chore: Änderungen commited
This commit is contained in:
@ -335,4 +335,248 @@ verify_environment() {
|
||||
log "ERROR" "Umgebungsverifikation fehlgeschlagen ($errors Fehler)"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
install_mercedes_certificates() {
|
||||
log "INFO" "Installiere Mercedes-Benz Corporate Zertifikate..."
|
||||
|
||||
# Prüfe ob Mercedes-Zertifikate im Projekt vorhanden sind
|
||||
local mercedes_cert_dir="$INSTALL_PATH/certs/mercedes"
|
||||
if [[ ! -d "$mercedes_cert_dir" ]]; then
|
||||
log "WARN" "Mercedes-Zertifikat-Verzeichnis nicht gefunden: $mercedes_cert_dir"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# System-Zertifikat-Verzeichnis erstellen
|
||||
local system_cert_dir="/usr/local/share/ca-certificates/mercedes"
|
||||
mkdir -p "$system_cert_dir"
|
||||
|
||||
# Mercedes-Zertifikate finden und installieren
|
||||
local cert_files_found=0
|
||||
|
||||
# Corp-Prj-Root-CA.cer
|
||||
if [[ -f "$mercedes_cert_dir/Corp-Prj-Root-CA.cer" ]]; then
|
||||
log "INFO" "Installiere Mercedes Corp-Prj-Root-CA Zertifikat..."
|
||||
|
||||
# Konvertiere .cer zu .crt für ca-certificates
|
||||
cp "$mercedes_cert_dir/Corp-Prj-Root-CA.cer" "$system_cert_dir/Corp-Prj-Root-CA.crt"
|
||||
chmod 644 "$system_cert_dir/Corp-Prj-Root-CA.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ Corp-Prj-Root-CA Zertifikat installiert"
|
||||
fi
|
||||
|
||||
# Corp-Root-CA-G2.cer
|
||||
if [[ -f "$mercedes_cert_dir/Corp-Root-CA-G2.cer" ]]; then
|
||||
log "INFO" "Installiere Mercedes Corp-Root-CA-G2 Zertifikat..."
|
||||
|
||||
# Konvertiere .cer zu .crt für ca-certificates
|
||||
cp "$mercedes_cert_dir/Corp-Root-CA-G2.cer" "$system_cert_dir/Corp-Root-CA-G2.crt"
|
||||
chmod 644 "$system_cert_dir/Corp-Root-CA-G2.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ Corp-Root-CA-G2 Zertifikat installiert"
|
||||
fi
|
||||
|
||||
# Weitere Mercedes-Zertifikate automatisch erkennen
|
||||
for cert_file in "$mercedes_cert_dir"/*.cer "$mercedes_cert_dir"/*.crt; do
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
local basename=$(basename "$cert_file")
|
||||
local cert_name="${basename%.*}"
|
||||
|
||||
# Überspringe bereits behandelte Zertifikate
|
||||
if [[ "$cert_name" == "Corp-Prj-Root-CA" ]] || [[ "$cert_name" == "Corp-Root-CA-G2" ]]; then
|
||||
continue
|
||||
fi
|
||||
|
||||
log "INFO" "Installiere zusätzliches Mercedes-Zertifikat: $basename..."
|
||||
cp "$cert_file" "$system_cert_dir/${cert_name}.crt"
|
||||
chmod 644 "$system_cert_dir/${cert_name}.crt"
|
||||
cert_files_found=$((cert_files_found + 1))
|
||||
|
||||
log "INFO" "✓ $basename installiert"
|
||||
fi
|
||||
done
|
||||
|
||||
if [[ $cert_files_found -eq 0 ]]; then
|
||||
log "WARN" "Keine Mercedes-Zertifikate gefunden"
|
||||
return 0
|
||||
fi
|
||||
|
||||
# CA-Zertifikat-Store aktualisieren
|
||||
log "INFO" "Aktualisiere System-Zertifikat-Store..."
|
||||
if update-ca-certificates --verbose; then
|
||||
log "INFO" "✓ System-Zertifikat-Store erfolgreich aktualisiert"
|
||||
else
|
||||
log "ERROR" "Fehler beim Aktualisieren des Zertifikat-Stores"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Zertifikat-Installation für Python-Requests konfigurieren
|
||||
configure_python_certificates
|
||||
|
||||
# Zertifikat-Installation für Node.js konfigurieren
|
||||
configure_nodejs_certificates
|
||||
|
||||
# Zertifikat-Installation für Chromium konfigurieren
|
||||
configure_chromium_certificates
|
||||
|
||||
log "INFO" "Mercedes-Zertifikate Installation abgeschlossen ($cert_files_found Zertifikate)"
|
||||
}
|
||||
|
||||
configure_python_certificates() {
|
||||
log "INFO" "Konfiguriere Python für Mercedes-Zertifikate..."
|
||||
|
||||
# Python-Requests Zertifikat-Pfad konfigurieren
|
||||
local python_cert_config="/etc/myp/python-certs.conf"
|
||||
cat > "$python_cert_config" << 'EOF'
|
||||
# Mercedes-Benz Python Certificate Configuration
|
||||
# Für requests und andere Python-HTTP-Libraries
|
||||
|
||||
# CA Bundle Pfad für requests
|
||||
export REQUESTS_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
export SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt
|
||||
export SSL_CERT_DIR=/etc/ssl/certs
|
||||
|
||||
# Zusätzliche Umgebungsvariablen für Corporate-Umgebung
|
||||
export PYTHONHTTPSVERIFY=1
|
||||
export CURL_CA_BUNDLE=/etc/ssl/certs/ca-certificates.crt
|
||||
EOF
|
||||
|
||||
# Python-Konfiguration in Benutzer-Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Python Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/python-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
fi
|
||||
|
||||
# Für systemweite Anwendung
|
||||
echo "source /etc/myp/python-certs.conf" >> "/etc/environment"
|
||||
|
||||
log "INFO" "Python-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
configure_nodejs_certificates() {
|
||||
log "INFO" "Konfiguriere Node.js für Mercedes-Zertifikate..."
|
||||
|
||||
# Node.js CA-Konfiguration
|
||||
local nodejs_cert_config="/etc/myp/nodejs-certs.conf"
|
||||
cat > "$nodejs_cert_config" << 'EOF'
|
||||
# Mercedes-Benz Node.js Certificate Configuration
|
||||
|
||||
# CA Bundle für Node.js
|
||||
export NODE_EXTRA_CA_CERTS=/etc/ssl/certs/ca-certificates.crt
|
||||
|
||||
# Deaktiviere strenge SSL-Verifikation nur wenn nötig (nicht empfohlen)
|
||||
# export NODE_TLS_REJECT_UNAUTHORIZED=0
|
||||
EOF
|
||||
|
||||
# Node.js-Konfiguration in Profile einbinden
|
||||
if [[ -f "/home/$PROJECT_USER/.bashrc" ]]; then
|
||||
echo "# Mercedes-Benz Node.js Certificate Configuration" >> "/home/$PROJECT_USER/.bashrc"
|
||||
echo "source /etc/myp/nodejs-certs.conf" >> "/home/$PROJECT_USER/.bashrc"
|
||||
fi
|
||||
|
||||
log "INFO" "Node.js-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
configure_chromium_certificates() {
|
||||
log "INFO" "Konfiguriere Chromium für Mercedes-Zertifikate..."
|
||||
|
||||
# Chromium Policy-Verzeichnis erstellen
|
||||
local chromium_policy_dir="/etc/chromium/policies/managed"
|
||||
mkdir -p "$chromium_policy_dir"
|
||||
|
||||
# Chromium Certificate Policy
|
||||
cat > "$chromium_policy_dir/mercedes-certificates.json" << 'EOF'
|
||||
{
|
||||
"AutoSelectCertificateForUrls": [
|
||||
"https://*.mercedes-benz.com",
|
||||
"https://*.daimler.com",
|
||||
"https://*.daimlertruck.com"
|
||||
],
|
||||
"CertificateTransparencyEnforcementDisabledForUrls": [
|
||||
"*.mercedes-benz.com",
|
||||
"*.daimler.com",
|
||||
"*.daimlertruck.com"
|
||||
],
|
||||
"AllowInsecureLocalhost": true
|
||||
}
|
||||
EOF
|
||||
|
||||
# Chromium NSS-Datenbank für Benutzer konfigurieren
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
local nss_dir="/home/$PROJECT_USER/.pki/nssdb"
|
||||
mkdir -p "$nss_dir"
|
||||
chown -R "$PROJECT_USER:$PROJECT_GROUP" "/home/$PROJECT_USER/.pki"
|
||||
|
||||
# NSS-Datenbank initialisieren falls nicht vorhanden
|
||||
if [[ ! -f "$nss_dir/cert9.db" ]]; then
|
||||
sudo -u "$PROJECT_USER" certutil -N -d sql:"$nss_dir" --empty-password
|
||||
fi
|
||||
|
||||
# Mercedes-Zertifikate zu NSS-Datenbank hinzufügen
|
||||
for cert_file in /usr/local/share/ca-certificates/mercedes/*.crt; do
|
||||
if [[ -f "$cert_file" ]]; then
|
||||
local cert_name=$(basename "$cert_file" .crt)
|
||||
sudo -u "$PROJECT_USER" certutil -A -n "Mercedes-$cert_name" -t "C,," -d sql:"$nss_dir" -i "$cert_file" || true
|
||||
fi
|
||||
done
|
||||
|
||||
log "INFO" "Mercedes-Zertifikate zu Chromium NSS-Datenbank hinzugefügt"
|
||||
else
|
||||
log "WARN" "certutil nicht verfügbar, installiere NSS-Tools..."
|
||||
DEBIAN_FRONTEND=noninteractive apt-get install -y libnss3-tools
|
||||
|
||||
# Nach Installation nochmal versuchen
|
||||
if command -v certutil >/dev/null 2>&1; then
|
||||
configure_chromium_certificates
|
||||
fi
|
||||
fi
|
||||
|
||||
log "INFO" "Chromium-Zertifikat-Konfiguration abgeschlossen"
|
||||
}
|
||||
|
||||
verify_mercedes_certificates() {
|
||||
log "INFO" "Überprüfe Mercedes-Zertifikat-Installation..."
|
||||
|
||||
local errors=0
|
||||
|
||||
# Prüfe installierte Zertifikate
|
||||
local cert_count=$(find /usr/local/share/ca-certificates/mercedes -name "*.crt" 2>/dev/null | wc -l)
|
||||
if [[ $cert_count -eq 0 ]]; then
|
||||
log "ERROR" "Keine Mercedes-Zertifikate installiert"
|
||||
errors=$((errors + 1))
|
||||
else
|
||||
log "INFO" "✓ $cert_count Mercedes-Zertifikate installiert"
|
||||
fi
|
||||
|
||||
# Prüfe CA-Store-Update
|
||||
if [[ -f "/etc/ssl/certs/ca-certificates.crt" ]]; then
|
||||
# Prüfe ob Mercedes-Zertifikate im CA-Bundle enthalten sind
|
||||
if grep -q "Daimler AG" /etc/ssl/certs/ca-certificates.crt; then
|
||||
log "INFO" "✓ Mercedes-Zertifikate im System-CA-Store gefunden"
|
||||
else
|
||||
log "WARN" "Mercedes-Zertifikate möglicherweise nicht im CA-Store"
|
||||
fi
|
||||
else
|
||||
log "ERROR" "System-CA-Store nicht gefunden"
|
||||
errors=$((errors + 1))
|
||||
fi
|
||||
|
||||
# Teste HTTPS-Verbindung zu Mercedes-Domain (falls möglich)
|
||||
if command -v curl >/dev/null 2>&1; then
|
||||
if curl -s --connect-timeout 5 https://www.mercedes-benz.com >/dev/null 2>&1; then
|
||||
log "INFO" "✓ HTTPS-Verbindung zu Mercedes-Domain erfolgreich"
|
||||
else
|
||||
log "WARN" "HTTPS-Verbindung zu Mercedes-Domain fehlgeschlagen (möglicherweise Netzwerk)"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [[ $errors -eq 0 ]]; then
|
||||
log "INFO" "Mercedes-Zertifikat-Verifikation erfolgreich"
|
||||
return 0
|
||||
else
|
||||
log "ERROR" "Mercedes-Zertifikat-Verifikation fehlgeschlagen ($errors Fehler)"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
Reference in New Issue
Block a user