projects/ssl-cert-check/rhn-ssl-cert-check | 37 -
projects/ssl-cert-check/spacewalk-ssl-cert-check.spec | 10
projects/ssl-cert-check/ssl-cert-check | 379 ------------------
rel-eng/packages/spacewalk-ssl-cert-check | 2
4 files changed, 9 insertions(+), 419 deletions(-)
New commits:
commit f76e275374007e35fb5a03883994f09e3f2fbf33
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue May 4 16:19:36 2010 +0200
Automatic commit of package [spacewalk-ssl-cert-check] release [2.0-1].
diff --git a/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
b/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
index be1fffe..7aaa0aa 100644
--- a/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
+++ b/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
@@ -40,6 +40,9 @@ rm -rf $RPM_BUILD_ROOT
%doc LICENSE
%changelog
+* Tue May 04 2010 Jan Pazdziora 2.0-1
+- 461270 - replace our own ssl-cert-check with stock certwatch.
+
* Thu Sep 24 2009 Miroslav Suchý <msuchy(a)redhat.com> 1.9-1
- 524053 - Force to "upgrade" to older version of rhn-ssl-cert-check
diff --git a/rel-eng/packages/spacewalk-ssl-cert-check
b/rel-eng/packages/spacewalk-ssl-cert-check
index aec6b0b..09a3f5a 100644
--- a/rel-eng/packages/spacewalk-ssl-cert-check
+++ b/rel-eng/packages/spacewalk-ssl-cert-check
@@ -1 +1 @@
-1.9-1 projects/ssl-cert-check/
+2.0-1 projects/ssl-cert-check/
commit 78291f1becc421fb431ad200b776b58821fe93dc
Author: Jan Pazdziora <jpazdziora(a)redhat.com>
Date: Tue May 4 16:15:43 2010 +0200
461270 - replace our own ssl-cert-check with stock certwatch.
We take crypto-utils' /etc/cron.daily/certwatch and change it
to override any CERTWATCH_OPTS and NOCERTWATCH, use traceback_mail
value from Spacewalk configuration as the recipient's email
address, and to suggest the use of rhn-ssl-tool besides genkey.
diff --git a/projects/ssl-cert-check/rhn-ssl-cert-check
b/projects/ssl-cert-check/rhn-ssl-cert-check
index ce59b9f..d39cb00 100644
--- a/projects/ssl-cert-check/rhn-ssl-cert-check
+++ b/projects/ssl-cert-check/rhn-ssl-cert-check
@@ -31,23 +31,6 @@ unset ADMIN EXPIRATION CHECK
EXPIRATION=${EXPIRATION:-60}
-RHN_CONF_FILE=/etc/rhn/rhn.conf
-SSL_HTTPD_CONF_FILE=/etc/httpd/conf.d/ssl.conf
-SSL_CERT_CHECK=/usr/share/ssl/ssl-cert-check
-REMOTE_HOSTS=/etc/sysconfig/rhn/ssl-hosts.conf
-
-# If the admin email address is not set and RHN_CONF_FILE could not be found,
-# there's no point in moving forward
-[ -z "$ADMIN" -a ! -f $RHN_CONF_FILE ] && exit 0
-
-
-# Return path to the SSL certificate
-get_ssl_cert_file() {
- awk '/^SSLCertificateFile/ {print $2}' $SSL_HTTPD_CONF_FILE
-}
-
-# main
-
if [ -z "$ADMIN" ]; then
ADMIN=$(spacewalk-cfg-get traceback_mail)
# Replace commas with spaces
@@ -68,21 +51,7 @@ if [ -z "$ADMIN" ]; then
exit 0
fi
-# Parse remote hosts file
-if [ -f "$REMOTE_HOSTS" ]; then
- # Get rid of comments
- grep -v "^[[:blank:]]*#" $REMOTE_HOSTS |
- while IFS=: read server port; do
- if [ -n "$server" ]; then
- if [ -z "$port" ]; then
- port=443
- fi
- $SSL_CERT_CHECK -x $EXPIRATION -a -e "$ADMIN" -q -s $server -p
$port
- fi
- done
-fi
+sed -e "s!| */usr/sbin/sendmail!| sed
\"s/'genkey'/'rhn-ssl-tool' or 'genkey'/; /Generated by/a\\\\
and $0\" &!" \
+ -e "/\. *\/etc\/sysconfig\/httpd/aexport CERTWATCH_OPTS='--address $ADMIN
--period $EXPIRATION' ; unset NOCERTWATCH" /etc/cron.daily/certwatch \
+ | bash -
-SSL_CERT_FILE=$(get_ssl_cert_file)
-if [ -f "$SSL_CERT_FILE" ]; then
- $SSL_CERT_CHECK -x $EXPIRATION -c $SSL_CERT_FILE -a -e "$ADMIN" -q
-fi
diff --git a/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
b/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
index d2f2213..be1fffe 100644
--- a/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
+++ b/projects/ssl-cert-check/spacewalk-ssl-cert-check.spec
@@ -5,11 +5,11 @@ License: GPLv2
URL:
https://fedorahosted.org/spacewalk
Source0:
https://fedorahosted.org/releases/s/p/spacewalk/%{name}-%{version}.tar.gz
Epoch: 1
-Version: 1.9
+Version: 2.0
Release: 1%{?dist}
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildArch: noarch
-Requires: openssl
+Requires: /etc/cron.daily/certwatch
Obsoletes: rhn-ssl-cert-check < %{epoch}:%{version}
Provides: rhn-ssl-cert-check = %{epoch}:%{version}
@@ -27,10 +27,8 @@ administrator.
%install
rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT/%{_datadir}/ssl
install -d $RPM_BUILD_ROOT/etc/cron.daily
-install -m755 ssl-cert-check $RPM_BUILD_ROOT/%{_datadir}/ssl/ssl-cert-check
install -m755 rhn-ssl-cert-check
$RPM_BUILD_ROOT/%{_sysconfdir}/cron.daily/rhn-ssl-cert-check
%clean
@@ -39,7 +37,6 @@ rm -rf $RPM_BUILD_ROOT
%files
%defattr(-,root,root,-)
%attr(0755,root,root) %{_sysconfdir}/cron.daily/rhn-ssl-cert-check
-%attr(0755,root,root) %{_datadir}/ssl/ssl-cert-check
%doc LICENSE
%changelog
diff --git a/projects/ssl-cert-check/ssl-cert-check
b/projects/ssl-cert-check/ssl-cert-check
deleted file mode 100644
index c00e9f1..0000000
--- a/projects/ssl-cert-check/ssl-cert-check
+++ /dev/null
@@ -1,379 +0,0 @@
-#!/bin/bash
-#
-# Program: SSL Certificate Check <ssl-cert-check>
-#
-# Author: Matty <matty(a)daemons.net>
-#
-# Current Version: 1.4
-#
-# Revision History:
-#
-# Version 1.4
-# Added "-c" flag to report expiration status of a PEM encoded certificate
-# -- functionality added by Hampus Lundqvist
-#
-# Version 1.3
-# Updated the prints messages to display the reason a connection
-# failed (connection refused, connection timeout, bad cert, etc)
-#
-# Updated the GNU date checking routines. I really wish UNIX/BSD/Linux
-# based systems utilized a common set of options/interfaces. *sigh*
-#
-# Version 1.2
-# Added checks for each binary required
-# Added checks for connection timeouts
-#
-# Versions 1.1
-# Added checks for GNU date
-# Added a "-h" option
-# Cleaned up the documentation
-#
-# Version 1.0
-# Initial Release
-#
-# Last Updated: 01-04-2005
-#
-# Purpose:
-# ssl-cert-check checks to see if a digital certificate in X.509 format
-# has expired. ssl-cert-check can be run in interactive and batch mode,
-# and provides facilities to alarm if a certificate is about to expire.
-#
-# License:
-# This program is free software; you can redistribute it and/or modify it
-# under the terms of the GNU General Public License as published by the
-# Free Software Foundation; either version 2, or (at your option) any
-# later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# GNU General Public License for more details.
-#
-# You should have received a copy of the GNU General Public License
-# along with this program; if not, write to the Free Software
-# Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
-#
-# Requirements:
-# Requires openssl and GNU date
-#
-# Installation:
-# Copy the shell script to a suitable location
-#
-# Usage (script should be run as a non-privileged user):
-# Usage: ./ssl-cert-check {[ -c certificate file ]} || {[ -b ] && [ -f cert_file
]} || {[ -s common_name ] && [ -p port]}}
-# [ -e email ] [ -x expir_days ] [ -q ] [ -a ] [ -h ]
-# -a : Send a warning message through email
-# -b : Print the expiration date for all certificates in cert_file
(batch mode)
-# -c : Print the expiration date for a PEM formatted certificate
-# -e email address : Email address to send expiration notices
-# -f cert file : File with a list of common names and ports (eg.,
blatch.com 443)
-# -h : Print this screen
-# -p port : Port to connect to (interactive mode)
-# -s commmon name : Server to connect to (interactive mode)
-# -q : Don't print anything on the console
-# -x days : Certificate expiration interval (eg. if cert_date < days)
-#
-#
-# Examples:
-# Print the certificate expiration status of the X.509 certificate stored in file
cacert.pem
-# $ ssl-cert-check -c /etc/ca/cacert.pem
-#
-# Print the certificate expiration dates for a list of domains specified in the file
ssldomains:
-# $ ssl-cert-check -b -f ssldomains
-#
-# Print the certificate expiration date for
mail.daemons.net:
-# $ ssl-cert-check -s
mail.daemons.net -p 995
-#
-# Run ssl-cert-check in quiet mode, check for all certificates that will
-# expire in 75-days or less. Email the expiring certs to matty(a)daemons.net:
-# $ ssl-cert-check -a -b -f ssldomains -q -x 75 -e matty(a)daemons.net
-
-PATH=/bin:/usr/bin:/usr/local/bin:/usr/local/ssl/bin ; export PATH
-
-# Who to page when an expired certificate is detected (cmdline: -e)
-ADMIN="sysadmin(a)mydomain.com"
-
-# Number of days to give as a buffer (cmdline: -x)
-WARNDAYS=30
-
-# If QUIET is set to TRUE, don't print anything on the console (cmdline: -q)
-QUIET="FALSE"
-
-# Don't send emails by default (cmdline: -a)
-ALARM="FALSE"
-
-# Location of system binaries
-DATE="/bin/date"
-MAIL="/bin/mail"
-OPENSSL="/usr/bin/openssl"
-
-# Place to stash temporary files
-CERT_TMP="$HOME/cert.$$"
-ERROR_TMP="$HOME/error.$$"
-
-# Set the default umask to be somewhat restrictive
-umask 077
-
-
-###########################################################
-### Converts a date in string format passed as $1 into
-### the number of seconds since 01/01/70 00:00:00 UTC.
-### Replace this with another date normalization routine if
-### you do not have GNU date available.
-###########################################################
-utcseconds() {
- utcsec=`${DATE} -d "$1" +%s`
- echo "$utcsec"
-}
-
-
-###########################################################
-### Calculate the number of seconds between two dates
-###########################################################
-date_diff() {
- diff=`expr $2 - $1`
- echo "${diff}"
-}
-
-
-###########################################################
-### Calculate days given seconds
-###########################################################
-date_days() {
- DAYS=`expr ${1} \/ 86400`
- echo "${DAYS}"
-}
-
-
-#####################################################################
-### Method used to print a line with a certificates expiration status
-#####################################################################
-prints() {
- if [ "${QUIET}" != "TRUE" ]
- then
- MIN_DATE=`echo $4 | awk '{ print $1, $2, $4 }'`
- printf "%-30s %-25s %-20s %-5s\n" "$1:$2" "$3"
"$MIN_DATE" "$5"
- fi
-}
-
-
-########################
-### Print out a heading
-########################
-print_heading() {
- if [ "${QUIET}" != "TRUE" ]
- then
- printf "\n%-30s %-25s %-20s %-5s\n" "Host" "Status"
"Expires" "Days Left"
- fi
-}
-
-
-##########################################
-# Provide a listing of how the tool works
-##########################################
-useage() {
- echo "Usage: $0 {[ -c certificate file ]} || {[ -b ] && [ -f cert_file ]}
|| {[ -s common_name ] && [ -p port]}}"
- echo " [ -e email ] [ -x expir_days ] [ -q ] [ -a ] [ -h ]"
- echo " -a : Send a warning message through email "
- echo " -b : Print the expiration date for all certificates in
cert_file (batch mode)"
- echo " -c : Print the expiration date for a PEM formatted
certificate"
- echo " -e email address : Email address to send expiration notices"
- echo " -f cert file : File with a list of common names and ports (eg.,
blatch.com 443)"
- echo " -h : Print this screen"
- echo " -p port : Port to connect to (interactive mode)"
- echo " -s commmon name : Server to connect to (interactive mode)"
- echo " -q : Don't print anything on the console"
- echo " -x days : Certificate expiration interval (eg. if cert_date <
days)"
-}
-
-
-##################################################################
-### Connect to a server ($1) and port ($2) to see if a certificate
-### has expired
-##################################################################
-check_server_status() {
-
- echo "" | ${OPENSSL} s_client -connect ${1}:${2} 2> ${ERROR_TMP} 1>
${CERT_TMP}
-
- if grep -i "Connection refused" ${ERROR_TMP} > /dev/null
- then
- prints ${1} ${2} "Connection refused" "?"
"?"
-
- elif grep -i "gethostbyname failure" ${ERROR_TMP} > /dev/null
- then
- prints ${1} ${2} "Cannot resolve domain" "?"
"?"
-
- elif grep -i "Operation timed out" ${ERROR_TMP} > /dev/null
- then
- prints ${1} ${2} "Operation timed out" "?"
"?"
-
- elif grep -i "ssl handshake failure" ${ERROR_TMP} > /dev/null
- then
- prints ${1} ${2} "SSL handshake failed" "?"
"?"
-
- elif grep -i "connect: Connection timed out" ${ERROR_TMP} > /dev/null
- then
- prints ${1} ${2} "Connection timed out" "?" "?"
-
- else
- check_expiration ${CERT_TMP} $1 $2
- fi
-}
-
-#####################################################
-### Check the expiration status of a certificate file
-### Accepts three parameters:
-### $1 -> certificate file to process
-### $2 -> Server name
-### $3 -> Port number of certificate
-#####################################################
-check_expiration() {
-
- CERTDATE=`${OPENSSL} x509 -in ${1} -enddate -noout | sed
's/notAfter\=//'`
-
- # Convert the date to seconds, and get the diff between NOW and the expiration date
- CERTUTC=`utcseconds "${CERTDATE}"`
- CERTDIFF=`date_diff ${NOWUTC} ${CERTUTC}`
-
- if [ ${CERTDIFF} -lt 0 ]
- then
- if [ "${ALARM}" == "TRUE" ]
- then
- echo "The SSL certificate for ${2} has expired!" \
- | ${MAIL} -s "Certificate for ${2} has expired!"
${ADMIN}
- fi
-
- DAYS=`date_days $CERTDIFF`
- prints ${2} ${3} "Expired" "$CERTDATE"
"$DAYS"
-
- elif [ ${CERTDIFF} -lt ${WARNSECS} ]
- then
- if [ "${ALARM}" == "TRUE" ]
- then
- echo "The SSL certificate for ${2} will expire on
${CERTDATE}" \
- | ${MAIL} -s "$0: Certificate for ${2} will expire in
${WARNDAYS}-days or less" ${ADMIN}
- fi
-
- DAYS=`date_days $CERTDIFF`
- prints ${2} ${3} "Expiring" "${CERTDATE}"
"${DAYS}"
-
- else
- DAYS=`date_days $CERTDIFF`
- prints ${2} ${3} "Valid" "${CERTDATE}"
"${DAYS}"
-
- fi
-}
-
-
-#################################
-### Being the main program logic
-#################################
-while getopts abe:f:c:hp:s:qx: option
-do
- case "${option}"
- in
- a) ALARM="TRUE";;
- b) REPORT_ALL="TRUE";;
- c) CERTFILE=${OPTARG};;
- e) ADMIN=${OPTARG};;
- f) SERVERFILE=$OPTARG;;
- h) useage
- exit 1;;
- p) PORT=$OPTARG;;
- s) HOST=$OPTARG;;
- q) QUIET="TRUE";;
- x) WARNDAYS=$OPTARG;;
- \?) useage
- exit 1;;
- esac
-done
-
-
-if [ ! -f ${OPENSSL} ]
-then
- echo "ERROR: $OPENSSL does not exist. Please modify the \$OPENSSL variable."
- exit 1
-fi
-
-if [ ! -f ${DATE} ]
-then
- echo "ERROR: $DATE does not exist. Please modify the \$DATE variable."
- exit 1
-fi
-
-if [ ! -f ${MAIL} ]
-then
- echo "ERROR: $MAIL does not exist. Please modify the \$MAIL variable."
- exit 1
-fi
-
-if ${DATE} -R -d "Wed Jan 1 00:00:00 EDT 2000" "+%s" 2>&1 |
grep -i "illegal option" > /dev/null
-then
- echo "ERROR: \$DATE does not point to GNU date"
- exit 1
-fi
-
-if ${DATE} -R -d "Wed Jan 1 00:00:00 EDT 2000" "+%s" 2>&1 |
grep -i "unknown option" > /dev/null
-then
- echo "ERROR: \$DATE does not point to GNU date"
- exit 1
-fi
-
-### Baseline the dates so we have something to compare with
-NOWDATE=`${DATE}`
-NOWUTC=`utcseconds "${NOWDATE}"`
-
-
-### Get the number of seconds to compare the UTC time with
-WARNSECS=`expr ${WARNDAYS} \* 86400`
-
-
-### Touch the files to avoid issues
-touch ${CERT_TMP} ${ERROR_TMP}
-
-
-### IF a HOST and PORT were passed on the cmdline, use that
-if [ "${HOST}" != "" ] && [ "${PORT}" !=
"" ]
-then
- print_heading
- check_server_status "${HOST}" "${PORT}"
-
-
-#####################################################################
-### If a file and a "-a" are passed on the command line, check all
-### of the certificates in the file to see if they are about to expire
-#####################################################################
-elif [ "${REPORT_ALL}" == "TRUE" ] && [ -f
"${SERVERFILE}" ]
-then
- print_heading
- while read HOST PORT
- do
- check_server_status "${HOST}" "${PORT}"
-
- done < ${SERVERFILE}
-
-
-###################################################################
-### Check to see if the certificate in CERTFILE is about to expire
-###################################################################
-elif [ "${CERTFILE}" != "" ]
-then
- print_heading
- if [ -f "${CERTFILE}" ]
- then
- check_expiration ${CERTFILE} "FILE" "${CERTFILE}"
- else
- echo "ERROR: The file named ${CERTFILE} doesn't exist"
- fi
-
-###################################################
-### There was an error, so print how the tool works
-###################################################
-else
- useage
-fi
-
-###############################
-### Remove the temporary files
-###############################
-rm -f ${CERT_TMP} ${ERROR_TMP}