Skip to content

Add logs to keystore-setup and fix password regex #10723

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add logs to keystore-setup and fix password regex #10723

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e7c0472
Add logs to keystore-setup and fix password regex
deajan Apr 15, 2025
d9a633e
Move logging to logger & fix shellcheck issues
deajan Apr 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
68 changes: 49 additions & 19 deletions scripts/util/keystore-setup
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,52 +25,82 @@ CSR_FILE="$5"
ALIAS="cloud"
LIBVIRTD_FILE="/etc/libvirt/libvirtd.conf"

if type -p logger > /dev/null; then
LOGGER_CMD="$(type -p logger) -t cloudstack-keystore-setup"
else
LOG_FILE="/var/log/cloudstack/agent/cloudstack-keystore-setup.log"
log() {
if [ "${1}" != "" ]; then
__log_line="${1}"
else
read -r __log_line
fi

echo "${__log_line}" >> "${LOG_FILE}"
echo "${__log_line}"
}
LOGGER_CMD=log
fi

$LOGGER_CMD "$(date) - starting keystore-setup"

# Re-use existing password or use the one provided
if [ -f "$PROPS_FILE" ]; then
OLD_PASS=$(sed -n '/keystore.passphrase/p' "$PROPS_FILE" 2>/dev/null | sed 's/keystore.passphrase=//g' 2>/dev/null)
if [ ! -z "${OLD_PASS// }" ]; then
$LOGGER_CMD "Previous props file exists, trying to extract password"
OLD_PASS=$(sed -n '/^keystore.passphrase/p' "$PROPS_FILE" | sed 's/^keystore.passphrase=//g')
if [ -n "${OLD_PASS// }" ]; then
KS_PASS="$OLD_PASS"
$LOGGER_CMD "Password extraction successful"
else
sed -i "/keystore.passphrase.*/d" $PROPS_FILE 2> /dev/null || true
echo "keystore.passphrase=$KS_PASS" >> $PROPS_FILE
sed -i "/^keystore.passphrase.*/d" "$PROPS_FILE" 2>&1 | $LOGGER_CMD || true
echo "keystore.passphrase=$KS_PASS" >> "$PROPS_FILE"
if [ $? != 0 ]; then
$LOGGER_CMD "Could not add new password to agent.properties"
else
$LOGGER_CMD "New keystore password set"
fi
fi
fi

if [ -f "$KS_FILE" ]; then
keytool -delete -noprompt -alias "$ALIAS" -keystore "$KS_FILE" -storepass "$KS_PASS" > /dev/null 2>&1 || true
$LOGGER_CMD "keystore file exists. Deleting current entries"
keytool -delete -noprompt -alias "$ALIAS" -keystore "$KS_FILE" -storepass "$KS_PASS" 2>&1 | $LOGGER_CMD
[ $? -ne 0 ] && $LOGGER_CMD "Failed to delete current entries"
fi

$LOGGER_CMD "Generating new key"
CN=$(hostname --fqdn)
keytool -genkey -storepass "$KS_PASS" -keypass "$KS_PASS" -alias "$ALIAS" -keyalg RSA -validity "$KS_VALIDITY" -dname cn="$CN",ou="cloudstack",o="cloudstack",c="cloudstack" -keystore "$KS_FILE" > /dev/null 2>&1
keytool -genkey -storepass "$KS_PASS" -keypass "$KS_PASS" -alias "$ALIAS" -keyalg RSA -validity "$KS_VALIDITY" -dname cn="$CN",ou="cloudstack",o="cloudstack",c="cloudstack" -keystore "$KS_FILE" 2>&1 | $LOGGER_CMD

# Generate CSR
rm -f "$CSR_FILE"
$LOGGER_CMD "Generating CSR"
[ -f "$CSR_FILE" ] && rm -f "$CSR_FILE"
addresses=$(ip address | grep inet | awk '{print $2}' | sed 's/\/.*//g' | grep -v '^169.254.' | grep -v '^127.0.0.1' | egrep -v '^::1|^fe80' | grep -v '^::1' | sed 's/^/ip:/g' | tr '\r\n' ',')
keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file $CSR_FILE -keystore "$KS_FILE" -ext san="$addresses" > /dev/null 2>&1

$LOGGER_CMD "Found following SAN addresses to add to CSR: ${addresses}"
keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file "$CSR_FILE" -keystore "$KS_FILE" -ext san="$addresses" 2>&1 | $LOGGER_CMD
if [ $? -ne 0 ];then
echo "Failed to generate CSR file, retrying after removing existing settings"
$LOGGER_CMD "Failed to generate CSR file, retrying after removing existing settings"

if [ -f "$LIBVIRTD_FILE" ]; then
echo "Reverting libvirtd to not listen on TLS"
$LOGGER_CMD "Reverting libvirtd to not listen on TLS"
sed -i "s,^listen_tls=1,listen_tls=0,g" $LIBVIRTD_FILE
systemctl restart libvirtd
fi

echo "Removing cloud.* files in /etc/cloudstack/agent"
rm -f /etc/cloudstack/agent/cloud.*
$LOGGER_CMD "Removing cloud.* files in /etc/cloudstack/agent"
rm -f /etc/cloudstack/agent/cloud.* || $LOGGER_CMD "Could not remove /etc/cloudstack/agent/cloud.*"

echo "Retrying to generate CSR file"
keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file $CSR_FILE -keystore "$KS_FILE" -ext san="$addresses" >/dev/null 2>&1
$LOGGER_CMD "Retrying to generate CSR file"
keytool -certreq -storepass "$KS_PASS" -alias "$ALIAS" -file "$CSR_FILE" -keystore "$KS_FILE" -ext san="$addresses" 2>&1 | $LOGGER_CMD
if [ $? -ne 0 ];then
echo "Failed to generate CSR file while retrying"
$LOGGER_CMD "Failed to generate CSR file while retrying"
exit 1
fi
fi

cat "$CSR_FILE"

# Fix file permissions
chmod 600 $KS_FILE
chmod 600 $PROPS_FILE
chmod 600 $CSR_FILE
chmod 600 "$KS_FILE" || $LOGGER_CMD "Cannot chmod $KS_FILE"
chmod 600 "$PROPS_FILE" || $LOGGER_CMD "Cannot chmod $PROPS_FILE"
chmod 600 "$CSR_FILE" || $LOGGER_CMD "Cannot chmod $CSR_FILE"
Loading