From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 2BE759A0FA for ; Tue, 14 Nov 2023 15:15:05 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 0C3A41CD8D for ; Tue, 14 Nov 2023 15:14:35 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Tue, 14 Nov 2023 15:14:33 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 49B59429C0 for ; Tue, 14 Nov 2023 15:14:33 +0100 (CET) From: Folke Gleumes To: pmg-devel@lists.proxmox.com Date: Tue, 14 Nov 2023 15:14:08 +0100 Message-Id: <20231114141408.228705-10-f.gleumes@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231114141408.228705-1-f.gleumes@proxmox.com> References: <20231114141408.228705-1-f.gleumes@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.017 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record T_SCC_BODY_TEXT_LINE -0.01 - Subject: [pmg-devel] [PATCH pmg-api 8/8] cli: acme: expose acme eab options on the cli X-BeenThere: pmg-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Mail Gateway development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Nov 2023 14:15:05 -0000 interactively ask for external account binding credentials if either: * the ca requests it * a custom ca is used Signed-off-by: Folke Gleumes --- src/PMG/CLI/pmgconfig.pm | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/src/PMG/CLI/pmgconfig.pm b/src/PMG/CLI/pmgconfig.pm index cc036fa..2a7a7a1 100644 --- a/src/PMG/CLI/pmgconfig.pm +++ b/src/PMG/CLI/pmgconfig.pm @@ -244,6 +244,7 @@ __PACKAGE__->register_method({ code => sub { my ($param) = @_; + my $custom_directory = 1; if (!$param->{directory}) { my $directories = PMG::API2::ACME->get_directories({}); print "Directory endpoints:\n"; @@ -264,6 +265,7 @@ __PACKAGE__->register_method({ return; } elsif ($selection < $i && $selection >= 0) { $param->{directory} = $directories->[$selection]->{url}; + $custom_directory = 0; return; } } @@ -277,11 +279,13 @@ __PACKAGE__->register_method({ $attempts++; } } + print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n"; - my $tos = PMG::API2::ACME->get_tos({ directory => $param->{directory} }); - if ($tos) { + my $meta = PMG::API2::ACME->get_meta({ directory => $param->{directory} }); + if ($meta->{termsOfService}) { + my $tos = $meta->{termsOfService}; print "Terms of Service: $tos\n"; - my $term = Term::ReadLine->new('pvenode'); + my $term = Term::ReadLine->new('pmgconfig'); my $agreed = $term->readline('Do you agree to the above terms? [y|N]: '); die "Cannot continue without agreeing to ToS, aborting.\n" if ($agreed !~ /^y$/i); @@ -290,6 +294,25 @@ __PACKAGE__->register_method({ } else { print "No Terms of Service found, proceeding.\n"; } + + my $eab_enabled = $meta->{externalAccountRequired}; + if (!$eab_enabled && $custom_directory) { + my $term = Term::ReadLine->new('pmgconfig'); + my $agreed = $term->readline('Do you want to use external account binding? [y|N]: '); + $eab_enabled = ($agreed =~ /^y$/i); + } elsif ($eab_enabled) { + print "The CA requires external account binding.\n"; + } + if ($eab_enabled) { + print "You should have received a key id and a key from your CA.\n"; + my $term = Term::ReadLine->new('pmgconfig'); + my $eab_kid = $term->readline('Enter EAB key id: '); + my $eab_hmac_key = $term->readline('Enter EAB key: '); + + $param->{'eab-kid'} = $eab_kid; + $param->{'eab-hmac-key'} = $eab_hmac_key; + } + print "\nAttempting to register account with '$param->{directory}'..\n"; $upid_exit->(PMG::API2::ACME->register_account($param)); -- 2.39.2