fi
fi
# This sed command emulates the dirname command.
dstdir=`echo "$dst" | sed -e 's,/*$,,;s,[^/]*$,,;s,/*$,,;s,^$,.,'`
# Make sure that the destination directory exists.
# Skip lots of stat calls in the usual case.
if test ! -d "$dstdir"; then
defaultIFS='
'
IFS="${IFS-$defaultIFS}"
oIFS=$IFS
# Some sh's can't handle IFS=/ for some reason.
IFS='%'
set x `echo "$dstdir" | sed -e 's@/@%@g' -e 's@^%@/@'`
shift
IFS=$oIFS
pathcomp=
while test $# -ne 0 ; do
pathcomp=$pathcomp$1
shift
if test ! -d "$pathcomp"; then
$mkdirprog "$pathcomp"
# mkdir can fail with a `File exist' error in case several
# install-sh are creating the directory concurrently. This
# is OK.
test -d "$pathcomp" || exit
fi
pathcomp=$pathcomp/
done
fi
if test -n "$dir_arg"; then
$doit $mkdircmd "$dst" \
&& { test -z "$chowncmd" || $doit $chowncmd "$dst"; } \
&& { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } \
&& { test -z "$stripcmd" || $doit $stripcmd "$dst"; } \
&& { test -z "$chmodcmd" || $doit $chmodcmd "$dst"; }
else
dstfile=`basename "$dst"`
# Make a couple of temp file names in the proper directory.
dsttmp=$dstdir/_inst.$$_
rmtmp=$dstdir/_rm.$$_
# Trap to clean up those temp files at exit.
trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
trap '(exit $?); exit' 1 2 13 15
# Copy the file name to the temp name.
$doit $cpprog "$src" "$dsttmp" &&
# and set any options; do chmod last to preserve setuid bits.
#
# If any of these fail, we abort the whole thing. If we want to
# ignore errors from any of these, just make sure not to ignore
# errors from the above "$doit $cpprog $src $dsttmp" command.
#
{ test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } \
&& { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } \
&& { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } \
&& { test -z "$chmodcmd" || $doit $chmodcmd "$dsttmp"; } &&
# Now rename the file to the real destination.
{ $doit $mvcmd -f "$dsttmp" "$dstdir/$dstfile" 2>/dev/null \
|| {
# The rename failed, perhaps because mv can't rename something else
# to itself, or perhaps because mv is so ancient that it does not
# support -f.
# Now remove or move aside any old file at destination location.
# We try this two ways since rm can't unlink itself on some
# systems and the destination file might be busy for other
# reasons. In this case, the final cleanup might fail but the new
# file should still install successfully.
{
if test -f "$dstdir/$dstfile"; then
$doit $rmcmd -f "$dstdir/$dstfile" 2>/dev/null \
|| $doit $mvcmd -f "$dstdir/$dstfile" "$rmtmp" 2>/dev/null \
|| {
echo "$0: cannot unlink or rename $dstdir/$dstfile" >&2
(exit 1); exit 1
}
else
:
fi
} &&
# Now rename the file to the real destination.
$doit $mvcmd "$dsttmp" "$dstdir/$dstfile"
}
}
fi || { (exit 1); exit 1; }
done
# The final little trick to "correctly" pass the exit status to the exit trap.
{
(exit 0); exit 0
}
# Local variables:
# eval: (add-hook 'write-file-hooks 'time-stamp)
# time-stamp-start: "scriptversion="
# time-stamp-format: "%:y-%02m-%02d.%02H"
# time-stamp-end: "$"
# End:
globus_simple_ca-3.5/globus_automake_post 0000644 0000764 0000764 00000000000 12225575522 015767 0000000 0000000 globus_simple_ca-3.5/grid-ca-sign.in 0000777 0000764 0000764 00000031710 12044232524 014424 0000000 0000000 #! /bin/sh
#
# Copyright 1999-2006 University of Chicago
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# catch the kill signal (ctrl-c) and do cleanup
trap do_trap 1 2 3 6 9 13 15
############################################################
# main code section
############################################################
@GLOBUS_SCRIPT_INITIALIZER@
. ${libexecdir}/globus-script-initializer
globus_source ${libexecdir}/globus-sh-tools.sh
PROGRAM_NAME="${0##*/}"
PROGRAM_VERSION="$(expr '$Revision: 1.6.10.1 $' : ".Revision: \([0-9\.]*\) .")"
PACKAGE="@PACKAGE@"
VERSION="@VERSION@"
DIRT_TIMESTAMP="@DIRT_TIMESTAMP@"
DIRT_BRANCH_ID="@DIRT_BRANCH_ID@"
short_usage="$PROGRAM_NAME [-help] -in REQUEST -out CERTIFICATE [options ...]"
openssl_options=""
printhelp() {
option="${1}"
helpstr="${2}"
optwidth="${optwidth:-$((${COLUMNS:-80} / 3))}"
if [ "$optwidth" -gt 30 ]; then
optwidth=30
fi
helpwidth="${helpwidth:-$((${COLUMNS:-80} - $optwidth - 6))}"
helpstrformatted="$(echo "${helpstr}" | tr -sd '\n\t' ' ' | \
fold -sw ${helpwidth})"
OLDIFS="$IFS"
IFS="
"
first=1
for x in $helpstrformatted; do
printf " %-${optwidth}s %-${helpwidth}s\n" "${first:+$option}" "$x"
first=""
done
if [ "$first" = "1" ]; then
printf " %-${optwidth}s\n" "${first:+$option}"
fi
IFS="$OLDIFS"
}
long_usage () {
cat < $tmp_output 2>&1
openssl_result=$?
end_password_input
# check to see if an error occurred while signing
if test ${openssl_result} != 0; then
# check that a certificate with the same subject has not
# already been signed
already_signed=`${GLOBUS_SH_GREP-grep} \
"ERROR:There is already a certificate" \
${tmp_output}`
already_signed2=`${GLOBUS_SH_GREP-grep} \
"unique_subject = \"yes\"" \
${tmp_output}`
already_signed3=`${GLOBUS_SH_GREP-grep} \
"TXT_DB error number 2" \
${tmp_output}`
if test -n "${already_signed}" || test -n "${already_signed2}" \
|| test -n "${already_signed3}"; then
subj_tmp_output=/tmp/tmp_output.$$
${openssl_cmd} req -noout -in ${INPUT_REQ_FILE} \
-subject > ${subj_tmp_output} 2>&1
res=$?
if test $res != 0; then
echo ""
echo "ERROR: Failed to get subject of request ${INPUT_REQ_FILE}"
echo ""
do_cleanup
exit 1
fi
req_subj=`cat ${subj_tmp_output} | ${GLOBUS_SH_GREP-grep} "subject=" \
| ${GLOBUS_SH_SED-sed} -e "s/subject=[ ]*//"`
# find signed cert
for p in ${GRID_CA_DIR}/newcerts/*.pem; do
subj_tmp_output=/tmp/tmp_output.$$
${openssl_cmd} x509 -noout -subject -in ${p} \
> ${subj_tmp_output} 2>&1
res=$?
if test $res != 0; then
echo ""
echo "ERROR: Failed to get subject of signed cert at: ${p}"
echo ""
fi
signed_subj=`cat ${subj_tmp_output} | ${GLOBUS_SH_SED-sed} -e "s/subject=[ ]*//"`
if test "${signed_subj}" = "${req_subj}"; then
SIGNED_CERT=${p}
fi
done
if test -z "${SIGNED_CERT}"; then
echo ""
echo "ERROR: Failed to find signed cert in CA cert store with subject:"
echo " ${req_subj}"
echo ""
do_cleanup
exit 1
fi
if test ! -f "${SIGNED_CERT}"; then
echo ""
echo "ERROR: Could not find cert file to revoke in certificate store:"
echo " ${SIGNED_CERT}"
echo ""
do_cleanup
exit 1
fi
SIGNED_SUBJECT="${req_subj}"
expired=`${openssl_cmd} x509 -in ${SIGNED_CERT} -checkend 0 > /dev/null; echo $?`
if test -n "${force_sign}" || test "${expired}" = "0"; then
echo ""
echo "Revoking previous certificate"
tmp_revoke_output=/tmp/tmp_revoke_out.$$
do_password_input "To revoke the current certificate"
${openssl_cmd} ca $openssl_options -batch -config ${grid_ca_conf} \
-revoke ${SIGNED_CERT} \
2> ${tmp_revoke_output}
res=$?
end_password_input
if test $res != 0; then
echo ""
echo "ERROR: Failed to revoke previous certificate with subject:"
echo " ${SIGNED_SUBJECT}"
echo ""
echo "========== ERROR MESSAGES FROM OPENSSL =========="
cat ${tmp_revoke_output} 1>&2
echo "================================================="
echo ""
${GLOBUS_SH_RM-rm} -f ${tmp_revoke_output}
do_cleanup
exit 1
else
${GLOBUS_SH_RM-rm} -f ${tmp_revoke_output}
echo ""
echo "Signing new certificate"
do_sign;
return;
fi
else
echo ""
echo "There is already a valid certificate that matches this subject at:"
echo
echo "${SIGNED_CERT}"
echo
echo "You can use the -force option to overwrite"
echo "this certificate and create a new one."
echo ""
${GLOBUS_SH_RM-rm} -f ${subj_tmp_output}
do_cleanup
exit 1
fi
fi
echo ""
echo "ERROR running command:"
echo ""
echo " ${openssl_cmd} ca $openssl_options \\"
echo " -batch -config ${grid_ca_conf} \\"
echo " -in ${INPUT_REQ_FILE} -out ${SIGNED_OUTPUT_FILE}"
echo ""
echo "========== ERROR MESSAGES FROM OPENSSL =========="
cat ${tmp_output} 1>&2
echo "================================================="
# check if the error was with
no_config_file=`${GLOBUS_SH_GREP-grep} "error loading the config file" ${tmp_output}`
if test -n "${no_config_file}"; then
echo ""
echo "ERROR: No CA config file found."
echo "Either simple CA setup package is not installed,"
echo "or the config file is not located at:"
echo ""
echo " ${grid_ca_conf}"
echo ""
fi
# check if the CA's private key could be loaded
wrong_password=`${GLOBUS_SH_GREP-grep} "unable to load CA private key" ${tmp_output}`
if test -n "${wrong_password}"; then
echo ""
echo "ERROR: The CA private key could not be loaded."
echo "Possibly an incorrect password for the CA key was used."
echo ""
fi
# check that the cert request matches the CA cert
wrong_org=`${GLOBUS_SH_GREP-grep} "field needed to be the same" ${tmp_output}`
if test -n "${wrong_org}"; then
echo ""
echo "ERROR: The cert request does not match CA cert"
echo "Check that the correct security config files are"
echo "set during grid-cert-request"
echo ""
echo "The default configuration can be set using either"
echo "the command: grid-default-ca, or via the -ca option"
echo "to grid-cert-request."
echo ""
fi
${GLOBUS_SH_RM-rm} -f ${tmp_output}
echo ""
do_cleanup
exit 1
fi
}
readCommandLine "$@"
if test -z "$GRID_CA_DIR"; then
if test -w "${localstatedir}/lib/globus/simple_ca/."; then
GRID_CA_DIR="${localstatedir}/lib/globus/simple_ca"
elif test -d "${HOME}/.globus/simpleCA/."; then
GRID_CA_DIR="${HOME}/.globus/simpleCA"
else
exec 1>&2
echo ""
echo "ERROR: No usable Simple CA directory found at \${HOME}/.globus/simpleCA or "
echo "\${localstatedir}/lib/globus/simple_ca"
echo ""
echo "Either specify a directory with -dir, or run"
echo "grid-ca-create to create a CA"
echo ""
exit 1
fi
fi
if test ! -f ${GRID_CA_DIR}/cacert.pem; then
exec 1>&2
echo ""
echo "ERROR: No CA certificate found at ${GRID_CA_DIR}/cacert.pem"
echo "The CA certificate is missing!"
echo "Please run setup-simple-ca before"
echo "signing certificates."
echo ""
exit 1
fi
grid_ca_conf=${GRID_CA_DIR}/grid-ca-ssl.conf
openssl_cmd=openssl
echo "${openssl_options}" | grep -- -passin > /dev/null
res1=$?
if test ! $res1 = 0; then
echo ${openssl_options} | grep -- -key > /dev/null
res1=$?
fi
if test ! $res1 = 0; then
if test -f ${GRID_CA_DIR}/passwd; then
openssl_options="${openssl_options} -passin file:${GRID_CA_DIR}/passwd"
res1=0
fi
fi
if test ! $res1 = 0; then
need_password_input=1
openssl_options="${openssl_options} -passin stdin"
fi
do_sign;
if test ! -f ${SIGNED_OUTPUT_FILE}; then
exec 1>&2
echo "ERROR: ${SIGNED_OUTPUT_FILE} does not exist. Invalid internal state, exiting..."
echo ""
exit 1
fi
NEW_SERIAL="$(${openssl_cmd} x509 -in ${SIGNED_OUTPUT_FILE} -noout -serial)"
res=$?
if test $res != 0; then
exec 1>&2
echo ""
echo "ERROR: Failed to get serial number of newly signed cert at: ${SIGNED_OUTPUT_FILE}"
echo ""
fi
NEW_SERIAL="${NEW_SERIAL##serial=}"
echo ""
echo "The new signed certificate is at: ${GRID_CA_DIR}/newcerts/${NEW_SERIAL}.pem"
echo ""
do_cleanup
exit
globus_simple_ca-3.5/grid-ca-create.in 0000777 0000764 0000764 00000054565 12147712220 014744 0000000 0000000 #! /bin/sh
# This script creates a new CA certificate and the configuration files so that
# the grid-cert-request and grid-ca-sign tools can be used with the CA.
# Unlike GT 2-5, this version of the simple CA tool does not create a setup package
set -e
# catch the kill signal (ctrl-c) and do cleanup
trap do_trap 1 2 3 6 9 13 15
##
# create_ca_directory:
# Creates the directory tree needed for a grid CA. The tree contains:
# $GRID_CA_DIR
# +- serial
# +- index.txt
# +- certs/
# +- crl/
# +- newcerts/
# +- private/
#
# On error, this function exits the shell.
#
# @param DIRECTORY
# Path to the new CA directory
#
create_ca_directory()
{
_ca_directory="$1"
_ca_dir_perms="0700"
if [ -d "${_ca_directory}/." ]; then
if test -z "${force}"; then
echo ""
echo "It looks like a CA has already been setup at this location."
printf "Do you want to overwrite this CA? (y/n) [n]: "
read tmp_answer
if ! expr "${tmp_answer:-n}" : '[Yy]' > /dev/null; then
exit 1
fi
fi
rm -rf "${_ca_directory}"
fi
mkdir -m ${_ca_dir_perms} -p "${_ca_directory}"
if [ $? -ne 0 -o ! -d "${_ca_directory}/." ]; then
echo "ERROR: Couldn't create directory: ${_ca_directory}"
echo " make sure you have valid permissions set."
exit 1;
fi
# from the CA.sh script - setup the CA directory
for directory in certs crl newcerts private ; do
mkdir -m ${_ca_dir_perms} "${_ca_directory}/${directory}"
if test $? -ne 0; then
exec 1>&2
echo ""
echo "ERROR: Failed to make directory: ${1}"
echo "Check permissions of base dir"
echo ""
exit 1
fi
done
echo "01" > ${_ca_directory}/serial
if test $? -ne 0; then
exec 1>&2
echo ""
echo "ERROR: Could not write to ${_ca_directory}/serial"
echo "Check permissions on the dir"
echo ""
exit 1
fi
touch ${_ca_directory}/index.txt
if test $? -ne 0; then
exec 1>&2
echo ""
echo "ERROR: Could not write to ${_ca_directory}/index.txt"
echo "Check the permissions on the dir"
echo ""
exit 1
fi
}
##
# generate_unique_name: finds a unique name for the CA
# based on the hostname
generate_unique_name()
{
tmp_hostname="$globus_hostname"
if test -z "${tmp_hostname}"; then
if [ -n "${noint}" ]; then
exec 1>&2
fi
echo ""
echo "Cannot determine this machine's hostname for the CA name."
echo ""
if [ -n "${noint}" ]; then
exit 1
fi
fi
echo "simpleCA-${tmp_hostname}"
return 0
}
#
# get_ca_subject: gets the CA subject name from the user if not in command-line options
#
get_ca_subject()
{
varname="${1}"
_casubject="${request_subject:-cn=Globus Simple CA, ou=$(generate_unique_name), ou=GlobusTest, o=Grid}"
_got_subject="no"
while [ "${_got_subject}" = "no" ] ; do
echo ""
echo "The unique subject name for this CA is:"
echo ""
echo "${_casubject}"
echo ""
if [ -n "${noint}" -o -n "${request_subject}" ]; then
_got_subject="yes"
else
printf "Do you want to keep this as the CA subject (y/n) [y]: "
while [ "${_got_subject}" = "no" ]; do
read _answer
case "${_answer:-y}" in
[Nn]*)
echo ""
while [ "$_got_subject" = "no" ]; do
printf "Enter a unique subject name for this CA: "
read _casubject
echo ""
if expr "${_casubject}" : "[Cc][Nn]=.*,.*=.*" > /dev/null; then
_got_subject="yes"
else
echo "Invalid CA subject name. Please include a common name and at least one"
echo "other name component (e.g. CN=Globus, O=Test)"
fi
done
;;
[Yy]*)
_got_subject="yes"
;;
*)
echo ""
echo "Please answer 'y' or 'n'"
echo ""
;;
esac
done
fi
done
eval "$varname=\"${_casubject}\""
}
get_ca_email()
{
_varname="${1}"
_caemail=""
_defaultemail="${request_email:-${globus_username}@$globus_hostname}"
if [ -n "${request_email}" -o -n "${noint}" ]; then
_caemail="${_defaultemail}"
fi
while [ -z "${_caemail}" ]; do
echo ""
echo "Enter the email of the CA (this is the email where certificate"
printf "requests will be sent to be signed by the CA) [${_defaultemail}]: "
read _caemail
_caemail="${_caemail:-${_defaultemail}}"
done
eval "${_varname}=\"${_caemail}\""
}
get_ca_lifetime()
{
_varname="${1}"
if [ -z "${noint}" -a -z "${request_days}" ]; then
cat <<-EOF
The CA certificate has an expiration date. Keep in mind that
once the CA certificate has expired, all the certificates
signed by that CA become invalid. A CA should regenerate
the CA certificate and start re-issuing ca-setup packages
before the actual CA certificate expires. This can be done
by re-running this setup script. Enter the number of DAYS
the CA certificate should last before it expires.
EOF
printf "[default: 5 years $((365 * 5)) days]: "
read _ca_cert_days
_ca_cert_days="${_ca_cert_days:-$((365 * 5))}"
echo
else
_ca_cert_days="${request_days:-$((365 * 5))}"
fi
eval "${_varname}=\"${_ca_cert_days}\""
}
##
# save_ca_settings: save the settings determined from this
# script to grid-security.conf for this CA
#
save_ca_settings()
{
_dest="$1"
_subj="$2"
_addr="$3"
# Save stdin and stdout
exec 3<&0
exec 4>&1
# Translate template to configuration file
exec 0< "${datadir}/globus_simple_ca/grid-security.conf.tmpl"
exec 1> "${_dest}/grid-security.conf"
# Template variables
domain="$(globus-domainname)"
GSI_CA_BASE_DN="$(expr "${_subj}" : "[Cc][Nn]=[^,]*, *\(.*\)")"
GSI_CA_NAME="$(expr "${_subj}" : "[Cc][Nn]= *\([^,]*\)")"
GSI_CA_EMAIL="${_addr}"
# Replace template variables in the configuration file
while read line; do
case "$line" in
"#"*)
echo "$line"
;;
*)
eval echo "$line"
;;
esac
done
# Restore stdin and stdout
exec 0<&3
exec 1>&4
exec 3<&-
exec 4>&-
}
############################################################
# create_input_file: generate the input file to be passed as
# stdin to the openssl req utility.
############################################################
create_input_file ()
{
_common_name="$1"
_config_file="$2"
# Parse the ssleay configuration file, to determine the
# correct default
exec 3<&0
exec 0< "${_config_file}" || {
rc=$?;
echo 1>&2 "Error opening ${_config_file}";
exit $rc
}
_skip=1
while read _line; do
if [ "$_line" = "# BEGIN CONFIG" ]; then
_skip=0
continue
elif [ "$_line" = "# END CONFIG" ]; then
break
fi
if [ "$_skip" -eq 0 ]; then
_attr="$(expr "$_line" : "\(.*[^ ]\) *=")"
_value="$(expr "$_line" : "[^=]*= *\(.*\)")"
if expr "${_attr}" : ".*_default\$" > /dev/null; then
echo "${_value}"
fi
fi
done
echo "$_common_name"
exec 0<&3
exec 3<&-
}
rfc2253_to_ssl_config()
{
_type="${1}"
_name="${2}"
OLDIFS="$IFS"
IFS=","
oucount=0
ocount=0
_reversei=""
for i in ${_name}; do
_reversei="${i}${_reversei:+,${_reversei}}"
done
for i in ${_reversei}; do
i="${i# }"
_component="${i%%=*}"
_value="${i#*=}"
case "$_component" in
[Cc])
printf "%-40s= %s\n" countryName "Country Name (2 letter code)"
printf "%-40s= %s\n" countryName_default "${_value}"
printf "%-40s= %s\n" countryName_min "2"
printf "%-40s= %s\n" countryName_max "2"
;;
[Oo])
printf "%-40s= %s\n" "$ocount.organizationName" "Level $ocount Organization"
printf "%-40s= %s\n" "$ocount.organizationName_default" "${_value}"
ocount=$(($ocount+1))
;;
[Oo][Uu])
printf "%-40s= %s\n" "$oucount.organizationalUnitName" "Level $oucount Organizational Unit"
printf "%-40s= %s\n" "$oucount.organizationalUnitName_default" "${_value}"
oucount=$(($oucount+1))
;;
[Cc][Nn])
if [ "$_type" = "-user" ]; then
printf "%-40s= %s\n" "$oucount.organizationalUnitName" "Level $oucount Organizational Unit"
printf "%-40s= %s\n" "$oucount.organizationalUnitName_default" "local"
fi
printf "%-40s= %s\n" "commonName" "Name (E.g., John M. Smith)"
printf "%-40s= %s\n" "commonName_max" "64"
;;
*)
echo 1>&2 "Unknown subject name component"
exit 1
;;
esac
done
IFS="$OLDIFS"
}
rfc2253_to_oneline()
{
_name="${1}"
OLDIFS="$IFS"
IFS=","
_oneline=""
for i in ${_name}; do
i="${i# }"
_component="${i%%=*}"
_value="${i#*=}"
case "$_component" in
[Cc])
_oneline="/C=${_value}${_oneline}"
;;
[Oo])
_oneline="/O=${_value}${_oneline}"
;;
[Oo][Uu])
_oneline="/OU=${_value}${_oneline}"
;;
[Cc][Nn])
_oneline="/CN=${_value}${_oneline}"
;;
*)
echo 1>&2 "Unknown subject name component"
exit 1
;;
esac
done
IFS="$OLDIFS"
echo "$_oneline"
}
generate_signing_policy()
{
_cadir="${1}"
_caname="${2}"
_template="${datadir}/globus_simple_ca/ca-signing-policy.tmpl"
GRID_CA_SUBJECT="$(rfc2253_to_oneline "${_caname}")"
rc=$?
if [ $rc -ne 0 ]; then
exit $rc
fi
GRID_CA_COND_SUBJECT="\"${GRID_CA_SUBJECT%%/CN=*}/*\""
exec 3<&0
exec 4>&1
exec 0< "${_template}"
exec 1> "${_cadir}/signing-policy"
while read line; do
if expr "${line}" : ".*#" > /dev/null; then
comment="#${line#*#}"
else
comment=""
fi
precomment="${line%%${comment}}"
eval lineval="\"${precomment}\""
echo "${lineval}${comment}"
done
exec 0<&3
exec 1>&4
exec 3<&-
exec 4>&-
}
setup_grid_security_dir()
{
_cadir="${1}"
_destdir="${2}"
_cahash="$(openssl x509 -in "${_cadir}/cacert.pem" -noout -hash)"
printf "Installing new CA files to ${_destdir}... "
if [ ! -d "${_destdir}" ]; then
mkdir -m 0755 -p "${_destdir}"
fi
cp "${_cadir}/cacert.pem" "${_destdir}/${_cahash}.0"
cp "${_cadir}/signing-policy" "${_destdir}/${_cahash}.signing_policy"
cp "${_cadir}/grid-security.conf" "${_destdir}/grid-security.conf.${_cahash}"
cp "${_cadir}/globus-user-ssl.conf" "${_destdir}/globus-user-ssl.conf.${_cahash}"
cp "${_cadir}/globus-host-ssl.conf" "${_destdir}/globus-host-ssl.conf.${_cahash}"
echo "done"
}
create_ssl_config()
{
(
_type="${1}"
_template="${2}"
_caname="${3}"
_cadir="${4}"
. "${_cadir}/grid-security.conf"
_ssl_conf_template=${datadir}/globus_simple_ca/grid-ca-ssl.conf.tmpl
exec 3<&0
exec 0< "${_ssl_conf_template}"
_skip=0
GRID_CA_DIR="${_cadir}"
while read line; do
if expr "${line}" : ".*#" > /dev/null; then
comment="#${line#*#}"
else
comment=""
fi
precomment="${line%%${comment}}"
if [ "$comment" = "# BEGIN CONFIG" ]; then
_skip=1
echo "${comment}"
rfc2253_to_ssl_config "${_type}" "${_caname}"
elif [ "$comment" = "# END CONFIG" ]; then
_skip=0
fi
if [ $_skip -eq 1 ]; then
continue
fi
case "$precomment" in
\[* )
echo "${precomment}${comment}"
;;
*)
eval printf "%s" "\"${precomment}\""
echo "${comment}"
;;
esac
done
exec 0<&3
exec 3<&-
)
}
############################################################
# generate_ca_certificate: the meat & potatoes - calls the
# openssl req utility that creates
# the CA certificate
############################################################
generate_ca_certificate()
{
_cadir="${1}"
_caname="${2}"
_privatedir="${_cadir}/private"
_ca_ssl_conf="${_cadir}/grid-ca-ssl.conf"
_user_ssl_conf="${_cadir}/globus-user-ssl.conf"
_host_ssl_conf="${_cadir}/globus-host-ssl.conf"
_ssl_conf_template="${datadir}/globus_simple_ca/grid-ca-ssl.conf.tmpl"
create_ssl_config -ca "${_ssl_conf_template}" "${_caname}" "${_cadir}" > "${_ca_ssl_conf}"
create_ssl_config -user "${_ssl_conf_template}" "${_caname}" "${_cadir}" > "${_user_ssl_conf}"
create_ssl_config -host "${_ssl_conf_template}" "${_caname}" "${_cadir}" > "${_host_ssl_conf}"
CA_REQ_INPUT=${_privatedir}/tmp_openssl_input.conf
create_input_file "${GSI_CA_NAME}" "${_ca_ssl_conf}" > ${CA_REQ_INPUT}
if test -n "${request_password}"; then
password_option="-passout pass:${request_password} "
elif test -n "${noint}"; then
password_option="-passout pass:globus "
else
password_option=""
fi
# create CA certificate
if [ -n "${verbose}" ]; then
openssl req ${openssl_options} ${password_option} -config "${_ca_ssl_conf}" \
-x509 -days ${CA_CERT_DAYS} \
-newkey rsa:1024 -keyout ${CA_KEY_FILE} \
-out ${CA_CERT_FILE} < ${CA_REQ_INPUT}
RET=$?
else
openssl req ${openssl_options} ${password_option} -config "${_ca_ssl_conf}" \
-x509 -days ${CA_CERT_DAYS} \
-newkey rsa:1024 -keyout ${CA_KEY_FILE} \
-out ${CA_CERT_FILE} < ${CA_REQ_INPUT} > openssl_req.log 2>&1
RET=$?
fi
if [ "${RET}" -eq 0 -a -n "${verbose}" ]; then
tput clear
elif [ "${RET}" -ne 0 ]; then
echo "Error number ${RET} was returned by openssl" 1>&2
exit ${RET}
fi
}
############################################################
# do_trap: catches any abortive signals and does cleanup
############################################################
do_trap() {
echo ""
echo ""
echo "Normal program execution interrupted. You will"
echo "need to rerun the script:"
echo ""
echo "\${GLOBUS_LOCATION}/setup/globus/setup-simple-ca"
echo ""
echo "to setup the simple CA."
echo ""
exit 1
}
############################################################
# main code section
############################################################
@GLOBUS_SCRIPT_INITIALIZER@
. "${libexecdir}/globus-script-initializer"
globus_source "${libexecdir}/globus-sh-tools-vars.sh"
PROGRAM_NAME="${0##*/}"
PROGRAM_VERSION="$(expr '$Revision: 1.4.10.2 $' : ".Revision: \([0-9\.]*\) .")"
PACKAGE="@PACKAGE@"
VERSION="@VERSION@"
DIRT_TIMESTAMP="@DIRT_TIMESTAMP@"
DIRT_BRANCH_ID="@DIRT_BRANCH_ID@"
short_usage="$PROGRAM_NAME [-help] [ options ...] [ openssl options ...]"
printhelp() {
option="${1}"
helpstr="${2}"
optwidth="${optwidth:-$((${COLUMNS:-80} / 3))}"
if [ "$optwidth" -gt 30 ]; then
optwidth=30
fi
helpwidth="${helpwidth:-$((${COLUMNS:-80} - $optwidth - 6))}"
helpstrformatted="$(echo "${helpstr}" | tr -sd '\n\t' ' ' | \
fold -sw ${helpwidth})"
OLDIFS="$IFS"
IFS="
"
first=1
for x in $helpstrformatted; do
printf " %-${optwidth}s %-${helpwidth}s\n" "${first:+$option}" "$x"
first=""
done
IFS="$OLDIFS"
}
globus_hostname="$(globus-hostname)"
globus_username="$(id -un)"
long_usage () {
cat < /dev/null; then
exec 1>&2
echo "Invalid CA subject name. Please include a common name and at least one"
echo "other name component (e.g. CN=Globus, O=Test)"
exit 1
fi
;;
-email)
request_email="${2}"
shift ; shift
;;
-days)
request_days="${2}"
shift ; shift
;;
-pass)
request_password="${2}"
shift ; shift
;;
-nobuild)
nobuild="yes"
shift
;;
-noint)
noint="yes"
force="yes"
shift
;;
-verbose)
verbose="yes"
shift
;;
-openssl-help)
shift;
openssl req -help;
exit;
;;
*)
openssl_options="$openssl_options $1"
shift;
;;
esac
done
}
# MAIN
readCommandLine "$@"
# setup variables used by the script
if test -z "${GRID_CA_DIR}"; then
if [ -d "${localstatedir}/lib/." -a -w "${localstatedir}/lib/." ]; then
GRID_CA_DIR="$localstatedir/lib/globus/simple_ca"
default_loc="yes"
else
GRID_CA_DIR="${HOME}/.globus/simpleCA"
default_loc="yes"
fi
fi
CA_KEY_FILE="${GRID_CA_DIR}/private/cakey.pem"
CA_CERT_FILE="${GRID_CA_DIR}/cacert.pem"
${GLOBUS_SH_CAT-cat} <