From 0513ac2eb159100f9f07754711094d87f84a7502 Mon Sep 17 00:00:00 2001 From: Simon Moser Date: Sun, 10 Sep 2023 21:43:51 +0200 Subject: [PATCH] Scripts added --- LICENSE | 4 ++- Secure Boot/mkkeys.sh | 44 +++++++++++++++++++++++ Secure Boot/secure-boot-setup-LockDown.sh | 4 +++ Secure Boot/secure-boot-setup.sh | 5 +++ Secure Boot/secure-boot-sign.sh | 6 ++++ TPM/tpm-crypt.sh | 7 ++++ TPM/tpm-setup.sh | 5 +++ Unified Kernel Image/api.inc.php.diff | 4 +++ Unified Kernel Image/cmd | 1 + Unified Kernel Image/osrel | 9 +++++ Unified Kernel Image/script.ipxe | 14 ++++++++ Unified Kernel Image/uki-create-sign.sh | 12 +++++++ iPXE signing/iPXE-key-setup.sh | 40 +++++++++++++++++++++ iPXE signing/iPXE-sign.sh | 3 ++ iPXE signing/ipxelinux.ipxe.diff | 8 +++++ 15 files changed, 165 insertions(+), 1 deletion(-) create mode 100644 Secure Boot/mkkeys.sh create mode 100644 Secure Boot/secure-boot-setup-LockDown.sh create mode 100644 Secure Boot/secure-boot-setup.sh create mode 100644 Secure Boot/secure-boot-sign.sh create mode 100644 TPM/tpm-crypt.sh create mode 100644 TPM/tpm-setup.sh create mode 100644 Unified Kernel Image/api.inc.php.diff create mode 100644 Unified Kernel Image/cmd create mode 100644 Unified Kernel Image/osrel create mode 100644 Unified Kernel Image/script.ipxe create mode 100644 Unified Kernel Image/uki-create-sign.sh create mode 100644 iPXE signing/iPXE-key-setup.sh create mode 100644 iPXE signing/iPXE-sign.sh create mode 100644 iPXE signing/ipxelinux.ipxe.diff diff --git a/LICENSE b/LICENSE index 2071b23..b895527 100644 --- a/LICENSE +++ b/LICENSE @@ -1,9 +1,11 @@ MIT License -Copyright (c) +Copyright (c) 2023 Simon Moser Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. + +The script mkkeys.sh, which is also found in this repository for simplicity reasons, is licensed under the terms of the GPL v3. It was retreived from https://www.rodsbooks.com/efi-bootloaders/mkkeys.sh. \ No newline at end of file diff --git a/Secure Boot/mkkeys.sh b/Secure Boot/mkkeys.sh new file mode 100644 index 0000000..f2cb1e6 --- /dev/null +++ b/Secure Boot/mkkeys.sh @@ -0,0 +1,44 @@ +#!/bin/bash +# Copyright (c) 2015 by Roderick W. Smith +# Licensed under the terms of the GPL v3 + +echo -n "Enter a Common Name to embed in the keys: " +read NAME + +openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME PK/" -keyout PK.key \ + -out PK.crt -days 3650 -nodes -sha256 +openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME KEK/" -keyout KEK.key \ + -out KEK.crt -days 3650 -nodes -sha256 +openssl req -new -x509 -newkey rsa:2048 -subj "/CN=$NAME DB/" -keyout DB.key \ + -out DB.crt -days 3650 -nodes -sha256 +openssl x509 -in PK.crt -out PK.cer -outform DER +openssl x509 -in KEK.crt -out KEK.cer -outform DER +openssl x509 -in DB.crt -out DB.cer -outform DER + +GUID=`python3 -c 'import uuid; print(str(uuid.uuid1()))'` +echo $GUID > myGUID.txt + +cert-to-efi-sig-list -g $GUID PK.crt PK.esl +cert-to-efi-sig-list -g $GUID KEK.crt KEK.esl +cert-to-efi-sig-list -g $GUID DB.crt DB.esl +rm -f noPK.esl +touch noPK.esl + +sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \ + -k PK.key -c PK.crt PK PK.esl PK.auth +sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \ + -k PK.key -c PK.crt PK noPK.esl noPK.auth +sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \ + -k PK.key -c PK.crt KEK KEK.esl KEK.auth +sign-efi-sig-list -t "$(date --date='1 second' +'%Y-%m-%d %H:%M:%S')" \ + -k KEK.key -c KEK.crt db DB.esl DB.auth + +chmod 0600 *.key + +echo "" +echo "" +echo "For use with KeyTool, copy the *.auth and *.esl files to a FAT USB" +echo "flash drive or to your EFI System Partition (ESP)." +echo "For use with most UEFIs' built-in key managers, copy the *.cer files;" +echo "but some UEFIs require the *.auth files." +echo "" diff --git a/Secure Boot/secure-boot-setup-LockDown.sh b/Secure Boot/secure-boot-setup-LockDown.sh new file mode 100644 index 0000000..00bd361 --- /dev/null +++ b/Secure Boot/secure-boot-setup-LockDown.sh @@ -0,0 +1,4 @@ +apt install gnu-efi help2man sbsigntool +cpan File::Slurp +git clone git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools ~/sbkeys +cd ~/sbkeys && make \ No newline at end of file diff --git a/Secure Boot/secure-boot-setup.sh b/Secure Boot/secure-boot-setup.sh new file mode 100644 index 0000000..8d85f0e --- /dev/null +++ b/Secure Boot/secure-boot-setup.sh @@ -0,0 +1,5 @@ +apt install efitools +mkdir ~/sbkeys && cd ~/sbkeys +wget https://www.rodsbooks.com/efi-bootloaders/mkkeys.sh +chmod +x mkkeys.sh +./mkkeys.sh \ No newline at end of file diff --git a/Secure Boot/secure-boot-sign.sh b/Secure Boot/secure-boot-sign.sh new file mode 100644 index 0000000..c5c2470 --- /dev/null +++ b/Secure Boot/secure-boot-sign.sh @@ -0,0 +1,6 @@ +cd /srv/openslx/tftp +mv ipxe.efi ipxe.efi.bak +sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt ipxe.efi.bak --output ipxe.efi +cd /srv/openslx/www/boot/bwlp/maxilinux-u2004/31r1 +mv kernel kernel.bak +sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt kernel.bak --output kernel \ No newline at end of file diff --git a/TPM/tpm-crypt.sh b/TPM/tpm-crypt.sh new file mode 100644 index 0000000..69ad458 --- /dev/null +++ b/TPM/tpm-crypt.sh @@ -0,0 +1,7 @@ +# Encryption using the TPM +echo "secret" | tpm2_rsaencrypt --object-context=0x81000001 --output=msg.enc +# Encryption using the public key +echo "secret" | openssl pkeyutl -encrypt -pubin -inkey key.pem -out msg2.enc +# Decryption using the TPM +tpm2_rsadecrypt --object-context=0x81000001 msg.enc +tpm2_rsadecrypt --object-context=0x81000001 msg2.enc \ No newline at end of file diff --git a/TPM/tpm-setup.sh b/TPM/tpm-setup.sh new file mode 100644 index 0000000..29399d5 --- /dev/null +++ b/TPM/tpm-setup.sh @@ -0,0 +1,5 @@ +apt install tpm2-tools +mkdir usb && mount /dev/sdb1 usb && cd usb +tpm2_createprimary --key-algorithm=rsa2048 --key-context=key.ctx +tpm2_evictcontrol --object-context=key.ctx 0x81000001 +tpm2_readpublic --object-context=0x81000001 --format=pem --output=key.pem \ No newline at end of file diff --git a/Unified Kernel Image/api.inc.php.diff b/Unified Kernel Image/api.inc.php.diff new file mode 100644 index 0000000..7d5c391 --- /dev/null +++ b/Unified Kernel Image/api.inc.php.diff @@ -0,0 +1,4 @@ +20a21,23 +> if ($entryId === 1) { +> $data = file_get_contents("/srv/script.ipxe"); +> } diff --git a/Unified Kernel Image/cmd b/Unified Kernel Image/cmd new file mode 100644 index 0000000..22690da --- /dev/null +++ b/Unified Kernel Image/cmd @@ -0,0 +1 @@ +slxbase=boot/bwlp/maxilinux-u2004/31r1 slxsrv=10.0.2.3 slx.stage4.path=stage4/bwlp/maxilinux-bookworm-6.1.33-94.qcow2 bridged quiet nosplash systemd.show_status=0 rd.shell=0 rd.emergency=reboot ipv4.ip=10.0.2.42 ipv4.router=10.0.2.1 ipv4.dns=10.0.2.1 ipv4.hostname=client ipv4.if=a8:a1:59:0b:fe:87 ipv4.ntpsrv=de.pool.ntp.org ipv4.subnet=255.255.255.0 slx.swap ibt=off slx.ipxe.id=1 \ No newline at end of file diff --git a/Unified Kernel Image/osrel b/Unified Kernel Image/osrel new file mode 100644 index 0000000..6c12857 --- /dev/null +++ b/Unified Kernel Image/osrel @@ -0,0 +1,9 @@ +PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" +NAME="Debian GNU/Linux" +VERSION_ID="12" +VERSION="12 (bookworm)" +VERSION_CODENAME=bookworm +ID=debian +HOME_URL="https://www.debian.org/" +SUPPORT_URL="https://www.debian.org/support" +BUG_REPORT_URL="https://bugs.debian.org/" \ No newline at end of file diff --git a/Unified Kernel Image/script.ipxe b/Unified Kernel Image/script.ipxe new file mode 100644 index 0000000..b73c0cb --- /dev/null +++ b/Unified Kernel Image/script.ipxe @@ -0,0 +1,14 @@ +#!ipxe +set ipappend1 ip=${ip}:10.0.2.3:${gateway}:\${netmask} +set ipappend2 BOOTIF=01-${mac:hexhyp} +set serverip 10.0.2.3 || +iseq ${idx} ${} && set idx:string X || +iseq ${self} ${} && set self http://10.0.2.3/boot/ipxe? || +set menuentryid 1 || +imgfree || +boot /boot/default/kernel.efi || goto fail +goto fail +goto end +:fail +prompt --timeout 5000 Error launching selected boot entry || +:end \ No newline at end of file diff --git a/Unified Kernel Image/uki-create-sign.sh b/Unified Kernel Image/uki-create-sign.sh new file mode 100644 index 0000000..c03aadf --- /dev/null +++ b/Unified Kernel Image/uki-create-sign.sh @@ -0,0 +1,12 @@ +cd /srv/openslx/www/boot/default +objcopy \ +--add-section .osrel=/srv/osrel \ +--change-section-vma .osrel=0x20000 \ +--add-section .cmdline=/srv/cmd \ +--change-section-vma .cmdline=0x30000 \ +--add-section .linux=kernel.bak \ +--change-section-vma .linux=0x40000 \ +--add-section .initrd=initramfs-stage31 \ +--change-section-vma .initrd=0x3000000 \ +/usr/lib/systemd/boot/efi/linuxx64.efi.stub kernel.efi.bak +sbsign --key ~/sbkeys/DB.key --cert ~/sbkeys/DB.crt kernel.efi.bak --output kernel.efi \ No newline at end of file diff --git a/iPXE signing/iPXE-key-setup.sh b/iPXE signing/iPXE-key-setup.sh new file mode 100644 index 0000000..d9eda04 --- /dev/null +++ b/iPXE signing/iPXE-key-setup.sh @@ -0,0 +1,40 @@ +openssl req -x509 -newkey rsa:2048 -out ca.crt -keyout ca.key -days 1000 +echo 01 > ca.srl +touch ca.idx +mkdir signed +cat << EOF >> ca.cnf +[ ca ] +default_ca = ca_default + +[ ca_default ] +certificate = ca.crt +private_key = ca.key +serial = ca.srl +database = ca.idx +new_certs_dir = signed +default_md = default +policy = policy_ipxe +preserve = yes +default_days = 90 +unique_subject = no + +[ policy_ipxe ] +commonName = ipxe.ca +countryName = match +stateOrProvinceName = match +organizationName = match +organizationalUnitName = optional +commonName = optional +emailAddress = optional + +[ cross ] +basicConstraints = critical,CA:true +keyUsage = critical,cRLSign,keyCertSign + +[ codesigning ] +keyUsage = digitalSignature +extendedKeyUsage = codeSigning +EOF + +openssl req -newkey rsa -keyout codesign.key -out codesign.req +openssl ca -config ca.cnf -extensions codesigning -in codesign.req -out codesign.crt \ No newline at end of file diff --git a/iPXE signing/iPXE-sign.sh b/iPXE signing/iPXE-sign.sh new file mode 100644 index 0000000..62003f3 --- /dev/null +++ b/iPXE signing/iPXE-sign.sh @@ -0,0 +1,3 @@ +openssl cms -sign -binary -noattr -in kernel.efi \ + -signer codesign.crt -inkey codesign.key -certfile ca.crt \ + -outform DER -out kernel.efi.sig \ No newline at end of file diff --git a/iPXE signing/ipxelinux.ipxe.diff b/iPXE signing/ipxelinux.ipxe.diff new file mode 100644 index 0000000..da54999 --- /dev/null +++ b/iPXE signing/ipxelinux.ipxe.diff @@ -0,0 +1,8 @@ +3a4 +> imgtrust --permanent +37c38,40 +< chain -ar ${self} || goto fail +--- +> imgfetch --name ipxe ${self} +> imgverify ipxe ${self}&sig=true +> imgload ipxe || goto fail