fruchti/hosts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Rupert, burp server: Use password files as well

Browse source
This commit is contained in:
fruchti 2023-03-12 15:41:36 +01:00
parent 01161228da
commit ff291dd912
3 changed files with 76 additions and 42 deletions
Download patch file Download diff file Expand all files Collapse all files

83
options/burp.nix
View file

@ -89,7 +89,7 @@ let
ssl_cert = ${serverHome}/ssl_cert-server.pem
ssl_key = ${serverHome}/ssl_cert-server.key
ssl_dhfile = ${serverHome}/dhfile.pem
ssl_key_password = ${cfg.server.sslKeyPassword}
ssl_key_password = ${if (cfg.server.sslKeyPasswordFile != null) then "#SSL_KEY_PASSWORD#" else cfg.server.sslKeyPassword}
${concatMapStringsSep "\n" (x: "keep = " + toString x) cfg.server.keep}
timer_script = ${cfg.server.timerScript}
@ -106,7 +106,7 @@ let
'';
clientConfigs = lib.attrsets.mapAttrs (name: config: (pkgs.writeText name ''
password = ${config.password}
password = ${if (config.passwordFile != null) then "#PASSWORD#" else config.password}
${config.extraConfig}
'')) cfg.server.clients;
@ -154,7 +154,6 @@ in {
SSL key password for loading a certificate with encryption.
'';
};
sslKeyPasswordFile = mkOption {
type = types.nullOr types.str;
default = null;
@ -238,6 +237,14 @@ in {
Password used by the client for first contact with the server.
'';
};
passwordFile = mkOption {
type = types.nullOr types.str;
default = null;
description = mdDoc ''
File to load a password for the first contact from client to server from.
Takes preference over `password`.
'';
};
extraConfig = mkOption {
type = types.lines;
@ -401,13 +408,13 @@ in {
install -Dm640 ${clientConf} '${configFile}'
${optionalString (cfg.client.passwordFile != null) ''
${replaceSecret} '#PASSWORD#' '${cfg.client.passwordFile}' '${configFile}'
${replaceSecret} '#PASSWORD#' '${cfg.client.passwordFile}' '${configFile}'
''}
${optionalString (cfg.client.sslKeyPasswordFile != null) ''
${replaceSecret} '#SSL_KEY_PASSWORD#' '${cfg.client.sslKeyPasswordFile}' '${configFile}'
${replaceSecret} '#SSL_KEY_PASSWORD#' '${cfg.client.sslKeyPasswordFile}' '${configFile}'
''}
${optionalString (cfg.client.encryptionPasswordFile != null) ''
${replaceSecret} '#ENCRYPTION_PASSWORD#' '${cfg.client.encryptionPasswordFile}' '${configFile}'
${replaceSecret} '#ENCRYPTION_PASSWORD#' '${cfg.client.encryptionPasswordFile}' '${configFile}'
''}
}
@ -449,8 +456,54 @@ in {
wantedBy = [ "multi-user.target" ];
path = [ cfg.package pkgs.nettools pkgs.openssl ];
serviceConfig = {
ExecStart = "${cfg.package}/bin/burp -F -v -c ${serverConf}";
serviceConfig = let
configFile = "${serverHome}/burp-server.conf";
replaceSecret = "${pkgs.replace-secret}/bin/replace-secret";
preStartScript = pkgs.writeScript "burp-server-prestart" ''
#!/${pkgs.bash}/bin/bash
prepare_data_directory()
{
if ! [ -d "${cfg.server.dataDirectory}" ] ; then
mkdir -p "${cfg.server.dataDirectory}"
fi
chown burp:burp "${cfg.server.dataDirectory}" "${serverClientConfDir}"
chmod 700 "${cfg.server.dataDirectory}"
}
prepare_config()
{
install -Dm640 -o burp -g burp '${serverConf}' '${configFile}'
${optionalString (cfg.server.sslKeyPasswordFile != null) ''
${replaceSecret} '#SSL_KEY_PASSWORD#' '${cfg.server.sslKeyPasswordFile}' '${configFile}'
''}
}
prepare_client_configs()
{
umask 077
if ! [ -d "${serverClientConfDir}" ] ; then
mkdir -p "${serverClientConfDir}"
fi
rm -f "${serverClientConfDir}"/*
${concatStringsSep "\n" (mapAttrsToList(name: file: ''
install -Dm640 -o burp -g burp '${file}' '${serverClientConfDir}/${name}'
${optionalString (cfg.server.clients.${name}.passwordFile != null) ''
${replaceSecret} '#PASSWORD#' '${cfg.server.clients.${name}.passwordFile}' '${serverClientConfDir}/${name}'
''}
'') clientConfigs)}
}
prepare_data_directory
prepare_config
prepare_client_configs
'';
in {
ExecStart = "${cfg.package}/bin/burp -F -v -c ${configFile}";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
User = "burp";
@ -467,19 +520,7 @@ in {
serverHome
];
ExecStartPre = "+${pkgs.writeScript "burp-prestart" ''
#!/${pkgs.bash}/bin/bash
if ! [ -d "${cfg.server.dataDirectory}" ] ; then
mkdir -p "${cfg.server.dataDirectory}"
fi
if ! [ -d "${serverClientConfDir}" ] ; then
mkdir -p "${serverClientConfDir}"
fi
chown burp:burp "${cfg.server.dataDirectory}" "${serverClientConfDir}"
chmod 700 "${cfg.server.dataDirectory}" "${serverClientConfDir}"
${concatStringsSep "\n" (mapAttrsToList(name: file:
"ln -fs " + file + " " + serverClientConfDir + "/" + name) clientConfigs)}
''}";
ExecStartPre = "+${preStartScript}";
Nice = 19;
IOSchedulingClass = "idle";