ssh-key-generator

# +-----------------------------------------------------------------------------------------+
# | GENERATE KEYS FOR NEW HOSTS OR RENEW PASSPHRASE FOR ALL KEYS                            |
# |                                                                                         |
# |                 Dit script moet uiteindelijk vervangen worden door puppet :)            |
# +-----------------------------------------------------------------------------------------+

# Dit script genereert public en private sshkeys voor alle linux hosts in de cmdb database.
# Alle private keys worden in /mnt/keys bewaard, de public keys worden in /var/www/keys gezet,
# zodat alle ldap enabled hosts ieadere nacht rond 3 uur deze public key kunnen wgetten vanuit
# de cron en deze in hun authorized_keyfiles kunnen zetten.
# Op deze manier is zelfs als ldap overlijd, er nog in te loggen op de andere machines, en
# zijn er geautomatiseerde taken als root op het platform los te laten.
# flip hess juli 2012 [email protected]

# Global variables:

PATH='/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin'
SCRIPT_PATH="${0}"
ARGS="${#}"
BASEDIR="/var/www/keys"
PUBKEYS="${BASEDIR}/pubkeys"
PRIVKEYS="/etc/keys"
TMP="/etc/keys/tmp"
MYSQL='mysql nagiostool -Be'


# Functions:

  # exit function
  function die()
  {
    echo -e "Error in${SCRIPT_PATH}:\n${1}"
    exit 1
  }

  # Shows usage function.
  function fShowUsage()
  {
    echo -e "Usage: ${SCRIPT_PATH} [create|renew|help]\n
    help     Show Usage
    create   Generate Public Keys for all new hosts in database\n
    renew    Renew password for all existing hosts\n
    ssh key generation root account\$ - [email protected]\n\nVersie 1.0"

    return 0
  }

  # check for.......
  function fCheck()
  {
    # user must be root:
    [ $(whoami) = root ] || die "User must be root!"

    # checken binaries
    { [ -x /usr/bin/mysqldump ] && [ -x /usr/bin/mysql ]; } || die "This script depends on mysql-common!"

    # check op .my.cnf
    [ -f /root/.my.cnf ] || die "/root/.my.cnf Not found!"

    # checken op connectiviteit
    ( mysql --connect-timeout=2 -Be "show databases" |grep -Eq '(information_schema|mysql)' ) || die "Failed to connect to database!"

    # checken op staat
    [ "$( ${MYSQL} "DESC tbl_host" | wc -l )" -eq 57 ] || die "Database state unknown!"

    # check argumenten
    { [ "${ARGS}" = 1 ]; } || { fShowUsage ; exit 1; }

    # get arguments
    read -p "Type het ssh passphrase wachtwoord in ----> " FRASE ; sleep 1
    echo "Password stored, dont forget to put it in teampass as well!"

    # check for testkey
    { [ -f "/var/www/keys/testkey.id_rsa" ] && [ -f "/var/www/keys/testkey.id_rsa.pub" ]; } || die "Testkey /var/www/keys/testkey.id_rsa[.pub] is gone"

    # check for dirs
    { [ -d "${PUBKEYS}" ] ; } die "Dir ${PUBKEYS}  is gone"
    { [ -d "${PRIVKEYS}" ]; } die "Dir ${PRIVKEYS} is gone"
    { [ -d "${BASEDIR}" ] ; } die "Dir ${BASEDIR}  is gone"

    # check if passphrase is correct:
    if ! ( ssh-keygen -p -P "${FRASE}" -N "${FRASE}" -f /var/www/keys/testkey.id_rsa | grep -q 'Your identification has been saved with the new passphrase' ); then
       die "Passphrase Incorrect!"
    fi

    return 0
  }

  # fInspect functie check if key is valid or regenerate
  function fVerify()
  {
   HOSTALIAS="${@}"
   NAME="${HOSTALIAS}_id_rsa"

   # check if frase is consistent
   if ! ( ssh-keygen -p -P "${FRASE}" -N "${FRASE}" -f "${PRIVKEY}/${NAME}_id_rsa" | grep -q 'Your identification has been saved with the new passphrase' ); then
     die "Passphrase Incorrect!"
   fi

   # check if ${1} is existent in /var/www/keys/pubkeys or report
   if  [ -f "${PUBKEYS}/${NAME}.pub" ] && [ -f "${PRIVKEYS}/${NAME}" ]; then
       # check if frase is consistent
       if ! ( ssh-keygen -p -P "${FRASE}" -N "${FRASE}" -f "${PRIVKEY}/${NAME}_id_rsa" | grep -q 'Your identification has been saved with the new passphrase' ); then
          { fReport "${HOSTALIAS}" ; return 1; }
       fi
   else
       { fReport "${HOSTALIAS}" ; return 1; }
   fi

   return 0
  }

  # fReport removes missed keys, and outputs
  function fReport()
  {
   HOSTALIAS="${@}"
   NAME="${HOSTALIAS}_id_rsa"
   DEST="${TMP}"

   # check if ${1} is existen in /var/www/keys/pubkeys and remove
   [ -f "${PUBKEYS}/${NAME}.pub" ] && rm "${PUBKEYS}/${NAME}"
   [ -f "${DEST}/${NAME}.pub" ] && rm "${DEST}/${NAME}"

   # check if privkey is existen in /etc/keys and remove
   [ -f "${PRIVKEYS}/${NAME}" ] && rm "${PRIVKEYS}/${NAME}"
   [ -f "${DEST}/${NAME}" ] && rm "${DEST}/${NAME}"

   # echo output
   echo -e "Key for ${HOSTALIAS} failed in generation or passphrase change.\n
   If you are in a hurry, run this script again manually or check how this problem can be solved"

   return 0

  }

  # fGenerate keys
  function fGenerate()
  {
   HOSTALIAS="${@}"
   NAME="${HOSTALIAS}_id_rsa"
   DEST="${TMP}"

   # check if existent, if so check and go to next
   { [ -f "${PRIVKEYS}/${NAME}" ] && [ -f "${PUBKEYS}/${NAME}.pub" ]; } && { fVerify "${HOSTALIAS}" ; return 1; }

   # generate key and move
   { ssh-keygen -b 4096 -N "${FRASE}" -C "${HOSTALIAS}" -f "${DEST}/${NAME}"; }           || { fReport "${HOSTALIAS}" ; return 1; }
   { [ -f "${DEST}/${NAME}" ]     && mv "${DEST}/${NAME}" "${PRIVKEYS}/${NAME}"; }        || { fReport "${HOSTALIAS}" ; return 1; }
   { [ -f "${DEST}/${NAME}.pub" ] && mv "${DEST}/${NAME}.pub" "${PUBKEYS}/${NAME}.pub"; } || { fReport "${HOSTALIAS}" ; return 1; }

   return 0
  }

  # fChange keys
  function fChange()
  {
   HOSTALIAS="${1}"
   NEWFRASE="${2}"
   NAME="${HOSTALIAS}_id_rsa"
   SOURCE="${PRIVKEYS}"

   # check if existent, if so check and go to next
   [ -f "${PRIVKEYS}/${NAME}" ]    || { fReport "${HOSTALIAS}" ; return 1; }
   [ -f "${PUBKEYS}/${NAME}.pub" ] || { fReport "${HOSTALIAS}" ; return 1; }

   { ssh-keygen -p -P "${FRASE}" -N "${NEWFRASE}" -C "${HOSTALIAS}" -f "${SOURCE}/${NAME}"; } || { fReport "${HOSTALIAS}" ; return 1; }

   return 0
  }

  # create new keys
  function fRunCreate()
  {
   # check if existent:
   if [ ! -d "${TMP}" ] ; then
      mkdir -p "${TMP}"
   else
      cd ${TMP} && rm *
   fi

   # create keys
   for HOSTALIAS in $( ${MYSQL} "SELECT display_name FROM tbl_host WHERE display_name LIKE '\.linux\.'" | sed '1d' | sort -u )
   do
     fGenerate ${HOSTALIAS} || { fReport "${HOSTALIAS}" ; continue; }
   done

   return 0
  }

  # function renew password of old keys
  function fRunRenew()
  {
   read -p "Please type the new passphrase for all ssh keys: ---> " NEWFRASE

   # check if enough chars:
   if [ "$( echo "${NEWFRASE}" | wc -m )" -lt 12 ] ; then
      die "Passphrase is less than 10 Chars, Please pick a STRONGER password! Are you a Window\$oft Clicker?"
   fi

   # for key in
   for KEY in $( ls ${PRIVKEYS} )
   do
    fChange "${HOSTALIAS}" "${NEWFRASE}" || { fReport "${HOSTALIAS}" ; continue; }
   done

   return 0
  }

  # The main function.
  function fMain()
  {
    # check for arguments:
    [ "${ARGS}" = 1 ] || fShowUsage

    # Do the Magic:
     #get options and set vars
      case "${ARG1}" in

        create)
          fRunCreate
          ;;
        renew)
          fRunRenew
          ;;
        help)
          fShowUsage
          ;;
        *)
          fShowUsage
          ;;
      esac

    return 0
  }

 # check environment:
  fCheck

 # Start the program:
  fMain

 # Exit with previous return code:
  exit "${?}"