Initial upload

Author: Mailstorm-ctrl

add-host.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+host=""
+cango=false
+spath="/home/$(whoami)"
+
+while (( $# >= 1 )); do
+	case $1 in
+	-h) host=$2 cango=true;;
+	*) break;
+	esac;
+	shift
+done
+
+if [[ "$cango" = 'false' ]]; then
+	echo "-h is a required argument. Please supply it.";
+	exit;
+fi
+
+if ! [[ -d $spath/.getssl/$host ]]; then
+	getssl -c $host
+fi
+mkdir -p $spath/pfscl/md5s
+touch $spath/.getssl/$host/$host.crt
+md5sum $spath/.getssl/$host/$host.crt > $spath/pfscl/md5s/$host.crt.md5
+

pfconfedit.py

@@ -0,0 +1,74 @@
+# This script will only edit the config.xml file.
+# It will not do anything else. Copying or moving the certificates is done by a seperate script.
+# You are free to use or modify this for whatever purpose. Just let me know how much time it saved you :)
+import base64
+import xmltodict
+import secrets
+import argparse
+
+parser = argparse.ArgumentParser()
+parser.add_argument("--publickey", help = "Specify the location of the public key file", required=True)
+parser.add_argument("--privatekey", help= " Specify the location the private key file", required=True)
+parser.add_argument("--config", help = 'Specify the location of the downloaded pfSense config', required=True)
+args = parser.parse_args()
+
+pf_config_file = args.config
+pub_key_file = args.publickey
+priv_key_file = args.privatekey
+
+def read_files():
+    """Load in pf config file and TLS pub and priv keys"""
+    with open(pf_config_file, 'r', encoding='utf-8') as conf_file:
+        r_xml = conf_file.read()
+    with open(pub_key_file, 'r', encoding='utf-8') as pk:
+        public_key = pk.read()
+    with open(priv_key_file, 'r', encoding='utf-8') as pk:
+        private_key = pk.read()
+    return r_xml, public_key, private_key
+
+def update_config(certs, public_key, private_key):
+    """Update the pf config file with new TLS certs. Also change the cert the web configurator uses."""
+    gen_refid = secrets.token_hex(13)[:13]
+    if type(certs) == dict:
+
+        # Just incase our originally generated cert id already exist.
+        while gen_refid == pf_conf['pfsense']['cert']['refid']:
+            gen_refid = secrets.token_hex(13)[:13]
+        
+        pf_conf['pfsense']['cert'] = [pf_conf['pfsense']['cert']]
+        
+        # This is our new certificate. We wont delete the old ones.
+        # Maybe in the future we will.
+        pf_conf['pfsense']['cert'].append({
+        'refid': gen_refid,
+        'descr': f'LE - {gen_refid}',
+        'crt': base64.b64encode(public_key.encode('utf-8')).decode('utf-8'),
+        'prv': base64.b64encode(private_key.encode('utf-8')).decode('utf-8')
+        })
+    else:
+        # Get list of existing cert ids
+        cert_ids = [cert['refid'] for cert in certs]
+        
+        while gen_refid in cert_ids:
+            gen_refid = secrets.token_hex(13)[:13]
+        pf_conf['pfsense']['cert'].append({
+        'refid': gen_refid,
+        'descr': f'LE - {gen_refid}',
+        'crt': base64.b64encode(public_key.encode('utf-8')).decode('utf-8'),
+        'prv': base64.b64encode(private_key.encode('utf-8')).decode('utf-8')
+        })
+    
+    # Finally, we tell pfsense that it should use our new TLS certificate for the web configurator.
+    pf_conf['pfsense']['system']['webgui']['ssl-certref'] = gen_refid
+
+
+r_xml, public_key, private_key = read_files()
+
+pf_conf = xmltodict.parse(r_xml)
+
+update_config(pf_conf['pfsense']['cert'], public_key, private_key)
+
+# Convert the dict to xml and write to disk.
+xml_format = xmltodict.unparse(pf_conf, pretty=True)
+with open(pf_config_file, 'w', encoding='utf-8') as new_xml:
+    new_xml.write(xml_format)

watcher.sh

@@ -0,0 +1,26 @@
+#!/bin/bash
+
+spath="/home/vmguest"
+sshkey_path="/home/$spath/.secrets"
+sshkey="adminkey"
+
+for md5 in "$spath/pfscl/md5s/"*
+do
+	output=$(md5sum -c --quiet "$md5")
+	if [[ -z "$output" ]]; then
+		:
+	else
+		host=$(echo "$md5" | cut -d'.' -f 1,2,3 | awk -F/ '{print $NF}')
+		scp -i $sshkey_path/$sshkey admin@$host:/cf/conf/config.xml $host-config.xml
+		time=$(date +%F_%R:%S_%:::z)
+		cp $host-config.xml $spath/pfscl/config-archive/$host/$host-config-$time.xml
+		python3 $spath/pfscl/pfconfedit.py --publickey $spath/.getssl/$host/$host.crt --privatekey $spath/.getssl/$host/$host.key --config $spath/pfscl/$host-config.xml
+		sleep 2
+		scp -i $sshkey_path/$sshkey $spath/pfscl/$host-config.xml admin@$host:/cf/conf/config.xml
+		ssh -i $sshkey_path/$sshkey admin@$host rm /tmp/config.cache
+		mkdir -p $spath/pfscl/config-archive/$host
+		time=$(date +%F_%R:%S_%:::z)
+		mv $host-config.xml $spath/pfscl/config-archive/$host/$host-config-$time.xml
+		md5sum $spath/.getssl/$host/$host.crt > $spath/pfscl/md5s/$host.crt.md5
+	fi
+done