deploy hook for Ruckus ZoneDirector / Unleashed #4832

kchiem · 2023-10-19T03:34:37Z

Tested on my Unleashed install, but according to the code it's adapted form, it should work for ZD installs too.

uberjay · 2024-10-21T19:57:08Z

Just stumbled across this and verified it works for deploying certificate updates from OPNsense to my Ruckus Unleashed controller.

Steps:

Place ruckus.sh file in /usr/local/share/examples/acme.sh/deploy/
chmod 555 ruckus.sh
Set up certificate for ruckus (via the OPNsense GUI). let's call the domain name $domain.
Run issue/renew certificate action.
ssh to your OPNsense system as root and drop to a shell
find the corresponding certificate configuration directory under /var/etc/acme-client/certs/
- in my case it was /var/etc/acme-client/certs/6716ac20201125.16873601.
- let's call this full directory path $certdir.
edit the cert config file (this will be $certdir/$domain/$domain.conf) to add the three variables:
- RUCKUS_HOST
- RUCKUS_USER
- RUCKUS_PASS
execute the acme.sh deploy action:

/usr/local/sbin/acme.sh --deploy --syslog 7 --debug --server 'letsencrypt' \
  --home '/var/etc/acme-client/home' \
  --cert-home "$certdir/$domain" \
  --certpath "$certdir/$domain/cert.pem" \
  --keypath "$certdir/$domain/private.key" \
  --capath "$certdir/$domain/chain.pem" \
  --fullchainpath "$certdir/$domain/fullchain.pem" \
  --domain "$domain" --deploy-hook ruckus

So, I vote for including this deployment hook. What else is needed to make it happen? It needs to be upstream (here) before OPNsense will add an option to use it, and it'd be really fantastic to have it "just work". ✨

Neilpang · 2024-11-03T12:21:33Z

deploy/ruckus.sh

+  }
+  trap cleanup EXIT
+
+  LOGIN_URL=$(curl https://$RUCKUS_HOST -ksSLo /dev/null -w '%{url_effective}')


do not use curl, please use _post() or _get() function instead.

My reimplemention using _get() and post() has been pushed to this PR now

fraenki · 2024-11-06T21:37:34Z

@uberjay I don't know if the original author is still working on this... Maybe you would be interested to finish the job? I'd suggest to apply the proposed fixes and submit a new PR.

ms264556 · 2024-11-06T21:56:09Z

@uberjay I don't know if the original author is still working on this... Maybe you would be interested to finish the job? I'd suggest to apply the proposed fixes and submit a new PR.

I'm the author of the code this is adapted from.

If anyone's already working on a fix then let me know. Otherwise I'm happy to re-implement this correctly: I'm on holiday for a couple more months, so I have the time.

(I had assumed this PR wouldn't be accepted as-is, since it's not idiomatic with the other acme code).

kchiem · 2024-11-06T22:05:56Z

@ms264556 I was planning on looking into it now, but if you're able to, please do go ahead.

uberjay · 2024-11-06T22:06:25Z

@ms264556 That'd be awesome! I don't know if the original PR author is following along here, and I don't personally have the bandwidth. It'd be very much appreciated!

ms264556 · 2024-11-06T22:45:04Z

@ms264556 I was planning on looking into it now, but if you're able to, please do go ahead.

Sure. I'll setup some test APs and have a look this afternoon.

I do remember that the acme code for existing integrations was very low level compared to my lazy 'get curl do all the thinking' code, so I don't think this is a 5 minute job.

ms264556 · 2024-11-10T09:26:55Z

@kchiem my changes are in a PR to your dev branch

Rewrite deploy/ruckus.sh to use _get() and _post()

Neilpang · 2024-11-12T20:36:18Z

deploy/ruckus.sh

+
+  _debug RUCKUS_HOST "$RUCKUS_HOST"
+  _debug RUCKUS_USER "$RUCKUS_USER"
+  _debug RUCKUS_PASS "$RUCKUS_PASS"


use _secure_debug for password, so that you won't leak it.

Neilpang · 2024-11-12T20:36:47Z

deploy/ruckus.sh

+  _debug RUCKUS_USER "$RUCKUS_USER"
+  _debug RUCKUS_PASS "$RUCKUS_PASS"
+
+  export HTTPS_INSECURE=1


why do we need "insecure" here?

Ruckus devices ship with 1024 bit self-signed server certificates, so curl will fail with error 60 unless I set HTTPS_INSECURE=1.

Overriding HTTPS_INSECURE to always be enabled seems wrong to me -- for initial deployment one can add --insecure: acme.sh --deploy -d your.domain.here --deploy-hook ruckus --insecure. On subsequent cert deploy runs, HTTPS_INSECURE=1 should no longer be necessary.

No problem. That's fixed now.

Neilpang · 2024-11-12T20:37:52Z

deploy/ruckus.sh

+  _replace_cert_ajax='<ajax-request action="docmd" comp="system" updater="rid.0.5" xcmd="replace-cert" checkAbility="6" timeout="-1"><xcmd cmd="replace-cert" cn="'$RUCKUS_HOST'"/></ajax-request>'
+  _post "$_replace_cert_ajax" "$_base_url/_cmdstat.jsp" >/dev/null
+
+  info "Rebooting"


use _info

Fixed, and I also fixed the unquoted _info strings

fix insecure password debug and _info typo

ms264556 · 2024-11-13T04:31:04Z

Oops. Would help if I quoted all of my _info() args. One more commit incoming.

And this is fixed now.

Fix info logging

kchiem · 2024-11-13T18:45:48Z

@ms264556 https://github.com/acmesh-official/acme.sh/actions/runs/11811051778/job/32909254460

fix acme.sh PR shfmt failure

ms264556 · 2024-11-13T20:50:20Z

@ms264556 acmesh-official/acme.sh/actions/runs/11811051778/job/32909254460

Fixed

Neilpang · 2024-11-14T18:42:53Z

please add the usage here:
https://github.com/acmesh-official/acme.sh/wiki/deployhooks

ms264556 · 2024-11-14T20:47:12Z

please add the usage here: Wiki: deployhooks

That's done

ms264556 · 2024-11-15T00:23:43Z

I noticed in the dev docs that we're not supposed to use awk. Our awk usage isn't doing anything useful, so I've given @kchiem a PR to remove this, which should be pushed here soon

Remove awk usage & refuse host redirects

deploy hook for Ruckus ZoneDirector / Unleashed

ed72b09

uberjay mentioned this pull request Oct 21, 2024

security/acme-client: action to push a cert to Ruckus ZoneDirector or Unleashed opnsense/plugins#3536

Closed

Neilpang reviewed Nov 3, 2024

View reviewed changes

Ruckus - use _get() and _post()

b6a77e0

ms264556 and others added 2 commits November 10, 2024 22:43

remove dead code

7178026

Merge pull request #1 from ms264556/dev

d7bafa6

Rewrite deploy/ruckus.sh to use _get() and _post()

Neilpang reviewed Nov 12, 2024

View reviewed changes

ms264556 and others added 3 commits November 13, 2024 12:50

fix insecure password debug and _info typo

0cc74b7

Merge pull request #2 from ms264556/dev

5f7ad72

fix insecure password debug and _info typo

Fix info logging

e98e7a2

kchiem and others added 3 commits November 12, 2024 21:11

Merge pull request #3 from ms264556/dev

b665014

Fix info logging

fix acme.sh PR shfmt failure

38c41b7

Remove HTTPS_INSECURE

2bb5fbd

Merge pull request #4 from ms264556/dev

412e14a

fix acme.sh PR shfmt failure

Remove awk usage and refuse redirect to new host

4232923

Merge pull request #5 from ms264556/dev

4299c6a

Remove awk usage & refuse host redirects

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deploy hook for Ruckus ZoneDirector / Unleashed #4832

deploy hook for Ruckus ZoneDirector / Unleashed #4832

kchiem commented Oct 19, 2023

uberjay commented Oct 21, 2024

Neilpang Nov 3, 2024

ms264556 Nov 12, 2024

fraenki commented Nov 6, 2024

ms264556 commented Nov 6, 2024

kchiem commented Nov 6, 2024

uberjay commented Nov 6, 2024

ms264556 commented Nov 6, 2024

ms264556 commented Nov 10, 2024

Neilpang Nov 12, 2024

ms264556 Nov 13, 2024

Neilpang Nov 12, 2024

ms264556 Nov 13, 2024

uberjay Nov 13, 2024 •

edited

Loading

ms264556 Nov 13, 2024

Neilpang Nov 12, 2024

ms264556 Nov 13, 2024

ms264556 commented Nov 13, 2024 •

edited

Loading

kchiem commented Nov 13, 2024

ms264556 commented Nov 13, 2024

Neilpang commented Nov 14, 2024

ms264556 commented Nov 14, 2024

ms264556 commented Nov 15, 2024

deploy hook for Ruckus ZoneDirector / Unleashed #4832

Are you sure you want to change the base?

deploy hook for Ruckus ZoneDirector / Unleashed #4832

Conversation

kchiem commented Oct 19, 2023

uberjay commented Oct 21, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fraenki commented Nov 6, 2024

ms264556 commented Nov 6, 2024

kchiem commented Nov 6, 2024

uberjay commented Nov 6, 2024

ms264556 commented Nov 6, 2024

ms264556 commented Nov 10, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

uberjay Nov 13, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ms264556 commented Nov 13, 2024 • edited Loading

kchiem commented Nov 13, 2024

ms264556 commented Nov 13, 2024

Neilpang commented Nov 14, 2024

ms264556 commented Nov 14, 2024

ms264556 commented Nov 15, 2024

uberjay Nov 13, 2024 •

edited

Loading

ms264556 commented Nov 13, 2024 •

edited

Loading