1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
|
#!/bin/sh
set -e
if test $# -eq 0 ; then
cat <<EOF 1>&2
Usage:
$(basename $0) <directory>
Generates a host key and then creates:
OUTPUT/<us>.pub i.e., {left,right}pubkey=...
OUTPUT/<us>.raw i.e., {left,right}{rsasig,ecdsa}key=
OUTPUT/<us>.pem mime file
OUTPUT/<us>.ckaid i.e., {left,right}ciakd=...
OUTPUT/<us>.hostkey copy of .raw or .pub
Uses directory to determine raw|pem and rsa|ecdsa.
EOF
exit 1
fi
keytype=
case $1 in
*rsa* ) keytype=rsa ;;
*ecdsa* ) keytype=ecdsa ;;
* ) echo "Unknown keytype" 1>&2 ; exit 1 ;;
esac
format=
case $1 in
*raw* ) format=raw ;;
*pem* ) format=pub ;;
*pub* ) format=pub ;;
* ) echo "Unknown format" 1>&2 ; exit 1 ;;
esac
echo ${format} ${keytype}
# US vs THEM
us=$(hostname | cut -d. -f1)
them=$(case $us in east ) echo west ;; west ) echo east ;; esac)
leftright=$(case $us in east ) echo right ;; west ) echo left ;; esac)
echo us=${us} them=${them} leftright=${leftright}
# generate the host key and save it
ckaid=$(ipsec newhostkey --keytype ${keytype} 2>&1 | grep "showhostkey" | sed "s/^.*ckaid //")
# sanitizing brought to you by id-sanitize.sed
printf "\t${leftright}ckaid=${ckaid}\n" > OUTPUT/$us.ckaid
# BEGIN...END
ipsec showhostkey --pem --ckaid "${ckaid}" > OUTPUT/$us.pem
# {left,right}{rsasig,ecdsa}key=...
ipsec showhostkey --${leftright} --ckaid "${ckaid}" > OUTPUT/$us.raw
# {left,right}pubkey=...
ipsec showhostkey --${leftright} --pubkey --ckaid "${ckaid}" > OUTPUT/$us.pub
cp OUTPUT/${us}.${format} OUTPUT/${us}.hostkey
|
