112 lines
3.4 KiB
Bash
Executable File
112 lines
3.4 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# Variablen für benutzerdefinierte Einstellungen
|
|
DB_NAME="openxpki_root"
|
|
DB_USER="root_db_user"
|
|
DB_PASSWORD="root_db_password"
|
|
SERVER_NAME="rootca.heim.lan"
|
|
|
|
# System aktualisieren
|
|
sudo dnf update -y
|
|
|
|
# Installiere erforderliche Pakete
|
|
sudo dnf install -y epel-release
|
|
sudo dnf install -y gcc gcc-c++ make perl-CPAN perl-DBI perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg \
|
|
perl-Data-UUID perl-DateTime perl-DateTime-TimeZone perl-MIME-Base64-URLSafe \
|
|
perl-XML-Parser perl-XML-Simple perl-Moose perl-MooseX-Aliases perl-Try-Tiny \
|
|
perl-JSON perl-DBD-MySQL perl-DBD-SQLite perl-DBD-Pg mariadb-server
|
|
|
|
# Füge das OpenXPKI-Repository hinzu
|
|
sudo rpm --import https://packages.openxpki.org/key/OpenXPKI-2016-02-15.pub
|
|
sudo tee /etc/yum.repos.d/openxpki.repo <<EOF
|
|
[openxpki]
|
|
name=OpenXPKI
|
|
baseurl=http://packages.openxpki.org/rhel/8/release/
|
|
enabled=1
|
|
gpgcheck=1
|
|
EOF
|
|
sudo dnf update -y
|
|
|
|
# Installiere OpenXPKI
|
|
sudo dnf install -y openxpki
|
|
|
|
# Starte und sichere die MariaDB-Installation
|
|
sudo systemctl start mariadb
|
|
sudo systemctl enable mariadb
|
|
sudo mysql_secure_installation
|
|
|
|
# Erstelle und konfiguriere die OpenXPKI-Datenbank
|
|
sudo mysql -u root -p <<EOF
|
|
CREATE DATABASE $DB_NAME;
|
|
CREATE USER '$DB_USER'@'localhost' IDENTIFIED BY '$DB_PASSWORD';
|
|
GRANT ALL PRIVILEGES ON $DB_NAME.* TO '$DB_USER'@'localhost';
|
|
FLUSH PRIVILEGES;
|
|
EXIT;
|
|
EOF
|
|
|
|
# Konfigurationsdateien bearbeiten, um den benutzerdefinierten Datenbankbenutzer zu verwenden
|
|
sudo sed -i "s/DBI:mysql:database=openxpki;host=localhost/DBI:mysql:database=$DB_NAME;host=localhost/" /etc/openxpki/config.d/system/database.yaml
|
|
sudo sed -i "s/user: openxpki/user: $DB_USER/" /etc/openxpki/config.d/system/database.yaml
|
|
sudo sed -i "s/pass: secret/password: $DB_PASSWORD/" /etc/openxpki/config.d/system/database.yaml
|
|
|
|
# Starte und aktiviere OpenXPKI
|
|
sudo systemctl start openxpki
|
|
sudo systemctl enable openxpki
|
|
|
|
# Installiere und konfiguriere Apache
|
|
sudo dnf install -y httpd mod_fcgid
|
|
|
|
# Erstelle die Apache-Konfigurationsdatei
|
|
sudo tee /etc/httpd/conf.d/openxpki.conf <<EOF
|
|
<VirtualHost *:80>
|
|
ServerName $SERVER_NAME
|
|
|
|
DocumentRoot /var/www/openxpki
|
|
|
|
<Directory /var/www/openxpki>
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride None
|
|
Require all granted
|
|
</Directory>
|
|
|
|
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
|
|
<Directory "/usr/lib/cgi-bin">
|
|
AllowOverride None
|
|
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
|
|
Require all granted
|
|
</Directory>
|
|
|
|
Alias /openxpki /var/www/openxpki
|
|
<Directory /var/www/openxpki>
|
|
Options Indexes FollowSymLinks
|
|
AllowOverride None
|
|
Require all granted
|
|
</Directory>
|
|
</VirtualHost>
|
|
EOF
|
|
|
|
# Konfiguriere und starte Apache neu
|
|
sudo systemctl start httpd
|
|
sudo systemctl enable httpd
|
|
sudo systemctl restart httpd
|
|
|
|
# Firewall-Einstellungen anpassen
|
|
sudo firewall-cmd --zone=public --add-service=http --permanent
|
|
sudo firewall-cmd --zone=public --add-service=https --permanent
|
|
sudo firewall-cmd --reload
|
|
|
|
# OpenXPKI als Root CA initialisieren (Beispielkonfiguration)
|
|
sudo tee /etc/openxpki/config.d/realm/heim.lan/crypto.yaml <<EOF
|
|
crypto:
|
|
default:
|
|
backend: OpenSSL
|
|
key: /etc/openxpki/keys/root-ca.key
|
|
cert: /etc/openxpki/keys/root-ca.crt
|
|
chain: []
|
|
tls_profile:
|
|
default:
|
|
label: "Root CA"
|
|
EOF
|
|
|
|
echo "Installation und Konfiguration von OpenXPKI als Root CA abgeschlossen. Öffne http://$SERVER_NAME/openxpki in deinem Browser."
|