62 lines
2.0 KiB
Plaintext
62 lines
2.0 KiB
Plaintext
|
#!/bin/sh /etc/rc.common
|
||
|
|
|
||
|
|
SERVICE_USE_PID=1
|
||
|
|
|
||
|
|
START=50
|
||
|
|
|
||
|
|
start() {
|
||
|
|
user_exists ocserv 72 || user_add ocserv 72 72 /var/lib/ocserv
|
||
|
|
group_exists ocserv 72 || group_add ocserv 72
|
||
|
|
|
||
|
|
[ ! -f /etc/ocserv/ca-key.pem ] && [ -x /usr/bin/certtool ] && {
|
||
|
|
echo "Generating CA certificate..."
|
||
|
|
mkdir -p /etc/ocserv/pki/
|
||
|
|
certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/ca-key.pem >/dev/null 2>&1
|
||
|
|
echo "cn=`uci get system.@system[0].hostname` CA" >/etc/ocserv/pki/ca.tmpl
|
||
|
|
echo "expiration_days=-1" >>/etc/ocserv/pki/ca.tmpl
|
||
|
|
echo "serial=1" >>/etc/ocserv/pki/ca.tmpl
|
||
|
|
echo "ca" >>/etc/ocserv/pki/ca.tmpl
|
||
|
|
echo "cert_signing_key" >>/etc/ocserv/pki/ca.tmpl
|
||
|
|
|
||
|
|
certtool --template /etc/ocserv/pki/ca.tmpl \
|
||
|
|
--generate-self-signed --load-privkey /etc/ocserv/ca-key.pem \
|
||
|
|
--outfile /etc/ocserv/ca.pem >/dev/null 2>&1
|
||
|
|
}
|
||
|
|
|
||
|
|
#generate server certificate/key
|
||
|
|
[ ! -f /etc/ocserv/server-key.pem ] && [ -x /usr/bin/certtool ] && {
|
||
|
|
echo "Generating server certificate..."
|
||
|
|
mkdir -p /etc/ocserv/pki/
|
||
|
|
certtool --bits 2048 --generate-privkey --outfile /etc/ocserv/server-key.pem >/dev/null 2>&1
|
||
|
|
echo "cn=`uci get system.@system[0].hostname`" >/etc/ocserv/pki/server.tmpl
|
||
|
|
echo "serial=2" >>/etc/ocserv/pki/server.tmpl
|
||
|
|
echo "expiration_days=-1" >>/etc/ocserv/pki/server.tmpl
|
||
|
|
echo "signing_key" >>/etc/ocserv/pki/server.tmpl
|
||
|
|
echo "encryption_key" >>/etc/ocserv/pki/server.tmpl
|
||
|
|
certtool --template /etc/ocserv/pki/server.tmpl \
|
||
|
|
--generate-certificate --load-privkey /etc/ocserv/server-key.pem \
|
||
|
|
--load-ca-certificate /etc/ocserv/ca.pem --load-ca-privkey \
|
||
|
|
/etc/ocserv/ca-key.pem --outfile /etc/ocserv/server-cert.pem >/dev/null 2>&1
|
||
|
|
}
|
||
|
|
|
||
|
|
[ -f /etc/ocserv/ocpasswd ] || {
|
||
|
|
touch /etc/ocserv/ocpasswd
|
||
|
|
}
|
||
|
|
|
||
|
|
[ -f /var/run/ocserv.pid ] || {
|
||
|
|
touch /var/run/ocserv.pid
|
||
|
|
chown ocserv:ocserv /var/run/ocserv.pid
|
||
|
|
}
|
||
|
|
[ -d /var/lib/ocserv ] || {
|
||
|
|
mkdir -m 0755 -p /var/lib/ocserv
|
||
|
|
chmod 0700 /var/lib/ocserv
|
||
|
|
chown ocserv:ocserv /var/lib/ocserv
|
||
|
|
}
|
||
|
|
service_start /usr/sbin/ocserv -c /etc/ocserv/ocserv.conf
|
||
|
|
}
|
||
|
|
|
||
|
|
stop() {
|
||
|
|
service_stop /usr/sbin/ocserv
|
||
|
|
}
|
||
|
|
|