[git.ipfire.org] IPFire 2.x development tree branch, next, updated. 36c16c71ed854b5bc43b79be926dd1d00f9091ff

[Arne Fitzenreiter <git@ipfire.org>]

[-- Attachment #1: Type: text/plain, Size: 3853 bytes --]

This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".

The branch, next has been updated
       via  36c16c71ed854b5bc43b79be926dd1d00f9091ff (commit)
      from  bca096b453809236775b497e0a3e4c7cd5e5437e (commit)

Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.

- Log -----------------------------------------------------------------
commit 36c16c71ed854b5bc43b79be926dd1d00f9091ff
Author: Arne Fitzenreiter <arne_f(a)ipfire.org>
Date:   Thu Jan 18 18:02:10 2024 +0100

    core183: replace https rsa key if it is too small
    
    new openssl need at least 2048 bit rsa keys for apache.
    So if the existing is smaller a new 4096 bit key is generated.
    
    fixes #13527
    
    Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org>

-----------------------------------------------------------------------

Summary of changes:
 config/backup/backup.pl                   | 13 +++++++++++++
 config/rootfiles/core/183/filelists/files |  1 +
 config/rootfiles/core/183/update.sh       | 15 +++++++++++++++
 3 files changed, 29 insertions(+)

Difference in files:
diff --git a/config/backup/backup.pl b/config/backup/backup.pl
index 75a0e4f60..7992f21c5 100644
--- a/config/backup/backup.pl
+++ b/config/backup/backup.pl
@@ -229,6 +229,19 @@ restore_backup() {
 	# Set correct ownership
 	chown nobody:nobody /var/ipfire/ovpn/ovpnconfig
 
+	# Generate new HTTPS RSA key if the existing is too small
+	KEYSIZE=$(openssl rsa -in /etc/httpd/server.key -text -noout | sed -n 's/Private-Key:\ (\(.*\)\ bit.*/\1/p')
+	if [ $KEYSIZE \< 2048 ]; then
+		openssl genrsa -out /etc/httpd/server.key 4096 &>/dev/null
+		chmod 600 /etc/httpd/server.key
+		sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
+				openssl req -new -key /etc/httpd/server.key \
+				-out /etc/httpd/server.csr &>/dev/null
+		openssl x509 -req -days 999999 -sha256 \
+			-in /etc/httpd/server.csr \
+			-signkey /etc/httpd/server.key \
+			-out /etc/httpd/server.crt &>/dev/null
+	fi
 	return 0
 }
 
diff --git a/config/rootfiles/core/183/filelists/files b/config/rootfiles/core/183/filelists/files
index 8e58c6ec2..42ddf682e 100644
--- a/config/rootfiles/core/183/filelists/files
+++ b/config/rootfiles/core/183/filelists/files
@@ -4,3 +4,4 @@ srv/web/ipfire/cgi-bin/dhcp.cgi
 srv/web/ipfire/cgi-bin/proxy.cgi
 srv/web/ipfire/cgi-bin/logs.cgi/firewalllog.dat
 usr/local/bin/backupiso
+var/ipfire/backup/bin/backup.pl
diff --git a/config/rootfiles/core/183/update.sh b/config/rootfiles/core/183/update.sh
index 3312608bc..5930ad324 100644
--- a/config/rootfiles/core/183/update.sh
+++ b/config/rootfiles/core/183/update.sh
@@ -128,6 +128,21 @@ if grep -q "ENABLED=on" /var/ipfire/vpn/settings; then
 	/etc/rc.d/init.d/ipsec start
 fi
 
+# Check apache rsa key and replace if it is too small
+KEYSIZE=$(openssl rsa -in /etc/httpd/server.key -text -noout | sed -n 's/Private-Key:\ (\(.*\)\ bit.*/\1/p')
+if [ $KEYSIZE \< 2048 ]; then
+	echo "Generating new HTTPS RSA server key (this will take a moment)..."
+	openssl genrsa -out /etc/httpd/server.key 4096 &>/dev/null
+	chmod 600 /etc/httpd/server.key
+	sed "s/HOSTNAME/`hostname -f`/" < /etc/certparams | \
+		openssl req -new -key /etc/httpd/server.key \
+			-out /etc/httpd/server.csr &>/dev/null
+	openssl x509 -req -days 999999 -sha256 \
+		-in /etc/httpd/server.csr \
+		-signkey /etc/httpd/server.key \
+		-out /etc/httpd/server.crt &>/dev/null
+fi
+
 # Rebuild initial ramdisks
 dracut --regenerate-all --force
 KVER="xxxKVERxxx"


hooks/post-receive
--
IPFire 2.x development tree