diff --git a/Dockerfile b/Dockerfile index 1b1ed86..61971df 100644 --- a/Dockerfile +++ b/Dockerfile @@ -7,7 +7,11 @@ RUN \ COPY custom.conf /etc/proftpd/conf.d/custom.conf COPY run.sh /run.sh +COPY cron.sh /cron.sh -RUN chmod +x /run.sh +RUN \ + chmod +x /run.sh && \ + chmod +x /cron.sh && \ + ln -s /cron.sh /etc/periodic/15min/reconfigure_certs.sh ENTRYPOINT ["/run.sh"] diff --git a/cron.sh b/cron.sh new file mode 100644 index 0000000..e82e276 --- /dev/null +++ b/cron.sh @@ -0,0 +1,45 @@ +#!/bin/sh + +############ TLS + +TLS_CERT=${TLS_CERT:-/certs/cert.pem} +TLS_KEY=${TLS_KEY:-/certs/privkey.pem} +TLS_CHAIN=${TLS_CHAIN:-/certs/chain.pem} + +cat $TLS_CERT > /etc/proftpd/cert.pem +cat $TLS_KEY > /etc/proftpd/privkey.pem +cat $TLS_CHAIN > /etc/proftpd/chain.pem + +############ IF CERT IS THE SAME, THEN EXIT + +md5sum -c /sums 1&>2 2>/dev/null && exit + +############ CHECK CERT KEY ALGO + +ALGO=$(openssl x509 -in /etc/proftpd/cert.pem -text | sed -n 's/\ *Public Key Algorithm: //p' | tr '\n') + +if [ "$ALGO" = "id-ecPublicKey" ] ; then +cat > /etc/proftpd/conf.d/certificate.conf < + TLSECCertificateFile /etc/proftpd/cert.pem + TLSECCertificateKeyFile /etc/proftpd/privkey.pem + TLSCertificateChainFile /etc/proftpd/chain.pem + +EOF +fi + +if [ "$ALGO" = "rsaEncryption" ] ; then +cat > /etc/proftpd/conf.d/certificate.conf < + TLSRSACertificateFile /etc/proftpd/cert.pem + TLSRSACertificateKeyFile /etc/proftpd/privkey.pem + TLSCertificateChainFile /etc/proftpd/chain.pem + +EOF +fi + +md5sum "$TLS_CERT" > /sums + +############ RELOAD + +killall -HUP proftpd diff --git a/run.sh b/run.sh index 1e91caa..b730842 100644 --- a/run.sh +++ b/run.sh @@ -24,7 +24,7 @@ cat $TLS_CHAIN > /etc/proftpd/chain.pem ############ CHECK CERT KEY ALGO -ALGO=$(openssl x509 -in /etc/proftpd/cert.pem -text | sed -n 's/\ *Public Key Algorithm: //p') +ALGO=$(openssl x509 -in /etc/proftpd/cert.pem -text | sed -n 's/\ *Public Key Algorithm: //p' | tr '\n') if [ "$ALGO" = "id-ecPublicKey" ] ; then cat > /etc/proftpd/conf.d/certificate.conf < /etc/proftpd/conf.d/certificate.conf < /sums + ############ PASSIVE PORTS PASSIVEPORTS_START=${PASSIVEPORTS_START:-50000} @@ -53,6 +55,10 @@ PASSIVEPORTS_END=${PASSIVEPORTS_END:-50050} echo "PassivePorts ${PASSIVEPORTS_START} ${PASSIVEPORTS_END}" > /etc/proftpd/conf.d/passive_ports.conf +############ START CRON + +crond -b + ############ START proftpd -n