logjam mitigation.

2 files changed, 15 insertions, 2 deletions

diff --git a/roles/common/files/usr/local/bin/gendhparam.sh b/roles/common/files/usr/local/bin/gendhparam.sh
new file mode 100755
index 0000000..074986b
--- /dev/null
+++ b/roles/common/files/usr/local/bin/gendhparam.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -ue
+PATH=/usr/bin:/bin
+
+privkey="$1"
+bits="${2:-2048}"
+rand=
+
+mv -f "$(mktemp)" "$privkey"
+chmod og-rwx "$privkey"
+
+openssl dhparam -rand "${rand:-/dev/urandom}" "$bits" >"$privkey"
diff --git a/roles/common/files/usr/local/bin/genkeypair.sh b/roles/common/files/usr/local/bin/genkeypair.sh
index d6539e2..982c1d9 100755
--- a/roles/common/files/usr/local/bin/genkeypair.sh
+++ b/roles/common/files/usr/local/bin/genkeypair.sh
@@ -37,6 +37,7 @@ cn=
 usage=
 chmod=
 chown=
+rand=
 
 usage() {
     cat >&2 <<- EOF
@@ -123,7 +124,6 @@ while [ $# -gt 0 ]; do
     shift;
 done
 
-rand=/dev/urandom
 case "$type" in
     # XXX: genrsa and dsaparam have been deprecated in favor of genpkey.
     # genpkey can also create explicit EC parameters, but not named.
@@ -184,7 +184,7 @@ elif [ ! -s "$privkey" -o $force -ge 2 ]; then
     mv -f "$(mktemp)" "$privkey" || exit 2
     chmod "${chmod:-og-rwx}" "$privkey" || exit 2
     [ -z "$chown" ] || chown "$chown" "$privkey" || exit 2
-    openssl $genkey -rand /dev/urandom $genkeyargs >"$privkey" || exit 2
+    openssl $genkey -rand "${rand:-/dev/urandom}" $genkeyargs >"$privkey" || exit 2
     [ "$cmd" = dkim ] && { dkiminfo; exit; }
 fi