Skip to content

Commit 9e9681e

Browse files
d--jd--j
committed
LE: fix hooks (were broken for rpm-based OSes) & make them compatible with ECDSA certificates #6563
1 parent 50080ea commit 9e9681e

File tree

3 files changed

+101
-121
lines changed

3 files changed

+101
-121
lines changed

‎server/scripts/letsencrypt_post_hook.sh‎

Lines changed: 22 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,7 @@
11
#!/bin/bash
22

3-
### BEGIN INIT INFO
4-
# Provides: LETSENCRYPT POST HOOK SCRIPT
5-
# Required-Start: $local_fs $network
6-
# Required-Stop: $local_fs
7-
# Default-Start: 2 3 4 5
8-
# Default-Stop: 0 1 6
93
# Short-Description: LETSENCRYPT POST HOOK SCRIPT
104
# Description: To force close http port 80 if it is by default closed, to be used by letsencrypt client standlone command
11-
### END INIT INFO
125

136
## If you need a custom hook file, create a file with the same name in
147
## /usr/local/ispconfig/server/conf-custom/scripts/
@@ -17,44 +10,35 @@
1710
##
1811
## Eg. you can override the ispc_letsencrypt_firewall_disable() function then 'return 124'
1912
## to customize the firewall setup.
20-
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh" ] ; then
21-
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh
22-
ret=$?
23-
if [ $ret != 124 ]; then exit $ret; fi
13+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh" ]; then
14+
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_post_hook.sh
15+
ret=$?
16+
if [ $ret != 124 ]; then exit $ret; fi
2417
fi
2518

2619
declare -F ispc_letsencrypt_firewall_disable &>/dev/null || ispc_letsencrypt_firewall_disable() {
27-
# delete 'ispc-letsencrypt' chain
28-
iptables -D INPUT -p tcp --dport 80 -j ispc-letsencrypt
29-
iptables -F ispc-letsencrypt
30-
iptables -X ispc-letsencrypt
20+
# delete 'ispc-letsencrypt' chain
21+
iptables -D INPUT -p tcp --dport 80 -j ispc-letsencrypt
22+
iptables -F ispc-letsencrypt
23+
iptables -X ispc-letsencrypt
3124
}
3225

3326
ispc_letsencrypt_firewall_disable
3427

35-
3628
# For RHEL, Centos or derivatives
37-
if which yum &> /dev/null 2>&1 ; then
38-
# Check if web server software is installed, start it if any
39-
if [ rpm -q nginx ]; then service nginx start
40-
elif [ rpm -q httpd ]; then service httpd start
41-
# # If using firewalld
42-
# elif [ rpm -q firewalld ] && [ `firewall-cmd --state` = running ]; then
43-
# firewall-cmd --zone=public --permanent --remove-service=http
44-
# firewall-cmd --reload
45-
# # If using UFW
46-
# elif [ rpm -q ufw ]; then ufw --force enable && ufw deny http
47-
fi
29+
if which yum &>/dev/null 2>&1; then
30+
# Check if web server software is installed, start it if any
31+
if rpm -q nginx; then
32+
service nginx start
33+
elif rpm -q httpd; then
34+
service httpd start
35+
fi
4836
# For Debian, Ubuntu or derivatives
49-
elif apt-get -v >/dev/null 2>&1 ; then
50-
# Check if web server software is installed, stop it if any
51-
if [ $(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service nginx start
52-
elif [ $(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service apache2 start
53-
# # If using UFW
54-
# elif [ $(dpkg-query -W -f='${Status}' ufw 2>/dev/null | grep -c "ok installed") -eq 1 ]; then ufw --force enable && ufw deny http
55-
fi
56-
## Try iptables as a final attempt
57-
#else
58-
# iptables -D INPUT -p tcp --dport 80 -j ACCEPT
59-
# service iptables save
37+
elif apt-get -v >/dev/null 2>&1; then
38+
# Check if web server software is installed, stop it if any
39+
if [ "$(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then
40+
service nginx start
41+
elif [ "$(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then
42+
service apache2 start
43+
fi
6044
fi

‎server/scripts/letsencrypt_pre_hook.sh‎

Lines changed: 17 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,7 @@
11
#!/bin/bash
22

3-
### BEGIN INIT INFO
4-
# Provides: LETSENCRYPT PRE HOOK SCRIPT
5-
# Required-Start: $local_fs $network
6-
# Required-Stop: $local_fs
7-
# Default-Start: 2 3 4 5
8-
# Default-Stop: 0 1 6
93
# Short-Description: LETSENCRYPT PRE HOOK SCRIPT
104
# Description: To force open http port 80 to be used by letsencrypt client standlone command
11-
### END INIT INFO
125

136
## If you need a custom hook file, create a file with the same name in
147
## /usr/local/ispconfig/server/conf-custom/scripts/
@@ -17,45 +10,30 @@
1710
##
1811
## Eg. you can override the ispc_letsencrypt_firewall_enable() function then 'return 124'
1912
## to customize the firewall setup.
20-
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh" ] ; then
21-
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh
22-
ret=$?
23-
if [ $ret != 124 ]; then exit $ret; fi
13+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh" ]; then
14+
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_pre_hook.sh
15+
ret=$?
16+
if [ $ret != 124 ]; then exit $ret; fi
2417
fi
2518

2619
declare -F ispc_letsencrypt_firewall_enable &>/dev/null || ispc_letsencrypt_firewall_enable() {
27-
# create 'ispc-letsencrypt' chain with ACCEPT policy and send port 80 there
28-
iptables -N ispc-letsencrypt
29-
iptables -I ispc-letsencrypt -p tcp --dport 80 -j ACCEPT
30-
iptables -A ispc-letsencrypt -j RETURN
31-
iptables -I INPUT -p tcp --dport 80 -j ispc-letsencrypt
20+
# create 'ispc-letsencrypt' chain with ACCEPT policy and send port 80 there
21+
iptables -N ispc-letsencrypt
22+
iptables -I ispc-letsencrypt -p tcp --dport 80 -j ACCEPT
23+
iptables -A ispc-letsencrypt -j RETURN
24+
iptables -I INPUT -p tcp --dport 80 -j ispc-letsencrypt
3225
}
3326

3427
ispc_letsencrypt_firewall_enable
3528

3629
# For RHEL, Centos or derivatives
37-
if which yum &> /dev/null 2>&1 ; then
38-
# Check if web server software is installed, stop it if any
39-
if [ rpm -q nginx ]; then service nginx stop; fi
40-
if [ rpm -q httpd ]; then service httpd stop; fi
41-
# # If using firewalld
42-
# if [ rpm -q firewalld ] && [ `firewall-cmd --state` = running ]; then
43-
# firewall-cmd --zone=public --permanent --add-service=http
44-
# firewall-cmd --reload
45-
# fi
46-
# # If using UFW
47-
# if [ rpm -q ufw ]; then ufw --force enable && ufw allow http; fi
48-
30+
if which yum &>/dev/null 2>&1; then
31+
# Check if web server software is installed, stop it if any
32+
if rpm -q nginx; then service nginx stop; fi
33+
if rpm -q httpd; then service httpd stop; fi
4934
# For Debian, Ubuntu or derivatives
50-
elif apt-get -v >/dev/null 2>&1 ; then
51-
# Check if web server software is installed, stop it if any
52-
if [ $(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service nginx stop; fi
53-
if [ $(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service apache2 stop; fi
54-
# # If using UFW
55-
# if [ $(dpkg-query -W -f='${Status}' ufw 2>/dev/null | grep -c "ok installed") -eq 1 ]; then ufw --force enable && ufw allow http; fi
56-
57-
## Try iptables as a final attempt
58-
#else
59-
# iptables -I INPUT -p tcp --dport 80 -j ACCEPT
60-
# service iptables save
35+
elif apt-get -v >/dev/null 2>&1; then
36+
# Check if web server software is installed, stop it if any
37+
if [ "$(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service nginx stop; fi
38+
if [ "$(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service apache2 stop; fi
6139
fi

‎server/scripts/letsencrypt_renew_hook.sh‎

Lines changed: 62 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,77 @@
11
#!/bin/bash
22

3-
### BEGIN INIT INFO
4-
# Provides: LETSENCRYPT RENEW HOOK SCRIPT
5-
# Required-Start: $local_fs $network
6-
# Required-Stop: $local_fs
7-
# Default-Start: 2 3 4 5
8-
# Default-Stop: 0 1 6
93
# Short-Description: LETSENCRYPT RENEW HOOK SCRIPT
104
# Description: Taken from LE4ISPC code. To be used to update ispserver.pem automatically after ISPConfig LE SSL certs are renewed and to reload / restart important ISPConfig server services
11-
### END INIT INFO
125

136
## If you need a custom hook file, create a file with the same name in
147
## /usr/local/ispconfig/server/conf-custom/scripts/
158
##
169
## End the file with 'return 124' to signal that this script should not terminate.
17-
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh" ] ; then
18-
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh
19-
ret=$?
20-
if [ $ret != 124 ]; then exit $ret; fi
10+
if [ -e "/usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh" ]; then
11+
. /usr/local/ispconfig/server/conf-custom/scripts/letsencrypt_renew_hook.sh
12+
ret=$?
13+
if [ $ret != 124 ]; then exit $ret; fi
2114
fi
2215

2316
hostname=$(hostname -f)
24-
if [ -d "/usr/local/ispconfig/server/scripts/${hostname}" ] ; then
25-
lelive="/usr/local/ispconfig/server/scripts/${hostname}" ;
26-
elif [ -d "/root/.acme.sh/${hostname}" ] ; then
27-
lelive="/root/.acme.sh/${hostname}" ;
28-
else
29-
lelive="/etc/letsencrypt/live/${hostname}" ;
17+
18+
# If you want to manually execute letsencrypt_renew_hook.sh, call it with the SUCCESS environment variable set.
19+
# E.g. like this: "SUCCESS=1 letsencrypt_renew_hook.sh"
20+
# Then we assume that the certificate is there and do the post-processing.
21+
SUCCESS=${SUCCESS:-}
22+
23+
# acme.sh defines/exports the environment variables
24+
# CERT_PATH, CERT_KEY_PATH, CA_CERT_PATH, CERT_FULLCHAIN_PATH and Le_Domain (main cert domain)
25+
# for all hooks
26+
if [ -f "$CERT_KEY_PATH" ] && [[ "${Le_Domain:-}" == "$hostname" ]]; then
27+
SUCCESS=acme.sh
28+
echo "$(/bin/date)" "Reconfigure and reload services after $hostname certificate issuing/renewal via acme.sh" >>/var/log/ispconfig/ispconfig.log
29+
# certbot defines/exports the environment variables
30+
# RENEWED_DOMAINS (all cert domains space separated) and RENEWED_LINEAGE (directory in /etc/letsencrypt/live)
31+
# for the renew/deploy hook
32+
elif [ -d "$RENEWED_LINEAGE" ] && [[ "$RENEWED_DOMAINS " == "$hostname "* ]]; then
33+
SUCCESS=certbot
34+
echo "$(/bin/date)" "Reconfigure and reload services after $hostname certificate issuing/renewal via certbot" >>/var/log/ispconfig/ispconfig.log
3035
fi
3136

32-
if [ -d "$lelive" ]; then
33-
cd /usr/local/ispconfig/interface/ssl; ibak=ispserver.*.bak; ipem=ispserver.pem; icrt=ispserver.crt; ikey=ispserver.key
34-
if ls $ibak 1> /dev/null 2>&1; then rm $ibak; fi
35-
if [ -e "$ipem" ]; then mv $ipem $ipem-$(date +"%y%m%d%H%M%S").bak; cat $ikey $icrt > $ipem; chmod 600 $ipem; fi
36-
pureftpdpem=/etc/ssl/private/pure-ftpd.pem; if [ -e "$pureftpdpem" ]; then chmod 600 $pureftpdpem; fi
37-
# For Red Hat, Centos or derivatives
38-
if which yum &> /dev/null 2>&1 ; then
39-
if ( rpm -q pure-ftpd ); then service pure-ftpd restart; fi
40-
if ( rpm -q monit ); then service monit restart; fi
41-
if ( rpm -q postfix ); then service postfix restart; fi
42-
if ( rpm -q dovecot ); then service dovecot restart; fi
43-
if ( rpm -q mysql-server ); then service mysqld restart; fi
44-
if ( rpm -q mariadb-server ); then service mariadb restart; fi
45-
if ( rpm -q MariaDB-server ); then service mysql restart; fi
46-
if ( rpm -q nginx ); then service nginx restart; fi
47-
if ( rpm -q httpd ); then service httpd restart; fi
48-
# For Debian, Ubuntu or derivatives
49-
elif apt-get -v >/dev/null 2>&1 ; then
50-
if [ $(dpkg-query -W -f='${Status}' pure-ftpd-mysql 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service pure-ftpd-mysql restart; fi
51-
if [ $(dpkg-query -W -f='${Status}' monit 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service monit restart; fi
52-
if [ $(dpkg-query -W -f='${Status}' postfix 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service postfix restart; fi
53-
if [ $(dpkg-query -W -f='${Status}' dovecot-imapd 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service dovecot restart; fi
54-
if [ $(dpkg-query -W -f='${Status}' mysql 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service mysql restart; fi
55-
if [ $(dpkg-query -W -f='${Status}' mariadb 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service mysql restart; fi
56-
if [ $(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service nginx restart; fi
57-
if [ $(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed") -eq 1 ]; then service apache2 restart; fi
37+
if [ -n "$SUCCESS" ]; then
38+
if cd /usr/local/ispconfig/interface/ssl; then
39+
ipem=ispserver.pem
40+
icrt=ispserver.crt
41+
ikey=ispserver.key
42+
if ls ispserver.*.bak &>/dev/null; then
43+
rm ispserver.*.bak
5844
fi
59-
else echo `/bin/date` "Your Lets Encrypt SSL certs path for your ISPConfig server FQDN is missing.$line" >> /var/log/ispconfig/ispconfig.log; fi
45+
if [ -e "$ipem" ]; then
46+
mv $ipem "$ipem-$(date +"%y%m%d%H%M%S").bak"
47+
cat $ikey $icrt >$ipem
48+
chmod 600 $ipem
49+
fi
50+
fi
51+
pureftpdpem=/etc/ssl/private/pure-ftpd.pem
52+
if [ -e "$pureftpdpem" ]; then chmod 600 $pureftpdpem; fi
53+
# For Red Hat, Centos or derivatives
54+
if which yum &>/dev/null 2>&1; then
55+
if rpm -q pure-ftpd; then service pure-ftpd restart; fi
56+
if rpm -q monit; then service monit restart; fi
57+
if rpm -q postfix; then service postfix restart; fi
58+
if rpm -q dovecot; then service dovecot restart; fi
59+
if rpm -q mysql-server; then service mysqld restart; fi
60+
if rpm -q mariadb-server; then service mariadb restart; fi
61+
if rpm -q MariaDB-server; then service mysql restart; fi
62+
if rpm -q nginx; then service nginx restart; fi
63+
if rpm -q httpd; then service httpd restart; fi
64+
# For Debian, Ubuntu or derivatives
65+
elif apt-get -v >/dev/null 2>&1; then
66+
if [ "$(dpkg-query -W -f='${Status}' pure-ftpd-mysql 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service pure-ftpd-mysql restart; fi
67+
if [ "$(dpkg-query -W -f='${Status}' monit 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service monit restart; fi
68+
if [ "$(dpkg-query -W -f='${Status}' postfix 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service postfix restart; fi
69+
if [ "$(dpkg-query -W -f='${Status}' dovecot-imapd 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service dovecot restart; fi
70+
if [ "$(dpkg-query -W -f='${Status}' mysql 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service mysql restart; fi
71+
if [ "$(dpkg-query -W -f='${Status}' mariadb 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service mysql restart; fi
72+
if [ "$(dpkg-query -W -f='${Status}' nginx 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service nginx restart; fi
73+
if [ "$(dpkg-query -W -f='${Status}' apache2 2>/dev/null | grep -c "ok installed")" -eq 1 ]; then service apache2 restart; fi
74+
fi
75+
else
76+
echo "$(/bin/date)" "Your Lets Encrypt SSL certs path for your ISPConfig server FQDN is missing." >>/var/log/ispconfig/ispconfig.log
77+
fi

0 commit comments

Comments
 (0)