日誌:200501

[トップ][一覧][最近の更新]

2005/01/30 11:06:10 JST

2005/01/30 03:05:46 JST

LにCAを設置した。 

groupadd -g 92 ca
useradd -u 92 -g ca -d /var/lib/ca ca
mkdir -p /var/lib/ca
chown -R ca.ca /var/lib/ca
su - ca
CA_DIR=/var/lib/ca
CA_URL=http://ca.tir.jp/
CA_CRT_URL=http://ca.tir.jp/ca.tir.jp.crt
CA_CRL_URL=http://ca.tir.jp/ca.tir.jp.crl
mkdir -p ${CA_DIR}
cd ${CA_DIR}
cat > openssl.ca.conf <<EOF
RANDFILE    = \$ENV::HOME/.rnd
oid_file    = \$ENV::HOME/.oid
oid_section = new_oids

[ new_oids ]

[ ca ]
  default_ca              = CA_default

[ CA_default ]
  dir                     = ${CA_DIR}
  certs                   = \$dir/certs
  crl_dir                 = \$dir/crl
  database                = \$dir/index.txt
  new_certs_dir           = \$dir/newcerts
  certificate             = \$dir/ca.cert.pem
  serial                  = \$dir/serial
  crl                     = \$dir/ca.crl.pem
  private_key             = \$dir/private/ca.key.pem
  RANDFILE                = \$dir/private/.rand
  x509_extensions         = cert_plain
  crl_extensions          = crl_ext
  name_opt                = ca_default
  cert_opt                = ca_default

  default_days            = 365
  default_crl_days        = 7
  default_md              = sha1
  preserve                = no
  policy                  = policy_anything

[ policy_match ] 
  countryName             = match 
  stateOrProvinceName     = optional 
  localityName            = match 
  organizationName        = match 
  organizationalUnitName  = optional 
  commonName              = supplied 
  emailAddress            = optional

[ policy_anything ]
  countryName             = optional
  stateOrProvinceName     = optional
  localityName            = optional
  organizationName        = optional
  organizationalUnitName  = optional
  commonName              = supplied
  emailAddress            = optional

[ cert_plain ]
  basicConstraints        = CA:true
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid,issuer:always

[ cert_ca ]
  basicConstraints        = CA:true
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always,issuer:always
  keyUsage                = cRLSign, keyCertSign
  issuerAltName           = URI:${CA_CRT_URL}
  crlDistributionPoints   = URI:${CA_CRL_URL}

[ cert_server ]
  basicConstraints        = CA:FALSE
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always,issuer:always
  nsCertType              = server
  keyUsage                = digitalSignature, keyEncipherment
  issuerAltName           = URI:${CA_CRT_URL}
  crlDistributionPoints   = URI:${CA_CRL_URL}

[ cert_client ]
  basicConstraints        = CA:FALSE
  subjectKeyIdentifier    = hash
  authorityKeyIdentifier  = keyid:always,issuer:always
  nsCertType              = client, email
  keyUsage = nonRepudiation, digitalSignature, keyEncipherment
  issuerAltName           = URI:${CA_CRT_URL}
  crlDistributionPoints   = URI:${CA_CRL_URL}

[ crl_ext ]
  #issuerAltName           = issuer:copy
  authorityKeyIdentifier  = keyid:always,issuer:always

EOF
cat > openssl.req.conf <<EOF
RANDFILE    = \$ENV::HOME/.rnd
oid_file    = \$ENV::HOME/.oid
oid_section = new_oids

[ new_oids ]

[ req ]
  default_bits            = 1024
  distinguished_name      = req_distinguished_name
  attributes              = req_attributes
  default_md              = sha1
  x509_extensions         = v3_plain
  string_mask             = nombstr

[ req_distinguished_name ]
  countryName                     = Country Name (2 letter code)
  countryName_default             = JP
  countryName_min                 = 2
  countryName_max                 = 2
  stateOrProvinceName             = State or Province Name (full name)
  stateOrProvinceName_default     = Hyogo
  localityName                    = Locality Name (eg, city)
  localityName_default            = Kawanishi
  0.organizationName              = Organization Name (eg, company)
  0.organizationName_default      = tir.jp
  organizationalUnitName          = Organizational Unit Name (eg, section)
  organizationalUnitName_default  = ca
  commonName                      = Common Name (***IMPORTANT***)
  commonName_max                  = 64
  emailAddress                    = Email Address
  emailAddress_default            = yamada@tir.jp
  emailAddress_max                = 64

[ req_attributes ]
  challengePassword               = A challenge password
  challengePassword_min           = 4
  challengePassword_max           = 20
  unstructuredName                = An optional company name

[ v3_plain ]
  basicConstraints                = CA:true
  subjectKeyIdentifier            = hash
  authorityKeyIdentifier          = keyid:always,issuer:always

# use only create to self-signed certificate of CA
[ v3_self_ca ]
  basicConstraints                = CA:true
  subjectKeyIdentifier            = hash
  authorityKeyIdentifier          = keyid:always,issuer:always
  keyUsage                        = cRLSign, keyCertSign
  nsCertType                      = sslCA, emailCA
  issuerAltName                   = URI:${CA_CRT_URL}
  crlDistributionPoints           = URI:${CA_CRL_URL}
  nsBaseUrl                       = ${CA_URL}
  nsCaRevocationUrl               = ${CA_CRL_URL}
  nsRevocationUrl                 = ${CA_URL}
  nsRenewalUrl                    = ${CA_URL}
  nsCaPolicyUrl                   = ${CA_URL}

EOF
touch index.txt
echo '01' > serial
chmod 644 ca.conf index.txt serial
mkdir -p certs crl newcerts private work
chmod 755 . certs crl newcerts
chmod 700 private work
openssl genrsa -des3 -out private/ca.key.pem 1024 \
  && chmod 400 private/ca.key.pem
openssl req \
  -config ~/openssl.req.conf \
  -new \
  -key private/ca.key.pem \
  -out work/ca.request.pem
openssl req \
  -config ~/openssl.req.conf \
  -extensions v3_self_ca \
  -x509 \
  -key private/ca.key.pem \
  -in work/ca.request.pem \
  -out ./ca.cert.pem \
  -days 3650
openssl ca \
  -config ~/openssl.ca.conf \
  -gencrl \
  -out ./ca.crl.pem
ln -sf ca.cert.pem `openssl x509 -noout -hash < ca.cert.pem`.0
ln -sf ca.crl.pem `openssl crl -noout -hash < ca.crl.pem`.r0
rm work/ca.request.pem
cat > server_keycertgen.sh <<EOF
#!/bin/sh
EXTENSIONS=cert_server
if [ \$1 ]; then
  cd ${CA_DIR} || exit 1
  if [ -e private/\$1.keycert.pem ]; then
    echo "'private/\$1.keycert.pem' already exists!" 1>&2
    exit 1
  else
    openssl genrsa -out work/\$1.key.pem 1024 \\
      && chmod 400 work/\$1.key.pem \\
      && openssl req \\
        -config ~/openssl.req.conf \\
        -new \\
        -key work/\$1.key.pem \\
        -out work/\$1.request.pem \\
      && openssl ca \\
        -config ~/openssl.ca.conf \\
        -policy policy_anything \\
        -extensions \${EXTENSIONS} \\
        -out work/\$1.cert.pem \\
        -days 365 \\
        -infiles work/\$1.request.pem \\
      && cat work/\$1.key.pem work/\$1.cert.pem \\
        > private/\$1.keycert.pem \\
      && chmod 400 private/\$1.keycert.pem \\
      && echo "'private/\$1.keycert.pem' created."
    rm -f work/\$1.key.pem work/\$1.request.pem work/\$1.cert.pem
  fi
else
  echo "usage : \$0 target-name" 1>&2
  exit 1
fi
EOF
cat > client_keycertgen.sh <<EOF
#!/bin/sh
EXTENSIONS=cert_client
if [ \$1 ]; then
  cd ${CA_DIR} || exit 1
  if [ -e private/\$1.keycert.pem ]; then
    echo "'private/\$1.keycert.pem' already exists!" 1>&2
    exit 1
  else
    openssl genrsa -out work/\$1.key.pem 1024 \\
      && chmod 400 work/\$1.key.pem \\
      && openssl req \\
        -config ~/openssl.req.conf \\
        -new \\
        -key work/\$1.key.pem \\
        -out work/\$1.request.pem \\
      && openssl ca \\
        -config ~/openssl.ca.conf \\
        -policy policy_anything \\
        -extensions \${EXTENSIONS} \\
        -out work/\$1.cert.pem \\
        -days 365 \\
        -infiles work/\$1.request.pem \\
      && cat work/\$1.key.pem work/\$1.cert.pem \\
        > private/\$1.keycert.pem \\
      && chmod 400 private/\$1.keycert.pem \\
      && echo "'private/\$1.keycert.pem' created."
    rm -f work/\$1.key.pem work/\$1.request.pem work/\$1.cert.pem
  fi
else
  echo "usage : \$0 target-name" 1>&2
  exit 1
fi
EOF
cat > ca_keycertgen.sh <<EOF
#!/bin/sh
EXTENSIONS=cert_ca
if [ \$1 ]; then
  cd ${CA_DIR} || exit 1
  if [ -e private/\$1.keycert.pem ]; then
    echo "'private/\$1.keycert.pem' already exists!" 1>&2
    exit 1
  else
    openssl genrsa -out work/\$1.key.pem 1024 \\
      && chmod 400 work/\$1.key.pem \\
      && openssl req \\
        -config ~/openssl.req.conf \\
        -new \\
        -key work/\$1.key.pem \\
        -out work/\$1.request.pem \\
      && openssl ca \\
        -config ~/openssl.ca.conf \\
        -policy policy_anything \\
        -extensions \${EXTENSIONS} \\
        -out work/\$1.cert.pem \\
        -days 365 \\
        -infiles work/\$1.request.pem \\
      && cat work/\$1.key.pem work/\$1.cert.pem \\
        > private/\$1.keycert.pem \\
      && chmod 400 private/\$1.keycert.pem \\
      && echo "'private/\$1.keycert.pem' created."
    rm -f work/\$1.key.pem work/\$1.request.pem work/\$1.cert.pem
  fi
else
  echo "usage : \$0 target-name" 1>&2
  exit 1
fi
EOF
chmod a+x server_keycertgen.sh
chmod a+x client_keycertgen.sh
chmod a+x ca_keycertgen.sh

2005/01/29 02:26:26 JST

以下の作業を行った。内容については後述。 

mkdir -p /var/lib/squid-ssl /certkeys
chmod -R 700 /certkeys
cp /home/nekoie/nekoie/misc/squid/rc.squid /etc/rc.d
grep squid /etc/rc.d/rc.local && ed /etc/rc.d/rc.local <<'EOP'
%g/squid/
c
if [ -x /etc/rc.d/rc.squid ]; then
  . /etc/rc.d/rc.squid
fi
.
w
q
EOP
rm -f /var/lib/squid/squid.conf
ln -sf /home/nekoie/nekoie/misc/squid/squid.conf \
  /var/lib/squid/squid.conf
ln -sf /home/nekoie/nekoie/misc/squid/goshredir.scm \
  /var/lib/squid/goshredir.scm
/etc/rc.d/rc.squid -k shutdown
/etc/rc.d/rc.squid

2005/01/27 04:49:59 JST

2005/01/24 03:15:24 JST

2005/01/23 20:30:21 JST

  1. tcpcgiグループ作成 
    groupadd -g 93 tcpcgi
  2. e.tir.jp用アカウント作成 
    TARGET=e_tir_jp PORT=40000
useradd -u $PORT -g tcpcgi -d /daemon/tcpcgi-$TARGET \
-s /bin/false -c 'service_for_tcpcgi' $TARGET
mkdir -p /daemon/tcpcgi-$TARGET
chown $TARGET.tcpcgi /daemon/tcpcgi-$TARGET
chmod 3755 /daemon/tcpcgi-$TARGET
  3. daemontools用設定設置 
    mkdir -p /var/log/tcpcgi-$TARGET
chown logger:logger /var/log/tcpcgi-$TARGET
mkdir -p /daemon/tcpcgi-$TARGET/{log,src}
cat > /daemon/tcpcgi-$TARGET/run <<EOF
#!/bin/sh
cd src
exec 2>&1
exec /usr/bin/env - PATH="\$PATH" \
/usr/local/bin/tcpserver \
-v -c32 -u$PORT -g93 -H -R \
-l127.0.0.1 127.0.0.1 $PORT \
/usr/local/gauche/bin/gosh $TARGET.scm
EOF
cat > /daemon/tcpcgi-$TARGET/log/run <<EOF
#!/bin/sh
exec setuidgid logger multilog t s16777215 n32 /var/log/tcpcgi-$TARGET
EOF
chmod a+x /daemon/tcpcgi-$TARGET/run \
/daemon/tcpcgi-$TARGET/log/run
  4. 仮の実行スクリプト設置 
    cat > /daemon/tcpcgi-$TARGET/src/$TARGET.scm <<'EOF'
#!/usr/bin/env gosh
(use tcpcgi)
(define *tcpcgi*
  (make <tcpcgi>
    :path-dispatch `(("/" "/proc/cpuinfo")
                     )
    :request-timeout 5
    :response-timeout 60
    :keepalive-timeout 300
    :use-server-header #t
    ))
(define (main args)
  (tcpcgi-main
    *tcpcgi*
    "210.224.176.52" ; SERVER_ADDR
    "80" ; SERVER_PORT
    "e.tir.jp" ; SERVER_NAME
    (sys-getenv "TCPREMOTEIP") ; REMOTE_ADDR
    (sys-getenv "TCPREMOTEPORT") ; REMOTE_PORT
    (sys-getenv "TCPREMOTEHOST") ; REMOTE_HOST
    #f ; HTTPS flag
    ))
EOF
chmod a+x /daemon/tcpcgi-$TARGET/src/$TARGET.scm
chown -R $TARGET.tcpcgi /daemon/tcpcgi-$TARGET/src
  5. サービス開始 
    ln -sf /daemon/tcpcgi-$TARGET /service

2005/01/15 15:13:27 JST

2005/01/14 16:05:18 JST

s.tir.jpでも分かりにくい気がしたので、sakura.tir.jpに更に移転。

2005/01/14 15:44:08 JST

このWiLiKiを設置していたn.tir.jpはNサーバと紛らわしいので、s.tir.jpに移転させた。

元のn.tir.jpにはリダイレクタを設置。

2005/01/14 10:28:58 JST

前に設置したtcpcgiのサービスをsquidから呼び出してみる設定の練習を行ってみた。 

su -
mkdir -p /var/lib/squid/gs-alpha/logs
cp ~nekoie/squid.conf /var/lib/squid/gs-alpha
chown -R squid.squid /var/lib/squid/gs-alpha
/usr/local/squid/sbin/squid -f /var/lib/squid/gs-alpha/squid.conf -z
/usr/local/squid/sbin/squid -f /var/lib/squid/gs-alpha/squid.conf
echo /usr/local/squid/sbin/squid -f /var/lib/squid/gs-alpha/squid.conf \
>> /etc/rc.d/rc.local

やっぱりdaemontools経由での起動はしない事にした(主な理由は、アップデート時にややっこしくなる為)。

2005/01/13 10:45:34 JST

練習として、Cにてtcpcgiを使ったサービスの設置を行う。

  1. 最初に、tcpcgi用のアカウントのグループを作成する事にした。 
    groupadd -g 93 tcpcgi
  2. サービス名と、内部で使用するport番号を決める。
  3. サービスのアカウントを作成する。 
    TARGET=gs_alpha PORT=40000
useradd -u $PORT -g tcpcgi -d /daemon/tcpcgi-$TARGET \
-s /bin/false -c 'service_for_tcpcgi' $TARGET
mkdir -p /daemon/tcpcgi-$TARGET
chown $TARGET.tcpcgi /daemon/tcpcgi-$TARGET
chmod 3755 /daemon/tcpcgi-$TARGET
    uid, gidは基本的にport番号と同じにする事にした。
  4. /daemon内に、daemontools経由でtcpserverを起動し、multilogでロギングするようにする。 
    mkdir -p /var/log/tcpcgi-$TARGET
chown logger:logger /var/log/tcpcgi-$TARGET
mkdir -p /daemon/tcpcgi-$TARGET/log
ln -sf /var/log/tcpcgi-$TARGET /daemon/tcpcgi-$TARGET/log/main
cat > /daemon/tcpcgi-$TARGET/run <<EOF
#!/bin/sh
cd src
exec 2>&1
exec /usr/bin/env - PATH="\$PATH" \
/usr/local/bin/tcpserver \
-v -c32 -u40000 -g93 -H -R \
-l127.0.0.1 127.0.0.1 $PORT \
/usr/local/bin/gosh $TARGET.scm
EOF
cat > /daemon/tcpcgi-$TARGET/log/run <<EOF
#!/bin/sh
exec setuidgid logger multilog t s16777215 n32 ./main
EOF
chmod a+x /daemon/tcpcgi-$TARGET/run \
/daemon/tcpcgi-$TARGET/log/run
  5. /daemon/tcpcgi-gs_alpha/srcに、gs_alpha.scmとそのモジュールを用意。
  6. サービス開始。 
    ln -sf /daemon/tcpcgi-$TARGET /service
  7. ncで動作確認してみる。 
    echo -ne 'GET /cpuinfo HTTP/1.0\r\n\r\n' | nc localhost 40000
  8. あとは、適当に80番でreverse-proxyとしてsquidを動かすだけ。
  9. また、/daemon/tcpcgi-gs_alpha/src配下を楽に更新できるようにもしておく事。

2005/01/11 09:26:11 JST

最終更新 : 2005/01/30 11:06:10 JST