I'm trying to programmatically accept a CA certificate on a newly installed ubuntu 18.04.
The user does not have a ~/.mozilla folder when I run this script.
sudo apt install libnss3-tools
rm -rf /home/${USER}/.mozilla/
installId="4F96D1932A9F858E" # hash of firefox install location
defaultProfileId=$(openssl rand -hex 4)
releaseProfileId=$(openssl rand -hex 4)
certificateFile="/home/${USER}/hcp-ca-cert.pem"
certificateName="HCP CA Cert"
#########
certDir="/home/${USER}/.mozilla/firefox/${defaultProfileId}.default"
mkdir -p $certDir
certutil -A -n "${certificateName}" -t "TCu,Cu,Tu" -i "${certificateFile}" -d "${certDir}"
certDir="/home/${USER}/.mozilla/firefox/${releaseProfileId}.default-release"
mkdir -p $certDir
certutil -A -n "${certificateName}" -t "TCu,Cu,Tu" -i "${certificateFile}" -d "${certDir}"
#########
cat << EOF >> /home/${USER}/.mozilla/firefox/profiles.ini
[Install${installId}]
Default=${defaultProfileId}.default
Locked=1
[Profile1]
Name=default
IsRelative=1
Path=${defaultProfileId}.default
Default=1
[Profile0]
Name=default-release
IsRelative=1
Path=${releaseProfileId}.default
[General]
StartWithLastProfile=1
Version=2
EOF
#########
cat << EOF >> /home/${USER}/.mozilla/firefox/installs.ini
[${installId}]
Default=${releaseProfileId}.default-release
Locked=1
EOF
This creates the profiles, e.g.
ubuntu#ip-10-1-0-121:~$ certutil -L -d .mozilla/firefox/d8cfb77c.default/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
HCP CA Cert CT,C,c
and
ubuntu#ip-10-1-0-121:~$ certutil -L -d .mozilla/firefox/d8cfb77c.default/
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
HCP CA Cert CT,C,c
However, if I attempt to browse a site using the CA, I get the error invalid certificate:
Error code: SEC_ERROR_UNKNOWN_ISSUER
If I manually import the CA certificate into firefox's trusted authorities, the site loads fine without validation errors.
Update:
Looking at the file access times, it seems that when I open firefox, it is creating a new file 'cert9.db':
ubuntu#ip-10-1-0-121:~$ ll .mozilla/firefox/bf0a1f94.default-release/*.db
-rw------- 1 ubuntu ubuntu 65536 Apr 1 09:12 .mozilla/firefox/bf0a1f94.default-release/cert8.db
-rw------- 1 ubuntu ubuntu 16384 Apr 1 09:12 .mozilla/firefox/bf0a1f94.default-release/key3.db
-rw------- 1 ubuntu ubuntu 16384 Apr 1 09:12 .mozilla/firefox/bf0a1f94.default-release/secmod.db
and
ubuntu#ip-10-1-0-121:~$ ll .mozilla/firefox/d8cfb77c.default/*.db
-rw------- 1 ubuntu ubuntu 65536 Apr 1 09:12 .mozilla/firefox/d8cfb77c.default/cert8.db
-rw------- 1 ubuntu ubuntu 229376 Apr 1 09:33 .mozilla/firefox/d8cfb77c.default/cert9.db
-rw------- 1 ubuntu ubuntu 16384 Apr 1 09:12 .mozilla/firefox/d8cfb77c.default/key3.db
-rw------- 1 ubuntu ubuntu 294912 Apr 1 09:33 .mozilla/firefox/d8cfb77c.default/key4.db
The file size of cert9 suggests that this includes a bunch of CAs.
The solution was to prefix the certDir with sql:
certutil -A -n "${certificateName}" -t "TCu,Cu,Tu" -i "${certificateFile}" -d "sql:${certDir}"
Related
When you receive the message "Unable to access "/etc/paths.d/Wireshark" - fix it and try again later please." in a pop up window:
Verify the access rights for Wireshark folder:
$ cd /etc
$ ls -l | grep Wireshark
$ -rw------- 1 root wheel 43 Nov 21 2019 Wireshark
FIX => Give access rights:
$ sudo chmod u=rw,g=r,o=r Wireshark
Verify:
$ ls -l | grep Wireshark
$ -rw-r--r-- 1 root wheel 43 Nov 21 2019 Wireshark
Now you should be able to install visual studio for Mac.
I have a scenario to automate the manual build update process via shell script on multiple VM nodes.
For the same, I am trying the below sample script to first ssh into the instance and then switch to root user to perform the further steps like copying the build to archives directory under /var and then proceed with the later steps.
Below is the sample script,
#!/bin/sh
publicKey='/path/to/publickey'
buildVersion='deb9.deb build'
buildPathToStore='/var/cache/apt/archives/'
pathToHomedir='/home'
script="whoami && pwd && ls -la && whoami && mv ${buildVersion} ${buildPathToStore} && find ${buildPathToStore} | grep deb9"
for var in "$#"
do
copyBuildPath="${publicKey} ${buildVersion} ${var}:/home/admin/"
echo "copy build ==>" ${copyBuildPath}
scp -r -i ${copyBuildPath}
ssh -i $publicKey -t $var "sudo su - & ${script}; " # This shall execute all commands as root
done
So the CLI stats for the above script are something like this
admin //this is the user check
/home/admin
total 48
drwxr-xr-x 6 admin admin 4096 Dec 6 00:28 .
drwxr-xr-x 6 root root 4096 Nov 17 14:07 ..
drwxr-xr-x 3 admin admin 4096 Nov 17 14:00 .ansible
drwx------ 2 admin admin 4096 Nov 23 18:26 .appdata
-rw------- 1 admin admin 5002 Dec 6 17:47 .bash_history
-rw-r--r-- 1 admin admin 220 May 16 2017 .bash_logout
-rw-r--r-- 1 admin admin 3506 Jun 14 2019 .bashrc
-rw-r--r-- 1 admin admin 675 May 16 2017 .profile
drwx------ 4 admin admin 4096 Nov 23 18:26 .registry
drwx------ 2 admin admin 4096 Jun 21 2019 .ssh
-rw-r--r-- 1 admin admin 0 Dec 6 19:42 testFile.txt
-rw------- 1 admin admin 2236 Jun 21 2019 .viminfo
admin
If I use sudo su -c and remove &
like:
ssh -i $publicKey -t $var "sudo su -c ${script}; "
Then for once whoami returns the user as root but the working directory still prints as /home/admin instead of /root
And the next set of commands are still accounted for admin user rather than the root. So the admin user do not have the privileges to move the build to archive directory and install the build.
Using & I want to ensure that the further steps are being done in the background.
Not sure how to proceed ahead with this. Good suggestions are most welcome right now :)
"sudo su - & ${script}; "
expands to:
sudo su - & whoami && pwd && ...
First sudo su - is run in the background. Then the command chain is executed.
sudo su -c ${script};
expands to:
sudo su -c whoami && pwd && ...
So first sudo su - whoami is executed, which runs whoami as root. Then if this command is successful, then pwd is executed. As normal user.
It is utterly hard to correctly pass commands to execute on remote site using ssh. It is increasingly hard to do it with sudo su - the command will be triple (or twice?) word splitted - one time by ssh, then by the shell, then by the shell run by sudo su.
If you do not need interactive communication, it's best to use a here document with -s shell option, something along (untested):
# DO NOT store commands to use in a variable.
# or if you do and you know what you are doing, properly quote it (printf "%q ") and run it via eval
script() {
set -euo pipefail
whoami
pwd
ls -la
whoami
mv "$buildVersion" "$buildPathToStore"
find "$buildPathToStore" | grep deb9
}
ssh ... "sudo bash -s" <<EOF
echo "Yay! anything here!"
echo "Note that here document delimiter is not quoted!"
$(
# safely import context to work with
# note how command substitution is executed on host side
declare -f script
# pass variables too!
declare -p buildVersion buildPathToStore buildPathToStore
)
script
EOF
When you use su alone it keeps you in your actual directory, if you use su - it simulates the root login.
You should write : su - root -c ${script};
I would to start a container with specific shell script using docker compose.
For example, a tomcat container starts initweb.sh creating the empty file /tmp/testweb
$ ls -lR
.:
total 8
-rw-rw-r-- 1 xxxxxx xxxxxx 223 déc. 4 19:45 docker-compose.yml
drwxrwxr-x 2 xxxxxx xxxxxx 4096 déc. 4 19:37 web
./web:
total 4
-rwxrwxr-x 1 xxxxxx xxxxxx 31 déc. 4 19:37 initweb.sh
$ cat docker-compose.yml
version: '3'
services:
web:
container_name: web
hostname: web
image: "tomcat:7.0-jdk8"
ports:
- 8080:8080
volumes:
- "./web/:/usr/local/bin/"
command: sh -c "/usr/local/bin/initweb.sh"
$ cat web/initweb.sh
#!/bin/bash
touch /tmp/testweb
When I execute docker-compose up
$ docker-compose up -d
Creating network "tomcat_default" with the default driver
Creating web ... done
$ docker-compose run web ls -l /usr/local/bin/
total 4
-rwxrwxr-x 1 1000 1000 31 Dec 4 18:37 initweb.sh
$ docker-compose run web ls -l /tmp
total 4
drwxr-xr-x 1 root root 4096 Nov 24 01:29 hsperfdata_root
The owner of my script initweb.sh is not root, so maybe that's why it is not executed but I don't know how to resolve this issue.
You need to make initweb.sh to behave like a server process :
#!/bin/bash
touch /tmp/testweb
sleep infinity
then
~$ docker-compose up -d
Creating network "tmp_default" with the default driver
Creating web ... done
~$ docker-compose exec web ls -l /tmp
total 4
drwxr-xr-x 1 root root 4096 Nov 24 01:29 hsperfdata_root
-rw-r--r-- 1 root root 0 Dec 4 22:39 testweb
I don't remember how I installed saltstack on my mac, so I tried uninstalling it every way possible. I tried brew uninstall saltstack, pip uninstall salt. I attempted to see if salt -h had anything to say to uninstall it, but it didn't work.
Update some system outputs
➤ pip list | grep salt
➤ whereis salt-call
➤ which salt-call
/opt/salt/bin/salt-call
➤ ls -l /opt/salt
total 0
drwxr-xr-x 45 root wheel 1.5K 24 Aug 13:07 bin/
drwxr-xr-x 8 root wheel 272B 24 Aug 13:07 include/
drwxr-xr-x 14 root wheel 476B 24 Aug 13:07 lib/
drwxr-xr-x 8 root wheel 272B 24 Aug 13:07 openssl/
drwxr-xr-x 3 root wheel 102B 24 Aug 13:07 share/
I'm guessing I installed it from this link:
curl -L https://bootstrap.saltstack.com -o install_salt.sh
sudo sh install_salt.sh -P -M
but it doesn't say how to uninstall it based on this method. Anyone know?
/opt/salt/bin/salt-call
It looks like you installed it using .pkg file: https://repo.saltstack.com/osx/
You can verify by running some commands:
❯❯❯❯ pkgutil --pkgs | grep salt
com.saltstack.salt
❯❯❯❯ pkgutil --pkg-info com.saltstack.salt
package-id: com.saltstack.salt
version: 2016.11.3
volume: /
location: /
install-time: 1504874150
List installed files:
❯❯❯❯ pkgutil --files com.saltstack.salt
Library
Library/LaunchDaemons
Library/LaunchDaemons/com.saltstack.salt.api.plist
Library/LaunchDaemons/com.saltstack.salt.master.plist
Library/LaunchDaemons/com.saltstack.salt.minion.plist
Library/LaunchDaemons/com.saltstack.salt.syndic.plist
etc
etc/salt
etc/salt/master.dist
etc/salt/minion.dist
opt
opt/salt
opt/salt/bin
...
Stop services:
❯❯❯❯ sudo launchctl unload -w /Library/LaunchDaemons/com.saltstack.salt.minion.plist
Do the same for api, master, syndic if they are running.
Remove files first:
❯❯❯❯ cd /
❯❯❯❯ pkgutil --only-files --files com.saltstack.salt | grep -v opt
Library/LaunchDaemons/com.saltstack.salt.api.plist
Library/LaunchDaemons/com.saltstack.salt.master.plist
Library/LaunchDaemons/com.saltstack.salt.minion.plist
Library/LaunchDaemons/com.saltstack.salt.syndic.plist
etc/salt/master.dist
etc/salt/minion.dist
❯❯❯❯ pkgutil --only-files --files com.saltstack.salt | grep -v opt | tr '\n' '\0' | xargs -0 sudo rm -f
then directories:
❯❯❯❯ pkgutil --only-dirs --files com.saltstack.salt | grep -v opt
Library
Library/LaunchDaemons
etc
etc/salt
❯❯❯❯ sudo rm -fr etc/salt
❯❯❯❯ sudo rm -fr opt/salt
And finally, remove the receipt:
❯❯❯❯ sudo pkgutil --forget com.saltstack.salt
Forgot package 'com.saltstack.salt' on '/'.
As long as you don't know exactly how it was installed it is a little difficult to tell how to get rid of it.
The mentioned link points to a script that is salt-bootstrap behind the scene - OSX is not mentioned there as supported, but maybe it works the BSD-way for OSX in this case.
Did you stumbled upon this page - it actually shows multiple ways of installing saltstack on OS X. Maybe you recognize what you've done before.
However in the end salt is just a bunch of python files. What does pip list say? Or whereis salt-call? This should give you some hints where salt is located.
I´m using lemonlatte / docker-webvirtmgr as base file, but the problem is that there are no ssh keys configured for the user www-data, so I wrote the following shell script:
#!/bin/sh
if [ ! -d "/var/local/webvirtmgr/nginxhome" ]; then
mkdir /var/local/webvirtmgr/nginxhome
chown -R www-data:www-data /var/local/webvirtmgr/nginxhome
usermod -d /var/local/webvirtmgr/nginxhome www-data
su - www-data -s /bin/bash -c "ssh-keygen -b 2048 -t rsa -f ~/.ssh/id_rsa -q -N ''"
su - www-data -s /bin/bash -c "touch /var/local/webvirtmgr/nginxhome/.ssh/config && echo -e 'StrictHostKeyChecking=no\nUserKnownHostsFile=/dev/null' >> /var/local/webvirtmgr/nginxhome/.ssh/config"
su - www-data -s /bin/bash -c "chmod 0600 ~/.ssh/config"
fi
After that I added the two statements to the dockerfile:
ADD setupssh.sh /webvirtmgr/setupssh.sh
RUN /bin/sh -c "/webvirtmgr/setupssh.sh"
I already tried CMD /webvirtmgr/setupssh.sh, RUN /webvirtmgr/setupssh.sh but with no success...
When I run the script inside the container by hand it is working fine.
What is wrong here?
greetings
UPDATE:
Here is the link to the repo of the maintainer: link
UPDATE 2:
The build of the dockerfile was successful and I put the statement between:
RUN apt-get -ys clean
<statements were here>
WORKDIR /
The directory /var/local/webvirtmgr is defined as a volume.
VOLUME /var/local/webvirtmgr
Therefore this directory is a mountpoint in the running container and what you have added to it gets overwritten.
You will have to use a different directory, then your script will work.
Here´s a Dockerfile to test it:
FROM lemonlatte/docker-webvirtmgr
RUN mkdir /var/local/webvirtmgr2
RUN touch /var/local/webvirtmgr2/t && touch /var/local/webvirtmgr/t
RUN ls -la //var/local/webvirtmgr
RUN ls -la /var/local/webvirtmgr2
Output:
Sending build context to Docker daemon 4.608 kB
Sending build context to Docker daemon
Step 0 : FROM lemonlatte/docker-webvirtmgr
---> 18e2839dffea
Step 1 : RUN mkdir /var/local/webvirtmgr2
---> Running in d7a1e897108e
---> cc029293525e
Removing intermediate container d7a1e897108e
Step 2 : RUN touch /var/local/webvirtmgr2/t && touch /var/local/webvirtmgr/t
---> Running in 1a1375651fa7
---> e314c2529d90
Removing intermediate container 1a1375651fa7
Step 3 : RUN ls -la //var/local/webvirtmgr
---> Running in 5228691c84f5
total 8
drwxr-xr-x 2 www-data www-data 4096 Jun 6 09:22 .
drwxr-xr-x 6 root root 4096 Jun 6 09:22 ..
---> ec4113936961
Removing intermediate container 5228691c84f5
Step 4 : RUN ls -la /var/local/webvirtmgr2
---> Running in a6d2a683391a
total 8
drwxr-xr-x 2 root root 4096 Jun 6 09:22 .
drwxr-xr-x 6 root root 4096 Jun 6 09:22 ..
-rw-r--r-- 1 root root 0 Jun 6 09:22 t
---> 3cb98c5c1baf
Removing intermediate container a6d2a683391a
Successfully built 3cb98c5c1baf