move signpubkey to own repo ssh-ca
This commit is contained in:
parent
54863127a7
commit
9e2cb99b4f
1 changed files with 0 additions and 101 deletions
101
bin/signpubkey
101
bin/signpubkey
|
@ -1,101 +0,0 @@
|
||||||
#!/bin/bash
|
|
||||||
|
|
||||||
|
|
||||||
usage() {
|
|
||||||
cat << EOF
|
|
||||||
|
|
||||||
Usage: $(dirname $0) [-t|--hsm] [-U|-H] [-n|--principals] <principal>[,<principal>[,<principal>[,...]]] [-V|--valid-time] <TIME> [-s|--serialnumber] <INT> [-S|-serialnumber-file] <filename> [-I|--identity] <identity> [--dry-run] <publickey>
|
|
||||||
|
|
||||||
|
|
||||||
EOF
|
|
||||||
|
|
||||||
}
|
|
||||||
default_serialnumberfile="${HOME}/ssh-ca/serialnumbers/serialnumber"
|
|
||||||
host_or_user=user
|
|
||||||
|
|
||||||
set -- $(getopt -u -o hHn:V:s:S:I:tU --long help,host,user,principals:,valid-time:,serialnumber:,serialnumber-file:,identity:,hms,dry-run -- "$@"|| exit $?)
|
|
||||||
|
|
||||||
while : ;do
|
|
||||||
case $1 in
|
|
||||||
-h|--help)
|
|
||||||
usage
|
|
||||||
exit 0
|
|
||||||
break
|
|
||||||
;;
|
|
||||||
-H|host)
|
|
||||||
host_or_user=host
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-U|user)
|
|
||||||
host_or_user=user
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-n|--principals)
|
|
||||||
shift
|
|
||||||
principals=$1
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-V|--valid-time)
|
|
||||||
shift
|
|
||||||
validtime="${1}"
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-S|--serialnumber)
|
|
||||||
shift
|
|
||||||
serialnumber=$1
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-s|--serialnumber-file)
|
|
||||||
shift
|
|
||||||
serialnumberfile="$1"
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-I|--identity)
|
|
||||||
shift
|
|
||||||
identity=${1}
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
-t|--hms)
|
|
||||||
# t wie token
|
|
||||||
shift
|
|
||||||
hms=true
|
|
||||||
;;
|
|
||||||
--dry-run)
|
|
||||||
DRY=true
|
|
||||||
shift
|
|
||||||
;;
|
|
||||||
--)
|
|
||||||
shift
|
|
||||||
break
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo wrong argument $1 >&2
|
|
||||||
usage
|
|
||||||
exit 1
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
[ -z "${validtime+x}" ] && validtime="+8W"
|
|
||||||
[ -z "${identity+x}" ] && identity=${USER}@$(hostname -f)
|
|
||||||
[ -z "${serialnumberfile+x}" ] && serialnumberfile=${default_serialnumberfile}
|
|
||||||
[ -z "${serialnumber+x}" ] && serialnumber=$(sed -i -r 's/^([0-9]+)$/echo "$((\1+1))"/ge' "${serialnumberfile}"; cat "${serialnumberfile}" )
|
|
||||||
[ -z "${principals+x}" ] && { echo "no principals given"; [ $DRY ] || usage; [ $DRY ] || exit 1; }
|
|
||||||
|
|
||||||
CABASE=~/ssh-ca
|
|
||||||
host_or_user=user
|
|
||||||
case $host_or_user in
|
|
||||||
host)
|
|
||||||
CAPATH=$CABASE/${host_or_user^^}_CA/${host_or_user}
|
|
||||||
;;
|
|
||||||
user)
|
|
||||||
CAPATH=$CABASE/${host_or_user^^}_CA/${host_or_user}_ca.pub
|
|
||||||
esac
|
|
||||||
|
|
||||||
if ${hms:-false};then
|
|
||||||
echo ssh-keygen -s $CABASE/${host_or_user^^}_CA/${host_or_user}_ca.pub -D $P11M -n "${principals}" -V "${validtime}" -z $serialnumber -I "${identity}" "$1"
|
|
||||||
[ $DRY ] || ssh-keygen -s $CABASE/${host_or_user^^}_CA/${host_or_user}_ca.pub -D $P11M -n "${principals}" -V "${validtime}" -z $serialnumber -I "${identity}" "$1"
|
|
||||||
else
|
|
||||||
echo ssh-keygen -s $CABASE/${host_or_user^^}_CA/${host_or_user}_ca -n "${principals}" -V "${validtime}" -z $serialnumber -I "${identity}" "$1"
|
|
||||||
[ $DRY ] || ssh-keygen -s $CABASE/${host_or_user^^}_CA/${host_or_user}_ca -n "${principals}" -V "${validtime}" -z $serialnumber -I "${identity}" "$1"
|
|
||||||
fi
|
|
Loading…
Reference in a new issue