Skip to content

Instantly share code, notes, and snippets.

@vkingw

vkingw/letsencrypt_esxi.sh

Forked from shr00mie/letsencrypt_esxi.sh
Created April 18, 2020 07:28
Show Gist options
  • Save vkingw/b34695c20e48ec22916e691c0dcbc2a6 to your computer and use it in GitHub Desktop.
Save vkingw/b34695c20e48ec22916e691c0dcbc2a6 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @shr00mie shr00mie revised this gist Sep 21, 2018. 1 changed file with 9 additions and 4 deletions.
    13 changes: 9 additions & 4 deletions letsencrypt_esxi.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -65,10 +65,12 @@ function input() {
    function pressanykey(){
    GREEN='\033[00;32m'
    RESTORE='\033[0m'
    echo -en "\n...${GREEN}$1 and press any key to continue${RESTORE}..."
    echo -en "\n...${GREEN}$1. Press any key to continue.${RESTORE}..."
    read -r -p "" -n 1
    }

    ## ---------------------------=[ Script Start ]=----------------------------- ##

    # Importing Variables
    status "Importing Variables"

    @@ -82,7 +84,7 @@ input "Enter the email for confirmation & renewal notifications" "Email"
    input "Enter ESXi target admin username" "ESXiUser"

    # Prompt user to confirm/enable SSH on ESXi target
    pressanykey "Confirm that SSH access is enabled on the esxi target: $ESXiHost"
    pressanykey "Confirm/Enable SSH access on $ESXiHost."

    # Check for existing ssh keys for esxi host
    status "Checking for existing ssh keys for $ESXiHost"
    @@ -110,7 +112,7 @@ else
    /etc/init.d/SSH restart"
    fi

    # Enable UPnP https port forward for requesting device
    # Enable UPnP http(s) port forward for requesting device
    status "Enabling http(s) port forwarding to client for letsencrypt verification"
    upnpc -e "letsencrypt http" -r 80 tcp
    upnpc -e "letsencrypt https" -r 443 tcp
    @@ -136,7 +138,10 @@ sudo scp /etc/letsencrypt/live/$ESXiHost/privkey.pem $ESXiUser@$ESXiHost:/etc/vm
    status "Restarting services on $ESXiHost"
    ssh $ESXiUser@$ESXiHost "services.sh restart"

    # Disable UPnP https port forward
    # Disable UPnP http(s) port forward
    status "Removing http(s) port forwarding"
    upnpc -d 80 tcp
    upnpc -d 443 tcp

    # Prompt user to confirm/disable SSH on ESXi target
    pressanykey "Remember to disable SSH service on $ESXiHost"
  2. @shr00mie shr00mie revised this gist Sep 21, 2018. 1 changed file with 135 additions and 72 deletions.
    207 changes: 135 additions & 72 deletions letsencrypt_esxi.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -1,79 +1,142 @@
    #!/bin/bash

    # registrar dns must have cname entry pointing host to @ for your public IP.
    # gateway must be upnp capable and device subnet running this script must be able to create upnp mappings
    # tested using ubuntu server 16.04 client and esxi 6.5 target

    echo -e "\n...\e[32mImporting Variables\e[m...\n"

    # Import domain
    read -p $'
    \e[32mEnter the domain name for the certificate in host.domain.tld format\e[m: ' DomainName

    # Import email
    read -p $'
    \e[32mEnter the email for confirmation & renew notifications\e[m: ' Email

    # Import esxi admin user
    read -p $'
    \e[32mEnter ESXi admin username\e[m: ' ESXiUser

    # Import esxi host or IP
    read -p $'
    \e[32mEnter host or IP for the ESXi target\e[m: ' ESXiHost

    echo -e "\n...\e[32mUpdating system and installing miniupnpc and letsencrypt\e[m...\n"

    # update, upgrade, and install requirements
    sudo apt update && sudo apt upgrade -y
    sudo apt install miniupnpc letsencrypt -y

    # prompt user to enable SSH on ESXi target
    read -n 1 -s -r -p '
    \e[32mConfirm that SSH access is enabled on $DomainName. Press any key to continue.\e[m'

    echo -e "\n...\e[32mSSH key transfer from client to $ESXiHost\e[m...\n"
    # check if rsa keypair exists. if true, copy to ESXi host authorized keys. else, create 4096 bit rsa key with no pass and export to ESXi host.
    if [[ -e ~/.ssh/id_rsa ]]; then
    echo -e "\n...\e[32mClient RSA key exists. Copying to $ESXiHost and restarting SSH\e[m...\n"
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    else
    echo -e "\n...\e[32mClient RSA key not found. Generating 4096 bit key\e[m...\n"
    ssh-keygen -b 4096 -t rsa -f ~/.ssh/id_rsa -q -N ""
    echo -e "\n...\e[32mCopying client RSA key to $ESXiHost and restarting SSH\e[m...\n"
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    #
    ## -------------------------------=[ Info ]=--------------------------------- ##
    #
    # Generate letsencrypt cert on local server and scp to esxi target.
    # Designed and tested on Ubuntu 16.04LTS.
    # Assumes you have upnp control over local network. Tested with Ubiquiti USG.
    #
    # Dependencies:
    # miniupnpc (sudo apt install miniupnpc)
    # certbot (sudo apt install certbot)
    #
    ## -=[ Author ]=------------------------------------------------------------- ##
    #
    # shr00mie
    # 9.21.2018
    # v0.4
    #
    ## -=[ Use Case ]=----------------------------------------------------------- ##
    #
    # Allows for the generation of certificates on a separate host which can then
    # be securely copied to target esxi host.
    #
    ## -=[ Breakdown ]=---------------------------------------------------------- ##
    #
    # 1. Prompt for esxi target FQDN, reminder email, and esxi admin username
    # 2. Check if ssh keys exist for target.
    # - If keys exist, continue.
    # - If keys don't exist:
    # - Silently generate 4096 RSA key, no passphrase, user@target as comment.
    # - Add key to ssh-agent
    # - Create target folder/file structure for scp automation
    # - Restart SSH service on target.
    # 3. Enable port forwarding.
    # 4. Generate 4096 bit letsencrypt cert
    # 5. Backup existing cert with datetime suffix
    # 6. Copy cert to target
    # 7. Restart target services
    # 8. Remove port forwarding
    #
    ## -=[ To-Do ]=-------------------------------------------------------------- ##
    #
    # change: PermitRootLogin yes -> PermitRootLogin no
    # add: ChallengeResponseAuthentication no
    # add: PasswordAuthentication no
    #
    ## -=[ Functions ]=---------------------------------------------------------- ##

    # Usage: status "Status Text"
    function status() {
    GREEN='\033[00;32m'
    RESTORE='\033[0m'
    echo -e "\n...${GREEN}$1${RESTORE}...\n"
    }

    # Usage: input "Prompt Text" "Variable Name"
    function input() {
    GREEN='\033[00;32m'
    RESTORE='\033[0m'
    echo -en "\n...${GREEN}$1${RESTORE}: "
    read $2
    echo -e ""
    }

    function pressanykey(){
    GREEN='\033[00;32m'
    RESTORE='\033[0m'
    echo -en "\n...${GREEN}$1 and press any key to continue${RESTORE}..."
    read -r -p "" -n 1
    }

    # Importing Variables
    status "Importing Variables"

    # Read ESXiHost
    input "Enter the FQDN for the certificate/host in host.domain.tld format" "ESXiHost"

    # Read Email
    input "Enter the email for confirmation & renewal notifications" "Email"

    # Read ESXiUser
    input "Enter ESXi target admin username" "ESXiUser"

    # Prompt user to confirm/enable SSH on ESXi target
    pressanykey "Confirm that SSH access is enabled on the esxi target: $ESXiHost"

    # Check for existing ssh keys for esxi host
    status "Checking for existing ssh keys for $ESXiHost"

    if [[ -e ~/.ssh/$ESXiHost'_rsa' ]]
    then
    status "Keys for $ESXiHost exist. Continuing"
    else
    status "Keys for $ESXiHost not found. Generating 4096 bit keys"
    # Generate 4096 bit key for user@target
    ssh-keygen -b 4096 -t rsa -f ~/.ssh/$ESXiHost'_rsa' -q -N "" -C "$ESXiUser@$HOSTNAME LetsEncrypt"
    status "Adding new key to ssh-agent"
    # Add key to agent
    eval `ssh-agent` && ssh-add ~/.ssh/$ESXiHost'_rsa'
    status "Configuring $ESXiHost for ssh access"
    # Store key as variable
    pubkey=`cat ~/.ssh/$ESXiHost'_rsa.pub'`
    # Create directory for authorized user, copy key to target, set permissions,
    # and restart ssh service on target.
    ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser &&
    echo $pubkey > /etc/ssh/keys-$ESXiUser/authorized_keys &&
    chmod 700 -R /etc/ssh/keys-$ESXiUser &&
    chmod 600 /etc/ssh/keys-$ESXiUser/authorized_keys &&
    chown -R $ESXiUser /etc/ssh/keys-$ESXiUser &&
    /etc/init.d/SSH restart"
    fi

    echo -e "\n...\e[32mEnabling https port forwarding to client for letsencrypt verification\e[m...\n"

    # Enable UPnP https port forward for requesting device
    upnpc -e "Let's Encrypt Temp SSL" -r 443 tcp

    echo -e "\n...\e[32mRequesting 4096 bit certificate for $ESXiHost\e[m...\n"

    # pull let's encrypt cert
    sudo letsencrypt certonly --standalone --agree-tos -m $Email -d $DomainName --rsa-key-size 4096

    echo -e "\n...\e[32mBacking up existing certificates on $ESXiHost\e[m...\n"

    # backup existing SSL components on ESXi target
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/castore.pem /etc/vmware/ssl/castore.pem.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.back"

    echo -e "\n...\e[32mCoping letsencrypt certificates to $ESXiHost\e[m...\n"

    # copy Let's Encrypt SSL componenets to ESXi target
    sudo scp /etc/letsencrypt/live/$DomainName/fullchain.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/castore.pem
    sudo scp /etc/letsencrypt/live/$DomainName/cert.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.crt
    sudo scp /etc/letsencrypt/live/$DomainName/privkey.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.key

    echo -e "\n...\e[32mRestarting services on $ESXiHost\e[m...\n"

    # restart services on ESXi target
    status "Enabling http(s) port forwarding to client for letsencrypt verification"
    upnpc -e "letsencrypt http" -r 80 tcp
    upnpc -e "letsencrypt https" -r 443 tcp

    # Acquire letsencrypt cert
    status "Requesting 4096 bit certificate for $ESXiHost"
    sudo certbot certonly --standalone --preferred-challenges tls-sni --agree-tos -m $Email -d $ESXiHost --rsa-key-size 4096

    # Backup existing SSL components on ESXi target
    status "Backing up existing certificates on $ESXiHost"
    time=$(date +%Y.%m.%d_%H:%M:%S)
    ssh $ESXiUser@$ESXiHost "cp /etc/vmware/ssl/castore.pem /etc/vmware/ssl/castore.pem.back.$time"
    ssh $ESXiUser@$ESXiHost "cp /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.back.$time"
    ssh $ESXiUser@$ESXiHost "cp /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.back.$time"

    # Copy letsencrypt cert to ESXi target
    status "Coping letsencrypt cert to $ESXiHost"
    sudo scp /etc/letsencrypt/live/$ESXiHost/fullchain.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/castore.pem
    sudo scp /etc/letsencrypt/live/$ESXiHost/cert.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.crt
    sudo scp /etc/letsencrypt/live/$ESXiHost/privkey.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.key

    # Restart services on ESXi target
    status "Restarting services on $ESXiHost"
    ssh $ESXiUser@$ESXiHost "services.sh restart"

    echo -e "\n...\e[32mRemoving https port forwarding\e[m...\n"

    # Disable UPnP https port forward
    upnpc -d 443 tcp
    status "Removing http(s) port forwarding"
    upnpc -d 80 tcp
    upnpc -d 443 tcp
  3. @shr00mie shr00mie revised this gist Mar 1, 2018. 1 changed file with 12 additions and 36 deletions.
    48 changes: 12 additions & 36 deletions letsencrypt_esxi.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -4,9 +4,7 @@
    # gateway must be upnp capable and device subnet running this script must be able to create upnp mappings
    # tested using ubuntu server 16.04 client and esxi 6.5 target

    echo -e "
    ...\e[32mImporting Variables\e[m...
    "
    echo -e "\n...\e[32mImporting Variables\e[m...\n"

    # Import domain
    read -p $'
    @@ -24,9 +22,7 @@ read -p $'
    read -p $'
    \e[32mEnter host or IP for the ESXi target\e[m: ' ESXiHost

    echo -e "
    ...\e[32mUpdating system and installing miniupnpc and letsencrypt\e[m...
    "
    echo -e "\n...\e[32mUpdating system and installing miniupnpc and letsencrypt\e[m...\n"

    # update, upgrade, and install requirements
    sudo apt update && sudo apt upgrade -y
    @@ -36,68 +32,48 @@ sudo apt install miniupnpc letsencrypt -y
    read -n 1 -s -r -p '
    \e[32mConfirm that SSH access is enabled on $DomainName. Press any key to continue.\e[m'

    echo -e "
    ...\e[32mSSH key transfer from client to $ESXiHost\e[m...
    "
    echo -e "\n...\e[32mSSH key transfer from client to $ESXiHost\e[m...\n"
    # check if rsa keypair exists. if true, copy to ESXi host authorized keys. else, create 4096 bit rsa key with no pass and export to ESXi host.
    if [[ -e ~/.ssh/id_rsa ]]; then
    echo -e "
    ...\e[32mClient RSA key exists. Copying to $ESXiHost and restarting SSH\e[m...
    "
    echo -e "\n...\e[32mClient RSA key exists. Copying to $ESXiHost and restarting SSH\e[m...\n"
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    else
    echo -e "
    ...\e[32mClient RSA key not found. Generating 4096 bit key\e[m...
    "
    echo -e "\n...\e[32mClient RSA key not found. Generating 4096 bit key\e[m...\n"
    ssh-keygen -b 4096 -t rsa -f ~/.ssh/id_rsa -q -N ""
    echo -e "
    ...\e[32mCopying client RSA key to $ESXiHost and restarting SSH\e[m...
    "
    echo -e "\n...\e[32mCopying client RSA key to $ESXiHost and restarting SSH\e[m...\n"
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    fi

    echo -e "
    ...\e[32mEnabling https port forwarding to client for letsencrypt verification\e[m...
    "
    echo -e "\n...\e[32mEnabling https port forwarding to client for letsencrypt verification\e[m...\n"

    # Enable UPnP https port forward for requesting device
    upnpc -e "Let's Encrypt Temp SSL" -r 443 tcp

    echo -e "
    ...\e[32mRequesting 4096 bit certificate for $ESXiHost\e[m...
    "
    echo -e "\n...\e[32mRequesting 4096 bit certificate for $ESXiHost\e[m...\n"

    # pull let's encrypt cert
    sudo letsencrypt certonly --standalone --agree-tos -m $Email -d $DomainName --rsa-key-size 4096

    echo -e "
    ...\e[32mBacking up existing certificates on $ESXiHost\e[m...
    "
    echo -e "\n...\e[32mBacking up existing certificates on $ESXiHost\e[m...\n"

    # backup existing SSL components on ESXi target
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/castore.pem /etc/vmware/ssl/castore.pem.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.back"

    echo -e "
    ...\e[32mCoping letsencrypt certificates to $ESXiHost\e[m...
    "
    echo -e "\n...\e[32mCoping letsencrypt certificates to $ESXiHost\e[m...\n"

    # copy Let's Encrypt SSL componenets to ESXi target
    sudo scp /etc/letsencrypt/live/$DomainName/fullchain.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/castore.pem
    sudo scp /etc/letsencrypt/live/$DomainName/cert.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.crt
    sudo scp /etc/letsencrypt/live/$DomainName/privkey.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.key

    echo -e "
    ...\e[32mRestarting services on $ESXiHost\e[m...
    "
    echo -e "\n...\e[32mRestarting services on $ESXiHost\e[m...\n"

    # restart services on ESXi target
    ssh $ESXiUser@$ESXiHost "services.sh restart"

    echo -e "
    ...\e[32mRemoving https port forwarding\e[m...
    "
    echo -e "\n...\e[32mRemoving https port forwarding\e[m...\n"

    # Disable UPnP https port forward
    upnpc -d 443 tcp
  4. @shr00mie shr00mie created this gist Dec 15, 2017.
    103 changes: 103 additions & 0 deletions letsencrypt_esxi.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,103 @@
    #!/bin/bash

    # registrar dns must have cname entry pointing host to @ for your public IP.
    # gateway must be upnp capable and device subnet running this script must be able to create upnp mappings
    # tested using ubuntu server 16.04 client and esxi 6.5 target

    echo -e "
    ...\e[32mImporting Variables\e[m...
    "

    # Import domain
    read -p $'
    \e[32mEnter the domain name for the certificate in host.domain.tld format\e[m: ' DomainName

    # Import email
    read -p $'
    \e[32mEnter the email for confirmation & renew notifications\e[m: ' Email

    # Import esxi admin user
    read -p $'
    \e[32mEnter ESXi admin username\e[m: ' ESXiUser

    # Import esxi host or IP
    read -p $'
    \e[32mEnter host or IP for the ESXi target\e[m: ' ESXiHost

    echo -e "
    ...\e[32mUpdating system and installing miniupnpc and letsencrypt\e[m...
    "

    # update, upgrade, and install requirements
    sudo apt update && sudo apt upgrade -y
    sudo apt install miniupnpc letsencrypt -y

    # prompt user to enable SSH on ESXi target
    read -n 1 -s -r -p '
    \e[32mConfirm that SSH access is enabled on $DomainName. Press any key to continue.\e[m'

    echo -e "
    ...\e[32mSSH key transfer from client to $ESXiHost\e[m...
    "
    # check if rsa keypair exists. if true, copy to ESXi host authorized keys. else, create 4096 bit rsa key with no pass and export to ESXi host.
    if [[ -e ~/.ssh/id_rsa ]]; then
    echo -e "
    ...\e[32mClient RSA key exists. Copying to $ESXiHost and restarting SSH\e[m...
    "
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    else
    echo -e "
    ...\e[32mClient RSA key not found. Generating 4096 bit key\e[m...
    "
    ssh-keygen -b 4096 -t rsa -f ~/.ssh/id_rsa -q -N ""
    echo -e "
    ...\e[32mCopying client RSA key to $ESXiHost and restarting SSH\e[m...
    "
    cat ~/.ssh/id_rsa.pub | ssh $ESXiUser@$ESXiHost "mkdir -p /etc/ssh/keys-$ESXiUser/ && cat >> /etc/ssh/keys-$ESXiUser/authorized_keys && /etc/init.d/SSH restart"
    fi

    echo -e "
    ...\e[32mEnabling https port forwarding to client for letsencrypt verification\e[m...
    "

    # Enable UPnP https port forward for requesting device
    upnpc -e "Let's Encrypt Temp SSL" -r 443 tcp

    echo -e "
    ...\e[32mRequesting 4096 bit certificate for $ESXiHost\e[m...
    "

    # pull let's encrypt cert
    sudo letsencrypt certonly --standalone --agree-tos -m $Email -d $DomainName --rsa-key-size 4096

    echo -e "
    ...\e[32mBacking up existing certificates on $ESXiHost\e[m...
    "

    # backup existing SSL components on ESXi target
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/castore.pem /etc/vmware/ssl/castore.pem.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.back"
    ssh $ESXiUser@$ESXiHost "mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.back"

    echo -e "
    ...\e[32mCoping letsencrypt certificates to $ESXiHost\e[m...
    "

    # copy Let's Encrypt SSL componenets to ESXi target
    sudo scp /etc/letsencrypt/live/$DomainName/fullchain.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/castore.pem
    sudo scp /etc/letsencrypt/live/$DomainName/cert.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.crt
    sudo scp /etc/letsencrypt/live/$DomainName/privkey.pem $ESXiUser@$ESXiHost:/etc/vmware/ssl/rui.key

    echo -e "
    ...\e[32mRestarting services on $ESXiHost\e[m...
    "

    # restart services on ESXi target
    ssh $ESXiUser@$ESXiHost "services.sh restart"

    echo -e "
    ...\e[32mRemoving https port forwarding\e[m...
    "

    # Disable UPnP https port forward
    upnpc -d 443 tcp