Mr.X

#!/usr/bin/bash

set -eu

# shellcheck disable=SC2034 # prefix= is set because the default /etc contains "${prefix}"
prefix="/usr"
COCKPIT_CONFIG="/etc/cockpit"
COCKPIT_WS_CERTS_D="${COCKPIT_CONFIG}/ws-certs.d"
COCKPIT_RUNTIME_DIR="/run/cockpit"

install_cert() {
    local destination="${COCKPIT_WS_CERTS_D}/$1"
    mv -Z "$1" "${destination}"

    # The certificate should be world-readable
    chmod a+r "${destination}"

    # Force flush to disk for embedded devices
    sync "${destination}"
}

install_key() {
    local destination="${COCKPIT_WS_CERTS_D}/$1"
    mv -Z "$1" "${destination}"

    # Force flush to disk for embedded devices
    sync "${destination}"
}

selfsign_sscg() {
    sscg --quiet \
        --lifetime "${DAYS}" \
        --cert-key-file "${KEYFILE}" \
        --cert-file "${CERTFILE}" \
        --ca-file "${CA_FILE}" \
        --hostname "${HOSTNAME}" \
        --organization "${MACHINE_ID:-unspecified}" \
        --subject-alt-name localhost \
        --subject-alt-name IP:127.0.0.1/255.255.255.255
}

selfsign_openssl() {
    openssl req -x509 \
        -days "${DAYS}" \
        -newkey rsa \
        -keyout "${KEYFILE}" \
        -keyform PEM \
        -nodes \
        -out "${CERTFILE}" \
        -outform PEM \
        -subj "${MACHINE_ID:+/O=${MACHINE_ID}}/CN=${HOSTNAME}" \
        -addext "subjectAltName=IP:127.0.0.1,DNS:localhost" \
        -addext "basicConstraints = critical,CA:TRUE" \
        -addext "keyUsage = critical,digitalSignature,cRLSign,keyCertSign,keyEncipherment,keyAgreement" \
        -addext "extendedKeyUsage = serverAuth"
}

cmd_selfsign() {
    # Common variables used by both methods
    local MACHINE_ID
    if [ -e /etc/machine-id ]; then
        MACHINE_ID="$(tr -d -c '[:xdigit:]' < /etc/machine-id)"
    fi
    local HOSTNAME="${HOSTNAME:-$(hostname)}"
    local CERTFILE="0-self-signed.cert"
    local KEYFILE="0-self-signed.key"
    local CA_FILE="0-self-signed-ca.pem"

    # do not stomp over a partial key -- the admin tried to do something wrong
    if [ -e "${COCKPIT_WS_CERTS_D}/${KEYFILE}" ] && [ ! -e "${COCKPIT_WS_CERTS_D}/${CERTFILE}" ]; then
        echo "Error: Found $KEYFILE but no $CERTFILE. Please remove the key file first." >&2
        exit 1
    fi

    mkdir -pZ "$COCKPIT_WS_CERTS_D"

    # We renew certificates up to 30 days before expiry, so give ourselves a
    # year, plus 30 days.  The maximum is variously mentioned to be 397 or 398.
    local DAYS=395

    # If sscg fails, try openssl
    selfsign_sscg || selfsign_openssl

    # Install the files and set permissions ($CA_FILE is only created by sscg)
    test ! -e "${CA_FILE}" || install_cert "${CA_FILE}"
    install_cert "${CERTFILE}"
    install_key "${KEYFILE}"
}

cmd_ipa_request() {
    local USER="$1"

    # IPA operations require auth; read password from stdin to avoid quoting issues
    # if kinit fails, we can't handle this setup, exit cleanly
    kinit "${USER}@${REALM}" || exit 0

    # ensure this gets run with a non-C locale; ipa fails otherwise
    if [ "$(sh -c 'eval `locale`; echo $LC_CTYPE')" = 'C' ]; then
        export LC_CTYPE=C.UTF-8
    fi

    # create a kerberos Service Principal Name for cockpit-ws, unless already present
    ipa service-show "${SERVICE}" || \
        ipa service-add --ok-as-delegate=true --ok-to-auth-as-delegate=true --force "${SERVICE}"

    # add cockpit-ws key, unless already present
    klist -k "${KEYTAB}" | grep -qF "${SERVICE}" || \
        ipa-getkeytab -p "HTTP/${HOST}" -k "${KEYTAB}"

    # request the certificate and put it into our certificate directory, so that auto-refresh works
    mkdir -pZ "$COCKPIT_WS_CERTS_D"
    ipa-getcert request -f "${COCKPIT_WS_CERTS_D}/10-ipa.cert" -k "${COCKPIT_WS_CERTS_D}/10-ipa.key" -K "HTTP/${HOST}" -m 640 -o root:root -M 644 -w -v
}

cmd_ipa_cleanup() {
    # clean up keytab
    if [ -e "${KEYTAB}" ]; then
        ipa-rmkeytab -k "${KEYTAB}" -p "${SERVICE}"
    fi

    # clean up certificate; support both "copy" and "direct" modes from cmd_ipa_request()
    if [ -e "${COCKPIT_WS_CERTS_D}/10-ipa.key" ]; then
        rm "${COCKPIT_WS_CERTS_D}/10-ipa.cert" "${COCKPIT_WS_CERTS_D}/10-ipa.key"
        ipa-getcert stop-tracking -f "${COCKPIT_WS_CERTS_D}/10-ipa.cert" -k "${COCKPIT_WS_CERTS_D}/10-ipa.key" || \
            ipa-getcert stop-tracking -f /run/cockpit/certificate-helper/10-ipa.cert -k /run/cockpit/certificate-helper/10-ipa.key
    fi
}

cmd_ipa() {
    local REALM="$2"

    local HOST
    HOST="$(hostname -f)"
    local SERVICE="HTTP/${HOST}@${REALM}"
    local KEYTAB="${COCKPIT_CONFIG}/krb5.keytab"

    # use a temporary keytab to avoid interfering with the system one
    export KRB5CCNAME=/run/cockpit/keytab-setup

    # not an IPA setup? cannot handle this
    if [ -z "$(which ipa)" ]; then
        echo 'ipa must be installed for this command'
        exit 1
    fi

    case "$1" in
        request)
            cmd_ipa_request "$3"
            ;;
        cleanup)
            cmd_ipa_cleanup
            ;;
        *)
            echo 'unknown subcommand'
            exit 1
            ;;
    esac
}

main() {
    # ipa-getkeytab needs root to create the file, same for cert installation
    if [ "$(id -u)" != "0" ]; then
        echo 'must be run as root'
        exit 1
    fi

    # Create a private working directory
    mkdir -p "${COCKPIT_RUNTIME_DIR}"
    WORKDIR="${COCKPIT_RUNTIME_DIR}/certificate-helper"
    mkdir -m 700 "${WORKDIR}" # we expect that not to have existed
    trap 'exit' INT QUIT PIPE TERM
    trap 'rm -rf "${WORKDIR}"' EXIT
    cd "${WORKDIR}"

    # Dispatch subcommand
    case "$1" in
        selfsign)
            cmd_selfsign
            ;;
        ipa)
            shift
            cmd_ipa "$@"
            ;;
        *)
            echo 'unknown subcommand'
            exit 1
            ;;
    esac
}

main "$@"

Name	Type	Size	Permission
awk	Folder		0755
bluetooth	Folder		0755
cloud-init	Folder		0755
coreutils	Folder		0755
cpanel-pdns	Folder		0755
dovecot	Folder		0755
dpkg	Folder		0755
gawk	Folder		0755
gcc	Folder		0755
geoclue-2.0	Folder		0755
getconf	Folder		0755
git-core	Folder		0755
grub2	Folder		0755
grubby	Folder		0755
gstreamer-1.0	Folder		0755
hostname	Folder		0755
imunify-notifier	Folder		0755
initscripts	Folder		0755
installkernel	Folder		0755
iptables	Folder		0755
irqbalance	Folder		0755
linux-boot-probes	Folder		0755
lsm.d	Folder		0755
man-db	Folder		0755
microcode_ctl	Folder		0755
nfs-utils	Folder		0755
openldap	Folder		0755
openssh	Folder		0755
os-prober	Folder		0755
os-probes	Folder		0755
p11-kit	Folder		0755
psacct	Folder		0755
rsyslog	Folder		0755
selinux	Folder		0755
smartmontools	Folder		0755
sssd	Folder		0755
sudo	Folder		0755
totem-pl-parser	Folder		0755
tracker3	Folder		0755
tuned	Folder		0755
utempter	Folder		0755
arptables-helper	File	1.27 KB	0755
arptables-nft-helper	File	1.27 KB	0755
at-spi-bus-launcher	File	32.12 KB	0755
at-spi2-registryd	File	81.38 KB	0755
cockpit-askpass	File	239 B	0755
cockpit-certificate-ensure	File	23.28 KB	0755
cockpit-certificate-helper	File	5.72 KB	0755
cockpit-client	File	12.17 KB	0755
cockpit-client.ui	File	4.13 KB	0644
cockpit-desktop	File	5.12 KB	0755
cockpit-session	File	59.69 KB	0755
cockpit-tls	File	47.76 KB	0755
cockpit-ws	File	255.73 KB	0755
cockpit-wsinstance-factory	File	15.2 KB	0755
dconf-service	File	77.01 KB	0755
dirmngr_ldap	File	40.03 KB	0755
dnf-utils	File	3.6 KB	0755
exim.daemon	File	761 B	0755
fips-setup-helper	File	333 B	0755
flatpak-oci-authenticator	File	1.19 MB	0755
flatpak-portal	File	1.3 MB	0755
flatpak-session-helper	File	171.27 KB	0755
flatpak-system-helper	File	1.22 MB	0755
flatpak-validate-icon	File	15.45 KB	0755
fprintd	File	133.97 KB	0755
generate-rndc-key.sh	File	681 B	0755
geoclue	File	240.77 KB	0755
glib-pacrunner	File	24 KB	0755
gpg-check-pattern	File	59.91 KB	0755
gpg-pair-tool	File	64.48 KB	0755
gpg-preset-passphrase	File	35.74 KB	0755
gpg-protect-tool	File	84.68 KB	0755
gpg-wks-client	File	50 B	0755
grepconf.sh	File	257 B	0755
import-state	File	1.04 KB	0755
imunify-message-gateway	File	5.93 MB	0755
keyboxd	File	158.24 KB	0755
loadmodules	File	237 B	0755
low-memory-monitor	File	28.33 KB	0755
lvresize_fs_helper	File	9.57 KB	0755
mlocate-run-updatedb	File	142 B	0750
nfsrahead	File	27.3 KB	0755
nm-daemon-helper	File	15.3 KB	0755
nm-dhcp-helper	File	19.23 KB	0755
nm-dispatcher	File	76.6 KB	0755
nm-initrd-generator	File	771.93 KB	0755
nm-priv-helper	File	39.91 KB	0755
packagekit-direct	File	148.66 KB	0755
packagekitd	File	338.76 KB	0755
pk-offline-update	File	31.54 KB	0755
platform-python	File	15.09 KB	0755
platform-python3.9	File	15.09 KB	0755
realmd	File	289.33 KB	0755
report-command-error	File	8.06 MB	0755
revokefs-fuse	File	32.26 KB	0755
rtkit-daemon	File	68.02 KB	0755
run-with-intensity	File	6.1 MB	0755
scdaemon	File	427.34 KB	0755
tracker-extract-3	File	133.17 KB	0755
tracker-miner-fs-3	File	149.47 KB	0755
tracker-miner-fs-control-3	File	72.16 KB	0755
tracker-writeback-3	File	43.71 KB	0755
tracker-xdg-portal-3	File	39.69 KB	0755
upowerd	File	240.27 KB	0755
vi	File	1.38 MB	0755
virt-what-cpuid-helper	File	15.11 KB	0755
xdg-desktop-portal	File	725.42 KB	0755
xdg-desktop-portal-gtk	File	333.3 KB	0755
xdg-document-portal	File	202.93 KB	0755
xdg-permission-store	File	84.7 KB	0755

Upload:

Command:

Filemanager

Server Info

System Info