149 lines
4.5 KiB
Bash
149 lines
4.5 KiB
Bash
#!/bin/bash
|
|
# Daily CRL Update Script for SAW
|
|
# Version: 1.0
|
|
# Date: 2026-04-02
|
|
#
|
|
# This script is designed to be run as a cron job to keep the Certificate
|
|
# Revocation List (CRL) up to date. It downloads, verifies, and installs
|
|
# the CRL from your CA server.
|
|
#
|
|
# This script should be scheduled to run daily, typically at 2:00 AM.
|
|
#
|
|
# Setup:
|
|
# 1. Copy this script to /usr/local/bin/daily-crl-update.sh
|
|
# 2. Make it executable: chmod +x /usr/local/bin/daily-crl-update.sh
|
|
# 3. Configure the CRL_URL variable below with your CA server
|
|
# 4. Add to crontab: 0 2 * * * root /usr/local/bin/daily-crl-update.sh
|
|
#
|
|
# SECURITY RATIONALE:
|
|
# Regular CRL updates are critical because:
|
|
# 1. CRLs are updated when certificates are revoked
|
|
# 2. Outdated CRLs may allow revoked certificates
|
|
# 3. Daily updates ensure current revocation status
|
|
# 4. Meets compliance requirements for regular updates
|
|
# 5. Provides defense against compromised CA keys
|
|
#
|
|
# Reference: https://www.openssl.org/docs/man1.1.1/man1/crl.html
|
|
|
|
set -e
|
|
|
|
# Configuration
|
|
# TODO: Update this with your CA server URL
|
|
CRL_URL="https://your-ca-server.com/crl.pem"
|
|
CRL_CACHE_FILE="/var/cache/crl/crl.pem"
|
|
CA_KEY_PATH="/etc/pki/rpm-gpg/RPM-GPG-KEY-custom-ca"
|
|
LOG_FILE="/var/log/crl-update.log"
|
|
|
|
# Colors for output
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
BLUE='\033[0;34m'
|
|
NC='\033[0m'
|
|
|
|
# Print functions
|
|
log_info() {
|
|
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
echo -e "${GREEN}[$timestamp]${NC} [INFO] $1" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
log_warning() {
|
|
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
echo -e "${YELLOW}[$timestamp]${NC} [WARNING] $1" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
log_error() {
|
|
local timestamp=$(date '+%Y-%m-%d %H:%M:%S')
|
|
echo -e "${RED}[$timestamp]${NC} [ERROR] $1" | tee -a "$LOG_FILE"
|
|
}
|
|
|
|
# Main execution
|
|
main() {
|
|
echo "=========================================="
|
|
echo " Daily CRL Update"
|
|
echo " Fedora Kinoite SAW"
|
|
echo "=========================================="
|
|
echo ""
|
|
|
|
# Check if CRL URL is configured
|
|
if [ "$CRL_URL" = "https://your-ca-server.com/crl.pem" ]; then
|
|
log_error "CRL URL not configured"
|
|
log_info "Please edit this script and set CRL_URL to your CA server"
|
|
exit 1
|
|
fi
|
|
|
|
# Create cache directory
|
|
mkdir -p /var/cache/crl
|
|
|
|
# Download CRL
|
|
log_info "Downloading CRL from: $CRL_URL"
|
|
|
|
if ! curl -s -o "$CRL_CACHE_FILE" "$CRL_URL"; then
|
|
log_error "Failed to download CRL"
|
|
exit 1
|
|
fi
|
|
|
|
log_info "CRL downloaded successfully"
|
|
|
|
# Verify CRL
|
|
log_info "Verifying CRL signature..."
|
|
|
|
if [ ! -f "$CA_KEY_PATH" ]; then
|
|
log_error "CA key not found: $CA_KEY_PATH"
|
|
exit 1
|
|
fi
|
|
|
|
if ! openssl crl -in "$CRL_CACHE_FILE" -CAfile "$CA_KEY_PATH" -noout 2>/dev/null; then
|
|
log_error "CRL verification failed"
|
|
exit 1
|
|
fi
|
|
|
|
log_info "CRL verified successfully"
|
|
|
|
# Get CRL information
|
|
local this_update=$(openssl crl -in "$CRL_CACHE_FILE" -noout -text 2>/dev/null | grep "Last Update:" | head -1)
|
|
log_info "CRL Last Update: $this_update"
|
|
|
|
# Update CA trust
|
|
log_info "Updating CA trust database..."
|
|
|
|
# Copy CRL to CA trust source
|
|
mkdir -p /etc/pki/ca-trust/source/anchors
|
|
cp "$CRL_CACHE_FILE" /etc/pki/ca-trust/source/anchors/crl.pem
|
|
|
|
# Update CA trust
|
|
update-ca-trust extract
|
|
|
|
log_info "CA trust database updated"
|
|
|
|
# Check for revoked certificates in installed packages
|
|
log_info "Checking for revoked certificates..."
|
|
|
|
local revoked_count=0
|
|
|
|
# Check a sample of packages (first 100)
|
|
while IFS= read -r pkg; do
|
|
# Extract certificate ID from signature
|
|
local cert_id=$(echo "$pkg" | awk '{print $2}' | cut -d: -f2)
|
|
|
|
if [ -n "$cert_id" ]; then
|
|
# Check if certificate is in CRL
|
|
if openssl crl -in "$CRL_CACHE_FILE" -noout -text 2>/dev/null | grep -q "$cert_id"; then
|
|
log_error "REVOKED: Package signed with revoked certificate: $cert_id"
|
|
((revoked_count++))
|
|
fi
|
|
fi
|
|
done < <(rpm -qa --queryformat='%{NAME} %{SIGPGP:pgpsig}\n' 2>/dev/null | head -100)
|
|
|
|
if [ $revoked_count -gt 0 ]; then
|
|
log_warning "WARNING: $revoked_count packages have revoked certificates!"
|
|
log_info "These packages should be reviewed"
|
|
else
|
|
log_info "No revoked certificates found in checked packages"
|
|
fi
|
|
|
|
log_info "CRL update completed successfully"
|
|
}
|
|
|
|
# Run main function
|
|
main "$@" |