LDAP: Rotate soon-to-be expired key material.

Also, switch from rsa4096 to ed25519 and use a separate key for each
syncrepl.

1 files changed, 6 insertions, 4 deletions

diff --git a/roles/common/files/usr/local/bin/genkeypair.sh b/roles/common/files/usr/local/bin/genkeypair.sh
index ad65aef..72102f4 100755
--- a/roles/common/files/usr/local/bin/genkeypair.sh
+++ b/roles/common/files/usr/local/bin/genkeypair.sh
@@ -102,48 +102,50 @@ while [ $# -gt 0 ]; do
         -f) force=$(( 1 + $force ));;
         --pubkey=?*) pubkey="${1#--pubkey=}";;
         --privkey=?*) privkey="${1#--privkey=}";;
 
         --usage=?*) usage="${usage:+$usage,}${1#--usage=}";;
         --config=?*) config="${1#--config=}";;
 
         --mode=?*) mode="${1#--mode=}";;
         --owner=?*) owner="${1#--owner=}";;
         --group=?*) group="${1#--group=}";;
 
         --help) usage; exit;;
         *) echo "Unrecognized argument: $1" >&2; exit 2
     esac
     shift;
 done
 
 case "$type" in
     # XXX: genrsa and dsaparam have been deprecated in favor of genpkey.
     # genpkey can also create explicit EC parameters, but not named.
-    rsa) genkey=genrsa; genkeyargs="-f4 ${bits:-2048}";;
-    dsa) genkey=dsaparam; genkeyargs="-noout -genkey ${bits:-1024}";;
+    rsa) genkey=genrsa; genkeyargs="-rand /dev/urandom -f4 ${bits:-2048}";;
+    dsa) genkey=dsaparam; genkeyargs="-rand /dev/urandom -noout -genkey ${bits:-1024}";;
     # See 'openssl ecparam -list_curves' for the list of supported
     # curves. StrongSwan doesn't support explicit curve parameters
     # (however explicit parameters might be required to make exotic
     # curves work with some clients.)
     ecdsa) genkey=ecparam
-           genkeyargs="-noout -name ${bits:-secp224r1} -param_enc named_curve -genkey";;
+           genkeyargs="-rand /dev/urandom -noout -name ${bits:-secp224r1} -param_enc named_curve -genkey";;
+    x25519|x448|ed25519|ed448) genkey=genpkey
+                               genkeyargs="-algorithm $type";;
     *) echo "Unrecognized key type: $type" >&2; exit 2
 esac
 
 if [ "$cmd" = x509 -o "$cmd" = csr ]; then
     case "$hash" in
         md5|rmd160|sha1|sha224|sha256|sha384|sha512|'') ;;
         *) echo "Invalid digest algorithm: $hash" >&2; exit 2;
     esac
 
     [ "$cn" ] || cn="$(hostname --fqdn)"
     [ ${#cn} -le 64 ] || { echo "CommonName too long: $cn" >&2; exit 2; }
 fi
 
 if [ -z "$config" -a \( "$cmd" = x509 -o "$cmd" = csr \) ]; then
     config=$(mktemp) || exit 2
     trap 'rm -f "$config"' EXIT
 
     # see /usr/share/ssl-cert/ssleay.cnf
     cat >"$config" <<- EOF
 		[ req ]
@@ -156,40 +158,40 @@ if [ -z "$config" -a \( "$cmd" = x509 -o "$cmd" = csr \) ]; then
 		[ req_distinguished_name ]
 		organizationName       = Fripost
 		organizationalUnitName = SSLcerts
 		$(echo "$ou")
 		commonName             = ${cn:-/}
 
 		[ v3_req ]
 		subjectAltName       = email:admin@fripost.org${dns:+, $dns}
 		basicConstraints     = critical, CA:FALSE
 		# https://security.stackexchange.com/questions/24106/which-key-usages-are-required-by-each-key-exchange-method
 		keyUsage             = critical, ${usage:-digitalSignature, keyEncipherment, keyCertSign}
 		subjectKeyIdentifier = hash
 	EOF
 fi
 
 if [ -s "$privkey" -a $force -eq 0 ]; then
     echo "Error: private key exists: $privkey" >&2
     exit 1
 elif [ ! -s "$privkey" -o $force -ge 2 ]; then
     install --mode="${mode:-0600}" ${owner:+--owner="$owner"} ${group:+--group="$group"} /dev/null "$privkey" || exit 2
-    openssl $genkey -rand /dev/urandom $genkeyargs >"$privkey" || exit 2
+    openssl $genkey $genkeyargs >"$privkey" || exit 2
     [ "$cmd" = dkim ] && exit
 fi
 
 if [ "$cmd" = x509 -a "$pubkey" = "$privkey" ]; then
     pubkey=$(mktemp)
     openssl req -config "$config" -new -x509 ${hash:+-$hash} -days 3650 -key "$privkey" >"$pubkey" || exit 2
     cat "$pubkey" >>"$privkey" || exit 2
     rm -f "$pubkey"
 elif [ "$cmd" = x509 -o "$cmd" = csr ]; then
     if [ -s "$pubkey" -a $force -eq 0 ]; then
         echo "Error: public key exists: $pubkey" >&2
         exit 1
     else
         [ "$cmd" = x509 ] && x509=-x509 || x509=
         openssl req -config "$config" -new $x509 ${hash:+-$hash} -days 3650 -key "$privkey" >"$pubkey" || exit 2
     fi
 elif [ "$cmd" = keypair -a "$pubkey" ]; then
     openssl pkey -pubout <"$privkey" >"$pubkey"
 fi