111 lines
3.2 KiB
Bash
Executable File
111 lines
3.2 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# Author by JKO Email: jonathan@kosar.email
|
||
# This script tool enables DHEC for SSL on Nginx.
|
||
# A user can also add a more hardened SSL cipher suite.
|
||
# Otherwise a default 2048 EC key is generated and added to nginx-ssl.conf.
|
||
# No suite or protocols are changed. Only in hardened mode they are changed.
|
||
# But only clients that support the suites will be able to connect, please remember that.
|
||
# http://www.roushtech.net/2014/04/01/100-qualys-ssl-test-a/
|
||
# See usage command for more.
|
||
# Sidenote: -h -b 2048 will produce a hardened settings with 2048 bit key.
|
||
|
||
source /etc/mailinabox.conf # load global vars
|
||
source setup/functions.sh #functions
|
||
|
||
apt_install openssl
|
||
|
||
nginx_ssl_conf=/etc/nginx/nginx-ssl.conf
|
||
DEFAULT_BIT_SIZE=2048
|
||
isHardened="false"
|
||
hardened_ciphers="'ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH';"
|
||
hardened_protocol="TLSv1.2;"
|
||
|
||
DHEC_path=$STORAGE_ROOT/ssl/dhparam.pem
|
||
|
||
# Functions
|
||
update_config()
|
||
{
|
||
lineNUM=$(grep -n "$2" $1 | tail -n1 | sed 's/:.*//')
|
||
[ "$lineNUM" ] || lineNUM="$"
|
||
sed -i -r "$lineNUM s|#?(.*)|#\1\n$4\n$2 $3|" "$1"
|
||
}
|
||
|
||
ok()
|
||
{
|
||
echo -e '\e[32m'$1'\e[m';
|
||
}
|
||
|
||
|
||
# Usage info
|
||
usage()
|
||
{
|
||
cat << EOF
|
||
Usage: ${0##*/} [-h] [-b BIT_SIZE] [-p DIR_DHEC_KEY] [-c DIR_NGINX_SSL]
|
||
This script generates and enables DHEC for Nginx. Defaulted to 2048 key.
|
||
Hardened mode will generate 4096 key and the following cipher suites:
|
||
'ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH'
|
||
|
||
-h Enable hardened ciphers and 4096 bit key.
|
||
-b Specify the bit size to generate which will override any other default.
|
||
-p Specify dir to generate the DHEC key.
|
||
-c Specify dir nginx ssl conf is.
|
||
EOF
|
||
exit 1
|
||
}
|
||
|
||
while getopts "hb:c:p:" opt ; do
|
||
case "${opt}" in
|
||
b)
|
||
BIT_SIZE=${OPTARG}
|
||
if [ -z "${OPTARG}" ]; then
|
||
usage
|
||
fi
|
||
;;
|
||
h)
|
||
isHardened=true
|
||
BIT_SIZE=4096
|
||
;;
|
||
p)
|
||
DHEC_path=${OPTARG}
|
||
if [ -z "${OPTARG}" ]; then
|
||
usage
|
||
fi
|
||
;;
|
||
c)
|
||
nginx_ssl_conf=${OPTARG}
|
||
if [ -z "${OPTARG}" ]; then
|
||
usage
|
||
fi
|
||
;;
|
||
*)
|
||
usage
|
||
;;
|
||
esac
|
||
done
|
||
shift $((OPTIND-1))
|
||
|
||
if [ -z "${BIT_SIZE}" -a "true" == ${isHardened} ]; then
|
||
BIT_SIZE=4096
|
||
elif [ -z "${BIT_SIZE}" ]; then
|
||
BIT_SIZE=$DEFAULT_BIT_SIZE
|
||
fi
|
||
|
||
ok "❯❯❯ It might take a while, grab a coffee!"
|
||
|
||
if [ ! -f $DHEC_path ]; then
|
||
# Generate a 4096 bit random parameter for DH elliptic curves.
|
||
# Generated by OpenSSL with the following command:
|
||
# openssl dhparam -outform pem -out dhparam.pem 2048
|
||
# openssl dhparam -outform pem -out dhparam.pem 4096
|
||
openssl dhparam -outform pem -out $DHEC_path $BIT_SIZE
|
||
fi
|
||
update_config $nginx_ssl_conf ssl_dhparam $DHEC_path';' "#Path to DHEC key"
|
||
|
||
if [ $isHardened == "true" ]; then
|
||
update_config $nginx_ssl_conf ssl_ciphers $hardened_ciphers "#Hardened SSL Ciphers DHEC"
|
||
update_config $nginx_ssl_conf ssl_protocols $hardened_protocol "#Hardened SSL Protocol"
|
||
fi
|
||
|
||
service nginx reload
|