6 Commits (master)

Author	SHA1	Message	Date
Guillem Jover	5e174ba25d	MT#64527 ngcp-panel-create-keys: Add missing import ... We need to import Fcntl for O_WRONLY. Fixes: commit fb44ee879a Change-Id: I3458e1ece61c230072d9f8e325cab5adc8cf07fb	5 days ago
Guillem Jover	fb44ee879a	MT#64527 ngcp-panel-create-keys: Fix race condition when creating TLS certs ... We should not create and populate the TLS keys and certificate files with the default permissions from open(), to then fix that up in a later call. Instead use the specified permissions (even if they might get restricted further by the current umask), and then we will possibly open them up again when doing the chmod(). Spotted-by: Michael Prokop <mprokop@sipwise.com> Change-Id: I810e041cc4038bdaed8a3335ca45009129c928de	6 days ago
Guillem Jover	5190438b95	MT#64527 ngcp-panel-create-keys: Increase the default RSA key size to 3072 ... The BSI recommends a minimum key size of 3000 bits, which for RSA maps to 3072 bits. Ref: https://www.keylength.com/en/8/ Change-Id: I07c53a9c55d8f6472e69f80e7c1e0725e8b1491c	6 days ago
Guillem Jover	d48ff17aac	MT#64527 ngcp-panel-create-keys: Do not allow RSA keys sizes below 2048 bits ... This is the minimum accepted by NIST for example. Spotted-by: Michael Prokop <mprokop@sipwise.com> Change-Id: I69032f6a13493a7d042b81e205a6e446c186f7cd	6 days ago
Guillem Jover	43f176de69	MT#64527 ngcp-panel-create-keys: Fix TLS keys/certs files and dirs permissions ... We must not create this directory, which does not have the sticky bit set, with world writable permissions, even more so when we are storing TLS certificates and keys in it. We should not create the TLS (public) certificate with 600 permissions, 644 is more appropriate. Change-Id: Icb8bf970f795d053444598c37a95a89aad3ae9ae	6 days ago
Rene Krenn	175d8b2df6	TT#84328 write .pem files directly ... write generated RSA keys directly to -/etc/ngcp-config/shared-files/ngcp-panel/rsa_public_key.pem -/etc/ngcp-config/shared-files/ngcp-panel/rsa_private_key.pem -chmod 600 -chown root:root if the .pem files already exist, a counter in the filenames is incremented, ie. rsa_public_key_1.pem rsa_private_key_1.pem Change-Id: I439c189e7405f0eb3ab1b0178cda437ac2ab6ced	6 years ago