ラベル鯖の投稿を表示しています。すべての投稿を表示

2015/10/28

$ cd ~/tmp/ssl
$ mkdir ca
$ mkdir ca/newcerts ca/crl ca/private client
$ touch ca/index.txt
$ echo 00 > ca/serial
$ echo 00 > ca/crlnumber
$ cp /usr/ssl/openssl.cnf ./

dir を ca の絶対パスに修正

$ vim ./openssl.cnf

CA 環境構築

CA 秘密鍵を作成

$ openssl genrsa -out ca/private/cakey.pem 2048 -config openssl.cnf

CA 証明書要求を作成

$ openssl req -new -key ca/private/cakey.pem -out ca/cacsr.pem -config openssl.cnf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:Minato-ku
Organization Name (eg, company) [Internet Widgits Pty Ltd]:foo
Organizational Unit Name (eg, section) []:bar
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

CA 証明書を作成

$ openssl x509 -req -in ca/cacsr.pem -signkey ca/private/cakey.pem -out ca/cacert.pem

クライアント環境構築

クライアント秘密鍵作成

$ openssl genrsa -out client/clientkey.pem 2048 -config ./openssl.cnf

クライアント証明書要求を作成

$ openssl req -new -key client/clientkey.pem -out client/clientcsr.pem -config ./openssl.cnf
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:JP
State or Province Name (full name) [Some-State]:Tokyo
Locality Name (eg, city) []:Minato-ku
Organization Name (eg, company) [Internet Widgits Pty Ltd]:foo
Organizational Unit Name (eg, section) []:bar
Common Name (e.g. server FQDN or YOUR name) []:localhost
Email Address []:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

クライアント証明書作成

クライアントから csr を受け取った CA がやる作業。

$ openssl ca -config ./openssl.cnf -out client/client.crt -infiles client/clientcsr.pem
Using configuration from ./openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 0 (0x0)
        Validity
            Not Before: Oct 27 17:33:35 2015 GMT
            Not After : Oct 26 17:33:35 2016 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            organizationName          = foo
            organizationalUnitName    = bar
            commonName                = localhost
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                E1:44:51:CF:68:FC:3D:E1:52:59:F3:C3:E9:09:B4:64:CC:81:47:7C
            X509v3 Authority Key Identifier:
                DirName:/C=JP/ST=Tokyo/L=Minato-ku/O=foo/OU=bar/CN=localhost
                serial:E3:E6:4D:2B:0C:20:5A:E2

Certificate is to be certified until Oct 26 17:33:35 2016 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

サーバー環境構築

サーバー秘密鍵とキーストア作成

$ keytool -genkey -alias tomcat -keyalg RSA -keystore ../../.keystore
キーストアのパスワードを入力してください:  changeit
新規パスワードを再入力してください: changeit
姓名は何ですか。
  [Unknown]:  localhost
組織単位名は何ですか。
  [Unknown]:  bar
組織名は何ですか。
  [Unknown]:  foo
都市名または地域名は何ですか。
  [Unknown]:  Minato-ku
都道府県名または州名は何ですか。
  [Unknown]:  Tokyo
この単位に該当する2文字の国コードは何ですか。
  [Unknown]:  JP
CN=localhost, OU=bar, O=foo, L=Minato-ku, ST=Tokyo, C=JPでよろしいですか。
  [いいえ]:  y

<tomcat>の鍵パスワードを入力してください
        (キーストアのパスワードと同じ場合はRETURNを押してください):

サーバー証明書要求作成

$ keytool -certreq -alias tomcat -file tomcat.csr -keystore ../../.keystore

サーバー証明書作成

サーバーから csr を受け取った CA がやる作業。

$ openssl ca -policy policy_anything -config ./openssl.cnf -out tomcat.crt -infiles tomcat.csr
Using configuration from ./openssl.cnf
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number: 1 (0x1)
        Validity
            Not Before: Oct 27 17:47:23 2015 GMT
            Not After : Oct 26 17:47:23 2016 GMT
        Subject:
            countryName               = JP
            stateOrProvinceName       = Tokyo
            localityName              = Minato-ku
            organizationName          = foo
            organizationalUnitName    = bar
            commonName                = localhost
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            Netscape Comment:
                OpenSSL Generated Certificate
            X509v3 Subject Key Identifier:
                5A:E0:56:79:25:16:46:39:DD:33:89:59:67:91:0F:5F:96:49:CB:10
            X509v3 Authority Key Identifier:
                DirName:/C=JP/ST=Tokyo/L=Minato-ku/O=foo/OU=bar/CN=localhost
                serial:E3:E6:4D:2B:0C:20:5A:E2

Certificate is to be certified until Oct 26 17:47:23 2016 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

サーバーキーストアにCA証明書をインポート

$ keytool -import -alias ca -trustcacerts -file ./ca/cacert.pem -keystore ../../.keystore
キーストアのパスワードを入力してください:  changeit
所有者: CN=localhost, OU=bar, O=foo, L=Minato-ku, ST=Tokyo, C=JP
発行者: CN=localhost, OU=bar, O=foo, L=Minato-ku, ST=Tokyo, C=JP
シリアル番号: e3e64d2b0c205ae2
有効期間の開始日: Wed Oct 28 02:28:40 JST 2015終了日: Fri Nov 27 02:28:40 JST 2015
証明書のフィンガプリント:
         MD5:  5C:16:AC:D6:25:3D:59:23:1B:C1:CF:F1:51:A1:6A:4B
         SHA1: 4B:C2:E7:3D:21:71:6E:C7:29:5A:34:67:9A:0C:E1:30:E8:B2:C2:19
         SHA256: DA:4B:2C:07:86:D3:93:2C:A9:74:28:54:D5:5D:77:83:3F:85:D9:01:8D:34:98:99:BD:BF:51:AC:84:59:10:91
         署名アルゴリズム名: SHA256withRSA
         バージョン: 1
この証明書を信頼しますか。 [いいえ]:  y
証明書がキーストアに追加されました

サーバーキーストアにサーバー証明書をインポート

$ keytool -import -alias tomcat -trustcacerts -file ./tomcat.crt -keystore ../../.keystore
キーストアのパスワードを入力してください:  changeit
証明書応答がキーストアにインストールされました

Tomcat 設定

server.xml

redirectPort を削除。

    <Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1"/>

追加。

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="true" sslProtocol="TLS" truststoreFile= "C:/Users/mikoto/.keystore"
               truststorePass="changeit"/>

web.xml

web-app タグの末尾に追加。

<login-config>
    <auth-method>CLIENT-CERT</auth-method>
</login-config>

wget してみる

$ # クライアント証明書による認証で失敗する
$ wget https://localhost:8443/
--2015-10-28 03:05:42--  https://localhost:8443/
localhost (localhost) をDNSに問いあわせています... ::1, 127.0.0.1
localhost (localhost)|::1|:8443 に接続しています... 接続しました。
OpenSSL: error:14094412:SSL routines:ssl3_read_bytes:sslv3 alert bad certificate
SSL による接続が確立できません。
$
$
$ # クライアント証明書を指定して接続しに行く。
$ # サーバ証明書が信用できない証明書なので失敗する
$ wget https://localhost:8443/ --private-key=client/clientkey.pem --certificate=client/client.crt
--2015-10-28 03:07:46--  https://localhost:8443/
localhost (localhost) をDNSに問いあわせています... ::1, 127.0.0.1
localhost (localhost)|::1|:8443 に接続しています... 接続しました。
エラー: localhost の証明書(発行者: `CN=localhost,OU=bar,O=foo,L=Minato-ku,ST=Tokyo,C=JP')の検証に失敗しました:
  自己署名証明書です。
localhost に安全の確認をしないで接続するには、`--no-check-certificate' を使ってください。
$
$
$ # クライアント証明書とCA証明書を指定して接続しに行く
$ # サーバ証明書がCAに信用されているので接続できる
$ wget https://localhost:8443/ --private-key=client/clientkey.pem --certificate=client/client.crt --ca-certificate=ca/cacert.pem
--2015-10-28 03:09:41--  https://localhost:8443/
localhost (localhost) をDNSに問いあわせています... ::1, 127.0.0.1
localhost (localhost)|::1|:8443 に接続しています... 接続しました。
HTTP による接続要求を送信しました、応答を待っています... 404 Not Found
2015-10-28 03:09:41 エラー 404: Not Found。

2013/10/29

インストール

aptitude install gitit git-core

データ格納ディレクトリ作成

mkdir -p /data/wiki

デフォルト設定ファイルの作成

gitit --print-default-config > /data/wiki/gitit.conf
vi /data/wiki/gitit.conf

# 修正点のみ抜き出し
# パスをすべて絶対パスに直す
repository-path: /data/wiki/wikidata
user-file: /data/wiki/gitit-users
static-dir: /data/wiki/static
templates-dir: /data/wiki/templates
log-file: /data/wiki/gitit.log

起動スクリプト作成

cp /etc/init.d/skeleton /etc/init.d/gitit
vi /etc/init.d/gitit

#! /bin/sh
### BEGIN INIT INFO
# Provides:          gitit
# Required-Start:    $remote_fs $syslog
# Required-Stop:     $remote_fs $syslog
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Wiki Server Gitit
# Description:       Wiki Server Gitit
### END INIT INFO

# Author: mikoto2000 <mikoto2000>

# Do NOT "set -e"

# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="Wiki Server Gitit"
NAME=gitit
DAEMON=/usr/bin/$NAME
DAEMON_ARGS="-f /data/wiki/gitit.conf"
PIDFILE=/var/run/$NAME.pid
SCRIPTNAME=/etc/init.d/$NAME
PWD=/data/wiki

# Exit if the package is not installed
[ -x "$DAEMON" ] || exit 0

# Read configuration variable file if it is present
[ -r /etc/default/$NAME ] && . /etc/default/$NAME

# Load the VERBOSE setting and other rcS variables
. /lib/init/vars.sh

# Define LSB log_* functions.
# Depend on lsb-base (>= 3.2-14) to ensure that this file is present
# and status_of_proc is working.
. /lib/lsb/init-functions

#
# Function that starts the daemon/service
#
do_start()
{
    # Return
    #   0 if daemon has been started
    #   1 if daemon was already running
    #   2 if daemon could not be started
    start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --test > /dev/null \
        || return 1
    start-stop-daemon --start --quiet --pidfile $PIDFILE --exec $DAEMON --background -- \
        $DAEMON_ARGS \
        || return 2
    # Add code here, if necessary, that waits for the process to be ready
    # to handle requests from services started subsequently which depend
    # on this one.  As a last resort, sleep for some time.
}

#
# Function that stops the daemon/service
#
do_stop()
{
    # Return
    #   0 if daemon has been stopped
    #   1 if daemon was already stopped
    #   2 if daemon could not be stopped
    #   other if a failure occurred
    start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile $PIDFILE --name $NAME
    RETVAL="$?"
    [ "$RETVAL" = 2 ] && return 2
    # Wait for children to finish too if this is a daemon that forks
    # and if the daemon is only ever run from this initscript.
    # If the above conditions are not satisfied then add some other code
    # that waits for the process to drop all resources that could be
    # needed by services started subsequently.  A last resort is to
    # sleep for some time.
    start-stop-daemon --stop --quiet --oknodo --retry=5 --signal 0 --exec $DAEMON
    [ "$?" = 2 ] && return 2
    # Many daemons don't delete their pidfiles when they exit.
    rm -f $PIDFILE
    return "$RETVAL"
}

#
# Function that sends a SIGHUP to the daemon/service
#
do_reload() {
    #
    # If the daemon can reload its configuration without
    # restarting (for example, when it is sent a SIGHUP),
    # then implement that here.
    #
    start-stop-daemon --stop --signal 1 --quiet --pidfile $PIDFILE --name $NAME
    return 0
}

case "$1" in
  start)
    [ "$VERBOSE" != no ] && log_daemon_msg "Starting $DESC" "$NAME"
    do_start
    case "$?" in
        0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
        2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
    esac
    ;;
  stop)
    [ "$VERBOSE" != no ] && log_daemon_msg "Stopping $DESC" "$NAME"
    do_stop
    case "$?" in
        0|1) [ "$VERBOSE" != no ] && log_end_msg 0 ;;
        2) [ "$VERBOSE" != no ] && log_end_msg 1 ;;
    esac
    ;;
  status)
       status_of_proc "$DAEMON" "$NAME" && exit 0 || exit $?
       ;;
  #reload|force-reload)
    #
    # If do_reload() is not implemented then leave this commented out
    # and leave 'force-reload' as an alias for 'restart'.
    #
    #log_daemon_msg "Reloading $DESC" "$NAME"
    #do_reload
    #log_end_msg $?
    #;;
  restart|force-reload)
    #
    # If the "reload" option is implemented then remove the
    # 'force-reload' alias
    #
    log_daemon_msg "Restarting $DESC" "$NAME"
    do_stop
    case "$?" in
      0|1)
        do_start
        case "$?" in
            0) log_end_msg 0 ;;
            1) log_end_msg 1 ;; # Old process is still running
            *) log_end_msg 1 ;; # Failed to start
        esac
        ;;
      *)
        # Failed to stop
        log_end_msg 1
        ;;
    esac
    ;;
  *)
    #echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload}" >&2
    echo "Usage: $SCRIPTNAME {start|stop|status|restart|force-reload}" >&2
    exit 3
    ;;
esac

:

起動スクリプトに実行権限追加

chmod a+x /etc/init.d/gitit

スタート確認

/etc/init.d/gitit start
ps aux | grep gitit

ストップ確認

/etc/init.d/gitit stop
ps aux | grep gitit

サービス登録

update-rc.d gitit defaults

2012/09/01

[Debian][鯖][作業記録] Debian 最小構成インストールから Apache2 + Redmine の index.html を拝むまで

やったこと

redmine のインストール
apache との連携設定

redmine の導入

# パッケージのインストール
aptitude install redmine

# コンテンツ(？)ファイル郡のコピー
#(デフォルトの場所が気に入らなかったので場所変更)
mkdir /var/redmine
cd /var/redmine
cp -a /usr/share/redmine/* ./

# 起動テスト
ruby script/server webrick -e production
=> Booting WEBrick
=> Rails 2.3.5 application starting on http://127.0.0.1:3000
./script/../config/../vendor/rails/railties/lib/rails/gem_dependency.rb:119:Warning: Gem::Dependency#version_requirements is deprecated and will be removed on or after August 2010.  Use #requirement
/var/redmine/vendor/rails/railties/lib/rails/rack/log_tailer.rb:10:in `size': No such file or directory - /var/redmine/log/production.log (Errno::ENOENT)
        from /var/redmine/vendor/rails/railties/lib/rails/rack/log_tailer.rb:10:in `initialize'
        from /usr/lib/ruby/1.8/rack/builder.rb:54:in `new'
        from /usr/lib/ruby/1.8/rack/builder.rb:54:in `use'
        from /usr/lib/ruby/1.8/rack/builder.rb:73:in `call'
        from /usr/lib/ruby/1.8/rack/builder.rb:73:in `to_app'
        from /usr/lib/ruby/1.8/rack/builder.rb:71:in `inject'
        from /usr/lib/ruby/1.8/rack/builder.rb:73:in `each'
        from /usr/lib/ruby/1.8/rack/builder.rb:73:in `inject'
        from /usr/lib/ruby/1.8/rack/builder.rb:73:in `to_app'
        from /var/redmine/vendor/rails/railties/lib/commands/server.rb:95
        from /usr/lib/ruby/1.8/rubygems/custom_require.rb:31:in `gem_original_require'
        from /usr/lib/ruby/1.8/rubygems/custom_require.rb:31:in `require'
        from script/server:3

# production.log がないと怒られたので作成する
mkdir log
touch log/production.log
ruby script/server webrick -e production

# 動作確認
w3m http://127.0.0.1:3000/

apache2 との連携設定

# 必要パッケージインストール
aptitude install apache2 libapache2-mod-passenger

# ここで指定したパスにアクセスすると、 rails が動く？
echo 'RailsBaseURI /redmine" >> /etc/apache2/httpd.conf

# apache の公開ディレクトリに、
# redmine のファイルへのシンボリックリンクを作成。
ln -s /var/redmine/public redmine

# apache スタート
/etc/init.d/apache2 restart

設定は、深く考えずに書きサイトよりコピペ的に拝借しました。