147 lines
5.3 KiB
Bash
Executable File
147 lines
5.3 KiB
Bash
Executable File
#!/bin/bash
|
|
# Copyright 2015 ISRG. All rights reserved
|
|
# This Source Code Form is subject to the terms of the Mozilla Public
|
|
# License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
#
|
|
# This file creates individual AMQP accounts for each Boulder component,
|
|
# and sets restrictive access controls on those accounts.
|
|
#
|
|
# You can use this tool without any configuration to produce users named
|
|
# [am, ca, sa, ra, va, wfe, ocsp-updater] which all have the password "guest".
|
|
# You can also customize this tool by creating a config file that will be
|
|
# sourced. By default this file is obtained from $HOME/.rabbitmq_config, but
|
|
# you can override the config file path using the environment variable
|
|
# RABBITMQ_ACL_CONFIG, such as:
|
|
#
|
|
# $ RABBITMQ_ACL_CONFIG=myconfig ./rabbitmq_acl_configure.sh
|
|
|
|
# VARIABLES
|
|
PORT=15672
|
|
HOST=localhost
|
|
VHOST="/"
|
|
EXTRA=""
|
|
RABBIT_ADMIN=$(which rabbitmqadmin)
|
|
|
|
# USER NAMES
|
|
USER_BOULDER_AM="am"
|
|
USER_BOULDER_CA="ca"
|
|
USER_BOULDER_SA="sa"
|
|
USER_BOULDER_RA="ra"
|
|
USER_BOULDER_VA="va"
|
|
USER_BOULDER_WFE="wfe"
|
|
USER_BOULDER_OCSP="ocsp-updater"
|
|
USER_BOULDER_PUBLISHER="publisher"
|
|
|
|
# PASSWORDS
|
|
PASS_BOULDER_AM="guest"
|
|
PASS_BOULDER_CA="guest"
|
|
PASS_BOULDER_SA="guest"
|
|
PASS_BOULDER_RA="guest"
|
|
PASS_BOULDER_VA="guest"
|
|
PASS_BOULDER_WFE="guest"
|
|
PASS_BOULDER_OCSP="guest"
|
|
PASS_BOULDER_PUBLISHER="guest"
|
|
|
|
# To use different options, you should create an override
|
|
# file with whatever changes you want for the above variables
|
|
RABBITMQ_ACL_CONFIG=${RABBITMQ_ACL_CONFIG:-$HOME/.rabbitmq_config}
|
|
|
|
if [ -r "${RABBITMQ_ACL_CONFIG}" ] ; then
|
|
echo "Loading overrides from ${RABBITMQ_ACL_CONFIG}..."
|
|
source "${RABBITMQ_ACL_CONFIG}"
|
|
fi
|
|
|
|
if ! [ -x "${RABBIT_ADMIN}" ] ; then
|
|
echo "Could not locate rabbitmqadmin; please set RABBIT_ADMIN in your ${RABBITMQ_ACL_CONFIG} file."
|
|
exit 1
|
|
fi
|
|
|
|
run() {
|
|
echo $*
|
|
$*
|
|
}
|
|
|
|
admin() {
|
|
run ${RABBIT_ADMIN} -H ${HOST} -P ${PORT} -V ${VHOST} ${EXTRA} $*
|
|
}
|
|
|
|
admin declare queue name="Monitor" durable=false
|
|
admin declare queue name="CA.server" durable=false
|
|
admin declare queue name="SA.server" durable=false
|
|
admin declare queue name="RA.server" durable=false
|
|
admin declare queue name="VA.server" durable=false
|
|
admin declare queue name="Publisher.server" durable=false
|
|
|
|
admin declare exchange name="boulder" type=topic durable=false
|
|
|
|
# Bind the wildcard topic (#) to Monitor, asking the server to copy all messages
|
|
# and place them in the Montior queue.
|
|
admin declare binding source="boulder" destination="Monitor" routing_key="#"
|
|
|
|
admin declare user name=${USER_BOULDER_AM} password=${PASS_BOULDER_AM} tags=""
|
|
admin declare user name=${USER_BOULDER_CA} password=${PASS_BOULDER_CA} tags=""
|
|
admin declare user name=${USER_BOULDER_SA} password=${PASS_BOULDER_SA} tags=""
|
|
admin declare user name=${USER_BOULDER_RA} password=${PASS_BOULDER_RA} tags=""
|
|
admin declare user name=${USER_BOULDER_VA} password=${PASS_BOULDER_VA} tags=""
|
|
admin declare user name=${USER_BOULDER_WFE} password=${PASS_BOULDER_WFE} tags=""
|
|
admin declare user name=${USER_BOULDER_OCSP} password=${PASS_BOULDER_OCSP} tags=""
|
|
admin declare user name=${USER_BOULDER_PUBLISHER} password=${PASS_BOULDER_PUBLISHER} tags=""
|
|
|
|
##################################################
|
|
## Permissions RegExes ##
|
|
##################################################
|
|
## Mystified? These are applied by the server ##
|
|
## to various operations on queue names per ##
|
|
## the decoder matrix here: ##
|
|
## https://www.rabbitmq.com/access-control.html ##
|
|
##################################################
|
|
|
|
# AM is read-only, and uses a predeclared Queue.
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_AM} \
|
|
configure="^$" \
|
|
write="^$" \
|
|
read="^Monitor$"
|
|
|
|
# VA uses VA.server, as well as dynamic queues named VA->RA.{hostname}.
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_VA} \
|
|
configure="^(VA\.server|VA->RA.*)$" \
|
|
write="^(boulder|VA\.server|VA->RA.*)$" \
|
|
read="^(boulder|VA\.server|VA->RA.*)$"
|
|
|
|
# RA uses RA.server, and RA->CA, RA->SA, RA->VA
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_RA} \
|
|
configure="^(RA\.server|RA->(CA|SA|VA).*)$" \
|
|
write="^(boulder|RA\.server|RA->(CA|SA|VA).*)$" \
|
|
read="^(boulder|RA\.server|RA->(CA|SA|VA).*)$"
|
|
|
|
# CA uses CA.server, and CA->SA
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_CA} \
|
|
configure="^(CA\.server|CA->SA.*)$" \
|
|
write="^(boulder|CA\.server|CA->SA.*)$" \
|
|
read="^(boulder|CA\.server|CA->(SA|Publisher).*)$"
|
|
|
|
# SA uses only SA.server
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_SA} \
|
|
configure="^SA\.server$" \
|
|
write="^(boulder|SA\.server)$" \
|
|
read="^(boulder|SA\.server)$"
|
|
|
|
# WFE uses WFE->RA and WFE->SA
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_WFE} \
|
|
configure="^(WFE->(RA|SA).*)$" \
|
|
write="^(boulder|WFE->(RA|SA).*)$" \
|
|
read="^(boulder|WFE->(RA|SA).*)$"
|
|
|
|
# OCSP uses only OCSP->CA
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_OCSP} \
|
|
configure="^(OCSP->CA.*)$" \
|
|
write="^(boulder|OCSP->CA.*)$" \
|
|
read="^(boulder|OCSP->CA.*)$"
|
|
|
|
# Publisher uses Publisher.server and Publisher->SA
|
|
admin declare permission vhost=${VHOST} user=${USER_BOULDER_PUBLISHER} \
|
|
configure="^Publisher\.server$" \
|
|
write="^(boulder|Publisher\.server)$" \
|
|
read="^(boulder|Publisher\.server|Publisher->SA.*)$"
|