tls_livemigration

###############################################
#                                             #
#  Livmigration TLS-Skript                    #
#  Autor: Christoph Raible                    #
#                                             #
###############################################
###############################################################################
#                                                                             #
#  Requirements:                                                              #
#  Jeder Server sollte per ssh ohne passwortautentifizierung erreichbar sein  #
#  Die beiliegenden Konfigurationsdateien müssen angepasst werden             #
#                                                                             #
###############################################################################



#Variablen
LOCATION=/root/TLS_LIVEMIGRATION2
DIRECTORY=/etc/pki
HOSTNAME=( nebula0 nebula1 nebula2 nebula3 )

# Private Key erstellen
cd $LOCATION
certtool --generate-privkey > ca-key.pem
certtool --generate-self-signed --load-privkey ca-key.pem --template ca.info --outfile ca-cert.pem


#Vorlagen erstellen
for host in "${HOSTNAME[@]}"; do sed "s/nebulaX/$host/" worker-server.info.TEMPLATE > $host-server.info  ;done


# Template aufräumen
rm -f worker.info.TEMPLATE

# Private Key pro Worker
for host in "${HOSTNAME[@]}"; do certtool --generate-privkey > $host-serverkey.pem ;done
for host in "${HOSTNAME[@]}"; do certtool --generate-certificate --load-privkey $host-serverkey.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template $host-server.info --outfile $host-servercert.pem ;done


# Anlegen der $host-client.info via Template
for host in "${HOSTNAME[@]}"; do sed "s/nebulaX/$host/" worker-client.info.TEMPLATE > $host-client.info  ;done
for host in "${HOSTNAME[@]}"; do certtool --generate-privkey > $host-clientkey.pem ;done
for host in "${HOSTNAME[@]}"; do certtool --generate-certificate --load-privkey $host-clientkey.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template $host-client.info --outfile $host-clientcert.pem; done


# Erstellen der Ordnerstruktur & Setzen der Rechte
for host in "${HOSTNAME[@]}"; do ssh $host "mkdir -p $DIRECTORY/CA/private &&  chmod 755 $DIRECTORY/CA && chmod 755 $DIRECTORY/ && mkdir -p $DIRECTORY/libvirt/private/ && chmod 755 $DIRECTORY/libvirt/private &&  chown root:kvm $DIRECTORY/libvirt/private && chmod 755 $DIRECTORY/libvirt/ &&  chown root:kvm $DIRECTORY/libvirt/"; done



#Verteilen der keys auf die entsprechenden Server
for host in "${HOSTNAME[@]}"; do scp $host-clientkey.pem $host:$DIRECTORY/libvirt/private/clientkey.pem; done
for host in "${HOSTNAME[@]}"; do scp $host-serverkey.pem $host:$DIRECTORY/libvirt/private/serverkey.pem ;done
for host in "${HOSTNAME[@]}"; do scp $host-servercert.pem $host:$DIRECTORY/libvirt/servercert.pem ;done
for host in "${HOSTNAME[@]}"; do scp $host-clientcert.pem $host:$DIRECTORY/libvirt/clientcert.pem ;done

#Setzen der richtigen Rechte
for host in "${HOSTNAME[@]}"; do ssh $host "chmod  744 $DIRECTORY/libvirt/private/*" ;done

#Altes CA-Cert sichern & Neues kopieren"
for host in "${HOSTNAME[@]}"; do ssh $host "mv $DIRECTORY/CA/cacert.pem $DIRECTORY/CA/cacert.pem.OLD"; done
for host in "${HOSTNAME[@]}"; do scp ca-cert.pem $host:$DIRECTORY/CA/cacert.pem ; done
for host in "${HOSTNAME[@]}"; do scp ca-key.pem $host:$DIRECTORY/CA/private/cakey.pem ; done
for host in "${HOSTNAME[@]}"; do ssh $host "chmod 744 $DIRECTORY/CA/cacert.pem && chmod 744 $DIRECTORY/CA/private/cakey.pem"; done