Scripts added

LICENSE

@@ -1,9 +1,11 @@
 MIT License
 
-Copyright (c) <year> <copyright holders>
+Copyright (c) 2023 Simon Moser
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+The script mkkeys.sh, which is also found in this repository for simplicity reasons, is licensed under the terms of the GPL v3. It was retreived from https://www.rodsbooks.com/efi-bootloaders/mkkeys.sh.

Secure Boot/mkkeys.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Copyright (c) 2015 by Roderick W. Smith
+# Licensed under the terms of the GPL v3
+
+echo -n "Enter a Common Name to embed in the keys: "
+read NAME
+
+openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME PK/" -keyout PK.key \
+        -out PK.crt -days 3650 -nodes -sha256
+openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME KEK/" -keyout KEK.key \
+        -out KEK.crt -days 3650 -nodes -sha256
+openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME DB/" -keyout DB.key \
+        -out DB.crt -days 3650 -nodes -sha256
+openssl x509 -in PK.crt -out PK.cer -outform DER
+openssl x509 -in KEK.crt -out KEK.cer -outform DER
+openssl x509 -in DB.crt -out DB.cer -outform DER
+
+GUID=`python3 -c 'import uuid; print(str(uuid.uuid1()))'`
+echo $GUID > myGUID.txt
+
+cert-to-efi-sig-list -g $GUID PK.crt PK.esl
+cert-to-efi-sig-list -g $GUID KEK.crt KEK.esl
+cert-to-efi-sig-list -g $GUID DB.crt DB.esl
+rm -f noPK.esl
+touch noPK.esl
+
+sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
+                  -k PK.key -c PK.crt PK PK.esl PK.auth
+sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
+                  -k PK.key -c PK.crt PK noPK.esl noPK.auth
+sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
+                  -k PK.key -c PK.crt KEK KEK.esl KEK.auth
+sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \
+                  -k KEK.key -c KEK.crt db DB.esl DB.auth
+
+chmod 0600 *.key
+
+echo ""
+echo ""
+echo "For use with KeyTool, copy the *.auth and *.esl files to a FAT USB"
+echo "flash drive or to your EFI System Partition (ESP)."
+echo "For use with most UEFIs' built-in key managers, copy the *.cer files;"
+echo "but some UEFIs require the *.auth files."
+echo ""

Secure Boot/secure-boot-setup-LockDown.sh

@@ -0,0 +1,4 @@
+apt install gnu-efi help2man sbsigntool
+cpan File::Slurp
+git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools ~/sbkeys
+cd ~/sbkeys && make

Secure Boot/secure-boot-setup.sh

@@ -0,0 +1,5 @@
+apt install efitools
+mkdir ~/sbkeys && cd ~/sbkeys
+wget https://www.rodsbooks.com/efi-bootloaders/mkkeys.sh
+chmod +x mkkeys.sh
+./mkkeys.sh

Secure Boot/secure-boot-sign.sh

@@ -0,0 +1,6 @@
+cd /srv/openslx/tftp
+mv ipxe.efi ipxe.efi.bak
+sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt ipxe.efi.bak --output ipxe.efi
+cd /srv/openslx/www/boot/bwlp/maxilinux-u2004/31r1
+mv kernel kernel.bak
+sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt kernel.bak --output kernel

TPM/tpm-crypt.sh

@@ -0,0 +1,7 @@
+# Encryption using the TPM
+echo "secret" | tpm2_rsaencrypt --object-context=0x81000001 --output=msg.enc
+# Encryption using the public key
+echo "secret" | openssl pkeyutl -encrypt -pubin -inkey key.pem -out msg2.enc
+# Decryption using the TPM
+tpm2_rsadecrypt --object-context=0x81000001 msg.enc
+tpm2_rsadecrypt --object-context=0x81000001 msg2.enc

TPM/tpm-setup.sh

@@ -0,0 +1,5 @@
+apt install tpm2-tools
+mkdir usb && mount /dev/sdb1 usb && cd usb
+tpm2_createprimary --key-algorithm=rsa2048 --key-context=key.ctx
+tpm2_evictcontrol --object-context=key.ctx 0x81000001
+tpm2_readpublic --object-context=0x81000001 --format=pem --output=key.pem

Unified Kernel Image/api.inc.php.diff

@@ -0,0 +1,4 @@
+20a21,23
+> 		if ($entryId === 1) {
+> 			$data = file_get_contents("/srv/script.ipxe");
+> 		}

Unified Kernel Image/cmd

@@ -0,0 +1 @@
+slxbase=boot/bwlp/maxilinux-u2004/31r1 slxsrv=10.0.2.3 slx.stage4.path=stage4/bwlp/maxilinux-bookworm-6.1.33-94.qcow2 bridged quiet nosplash systemd.show_status=0 rd.shell=0 rd.emergency=reboot ipv4.ip=10.0.2.42 ipv4.router=10.0.2.1 ipv4.dns=10.0.2.1 ipv4.hostname=client ipv4.if=a8:a1:59:0b:fe:87 ipv4.ntpsrv=de.pool.ntp.org ipv4.subnet=255.255.255.0 slx.swap ibt=off slx.ipxe.id=1

Unified Kernel Image/osrel

@@ -0,0 +1,9 @@
+PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
+NAME="Debian GNU/Linux"
+VERSION_ID="12"
+VERSION="12 (bookworm)"
+VERSION_CODENAME=bookworm
+ID=debian
+HOME_URL="https://www.debian.org/"
+SUPPORT_URL="https://www.debian.org/support"
+BUG_REPORT_URL="https://bugs.debian.org/"

Unified Kernel Image/script.ipxe

@@ -0,0 +1,14 @@
+#!ipxe
+set ipappend1 ip=${ip}:10.0.2.3:${gateway}:\${netmask}
+set ipappend2 BOOTIF=01-${mac:hexhyp}
+set serverip 10.0.2.3 ||
+iseq ${idx} ${} && set idx:string X ||
+iseq ${self} ${} && set self http://10.0.2.3/boot/ipxe? ||
+set menuentryid 1 ||
+imgfree ||
+boot /boot/default/kernel.efi || goto fail
+goto fail
+goto end
+:fail
+prompt --timeout 5000 Error launching selected boot entry ||
+:end

Unified Kernel Image/uki-create-sign.sh

@@ -0,0 +1,12 @@
+cd /srv/openslx/www/boot/default
+objcopy \
+--add-section .osrel=/srv/osrel \
+--change-section-vma .osrel=0x20000 \
+--add-section .cmdline=/srv/cmd \
+--change-section-vma .cmdline=0x30000 \
+--add-section .linux=kernel.bak \
+--change-section-vma .linux=0x40000 \
+--add-section .initrd=initramfs-stage31 \
+--change-section-vma .initrd=0x3000000 \
+/usr/lib/systemd/boot/efi/linuxx64.efi.stub kernel.efi.bak
+sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt kernel.efi.bak --output kernel.efi

iPXE signing/iPXE-key-setup.sh

@@ -0,0 +1,40 @@
+openssl req -x509 -newkey rsa:2048 -out ca.crt -keyout ca.key -days 1000
+echo 01 > ca.srl
+touch ca.idx
+mkdir signed
+cat << EOF >> ca.cnf
+[ ca ]
+default_ca             = ca_default
+
+[ ca_default ]
+certificate            = ca.crt
+private_key            = ca.key
+serial                 = ca.srl
+database               = ca.idx
+new_certs_dir          = signed
+default_md             = default
+policy                 = policy_ipxe
+preserve               = yes
+default_days           = 90
+unique_subject         = no
+
+[ policy_ipxe ]
+commonName             = ipxe.ca
+countryName             = match
+stateOrProvinceName     = match
+organizationName        = match
+organizationalUnitName  = optional
+commonName              = optional
+emailAddress            = optional
+
+[ cross ]
+basicConstraints       = critical,CA:true
+keyUsage               = critical,cRLSign,keyCertSign
+
+[ codesigning ]
+keyUsage                = digitalSignature
+extendedKeyUsage        = codeSigning
+EOF
+
+openssl req -newkey rsa -keyout codesign.key -out codesign.req
+openssl ca -config ca.cnf -extensions codesigning -in codesign.req -out codesign.crt

iPXE signing/iPXE-sign.sh

@@ -0,0 +1,3 @@
+openssl cms -sign -binary -noattr -in kernel.efi \
+    -signer codesign.crt -inkey codesign.key -certfile ca.crt \
+    -outform DER -out kernel.efi.sig

iPXE signing/ipxelinux.ipxe.diff

@@ -0,0 +1,8 @@
+3a4
+> imgtrust --permanent
+37c38,40
+< chain -ar ${self} || goto fail
+---
+> imgfetch --name ipxe ${self}
+> imgverify ipxe ${self}&sig=true
+> imgload ipxe || goto fail