Skip to content
GitLab
Menu
Projects
Groups
Snippets
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in / Register
Toggle navigation
Menu
Open sidebar
ruanhaishen
Acme.Sh
Commits
d9a9695f
Commit
d9a9695f
authored
Feb 05, 2020
by
Paul Nguyen
Browse files
Deploy certificates to Palo Alto Network Firewalls
parent
8e6c4e1a
Changes
1
Show whitespace changes
Inline
Side-by-side
deploy/panos.sh
0 → 100644
View file @
d9a9695f
#!/usr/bin/env sh
# Script to deploy certificates to Palo Alto Networks PANOS via API
# Note PANOS API KEY and IP address needs to be set prior to running.
# The following variables exported from environment will be used.
# If not set then values previously saved in domain.conf file are used.
#
# Firewall admin with superuser and IP address is required.
#
# export PANOS_USER="" # required
# export PANOS_PASS="" # required
# export PANOS_HOST="" # required
# This function is to parse the XML
parse_response
()
{
status
=
$(
echo
"
$1
"
|
sed
's/^.*"\([a-z]*\)".*/\1/g'
)
message
=
$(
echo
"
$1
"
|
sed
's/^.*<result>\(.*\)<\/result.*/\1/g'
)
return
0
}
deployer
()
{
type
=
$1
# Types are cert, key, commit
_debug
"**** Deploying
$type
*****"
#Generate DEIM
delim
=
"-----MultipartDelimiter
$(
date
"+%s%N"
)
"
nl
=
"
\0
15
\0
12"
#Set Header
_H1
=
"Content-Type: multipart/form-data; boundary=
$delim
"
if
[
$type
=
'cert'
]
;
then
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
file
\"
; filename=
\"
$(
basename
"
$_cfullchain
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_cfullchain
"
)
"
fi
if
[
$type
=
'key'
]
;
then
#Add key
content
=
"
$content
${
nl
}
--
$delim
${
nl
}
Content-Disposition: form-data; name=
\"
file
\"
; filename=
\"
$(
basename
"
$_ckey
"
)
\"
${
nl
}
Content-Type: application/octet-stream
${
nl
}${
nl
}
$(
cat
"
$_ckey
"
)
"
fi
#Close multipart
content
=
"
$content
${
nl
}
--
$delim
--
${
nl
}
"
#Convert CRLF
content
=
$(
printf
%b
"
$content
"
)
if
[
$type
=
'cert'
]
;
then
panos_url
=
"https://
$_panos_host
/api/?type=import&category=certificate&certificate-name=
$_cdomain
&format=pem&key=
$_panos_key
"
fi
if
[
$type
=
'key'
]
;
then
panos_url
=
"https://
$_panos_host
/api/?type=import&category=private-key&certificate-name=
$_cdomain
&format=pem&passphrase=none&key=
$_panos_key
"
fi
if
[
$type
=
'commit'
]
;
then
cmd
=
$(
_url_encode
"<commit><partial><
$_panos_user
></
$_panos_user
></partial></commit>"
)
panos_url
=
"https://
$_panos_host
/api/?type=commit&cmd=
$cmd
&key=
$_panos_key
"
fi
if
[
$type
=
'key'
]
||
[
$type
=
'cert'
]
;
then
response
=
$(
_post
"
$content
"
"
$panos_url
"
""
"POST"
)
else
response
=
$(
_get
$panos_url
)
fi
_debug panos_url
$panos_url
_debug
"RESPONSE
$response
"
parse_response
"
$response
"
_debug
"STATUS IS
$status
"
_debug
"MESSAGE IS
$message
"
# Saving response to variables
response_status
=
$status
# Check for cert upload error and handle gracefully.
#DEBUG
_debug header
"
$_H1
"
# _debug content "$content"
_debug response_status
"
$response_status
"
if
[
"
$response_status
"
=
"success"
]
;
then
_debug
"Successfully deployed
$type
"
return
0
else
_err
"Deploy of type
$type
failed. Try deploying with --debug to troubleshoot."
_debug
"
$message
"
return
1
fi
}
# This is the main function that will call the other functions to deploy everything.
panos_deploy
()
{
_cdomain
=
"
$1
"
_ckey
=
"
$2
"
_cfullchain
=
"
$5
"
# PANOS HOST is required to make API calls to the PANOS/Panorama
if
[
-z
"
$PANOS_HOST
"
]
;
then
if
[
-z
"
$_panos_host
"
]
;
then
_err
"PANOS_HOST not defined."
return
1
fi
else
_debug
"PANOS HOST is set. Save to domain conf."
_panos_host
=
"
$PANOS_HOST
"
_savedomainconf _panos_host
"
$_panos_host
"
fi
# Retrieve stored variables
_panos_user
=
"
$(
_readaccountconf_mutable PANOS_USER
)
"
_panos_pass
=
"
$(
_readaccountconf_mutable PANOS_PASS
)
"
# PANOS Credentials check
if
[
-z
"
$PANOS_USER
"
]
||
[
-z
"
$PANOS_PASS
"
]
;
then
_debug
"PANOS_USER, PANOS_PASS is not defined"
if
[
-z
"
$_panos_user
"
]
&&
[
-z
"
$_panos_pass
"
]
;
then
_err
"No user and pass found in storage. If this is the first time deploying please set PANOS_USER and PANOS_PASS in environment variables."
return
1
else
_debug
"ok"
fi
else
_debug
"Saving environment variables"
# Encrypt and save user
_saveaccountconf_mutable PANOS_USER
"
$PANOS_USER
"
_saveaccountconf_mutable PANOS_PASS
"
$PANOS_PASS
"
_panos_user
=
"
$PANOS_USER
"
_panos_pass
=
"
$PANOS_PASS
"
fi
_debug
"Let's use username and pass to generate token."
if
[
-z
"
$_panos_user
"
]
||
[
-z
"
$_panos_pass
"
]
||
[
-z
"
$_panos_host
"
]
;
then
_err
"Please pass username and password and host as env variables PANOS_USER, PANOS_PASS and PANOS_HOST"
return
1
else
_debug
"Getting PANOS KEY"
panos_key_response
=
$(
_get
"https://
$_panos_host
/api/?type=keygen&user=
$_panos_user
&password=
$_panos_pass
"
)
_debug
"PANOS KEY FULL RESPONSE
$panos_key_response
"
status
=
$(
echo
"
$panos_key_response
"
|
sed
's/^.*\(['
\'
']\)\([a-z]*\)'
\'
'.*/\2/g'
)
_debug
"STATUS IS
$status
"
if
[
"
$status
"
=
"success"
]
;
then
panos_key
=
$(
echo
"
$panos_key_response
"
|
sed
's/^.*\(<key>\)\(.*\)<\/key>.*/\2/g'
)
_panos_key
=
$panos_key
else
_err
"PANOS Key could not be set. Deploy with --debug to troubleshoot"
return
1
fi
if
[
-z
"
$_panos_host
"
]
&&
[
-z
"
$_panos_key
"
]
&&
[
-z
"
$_panos_user
"
]
;
then
_err
"Missing host, apikey, user."
return
1
else
deployer cert
deployer key
deployer commit
fi
fi
}
\ No newline at end of file
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment