acme client package for pfSense, initial commit #89

PiBa-NL · 2016-03-29T22:08:51Z

acme client package for pfSense, initial commit

…e webservers, some bugfixes

mcfedr · 2016-06-10T06:12:44Z

Not sure if its of use, or too late, there is an php implementation of acme thats quite well done, https://github.com/kelunik/acme

Saeverix · 2016-06-23T13:51:02Z

Can't you just use the FreeBSD Shell script package as base? http://www.freshports.org/security/letsencrypt.sh/

PiBa-NL · 2016-06-24T17:51:44Z

Yes that 'could' be possible now (it didnt exist when i first created the package..), and i'm willing to change it if one of the ESF guy's tells me that would help get the pfSense package committed. Sofar i have not heard anything from them.

vpetersson · 2016-10-01T12:19:18Z

+1

razims · 2016-10-04T10:58:24Z

rbgarga · 2016-12-05T20:33:30Z

@PiBa-NL you can go ahead and make all necessary changes. Let me know when you have a final version for proper revision. Thanks!

gonzopancho · 2016-12-08T02:43:46Z

@PiBa-NL In case it's not clear, when the changes are made and accepted, we'll be bringing this to pfSense.

idarlund · 2016-12-08T07:15:34Z

Take a look at https://github.com/lukas2511/dehydrated - this is the renamed (new) version of the FreeBSD Shell script that @wernerdev referes to.

PiBa-NL · 2016-12-08T19:17:28Z

Yes i shortly discussed with rbgarga, i am taking a look at the alternatives to the currently used 'lescript' which seems to hardly be maintained at all.. To which might be the 'best' way to integrate one of the other implementations. t.b.h. ive barely looked at further improvement the past half year as it was uncertain to if it would be 'allowed', the 'go ahead' has been received :) , need a few days though to switch

kelunik/acme , seems like adding the amp framework just for this is to much complexity/overhead.. evn though the 'php only' implementation is nice..
lukas2511/dehydrated , its a official freebsd port (the old version anyhow) which i suppose is a pro..
Neilpang/acme.sh , looks to be most actively developed and integrated with dns update options which could prove nice to have

currently i'm leaning towards the Neilpang implementation.. unless there are compelling reasons ive overlooked the others are way better.?

idarlund · 2016-12-09T06:35:16Z

I actually use the DNS update option in acme.sh and it's pretty nice! The good thing about that is that you can still have your haproxy run on port 80 (and 443) without have to turn it off for a cert update. I'd vote for acme.sh if that's the only one who support the DNS update method.

PiBa-NL · 2016-12-22T23:35:35Z

@rbgarga, i think its ready to commit, still things to improve i guess but those can follow later once people start testing it

… license / added service restart action

…pkg-acme and provide webgui options for them + small fixes

…ting the proper accountkey

idarlund · 2016-12-27T09:21:43Z

DNS-Manual works as expected! Thanks!
acme/acme_certificates.php is accepting name field with spaces, but the acme script does not wrap the text with quotes. remove space acceptance in php or wrap text.
Last renewed is not updated when running manual "renew" in acme/acme_certificates.php

hoerup · 2016-12-27T22:40:24Z

Installed on pfsense 2.3. Works fine with DNS-manual although it couldn't find curl out of the box.

Regarding webroot method, seems that $domain_info['webrootfolder'] was not set so the following code fails

if ($domain_info['method'] == 'webroot') {
echo "webroot\n";
$directory = $domain_info['webrootfolder'];
if(!file_exists($directory) && !@mkdir($directory, 0755, true)) {
throw new \RuntimeException("Couldn't create directory to expose challenge: ${tokenPath}");
}

…th proper refid references, validate certificatename configured does not contain spaces as acme.sh dies not handle them well

jim-p

Seems to operate but could use some refinement and security improvements. See my inline comments for details.

jim-p · 2017-01-09T15:39:19Z

security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc

+	function generateAccountKey() {
+		unlink_if_exists("{$this->path_account}/account.key");
+		$this->debug = false;
+		$this->execacmesh("--home {$this->acmeconf} --createAccountKey --accountkeylength 4096 --accountconf {$this->accountconfig}");


Must use escapeshellarg() around all parameters involving variables.

jim-p · 2017-01-09T15:39:29Z

security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc

+
+	function registeraccount($key) {
+		file_put_contents("{$this->path_account}/account.key", $key);
+		$result = $this->execacmesh(""


Must use escapeshellarg() around all parameters involving variables.

using escapeshellarg now

jim-p · 2017-01-09T15:39:35Z

security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc

+		safe_mkdir($certpath);
+
+		unlink_if_exists("{$certpath}/{$domain}.key");
+		$this->execacmesh(""


Must use escapeshellarg() around all parameters involving variables.

jim-p · 2017-01-09T15:39:40Z

security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_sh.inc

+		foreach($domainstosign as $domain) {
+			$domainstr .= " -d {$domain}";
+		}
+		$this->execacmesh(""


Must use escapeshellarg() around all parameters involving variables.

jim-p · 2017-01-09T15:40:51Z

security/pfSense-pkg-acme/files/usr/local/www/acme/acme_generalsettings.php

+
+$form->add($section);
+
+print $form;


With only this one option and just the checkbox text this page seems really bare. Maybe at least add a little description text about what the renewal job does?
For example, if it uses cron, how often it runs, etc, etc.

added a check basically preventing to show the page

jim-p · 2017-01-09T15:49:15Z

security/pfSense-pkg-acme/files/usr/local/pkg/acme/acme_command.sh

@@ -0,0 +1,66 @@
+#!/usr/local/bin/php -f


This script needs the execute bit set.

makefile sets -m 0755, that should be enough right?

Now changed to use INSTALL_DATA/INSTALL_SCRIPT macros in the Makefile.

jim-p · 2017-01-09T15:49:53Z

security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys_edit.php

+	/* Ensure that our pool names are unique */
+	for ($i=0; isset($config['installedpackages']['acme']['accountkeys']['item'][$i]); $i++) {
+		if (($_POST['name'] == $config['installedpackages']['acme']['accountkeys']['item'][$i]['name']) && ($i != $id)) {
+			$input_errors[] = "This pool name has already been used.  Pool names must be unique.";


"Pool name"? Shouldn't this be "Account Key Name"?

jim-p · 2017-01-09T15:50:11Z

security/pfSense-pkg-acme/files/usr/local/www/acme/acme_accountkeys_edit.php

+	}
+
+	if($accountkey['name'] != "") {
+		$changedesc .= " modified pool: '{$accountkey['name']}'";


jim-p · 2017-01-09T15:50:26Z

security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates_edit.php

+	/* Ensure that our pool names are unique */
+	for ($i=0; isset($config['installedpackages']['acme']['certificates']['item'][$i]); $i++) {
+		if (($_POST['name'] == $config['installedpackages']['acme']['certificates']['item'][$i]['name']) && ($i != $id)) {
+			$input_errors[] = "This pool name has already been used.  Pool names must be unique.";


jim-p · 2017-01-09T15:50:35Z

security/pfSense-pkg-acme/files/usr/local/www/acme/acme_certificates_edit.php

+	}
+
+	if($certificate['name'] != "") {
+		$changedesc .= " modified pool: '{$certificate['name']}'";


rbgarga · 2017-01-09T15:54:30Z

I'll wait the changes for items pointed out by @jim-p before start reviewing

jim-p · 2017-01-09T19:01:03Z

One more question: Why is nsupdate support commented out? That would be one of the best choices for a lot of users.

PiBa-NL · 2017-01-10T00:23:17Z

Regarding nsupdate, i will add below run_depends item, would that make its binary available.?
RUN_DEPENDS= samba-nsupdate:dns/samba-nsupdate

jim-p · 2017-01-10T00:27:14Z

We already have nsupdate, it is what we use for RFC 2136 updates.
: pkg which /usr/local/bin/nsupdate
/usr/local/bin/nsupdate was installed by package bind-tools-9.11.0P1_1

…warnings, use fa-plus instead of fa-level-down icon

PiBa-NL · 2017-01-10T00:49:44Z

Ah ok, well then i think all comments have been addressed.

The buttons for generating/registering account key still change to a check-mark when successful, i think thats alright. I've added the nsupdate option (someone should test it..). Added a little more text. Removed the 'pool' texts (which came from copy/paste from haproxy package..)

Lemme know if i missed something :).

…TALL_SCRIPT macro's

rbgarga · 2017-01-10T20:01:32Z

@PiBa-NL here is output of 'portlint -CN', please fix all warnings and fatal messages

WARN: /usr/home/garga/work/pfsense/freebsd-ports/security/pfSense-pkg-acme/pkg-plist: [32]: empty line found in plist.
WARN: /usr/home/garga/work/pfsense/freebsd-ports/security/pfSense-pkg-acme/pkg-plist: [33]: empty line found in plist.
WARN: /usr/home/garga/work/pfsense/freebsd-ports/security/pfSense-pkg-acme/pkg-plist: [34]: empty line found in plist.
WARN: /usr/home/garga/work/pfsense/freebsd-ports/security/pfSense-pkg-acme/pkg-plist: seems to have unnecessary blank lines at the last part.
WARN: /usr/home/garga/work/pfsense/freebsd-ports/security/pfSense-pkg-acme/pkg-descr: includes lines that exceed 80 characters.
FATAL: Makefile: [13]: use a tab (not space) after a variable name
WARN: Makefile: [15]: whitespace before end of line.
FATAL: Makefile: MAINTAINER address, PiBa-NL, does not appear to be a valid email address.
WARN: Makefile: COMMENT should begin with a capital, and end without a period
WARN: Makefile: Consider defining LICENSE.

rbgarga · 2017-01-10T20:07:09Z