source/code/plugins/agent_maintenance_script.rb
# Create the public/private key pair for the agent/workspace
Create the public/private key pair for the agent/workspace
Create the public / private key pair for the agent / workspace
def generate_certs(workspace_id, agent_guid)
      if workspace_id.nil? or agent_guid.nil? or workspace_id.empty? or agent_guid.empty?
        log_error("Both WORKSPACE_ID and AGENT_GUID must be defined to generate certificates")
        return MISSING_CONFIG
      end
      log_info("Generating certificate ...")
      error=nil
      key_file = File.new(@key_path, "w")
      cert_file = File.new(@cert_path, "w")
      File.chmod(0640, @key_path)
      File.chmod(0640, @cert_path)
      chown_omsagent([@key_path, @cert_path])
      begin
        key = OpenSSL::PKey::RSA.new(2048)
        x509_version = 2  
        two_byte_range = 2**16 - 2  
        year = 1 * 365 * 24 * 60 * 60  
        csr = OpenSSL::X509::Request.new
        csr.version = x509_version
        csr.subject = OpenSSL::X509::Name.new([
            ["CN", workspace_id],
            ["CN", agent_guid],
            ["OU", "Linux Monitoring Agent"],
            ["O", "Microsoft"]])
        csr.public_key = key.public_key
        csr.sign(key, OpenSSL::Digest::SHA256.new)
        csr_cert = OpenSSL::X509::Certificate.new
        csr_cert.serial = SecureRandom.random_number(two_byte_range) + 1
        csr_cert.version = x509_version
        csr_cert.not_before = Time.now
        csr_cert.not_after = Time.now + year
        csr_cert.subject = csr.subject
        csr_cert.public_key = csr.public_key
        csr_cert.issuer = csr_cert.subject  
        ef = OpenSSL::X509::ExtensionFactory.new
        ef.subject_certificate = csr_cert
        ef.issuer_certificate = csr_cert
        csr_cert.add_extension(ef.create_extension("subjectKeyIdentifier","hash",false))
        csr_cert.add_extension(ef.create_extension("authorityKeyIdentifier","keyid:always",false))
        csr_cert.add_extension(ef.create_extension("basicConstraints","CA:TRUE",false))
        csr_cert.sign(key, OpenSSL::Digest::SHA256.new)
        key_file.write(key)
        cert_file.write(csr_cert)
      rescue => e
        error = e
      ensure
        key_file.close
        cert_file.close
      end
      if !error.nil?
        log_error("Error generating certs: #{error.message}")
        return ERROR_GENERATING_CERTS
      elsif !file_exists_nonempty(@cert_path) or !file_exists_nonempty(@key_path)
        log_error("Error generating certs")
        return ERROR_GENERATING_CERTS
      end
      return 0
    end
def generate_certs ( workspace_id , agent_guid ) if workspace_id . nil? or agent_guid . nil? or workspace_id . empty? or agent_guid . empty? log_error ( "Both WORKSPACE_ID and AGENT_GUID must be defined to generate certificates" ) return MISSING_CONFIG end log_info ( "Generating certificate ..." ) error = nil key_file = File . new ( @key_path , "w" ) cert_file = File . new ( @cert_path , "w" ) File . chmod ( 0640 , @key_path ) File . chmod ( 0640 , @cert_path ) chown_omsagent ( [ @key_path , @cert_path ] ) begin key = OpenSSL :: PKey :: RSA . new ( 2048 ) x509_version = 2 two_byte_range = 2 ** 16 - 2 year = 1 * 365 * 24 * 60 * 60 csr = OpenSSL :: X509 :: Request . new csr . version = x509_version csr . subject = OpenSSL :: X509 :: Name . new ( [ [ "CN" , workspace_id ] , [ "CN" , agent_guid ] , [ "OU" , "Linux Monitoring Agent" ] , [ "O" , "Microsoft" ] ] ) csr . public_key = key . public_key csr . sign ( key , OpenSSL :: Digest :: SHA256 . new ) csr_cert = OpenSSL :: X509 :: Certificate . new csr_cert . serial = SecureRandom . random_number ( two_byte_range ) + 1 csr_cert . version = x509_version csr_cert . not_before = Time . now csr_cert . not_after = Time . now + year csr_cert . subject = csr . subject csr_cert . public_key = csr . public_key csr_cert . issuer = csr_cert . subject ef = OpenSSL :: X509 :: ExtensionFactory . new ef . subject_certificate = csr_cert ef . issuer_certificate = csr_cert csr_cert . add_extension ( ef . create_extension ( "subjectKeyIdentifier" , "hash" , false ) ) csr_cert . add_extension ( ef . create_extension ( "authorityKeyIdentifier" , "keyid:always" , false ) ) csr_cert . add_extension ( ef . create_extension ( "basicConstraints" , "CA:TRUE" , false ) ) csr_cert . sign ( key , OpenSSL :: Digest :: SHA256 . new ) key_file . write ( key ) cert_file . write ( csr_cert ) rescue => e error = e ensure key_file . close cert_file . close end if ! error . nil? log_error ( "Error generating certs: #{error.message}" ) return ERROR_GENERATING_CERTS elsif ! file_exists_nonempty ( @cert_path ) or ! file_exists_nonempty ( @key_path ) log_error ( "Error generating certs" ) return ERROR_GENERATING_CERTS end return 0 end
Create the public/private key pair for the agent/workspace
Create the public / private key pair for the agent / workspace
# Set safe certificate permissions before to prevent timing attacks # Create new private key of 2048 bits # enable X509 V3 extensions # 2 digit byte range for serial number # 365 days validity for certificate # Generate CSR from new private key # Self-sign CSR # self-signed # Write key and cert to files # Check for any error or non-existent or empty files
workspace_id
<not_specific>
agent_guid
<not_specific>