From 8fca612a7d5df82371d6e26f8a7e439b0e68296d Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Mon, 4 Jan 2021 08:11:23 +0100 Subject: [PATCH 1/6] Start work for using the go based signer --- .dockerignore | 1 + .gitignore | 3 ++- .mrconfig | 3 +++ docker-compose.yml | 2 +- docker/run-gosigner | 31 +++++++++++++++++++++++++++++++ gosigner.Dockerfile | 20 ++++++++++++++++++++ 6 files changed, 58 insertions(+), 2 deletions(-) create mode 100755 docker/run-gosigner create mode 100644 gosigner.Dockerfile diff --git a/.dockerignore b/.dockerignore index 4c49bd7..f66882e 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1 +1,2 @@ .env +**/.idea/** diff --git a/.gitignore b/.gitignore index 7269f5a..5829b8a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,7 @@ +.env .idea/ cacert-cats/ +cacert-gosigner/ cacert-mgr/ cacert-software/ -.env testca/ diff --git a/.mrconfig b/.mrconfig index 941a88e..b2f6f56 100644 --- a/.mrconfig +++ b/.mrconfig @@ -6,3 +6,6 @@ checkout = git clone git+ssh://git.cacert.org/srv/git/cacert-mgr.git cacert-mgr [cacert-software] checkout = git clone git+ssh://git.cacert.org/srv/git/cacert-devel.git cacert-software + +[cacert-gosigner] +checkout = git clone https://git.dittberner.info/jan/cacert-gosigner.git diff --git a/docker-compose.yml b/docker-compose.yml index 67cab0e..dd5d909 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -108,7 +108,7 @@ services: signer: build: context: . - dockerfile: signer.Dockerfile + dockerfile: gosigner.Dockerfile environment: SIGNER_WORKDIR: /srv/ca/work SIGNER_CA_CONFIG: /srv/caconfig diff --git a/docker/run-gosigner b/docker/run-gosigner new file mode 100755 index 0000000..44f7a7d --- /dev/null +++ b/docker/run-gosigner @@ -0,0 +1,31 @@ +#!/bin/sh + +set -eu + +export SERIAL_PORT=/dev/ttyUSB0 + +mkdir -p /srv/ca/CA/certs /srv/ca/CA/private /srv/ca/CA/newcerts +cp /srv/testca/root/ca.crt.pem /srv/ca/CA/ca.crt.pem +cp /srv/testca/root/private/ca.key.pem /srv/ca/CA/private/ca.key.pem +if [ ! -f /srv/ca/CA/index.txt ]; then cp /srv/testca/root/index.txt /srv/ca/CA/index.txt; fi +if [ ! -f /srv/ca/CA/index.txt.attr ]; then cp /srv/testca/root/index.txt.attr /srv/ca/CA/index.txt.attr; fi +if [ ! -f /srv/ca/CA/serial ]; then printf '00' >/srv/ca/CA/serial; fi +if [ ! -f /srv/ca/CA/crlnumber ]; then echo 1000 >/srv/ca/CA/crlnumber; fi + +mkdir -p /srv/ca/class3/certs /srv/ca/class3/private /srv/ca/class3/newcerts /srv/ca/gpg/gpg_root_0 +cp /srv/testca/class3/ca.crt.pem /srv/ca/class3/ca.crt.pem +cp /srv/testca/class3/private/ca.key.pem /srv/ca/class3/private/ca.key.pem +if [ ! -f /srv/ca/class3/index.txt ]; then cp /srv/testca/class3/index.txt /srv/ca/class3/index.txt; fi +if [ ! -f /srv/ca/class3/index.txt.attr ]; then cp /srv/testca/class3/index.txt.attr /srv/ca/class3/index.txt.attr; fi +if [ ! -f /srv/ca/class3/serial ]; then printf '00' >/srv/ca/class3/serial; fi +if [ ! -f /srv/ca/class3/crlnumber ]; then echo 1000 >/srv/ca/class3/crlnumber; fi +if [ ! -f /srv/ca/gpg/gpg_root_0/secring.gpg ]; then cp /srv/testca/gpg/gpg_root_0/secring.gpg /srv/ca/gpg/gpg_root_0/secring.gpg; fi +if [ ! -f /srv/ca/gpg/gpg_root_0/pubring.gpg ]; then cp /srv/testca/gpg/gpg_root_0/pubring.gpg /srv/ca/gpg/gpg_root_0/pubring.gpg; fi + +rm -f /srv/sockets/signer +socat -d -d PTY,link=/dev/ttyUSB0 UNIX-LISTEN:/srv/sockets/signer 2>&1 & +sleep 1 + +cd /app/ + +exec ./signer diff --git a/gosigner.Dockerfile b/gosigner.Dockerfile new file mode 100644 index 0000000..76f0dbf --- /dev/null +++ b/gosigner.Dockerfile @@ -0,0 +1,20 @@ +FROM golang:alpine AS builder + +COPY cacert-gosigner /src/ + +RUN set -ex ; \ + cd /src/signer ; \ + go build . + +FROM alpine/socat:latest + +COPY --from=builder /src/signer/signer /app/ + +COPY docker/run-gosigner usr/local/bin/ +COPY docker/signer-config/* /srv/caconfig/ +COPY testca /srv/testca/ + +VOLUME /srv/ca + +ENTRYPOINT [] +CMD ["/usr/local/bin/run-gosigner"] From 7e09af008e1ee81e1b1926f73ab9d6799a628236 Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Mon, 4 Jan 2021 20:40:51 +0100 Subject: [PATCH 2/6] Use buster-slim for go signer and smtp --- gosigner.Dockerfile | 18 ++++++++++++++---- mail.Dockerfile | 2 +- 2 files changed, 15 insertions(+), 5 deletions(-) diff --git a/gosigner.Dockerfile b/gosigner.Dockerfile index 76f0dbf..09ed63e 100644 --- a/gosigner.Dockerfile +++ b/gosigner.Dockerfile @@ -3,12 +3,22 @@ FROM golang:alpine AS builder COPY cacert-gosigner /src/ RUN set -ex ; \ - cd /src/signer ; \ - go build . + cd /src/cmd/signer ; \ + CGO_ENABLED=0 go build . -FROM alpine/socat:latest +# need to use Debian because we need xdelta 1.x to support signer protocol +# version 1 +FROM debian:buster-slim -COPY --from=builder /src/signer/signer /app/ +RUN apt-get update \ + && DEBIAN_FRONTEND=noninteractive \ + apt-get install -y --no-install-recommends \ + socat \ + xdelta \ + && apt-get clean \ + && rm -rf /var/lib/apt/lists/* + +COPY --from=builder /src/cmd/signer/signer /app/ COPY docker/run-gosigner usr/local/bin/ COPY docker/signer-config/* /srv/caconfig/ diff --git a/mail.Dockerfile b/mail.Dockerfile index 2ea32fb..9ff5fd9 100644 --- a/mail.Dockerfile +++ b/mail.Dockerfile @@ -1,4 +1,4 @@ -FROM debian:buster +FROM debian:buster-slim RUN apt-get update \ && DEBIAN_FRONTEND=noninteractive \ From e8bf83b231a9c7b29f3ed1732e5638007b2eba9b Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Tue, 5 Jan 2021 08:11:18 +0100 Subject: [PATCH 3/6] Switch imap and smtp to debian:buster-slim --- imap.Dockerfile | 15 --------------- smtp.Dockerfile | 4 ++-- 2 files changed, 2 insertions(+), 17 deletions(-) delete mode 100644 imap.Dockerfile diff --git a/imap.Dockerfile b/imap.Dockerfile deleted file mode 100644 index 14859a5..0000000 --- a/imap.Dockerfile +++ /dev/null @@ -1,15 +0,0 @@ -FROM debian:buster - -RUN apt-get update \ - && DEBIAN_FRONTEND=noninteractive \ - apt-get install -y --no-install-recommends \ - ca-certificates \ - curl \ - dovecot-imapd \ - psmisc \ - && apt-get clean \ - && rm -rf /var/lib/apt/lists/* - -EXPOSE 25 - -COPY docker/start-postfix.sh /usr/local \ No newline at end of file diff --git a/smtp.Dockerfile b/smtp.Dockerfile index 39a9195..8ed5da3 100644 --- a/smtp.Dockerfile +++ b/smtp.Dockerfile @@ -1,4 +1,4 @@ -FROM debian:buster +FROM debian:buster-slim RUN apt-get update \ && DEBIAN_FRONTEND=noninteractive \ @@ -26,4 +26,4 @@ VOLUME /home/catchall/Maildir COPY docker/run-postfix /usr/local/bin/run-postfix -CMD ["dumb-init", "/usr/local/bin/run-postfix"] \ No newline at end of file +CMD ["dumb-init", "/usr/local/bin/run-postfix"] From 7ee3ddd9981add5f21427f0a95c32a3ca6d5df58 Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Tue, 5 Jan 2021 20:26:29 +0100 Subject: [PATCH 4/6] WIP: devsetup --- setup_test_ca.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/setup_test_ca.sh b/setup_test_ca.sh index 9a9a3b3..4c7ea0a 100755 --- a/setup_test_ca.sh +++ b/setup_test_ca.sh @@ -133,8 +133,7 @@ if [ ! -f root/ca.crt.pem ]; then openssl req -new -x509 -config ca.cnf \ -keyout root/private/ca.key.pem \ -nodes \ - -subj "/CN=Test Root/C=${COUNTRY_CODE}/O=${ORGANIZATION}" \ - -days 3650 \ + -subj "/C=${COUNTRY_CODE}/O=${ORGANIZATION}/CN=Test Root" \ -extensions root_extensions \ -out root/ca.crt.pem fi From 0d012cbfe16e0c5e4f82a5d87199211bf53cd8a3 Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Fri, 8 Jan 2021 18:44:01 +0100 Subject: [PATCH 5/6] Synchronize openssl config --- docker/signer-config/class3-client-codesign.cnf | 6 +++--- docker/signer-config/class3-client-org.cnf | 6 +++--- docker/signer-config/class3-client.cnf | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docker/signer-config/class3-client-codesign.cnf b/docker/signer-config/class3-client-codesign.cnf index c6713c3..4d29fab 100644 --- a/docker/signer-config/class3-client-codesign.cnf +++ b/docker/signer-config/class3-client-codesign.cnf @@ -29,10 +29,10 @@ commonName = optional emailAddress = optional [ usr_cert ] -basicConstraints = critical, CA:FALSE +basicConstraints = critical,CA:FALSE nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org" -keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement -extendedKeyUsage = emailProtection, clientAuth, codeSigning, msCodeInd, msCodeCom, msEFS, msSGC, nsSGC +keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement +extendedKeyUsage = emailProtection,clientAuth,codeSigning,msCodeInd,msCodeCom,msEFS,msSGC,nsSGC authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org crlDistributionPoints = URI:http://crl.cacert.localhost/test-class3-revoke.crl subjectAltName = email:copy diff --git a/docker/signer-config/class3-client-org.cnf b/docker/signer-config/class3-client-org.cnf index ebb09a2..eef5545 100644 --- a/docker/signer-config/class3-client-org.cnf +++ b/docker/signer-config/class3-client-org.cnf @@ -29,10 +29,10 @@ commonName = optional emailAddress = optional [ usr_cert ] -basicConstraints = critical, CA:FALSE +basicConstraints = critical,CA:FALSE nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org" -keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement -extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC +keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement +extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl subjectAltName = email:copy diff --git a/docker/signer-config/class3-client.cnf b/docker/signer-config/class3-client.cnf index b9624f8..b800583 100644 --- a/docker/signer-config/class3-client.cnf +++ b/docker/signer-config/class3-client.cnf @@ -30,10 +30,10 @@ commonName = optional emailAddress = optional [ usr_cert ] -basicConstraints = critical, CA:FALSE +basicConstraints = critical,CA:FALSE nsComment = "To get your own certificate for FREE head over to http://www.CAcert.org" -keyUsage = critical, digitalSignature, keyEncipherment, keyAgreement -extendedKeyUsage = emailProtection, clientAuth, msEFS, msSGC, nsSGC +keyUsage = critical,digitalSignature,keyEncipherment,keyAgreement +extendedKeyUsage = emailProtection,clientAuth,msEFS,msSGC,nsSGC authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org crlDistributionPoints = URI:http://crl.cacert.localhost/class3-revoke.crl subjectAltName = email:copy From e575eed7ff82aa8b817b1a2ad3944462f94a0be7 Mon Sep 17 00:00:00 2001 From: Jan Dittberner Date: Fri, 23 Apr 2021 17:01:12 +0200 Subject: [PATCH 6/6] Add proper quotes to .env file --- README.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 586ac73..d0a4ac8 100644 --- a/README.md +++ b/README.md @@ -55,17 +55,17 @@ Variable | Usage ```shell -echo "CATCHALL_MAILBOX_PASSWORD=$(openssl rand -base64 18) +echo "CATCHALL_MAILBOX_PASSWORD='$(openssl rand -base64 18)' CLIENT_CERT_EMAIL=user@example.org -CLIENT_CERT_PASSWORD=$(openssl rand -base64 18) -CLIENT_CERT_USERNAME="John Doe" -MYSQL_WEBDB_PASSWORD=$(openssl rand -base64 18) +CLIENT_CERT_PASSWORD='$(openssl rand -base64 18)' +CLIENT_CERT_USERNAME='John Doe' +MYSQL_WEBDB_PASSWORD='$(openssl rand -base64 18)' MYSQL_WEBDB_USER=cacert_dev -MYSQL_CATS_PASSWORD=$(openssl rand -base64 18) +MYSQL_CATS_PASSWORD='$(openssl rand -base64 18)' MYSQL_CATS_USER=cats -MYSQL_MGR_PASSWORD=$(openssl rand -base64 18) +MYSQL_MGR_PASSWORD='$(openssl rand -base64 18)' MYSQL_MGR_USER=cacert_mgr -MYSQL_ROOT_PASSWORD=$(openssl rand -base64 18)" > .env +MYSQL_ROOT_PASSWORD='$(openssl rand -base64 18)'" | sed 's@/@_@g' > .env ./setup_test_ca.sh docker-compose up ```