53 lines
2.5 KiB
Bash
Executable File
53 lines
2.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# nts-cert.sh — issue the NTS-KE server certificate for the fleet NTP server,
|
|
# signed by the fleet step-ca so booted hosts (secure_ntp=true) authenticate it
|
|
# against the SAME radius-ca.pem they already trust (closes F-03/P-18). Run once
|
|
# after the CA is up (serving/dot1x-bench bootstrap.sh), from serving/chrony/.
|
|
# Writes ./nts/{nts.crt,nts.key}, which docker-compose mounts at /etc/chrony/nts.
|
|
# Pairs with docs/secure-ntp-design.md. BENCH-VERIFY the `step` flags vs your version.
|
|
set -euo pipefail
|
|
|
|
cd "$(dirname "$0")"
|
|
OUT="nts"
|
|
# step-ca lives in the dot1x-bench compose project; reach it there (same pattern
|
|
# as dot1x-bench/step-ca/bootstrap.sh issuing the RADIUS cert).
|
|
BENCH="../dot1x-bench"
|
|
[ -d "$BENCH" ] || { echo "ERROR: $BENCH not found (need the step-ca compose project)." >&2; exit 1; }
|
|
[ -f "$BENCH/.env" ] && . "$BENCH/.env"
|
|
CA_PORT=${CA_PORT:-8443}
|
|
CA_CONNECT=${CA_CONNECT:-localhost}
|
|
CA_URL="https://${CA_CONNECT}:${CA_PORT}"
|
|
PROVISIONER=${PROVISIONER:-enrol}
|
|
# The DNS SAN the booted host uses. The image derives it at runtime as
|
|
# <ntp_prefix>.<DHCP-domain> (default ntp.<domain>), so this MUST equal
|
|
# ntp.${BOOT_DOMAIN} and resolve via the fleet dnsmasq (NTP_HOST -> SERVER_IP).
|
|
NTP_SAN=${NTP_HOST:-ntp.fleet.lab}
|
|
|
|
PKI="$BENCH/pki"
|
|
PW="$PKI/stepca/password"
|
|
[ -e "$PW" ] || { [ -e "$PKI/stepca/secrets/password" ] && PW="$PKI/stepca/secrets/password"; }
|
|
[ -r "$PW" ] || { echo "ERROR: CA password $PW missing — run dot1x-bench bootstrap.sh first." >&2; exit 1; }
|
|
CONTAINER_PW="/home/step/${PW#"$PKI/stepca/"}"
|
|
|
|
incca() { ( cd "$BENCH" && docker compose exec -T step-ca "$@" ); }
|
|
|
|
echo "==> issuing NTS-KE server cert (CN/SAN ${NTP_SAN}) from the fleet CA"
|
|
incca mkdir -p /export/nts
|
|
# Leaf with serverAuth (default) + the NTS server name as SAN. --not-after within
|
|
# the CA's max claim (bootstrap.sh raised it to 2160h).
|
|
incca step ca certificate "${NTP_SAN}" \
|
|
/export/nts/nts.crt /export/nts/nts.key \
|
|
--ca-url "$CA_URL" --root /export/root_ca.crt \
|
|
--provisioner "${PROVISIONER}" --provisioner-password-file "$CONTAINER_PW" \
|
|
--not-after 2160h --force
|
|
|
|
# The CA wrote into $BENCH/pki/nts via the /export mount; copy to ./nts for the
|
|
# ntp container's bind mount.
|
|
mkdir -p "$OUT"
|
|
cp "$PKI/nts/nts.crt" "$OUT/nts.crt"
|
|
cp "$PKI/nts/nts.key" "$OUT/nts.key"
|
|
chmod 0644 "$OUT/nts.crt"; chmod 0640 "$OUT/nts.key"
|
|
echo "==> wrote $OUT/nts.crt + $OUT/nts.key"
|
|
echo " Ensure the image's ntp_server = ${NTP_SAN}, dnsmasq resolves ${NTP_SAN},"
|
|
echo " open tcp/4460 (NTS-KE) on the boot NIC, and restart the ntp service."
|