From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id DBD859D1BF for ; Wed, 25 Oct 2023 15:07:34 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id BB01514358 for ; Wed, 25 Oct 2023 15:07:34 +0200 (CEST) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for ; Wed, 25 Oct 2023 15:07:33 +0200 (CEST) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 4D25745F35 for ; Wed, 25 Oct 2023 15:07:33 +0200 (CEST) From: Folke Gleumes To: pve-devel@lists.proxmox.com Date: Wed, 25 Oct 2023 15:07:19 +0200 Message-Id: <20231025130720.195478-5-f.gleumes@proxmox.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20231025130720.195478-1-f.gleumes@proxmox.com> References: <20231025130720.195478-1-f.gleumes@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL 0.017 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [pvenode.pm] Subject: [pve-devel] [PATCH manager v2 4/5] fix #4497: cli/acme: detect eab and ask for credentials X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 25 Oct 2023 13:07:34 -0000 Since external account binding is advertised the same way as the ToS, it can be detected when creating an account and asked for if needed. Signed-off-by: Folke Gleumes --- Changes v1 -> v2: * If a custom directory is used, ask if EAB should be used, even when not required by the CA. PVE/CLI/pvenode.pm | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/PVE/CLI/pvenode.pm b/PVE/CLI/pvenode.pm index acef6c3b..a6fbb34e 100644 --- a/PVE/CLI/pvenode.pm +++ b/PVE/CLI/pvenode.pm @@ -83,6 +83,7 @@ __PACKAGE__->register_method({ code => sub { my ($param) = @_; + my $custom_directory = 0; if (!$param->{directory}) { my $directories = PVE::API2::ACMEAccount->get_directories({}); print "Directory endpoints:\n"; @@ -100,6 +101,7 @@ __PACKAGE__->register_method({ $selection = $1; if ($selection == $i) { $param->{directory} = $term->readline("Enter custom URL: "); + $custom_directory = 1; return; } elsif ($selection < $i && $selection >= 0) { $param->{directory} = $directories->[$selection]->{url}; @@ -117,8 +119,9 @@ __PACKAGE__->register_method({ } } print "\nAttempting to fetch Terms of Service from '$param->{directory}'..\n"; - my $tos = PVE::API2::ACMEAccount->get_tos({ directory => $param->{directory} }); - if ($tos) { + my $meta = PVE::API2::ACMEAccount->get_meta({ directory => $param->{directory} }); + if ($meta->{termsOfService}) { + my $tos = $meta->{termsOfService}; print "Terms of Service: $tos\n"; my $term = Term::ReadLine->new('pvenode'); my $agreed = $term->readline('Do you agree to the above terms? [y|N]: '); @@ -129,6 +132,25 @@ __PACKAGE__->register_method({ } else { print "No Terms of Service found, proceeding.\n"; } + + my $eab_enabled = $meta->{externalAccountRequired}; + if (!$eab_enabled && $custom_directory) { + my $term = Term::ReadLine->new('pvenode'); + my $agreed = $term->readline('Do you want to use external account binding? [y|N]: '); + $eab_enabled = ($agreed =~ /^y$/i); + } elsif ($eab_enabled) { + print "The CA requires external account binding.\n"; + } + if ($eab_enabled) { + print "You should have received a key id and a key from your CA.\n"; + my $term = Term::ReadLine->new('pvenode'); + my $eab_kid = $term->readline('Enter EAB key id: '); + my $eab_hmac_key = $term->readline('Enter EAB key: '); + + $param->{'eab-kid'} = $eab_kid; + $param->{'eab-hmac-key'} = $eab_hmac_key; + } + print "\nAttempting to register account with '$param->{directory}'..\n"; $upid_exit->(PVE::API2::ACMEAccount->register_account($param)); -- 2.39.2