You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

157 lines
5.2 KiB

6 years ago
  1. #!/usr/bin/env sh
  2. # Here is a script to deploy cert to routeros router.
  3. # Deploy the cert to remote routeros
  4. #
  5. # ```sh
  6. # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
  7. # ```
  8. #
  9. # Before you can deploy the certificate to router os, you need
  10. # to add the id_rsa.pub key to the routeros and assign a user
  11. # to that key.
  12. #
  13. # The user need to have access to ssh, ftp, read and write.
  14. #
  15. # There are no need to enable ftp service for the script to work,
  16. # as they are transmitted over SCP, however ftp is needed to store
  17. # the files on the router.
  18. #
  19. # Then you need to set the environment variables for the
  20. # deploy script to work.
  21. #
  22. # ```sh
  23. # export ROUTER_OS_USERNAME=certuser
  24. # export ROUTER_OS_HOST=router.example.com
  25. # export ROUTER_OS_PORT=22
  26. #
  27. # acme.sh --deploy -d ftp.example.com --deploy-hook routeros
  28. # ```
  29. #
  30. # The deploy script will remove previously deployed certificates,
  31. # and it does this with an assumption on how RouterOS names imported
  32. # certificates, adding a "cer_0" suffix at the end. This is true for
  33. # versions 6.32 -> 6.41.3, but it is not guaranteed that it will be
  34. # true for future versions when upgrading.
  35. #
  36. # If the router have other certificates with the same name as the one
  37. # beeing deployed, then this script will remove those certificates.
  38. #
  39. # At the end of the script, the services that use those certificates
  40. # could be updated. Currently only the www-ssl service is beeing
  41. # updated, but more services could be added.
  42. #
  43. # For instance:
  44. # ```sh
  45. # export ROUTER_OS_ADDITIONAL_SERVICES="/ip service set api-ssl certificate=$_cdomain.cer_0"
  46. # ```
  47. #
  48. # One optional thing to do as well is to create a script that updates
  49. # all the required services and run that script in a single command.
  50. #
  51. # To adopt parameters to `scp` and/or `ssh` set the optional
  52. # `ROUTER_OS_SSH_CMD` and `ROUTER_OS_SCP_CMD` variables accordingly,
  53. # see ssh(1) and scp(1) for parameters to those commands.
  54. #
  55. # Example:
  56. # ```ssh
  57. # export ROUTER_OS_SSH_CMD="ssh -i /acme.sh/.ssh/router.example.com -o UserKnownHostsFile=/acme.sh/.ssh/known_hosts"
  58. # export ROUTER_OS_SCP_CMD="scp -i /acme.sh/.ssh/router.example.com -o UserKnownHostsFile=/acme.sh/.ssh/known_hosts"
  59. # ````
  60. #
  61. # returns 0 means success, otherwise error.
  62. ######## Public functions #####################
  63. #domain keyfile certfile cafile fullchain
  64. routeros_deploy() {
  65. _cdomain="$1"
  66. _ckey="$2"
  67. _ccert="$3"
  68. _cca="$4"
  69. _cfullchain="$5"
  70. _debug _cdomain "$_cdomain"
  71. _debug _ckey "$_ckey"
  72. _debug _ccert "$_ccert"
  73. _debug _cca "$_cca"
  74. _debug _cfullchain "$_cfullchain"
  75. _getdeployconf ROUTER_OS_HOST
  76. if [ -z "$ROUTER_OS_HOST" ]; then
  77. _debug "Using _cdomain as ROUTER_OS_HOST, please set if not correct."
  78. ROUTER_OS_HOST="$_cdomain"
  79. fi
  80. _getdeployconf ROUTER_OS_USERNAME
  81. if [ -z "$ROUTER_OS_USERNAME" ]; then
  82. _err "Need to set the env variable ROUTER_OS_USERNAME"
  83. return 1
  84. fi
  85. _getdeployconf ROUTER_OS_PORT
  86. if [ -z "$ROUTER_OS_PORT" ]; then
  87. _debug "Using default port 22 as ROUTER_OS_PORT, please set if not correct."
  88. ROUTER_OS_PORT=22
  89. fi
  90. _getdeployconf ROUTER_OS_SSH_CMD
  91. if [ -z "$ROUTER_OS_SSH_CMD" ]; then
  92. _debug "Use default ssh setup."
  93. ROUTER_OS_SSH_CMD="ssh -p $ROUTER_OS_PORT"
  94. fi
  95. _getdeployconf ROUTER_OS_SCP_CMD
  96. if [ -z "$ROUTER_OS_SCP_CMD" ]; then
  97. _debug "USe default scp setup."
  98. ROUTER_OS_SCP_CMD="scp -P $ROUTER_OS_PORT"
  99. fi
  100. _getdeployconf ROUTER_OS_ADDITIONAL_SERVICES
  101. if [ -z "$ROUTER_OS_ADDITIONAL_SERVICES" ]; then
  102. _debug "Not enabling additional services"
  103. ROUTER_OS_ADDITIONAL_SERVICES=""
  104. fi
  105. _savedeployconf ROUTER_OS_HOST "$ROUTER_OS_HOST"
  106. _savedeployconf ROUTER_OS_USERNAME "$ROUTER_OS_USERNAME"
  107. _savedeployconf ROUTER_OS_PORT "$ROUTER_OS_PORT"
  108. _savedeployconf ROUTER_OS_SSH_CMD "$ROUTER_OS_SSH_CMD"
  109. _savedeployconf ROUTER_OS_SCP_CMD "$ROUTER_OS_SCP_CMD"
  110. _savedeployconf ROUTER_OS_ADDITIONAL_SERVICES "$ROUTER_OS_ADDITIONAL_SERVICES"
  111. _info "Trying to push key '$_ckey' to router"
  112. $ROUTER_OS_SCP_CMD "$_ckey" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.key"
  113. _info "Trying to push cert '$_cfullchain' to router"
  114. $ROUTER_OS_SCP_CMD "$_cfullchain" "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST:$_cdomain.cer"
  115. DEPLOY_SCRIPT_CMD="/system script add name=\"LE Cert Deploy - $_cdomain\" owner=$ROUTER_OS_USER \
  116. comment=\"generated by routeros deploy script in acme.sh\" \
  117. source=\"/certificate remove [ find name=$_cdomain.cer_0 ];\
  118. \n/certificate remove [ find name=$_cdomain.cer_1 ];\
  119. \n/certificate remove [ find name=$_cdomain.cer_2 ];\
  120. \ndelay 1;\
  121. \n/certificate import file-name=$_cdomain.cer passphrase=\\\"\\\";\
  122. \n/certificate import file-name=$_cdomain.key passphrase=\\\"\\\";\
  123. \ndelay 1;\
  124. \n/file remove $_cdomain.cer;\
  125. \n/file remove $_cdomain.key;\
  126. \ndelay 2;\
  127. \n/ip service set www-ssl certificate=$_cdomain.cer_0;\
  128. \n$ROUTER_OS_ADDITIONAL_SERVICES;\
  129. \n\"
  130. "
  131. # shellcheck disable=SC2029
  132. $ROUTER_OS_SSH_CMD "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "$DEPLOY_SCRIPT_CMD"
  133. # shellcheck disable=SC2029
  134. $ROUTER_OS_SSH_CMD "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script run \"LE Cert Deploy - $_cdomain\""
  135. # shellcheck disable=SC2029
  136. $ROUTER_OS_SSH_CMD "$ROUTER_OS_USERNAME@$ROUTER_OS_HOST" "/system script remove \"LE Cert Deploy - $_cdomain\""
  137. return 0
  138. }