diff options
-rwxr-xr-x | scripts/tps-configure.sh | 61 | ||||
-rwxr-xr-x | scripts/tps-create.sh | 15 | ||||
-rwxr-xr-x | scripts/tps-include.sh | 40 | ||||
-rwxr-xr-x | scripts/tps-remove.sh | 8 |
4 files changed, 124 insertions, 0 deletions
diff --git a/scripts/tps-configure.sh b/scripts/tps-configure.sh new file mode 100755 index 0000000..d3a4fe8 --- /dev/null +++ b/scripts/tps-configure.sh @@ -0,0 +1,61 @@ +#!/bin/sh -x + +. ./tps-include.sh + +PIN=`grep preop.pin= $INSTANCE_ROOT/$TPS_INSTANCE_NAME/conf/CS.cfg | awk -F= '{ print $2; }'` + +CERTS=$SRC_DIR/pki-dev/certs/tps +rm -rf $CERTS +mkdir -p $CERTS + +if [ "$TPS_SECURE_PORT" == "" ]; then + PORT="$TPS_ADMIN_SECURE_PORT" +else + PORT="$TPS_SECURE_PORT" +fi + +pkisilent ConfigureTPS \ + -cs_hostname $HOSTNAME \ + -cs_port $PORT \ + -cs_clientauth_port $PORT \ + -preop_pin $PIN \ + -client_certdb_dir "$CERTS" \ + -client_certdb_pwd "$PASSWORD" \ + -token_name "internal" \ + -sd_hostname "$HOSTNAME" \ + -sd_admin_port 9443 \ + -sd_ssl_port 9443 \ + -sd_agent_port 9443 \ + -sd_admin_name "caadmin" \ + -sd_admin_password "$PASSWORD" \ + -domain_name "$REALM" \ + -subsystem_name "$TPS_SUBSYSTEM_NAME" \ + -ldap_host "$TPS_LDAP_HOST" \ + -ldap_port "$TPS_LDAP_PORT" \ + -base_dn "$TPS_LDAP_BASE_DN" \ + -db_name "$TPS_LDAP_DATABASE" \ + -bind_dn "$TPS_LDAP_BIND_DN" \ + -bind_password "$TPS_LDAP_PASSWORD" \ + -key_type rsa \ + -key_size 2048 \ + -tps_server_cert_subject_name "$TPS_SERVER_CERT_SUBJECT_NAME" \ + -tps_subsystem_cert_subject_name "$TPS_SUBSYSTEM_CERT_SUBJECT_NAME" \ + -tps_audit_signing_cert_subject_name "$TPS_AUDIT_SIGNING_CERT_SUBJECT_NAME" \ + -ca_hostname "$HOSTNAME" \ + -ca_port 9180 \ + -ca_ssl_port 9443 \ + -ca_admin_port 9443 \ + -drm_hostname "$HOSTNAME" \ + -drm_ssl_port 12443 \ + -admin_user "$CA_ADMIN_USER" \ + -agent_name "$CA_ADMIN_NAME" \ + -admin_email "$CA_ADMIN_EMAIL" \ + -admin_password "$CA_ADMIN_PASSWORD" \ + -agent_key_size 2048 \ + -agent_key_type rsa \ + -agent_cert_subject "$CA_ADMIN_CERT_SUBJECT" + +echo $PASSWORD > "$CERTS/password.txt" +PKCS12Export -d "$CERTS" -o "$CERTS/ca-client-certs.p12" -p "$CERTS/password.txt" -w "$CERTS/password.txt" + +systemctl restart pki-cad@$CA_INSTANCE_NAME.service diff --git a/scripts/tps-create.sh b/scripts/tps-create.sh new file mode 100755 index 0000000..24e444c --- /dev/null +++ b/scripts/tps-create.sh @@ -0,0 +1,15 @@ +#!/bin/sh -x + +. ./tps-include.sh + +pkicreate -pki_instance_root=$INSTANCE_ROOT \ + -pki_instance_name=$TPS_INSTANCE_NAME \ + -subsystem_type=$TPS_SUBSYSTEM_TYPE \ + -secure_port=$TPS_SECURE_PORT \ + -non_clientauth_secure_port=$TPS_NON_CLIENTAUTH_SECURE_PORT \ + -unsecure_port=$TPS_UNSECURE_PORT \ + -user=$INSTANCE_USER \ + -group=$INSTANCE_GROUP \ + -redirect conf=/etc/$TPS_INSTANCE_NAME \ + -redirect logs=/var/log/$TPS_INSTANCE_NAME \ + -verbose diff --git a/scripts/tps-include.sh b/scripts/tps-include.sh new file mode 100755 index 0000000..0b9daba --- /dev/null +++ b/scripts/tps-include.sh @@ -0,0 +1,40 @@ +#!/bin/sh -x + +SRC_DIR="`cd ../.. ; pwd`" + +DOMAIN="example.com" +REALM="EXAMPLE-COM" +PASSWORD="Secret123" + +INSTANCE_ROOT="/var/lib" +INSTANCE_USER="pkiuser" +INSTANCE_GROUP="pkiuser" + +TPS_INSTANCE_NAME="pki-tps" + +TPS_SUBSYSTEM_TYPE="tps" +TPS_SUBSYSTEM_NAME="TPS" + +TPS_SECURE_PORT="7889" +TPS_NON_CLIENTAUTH_SECURE_PORT="7890" +TPS_UNSECURE_PORT="7888" +TPS_TOMCAT_SERVER_PORT="15701" + +TPS_LDAP_HOST="$HOSTNAME" +TPS_LDAP_PORT="389" +TPS_LDAP_DATABASE="$DOMAIN-$INSTANCE_NAME" +TPS_LDAP_BASE_DN="dc=tps,dc=example,dc=com" +TPS_LDAP_BIND_DN="cn=Directory Manager" +TPS_LDAP_PASSWORD="$PASSWORD" + +TPS_SIGN_CERT_SUBJECT_NAME="CN=$TPS_SUBSYSTEM_NAME,O=$REALM" +TPS_OCSP_CERT_SUBJECT_NAME="CN=OCSP Signing Certificate,O=$REALM" +TPS_SERVER_CERT_SUBJECT_NAME="CN=$HOSTNAME,O=$REALM" +TPS_SUBSYSTEM_CERT_SUBJECT_NAME="CN=TPS Subsystem Certificate,O=$REALM" +TPS_AUDIT_SIGNING_CERT_SUBJECT_NAME="CN=TPS Audit Signing Certificate,O=$REALM" + +TPS_ADMIN_USER="tpsadmin" +TPS_ADMIN_NAME="$TPS_ADMIN_USER" +TPS_ADMIN_EMAIL="$TPS_ADMIN_USER@$DOMAIN" +TPS_ADMIN_PASSWORD="$PASSWORD" +TPS_ADMIN_CERT_SUBJECT="CN=$TPS_ADMIN_NAME,UID=$TPS_ADMIN_USER,E=$TPS_ADMIN_EMAIL,O=$REALM" diff --git a/scripts/tps-remove.sh b/scripts/tps-remove.sh new file mode 100755 index 0000000..8d6848d --- /dev/null +++ b/scripts/tps-remove.sh @@ -0,0 +1,8 @@ +#!/bin/sh -x + +. ./tps-include.sh + +pkiremove -pki_instance_root=$INSTANCE_ROOT \ + -pki_instance_name=$TPS_INSTANCE_NAME \ + -force \ + -verbose |