adding some shib tools

Author: Giles Westwood

bin/shib-keygen

@@ -0,0 +1,98 @@
+#! /bin/sh
+
+# Defaults added for Debian.  They can still be overridden by command-line
+# options.
+OUT=/etc/shibboleth
+USER=_shibd
+GROUP=_shibd
+
+while getopts n:h:u:g:o:e:y:bf c
+     do
+         case $c in
+           u)         USER=$OPTARG;;
+           g)         GROUP=$OPTARG;;
+           o)         OUT=$OPTARG;;
+           b)         BATCH=1;;
+           f)         FORCE=1;;
+           h)         FQDN=$OPTARG;;
+           e)         ENTITYID=$OPTARG;;
+           y)         YEARS=$OPTARG;;
+		   n)         PREFIX=$OPTARG;;
+		   \?)        echo "keygen [-o output directory (default .)] [-u username to own keypair] [-g owning groupname] [-h hostname for cert] [-y years to issue cert] [-e entityID to embed in cert] [-n filename prefix (default 'sp')]"
+                      exit 1;;
+         esac
+     done
+     
+if [ -z "$OUT" ] ; then
+    OUT=.
+fi
+
+if [ -z "$PREFIX" ]; then
+	PREFIX="sp"
+fi
+
+if [ -n "$FORCE" ] ; then
+    rm $OUT/${PREFIX}-key.pem $OUT/${PREFIX}-cert.pem
+fi
+
+if  [ -s $OUT/${PREFIX}-key.pem -o -s $OUT/${PREFIX}-cert.pem ] ; then
+    if [ -z "$BATCH" ] ; then  
+        echo The files $OUT/${PREFIX}-key.pem and/or $OUT/${PREFIX}-cert.pem already exist!
+        echo Use -f option to force recreation of keypair.
+        exit 2
+    fi
+    exit 0
+fi
+
+# --fqdn flag added for Debian to generate better names for certificates.
+if [ -z "$FQDN" ] ; then
+    FQDN=`hostname --fqdn || hostname -f`
+fi
+
+if [ -z "$YEARS" ] ; then
+    YEARS=10
+fi
+
+DAYS=`expr $YEARS \* 365`
+
+if [ -z "$ENTITYID" ] ; then
+    ALTNAME=DNS:$FQDN
+else
+    ALTNAME=DNS:$FQDN,URI:$ENTITYID
+fi
+
+SSLCNF=$OUT/${PREFIX}-cert.cnf
+cat >$SSLCNF <<EOF
+# OpenSSL configuration file for creating keypair
+[req]
+prompt=no
+default_bits=3072
+encrypt_key=no
+default_md=sha256
+distinguished_name=dn
+# PrintableStrings only
+string_mask=MASK:0002
+x509_extensions=ext
+[dn]
+CN=$FQDN
+[ext]
+subjectAltName=$ALTNAME
+subjectKeyIdentifier=hash
+EOF
+
+touch $OUT/${PREFIX}-key.pem
+chmod 600 $OUT/${PREFIX}-key.pem
+if [ -z "$BATCH" ] ; then
+    openssl req -config $SSLCNF -new -x509 -days $DAYS -keyout $OUT/${PREFIX}-key.pem -out $OUT/${PREFIX}-cert.pem
+else
+    openssl req -config $SSLCNF -new -x509 -days $DAYS -keyout $OUT/${PREFIX}-key.pem -out $OUT/${PREFIX}-cert.pem 2> /dev/null
+fi
+rm $SSLCNF
+
+#if  [ -s $OUT/${PREFIX}-key.pem -a -n "$USER" ] ; then
+#    chown $USER $OUT/${PREFIX}-key.pem $OUT/${PREFIX}-cert.pem
+#fi
+
+#if  [ -s $OUT/${PREFIX}-key.pem -a -n "$GROUP" ] ; then
+#    chgrp $GROUP $OUT/${PREFIX}-key.pem $OUT/${PREFIX}-cert.pem
+#fi

lib/ssl.sh

@@ -1,3 +1,9 @@
+sk-ssl-cert-gen(){
+  sk_help_noarg "Usage: $FUNCNAME <subject> <days> <format>. Gen self signed certificate" "$@" && return
+  local subject=${1:-"/CN=`hostname`"} days=${2:-3650} key_format=${3:-"rsa:3072"}
+  openssl req -x509 -nodes -newkey "${key_format}" -keyout "/tmp/cert.key" -out "/tmp/cert.pem" -days $days -subj "${subject}"
+}
+
 sk-ssl-pem-to-raw(){
   sk_help_noarg "Usage: $FUNCNAME <pem cert file>. Strip raw cert from a pem file and output it" "$@" && return
   local certfile=${1:-wibble.pem}

shellkit_sync.sh

@@ -2,6 +2,9 @@
 
 version=${1:-main}
 
+if [ -d /tmp/shellkit_bump ];then
+  rm -Rf /tmp/shellkit_bump
+fi
 mkdir /tmp/shellkit_bump
 
 shellkit_clone_dir=/tmp/shellkit_bump/shellkit-$version
@@ -12,3 +15,8 @@ for file in lib/*;do
   cp $shellkit_clone_dir/$file $file
 done
 
+for file in bin/*;do
+  echo "$file"
+  cp $shellkit_clone_dir/$file $file
+done
+