2013-12-19 14:11:19 +00:00
|
|
|
#!/bin/bash
|
2018-04-25 10:03:50 +00:00
|
|
|
#
|
|
|
|
# Script to edit secrets for a host.
|
|
|
|
#
|
|
|
|
# This script is used by an administrator on his/hers local machine. The
|
|
|
|
# general principle is for this script to ssh to the target host, decrypt
|
|
|
|
# the secrets and allow changes to be made, and then fetch the encrypted
|
|
|
|
# secrets from the host and add it to the Cosmos repository on the
|
|
|
|
# administrators machine.
|
|
|
|
#
|
|
|
|
# Funnily enough, this script will execute itself (with the argument
|
|
|
|
# '--on-host') on the target host in order to do the decryption etc. Don't
|
|
|
|
# allow this to confuse you and everything will be fine.
|
|
|
|
#
|
2013-12-19 14:11:19 +00:00
|
|
|
|
|
|
|
set -e
|
|
|
|
umask 077
|
|
|
|
|
|
|
|
LAST_OUTPUT_FILENAME="/root/.last_edit-secrets_output"
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
test -d /dev/shm && export TMPDIR='/dev/shm'
|
|
|
|
|
|
|
|
TMPFILE=$(mktemp edit-secrets.XXXXXXXXXX)
|
|
|
|
TMPFILE2=$(mktemp edit-secrets.XXXXXXXXXX)
|
|
|
|
|
|
|
|
if [ ! -f $TMPFILE ]; then
|
|
|
|
echo "$TMPFILE"
|
|
|
|
echo "$0: Failed creating temporary file"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
if [ ! -f $TMPFILE2 ]; then
|
|
|
|
echo "$TMPFILE2"
|
|
|
|
echo "$0: Failed creating temporary file 2"
|
|
|
|
exit 1
|
2018-04-25 10:03:50 +00:00
|
|
|
fi
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
trap "rm -f $TMPFILE $TMPFILE2" EXIT
|
|
|
|
|
|
|
|
|
|
|
|
if [[ ! $1 ]]; then
|
|
|
|
# deliberately don't mention the --on-host argument
|
|
|
|
echo "Syntax: $0 fqdn"
|
2013-12-19 14:11:19 +00:00
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
2023-01-18 12:50:09 +00:00
|
|
|
function patch_broken_eyaml {
|
|
|
|
#
|
|
|
|
# Ubuntu 22.04 (jammy) has a broken hiera-eyaml package, a bug report
|
|
|
|
# exists here: https://bugs.launchpad.net/ubuntu/+source/hiera-eyaml/+bug/1974059
|
|
|
|
#
|
|
|
|
|
|
|
|
if [ "$(lsb_release -cs)" == "jammy" ]; then
|
|
|
|
plugins_file="/usr/share/rubygems-integration/all/gems/hiera-eyaml-3.2.2/lib/hiera/backend/eyaml/plugins.rb"
|
|
|
|
if [ -f $plugins_file ]; then
|
|
|
|
# We only want to try patching the file if it is the known broken version
|
|
|
|
bad_sum="1d0f14765ebcfcdae300d8ac5d715845ef9b283345d19114a23d96161556618f"
|
|
|
|
sum=$(sha256sum $plugins_file | awk '{print $1}')
|
|
|
|
if [ "$sum" == "$bad_sum" ]; then
|
|
|
|
patch --fuzz=0 --directory=/ --strip=0 <<'EOF'
|
|
|
|
--- /usr/share/rubygems-integration/all/gems/hiera-eyaml-3.2.2/lib/hiera/backend/eyaml/plugins.rb.orig 2023-01-18 08:20:22.140338419 +0000
|
|
|
|
+++ /usr/share/rubygems-integration/all/gems/hiera-eyaml-3.2.2/lib/hiera/backend/eyaml/plugins.rb 2023-01-18 08:21:05.654053501 +0000
|
|
|
|
@@ -32,6 +32,7 @@
|
|
|
|
specs = Gem::VERSION >= "1.6.0" ? source.latest_specs(true) : source.latest_specs
|
|
|
|
|
|
|
|
specs.each do |spec|
|
|
|
|
+ spec = spec.to_spec if spec.respond_to?(:to_spec)
|
|
|
|
next if @@plugins.include? spec
|
|
|
|
|
|
|
|
dependency = spec.dependencies.find { |d| d.name == "hiera-eyaml" }
|
|
|
|
EOF
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
fi
|
|
|
|
}
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
function edit_copy_and_commit()
|
|
|
|
{
|
|
|
|
#
|
|
|
|
# This code runs on the administrators local machine
|
|
|
|
#
|
|
|
|
local host=$1
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
if [[ ${EDITOR} ]]; then
|
|
|
|
declare -r REMOTE_EDITOR="${EDITOR}"
|
|
|
|
else
|
|
|
|
declare -r REMOTE_EDITOR='/usr/bin/vim.tiny'
|
2013-12-19 14:11:19 +00:00
|
|
|
fi
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
# Execute this script, on a remote host
|
|
|
|
ssh -t root@"${host}" EDITOR="${REMOTE_EDITOR}" /var/cache/cosmos/repo/edit-secrets --on-host
|
|
|
|
scp -q root@"${host}:${LAST_OUTPUT_FILENAME}" ${TMPFILE}
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
local save_to
|
2013-12-19 14:11:19 +00:00
|
|
|
if grep ^"STATUS=UPDATED" $TMPFILE > /dev/null; then
|
2015-03-06 22:07:58 +00:00
|
|
|
save_to="${host}/overlay/etc/hiera/data/secrets.yaml.asc"
|
2020-01-02 12:23:11 +00:00
|
|
|
|
2013-12-19 14:11:19 +00:00
|
|
|
# extract the GPG output
|
|
|
|
perl -e '$a = 0; while (<>) { $a = 1 if ($_ =~ /-+BEGIN PGP MESSAGE-+/);
|
|
|
|
print $_ if $a; $a = 0 if ($_ =~ /-+END PGP MESSAGE-+/); }' < $TMPFILE > $TMPFILE2
|
|
|
|
|
|
|
|
if ! grep "END PGP MESSAGE" $TMPFILE2 > /dev/null; then
|
|
|
|
echo "$0: Failed extracting PGP output from file $TMPFILE into $TMPFILE2"
|
|
|
|
exit 1
|
|
|
|
fi
|
2020-01-02 12:23:11 +00:00
|
|
|
elif grep ^"STATUS=EYAML_UPDATED" $TMPFILE > /dev/null; then
|
|
|
|
save_to="${host}/overlay/etc/hiera/data/local.eyaml"
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
# extract the eyaml output
|
|
|
|
perl -e '$a = 0; while (<>) { $a = 1 if ($_ =~ /^---$/);
|
|
|
|
print $_ if $a }' < $TMPFILE > $TMPFILE2
|
|
|
|
|
|
|
|
if ! grep "^---$" $TMPFILE2 > /dev/null; then
|
|
|
|
echo "$0: Failed extracting yaml output from file $TMPFILE into $TMPFILE2"
|
|
|
|
exit 1
|
|
|
|
fi
|
2013-12-19 14:11:19 +00:00
|
|
|
else
|
|
|
|
echo ""
|
|
|
|
echo "Not updated"
|
|
|
|
echo ""
|
2020-01-02 12:23:11 +00:00
|
|
|
|
|
|
|
exit 0
|
|
|
|
fi
|
|
|
|
|
|
|
|
# use cat to preserve permissions etc.
|
|
|
|
mkdir -p "`dirname ${save_to}`"
|
|
|
|
cat $TMPFILE2 > "${save_to}"
|
|
|
|
git add "${save_to}"
|
|
|
|
|
|
|
|
if grep ^"STATUS=EYAML_UPDATED" $TMPFILE > /dev/null; then
|
|
|
|
git diff --cached "${save_to}"
|
2013-12-19 14:11:19 +00:00
|
|
|
fi
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
echo ""
|
|
|
|
echo "$save_to updated"
|
|
|
|
echo ""
|
2013-12-19 14:11:19 +00:00
|
|
|
|
|
|
|
exit 0
|
2020-01-02 12:23:11 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
function edit_file_on_host() {
|
|
|
|
#
|
|
|
|
# Local execution on a host
|
|
|
|
#
|
|
|
|
|
|
|
|
local SECRETFILE=/etc/hiera/data/secrets.yaml.asc
|
|
|
|
local EYAMLFILE=/etc/hiera/data/local.eyaml
|
|
|
|
|
|
|
|
if [ -f "${EYAMLFILE}" ]; then
|
|
|
|
edit_eyaml_file ${EYAMLFILE}
|
|
|
|
elif [ -f "${SECRETFILE}" ]; then
|
|
|
|
edit_gpg_file ${SECRETFILE}
|
|
|
|
elif [ -f /etc/hiera/eyaml/public_certkey.pkcs7.pem ]; then
|
|
|
|
# default to eyaml if the key exists and none of the secrets-file above exist
|
2023-02-07 07:49:31 +00:00
|
|
|
echo "---" > ${EYAMLFILE}
|
2020-01-02 12:23:11 +00:00
|
|
|
edit_eyaml_file ${EYAMLFILE}
|
|
|
|
fi
|
|
|
|
}
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
function edit_gpg_file()
|
|
|
|
{
|
|
|
|
local SECRETFILE=$1
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
GNUPGHOME=/etc/hiera/gpg/
|
|
|
|
export GNUPGHOME
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
local GPG=`which gpg2 || true`
|
2013-12-19 14:11:19 +00:00
|
|
|
if [ ! -x "$GPG" ]; then
|
2020-01-02 12:23:11 +00:00
|
|
|
GPG=`which gpg || true`
|
|
|
|
if [ ! -x "$GPG" ]; then
|
|
|
|
echo "$0: gpg2 or gpg not found"
|
|
|
|
exit 1
|
|
|
|
fi
|
2013-12-19 14:11:19 +00:00
|
|
|
fi
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
if ! $GPG --list-secret-keys | grep -q ^"sec\s"; then
|
|
|
|
echo "$0: Secret key does not exist (in $GNUPGHOME)."
|
|
|
|
echo ""
|
|
|
|
echo "Generate it with /var/cache/cosmos/model/pre-tasks.d/040hiera-gpg"
|
|
|
|
echo ""
|
|
|
|
exit 1
|
|
|
|
fi
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
if [ -s $SECRETFILE ]; then
|
|
|
|
$GPG -d $SECRETFILE > $TMPFILE
|
|
|
|
fi
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
cp $TMPFILE $TMPFILE2
|
|
|
|
sensible-editor $TMPFILE
|
|
|
|
rm -f ${TMPFILE}~ ${TMPFILE2}~
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2018-04-25 10:03:50 +00:00
|
|
|
echo ""
|
|
|
|
echo ""
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
local status=0
|
|
|
|
cmp -s $TMPFILE $TMPFILE2 || status=1
|
|
|
|
if [ $status -eq 0 ]; then
|
|
|
|
(
|
|
|
|
echo "STATUS=NOT_CHANGED"
|
|
|
|
) > $LAST_OUTPUT_FILENAME
|
|
|
|
echo ""
|
|
|
|
echo "$0: No changes detected"
|
|
|
|
else
|
|
|
|
# figure out this hosts gpg key id
|
2020-09-14 08:02:20 +00:00
|
|
|
if lsb_release -r | grep -qE '(18|20).04'; then
|
2020-01-02 12:23:11 +00:00
|
|
|
recipient=$($GPG --list-secret-keys | grep -A1 '^sec' | tail -1 | awk '{print $1}')
|
|
|
|
else
|
|
|
|
recipient=$($GPG --list-secret-key | grep ^sec | head -1 | awk '{print $2}' | cut -d / -f 2)
|
|
|
|
fi
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
save_to="`hostname --fqdn`/overlay${SECRETFILE}"
|
|
|
|
echo ""
|
|
|
|
(
|
|
|
|
echo "STATUS=UPDATED"
|
|
|
|
echo ""
|
|
|
|
) > $LAST_OUTPUT_FILENAME
|
|
|
|
$GPG --output - --armor --recipient $recipient --sign --encrypt $TMPFILE >> $LAST_OUTPUT_FILENAME
|
|
|
|
echo ""
|
|
|
|
echo "GPG output saved in $LAST_OUTPUT_FILENAME - save it in Cosmos as"
|
|
|
|
echo ""
|
|
|
|
echo " $save_to"
|
|
|
|
echo ""
|
|
|
|
fi
|
|
|
|
}
|
|
|
|
|
|
|
|
function edit_eyaml_file()
|
|
|
|
{
|
|
|
|
local EYAMLFILE=$1
|
|
|
|
|
|
|
|
local FQDN=$(hostname --fqdn)
|
|
|
|
local privkey='/etc/hiera/eyaml/private_key.pkcs7.pem'
|
|
|
|
local pubkey='/etc/hiera/eyaml/public_certkey.pkcs7.pem'
|
|
|
|
for f in $privkey $pubkey; do
|
|
|
|
test -f "${f}" || { echo "$0: eyaml key file ${f} not found"; exit 1; }
|
|
|
|
done
|
|
|
|
|
2023-01-18 12:50:09 +00:00
|
|
|
patch_broken_eyaml
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
# save source file for comparision afterwards
|
|
|
|
cp "${EYAMLFILE}" "${TMPFILE}"
|
|
|
|
eyaml edit --pkcs7-private-key "${privkey}" --pkcs7-public-key "${pubkey}" "${EYAMLFILE}"
|
|
|
|
|
|
|
|
local status=0
|
|
|
|
cmp -s "${EYAMLFILE}" $TMPFILE || status=1
|
|
|
|
if [ $status -eq 0 ]; then
|
|
|
|
(
|
|
|
|
echo "STATUS=NOT_CHANGED"
|
|
|
|
) > $LAST_OUTPUT_FILENAME
|
|
|
|
echo ""
|
|
|
|
echo "$0: No changes detected"
|
|
|
|
else
|
|
|
|
echo ""
|
|
|
|
(
|
|
|
|
echo "STATUS=EYAML_UPDATED"
|
|
|
|
echo ""
|
|
|
|
) > $LAST_OUTPUT_FILENAME
|
|
|
|
cat "${EYAMLFILE}" >> $LAST_OUTPUT_FILENAME
|
|
|
|
fi
|
|
|
|
}
|
2013-12-19 14:11:19 +00:00
|
|
|
|
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
if [[ $1 == '--on-host' ]]; then
|
|
|
|
edit_file_on_host
|
2013-12-19 14:11:19 +00:00
|
|
|
else
|
2020-01-02 12:23:11 +00:00
|
|
|
host=$(echo $1 | sed -e 's!/*$!!') # remove trailing slashes
|
2013-12-19 14:11:19 +00:00
|
|
|
|
2020-01-02 12:23:11 +00:00
|
|
|
if [ ! -d $host ]; then
|
|
|
|
echo "$0: No host-directory for '$host' found - execute in top-level cosmos dir"
|
|
|
|
exit 1
|
|
|
|
fi
|
|
|
|
|
|
|
|
edit_copy_and_commit $host
|
2013-12-19 14:11:19 +00:00
|
|
|
fi
|
2020-01-02 12:23:11 +00:00
|
|
|
|
|
|
|
exit 0
|