I don't know how to deal with the long wait on a large key because the user might think the program froze butbecause it takes a long time generate. Its dependent on the environment of course how long you wait.How How would you deal with this, through a percentage output? TheI'm using a spinner at the moment which does the same thing as the 'openssl' command does output a wait marker but. So I will probably not use it pushes the screen outif I can't find something uses a line or two at most instead of viewcontinuous outputting and because it is too muchpushing everything off screen.
#!/bin/bash
source /etc/global.conf # load global vars
source setup/functions.sh #functions
apt_install openssl
nginx_ssl_conf=/etc/nginx/nginx-ssl.conf
DEFAULT_BIT_SIZE=2048
isHardened=false
hardened_protocol="TLSv1.2;"isHardened="false"
hardened_ciphers="'ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH';"
hardened_protocol="TLSv1.2;"
DHEC_path=$STORAGE_ROOT/ssl/dhparam.pem
# Functions
update_config()
{
lineNUM=$(grep -n "$2" $1 | tail -n1 | sed 's/:.*//')
[ "$lineNUM" ] || lineNUM="$"
sed -i -r "$lineNUM s|#?(.*)|#\1\n$4\n$2 $3|" "$1"
}
ok()
{
echo -e '\e[32m'$1'\e[m';
}
spinner()
{
local pid=$1
local delay=0.75
local spinstr='|/-\'
while [ "$(ps a | awk '{print $1}' | grep $pid)" ]; do
local temp=${spinstr#?}
printf " [%c] " "$spinstr"
local spinstr=$temp${spinstr%"$temp"}
sleep $delay
printf "\b\b\b\b\b\b"
done
printf " \b\b\b\b"
}
# Usage info
usage()
{
cat << EOF
Usage: ${0##*/} [-h] [-p DIR_DHEC_KEY] [-b BIT_SIZE] [-c DIR_NGINX_SSL]...
This script generates and enables DHEC for Nginx. Defaulted to 2048 key.
Hardened mode will generate 4096 key and the following cipher suites:
'ECDH+AESGCM256:DH+AESGCM256:ECDH+AES256:SH+AES256:RSA+AESGCM256:RSA+AES256:!aNULL:!MD5:!kEDH'
-h Enable hardened ciphers and 4096 bit key.
-p Specify dir to generate the DHEC key.
-c Specify dir nginx ssl conf is.
-b Specify the bit size to generate which will override any other default.
EOF
exit 1
}
while getopts "hb:c:p:" opt ; do
case "${opt}" in
b)
BIT_SIZE=${OPTARG}
if [ -z "${OPTARG}" ]; then
usage
fi
;;
h)
isHardened=true
BIT_SIZE=4096
;;
p)
DHEC_path=${OPTARG}
if [ -z "${OPTARG}" ]; then
usage
fi
;;
c)
nginx_ssl_conf=${OPTARG}
if [ -z "${OPTARG}" ]; then
usage
fi
;;
*)
usage
;;
esac
done
shift $((OPTIND-1))
if [ -z "${BIT_SIZE}" -a "true" == ${isHardened} ]; then
BIT_SIZE=4096
elif [ -z "${BIT_SIZE}" ]; then
BIT_SIZE=DEFAULT_BIT_SIZEBIT_SIZE=$DEFAULT_BIT_SIZE
fi
ok "Generating"â¯â¯â¯ Generating DH elliptic curve key. It might take a while, grab a coffee!"
ok "Seriously, $BIT_SIZE takes forever!"
if [ ! -f $DHEC_path ]; then
# Generate a 4096 bit random parameter for DH elliptic curves.
# Generated by OpenSSL with the following command:
# openssl dhparam -outform pem -out dhparam.pem 2048
# openssl dhparam -outform pem -out dhparam.pem 4096
hide_output \
( openssl dhparam -outform pem -out $DHEC_path $BIT_SIZE) &
echospinner something$!
fi
update_config $nginx_ssl_conf ssl_dhparam $DHEC_path';' "#Path to DHEC key"
if [ $isHardened == true"true" ]; then
update_config $nginx_ssl_conf ssl_protocolsssl_ciphers $hardened_protocol$hardened_ciphers "#Hardened SSL Protocol"Ciphers DHEC"
update_config $nginx_ssl_conf ssl_ciphersssl_protocols $hardened_ciphers$hardened_protocol "#Hardened SSL CiphersProtocol" DHEC"
fi
service nginx reload
