nihilist/acme.sh
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Removed ability to specify API key to facilitate future multiple host functionality.

Browse Source
This commit is contained in:
sg1888 2023-07-18 19:43:47 +00:00
parent 62a2ce1d35
commit edd1b60c3d
1 changed files with 18 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
deploy/panos.sh
View File

@ -8,21 +8,13 @@
# Firewall admin with superuser and IP address is required.
#
# REQURED:
# export PANOS_HOST="" # required
# export PANOS_USER="" # required
#
# AND one of the two authenticiation methods:
#
# Method 1: Password (RECOMMENDED)
# export PANOS_HOST=""
# export PANOS_USER="" #User *MUST* have Commit and Import Permissions in XML API for Admin Role
# export PANOS_PASS=""
#
# Method 2: API KEY
# export PANOS_KEY=""
#
#
# The Password method will automatically generate a new API key if
# The script will automatically generate a new API key if
# no key is found, or if a saved key has expired or is invalid.
#
# This function is to parse the XML response from the firewall
parse_response() {
@ -53,13 +45,15 @@ deployer() {
type=$1 # Types are keytest, keygen, cert, key, commit
panos_url="https://$_panos_host/api/"
#Test API Key by performing an empty commit.
#Test API Key by performing a lookup
if [ "$type" = 'keytest' ]; then
_debug "**** Testing saved API Key ****"
_H1="Content-Type: application/x-www-form-urlencoded"
#Exclude all scopes for the empty commit
_exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network><shared-object>exclude</shared-object>"
content="type=commit&action=partial&key=$_panos_key&cmd=<commit><partial>$_exclude_scope<admin><member>acmekeytest</member></admin></partial></commit>"
# Get Version Info to test key
content="type=version&key=$_panos_key"
## Exclude all scopes for the empty commit
#_exclude_scope="<policy-and-objects>exclude</policy-and-objects><device-and-network>exclude</device-and-network><shared-object>exclude</shared-object>"
#content="type=commit&action=partial&key=$_panos_key&cmd=<commit><partial>$_exclude_scope<admin><member>acmekeytest</member></admin></partial></commit>"
fi
# Generate API Key
@ -170,22 +164,17 @@ panos_deploy() {
_getdeployconf PANOS_PASS
fi
# PANOS_KEY
if [ "$PANOS_KEY" ]; then
_debug "Detected ENV variable PANOS_KEY. Saving to file."
_savedeployconf PANOS_KEY "$PANOS_KEY" 1
else
_debug "Attempting to load variable PANOS_KEY from file."
_getdeployconf PANOS_KEY
fi
#Store variables
_panos_host=$PANOS_HOST
_panos_key=$PANOS_KEY
_panos_user=$PANOS_USER
_panos_pass=$PANOS_PASS
#Test API Key if found. If the key is invalid, the variable panos_key will be unset.
#Load saved keys
_getdeployconf PANOS_KEY
_panos_key=$PANOS_KEY
#Test API Key if found. If the key is invalid, the variable _panos_key will be unset.
if [ "$_panos_host" ] && [ "$_panos_key" ]; then
_debug "**** Testing API KEY ****"
deployer keytest
@ -198,8 +187,8 @@ panos_deploy() {
elif [ -z "$_panos_user" ]; then
_err "No user found. If this is your first time deploying, please set PANOS_USER in ENV variables. You can delete it after you have successfully deployed the certs."
return 1
elif [ -z "$_panos_key" ] && { [ -z "$_panos_user" ] || [ -z "$_panos_pass" ]; }; then
_err "No pass OR valid API key found. If this is your first time deploying please set PANOS_PASS and/or PANOS_KEY in ENV variables. You can delete them after you have succesfully deployed the certs."
elif [ -z "$_panos_pass" ]; then
_err "No password found. If this is your first time deploying, please set PANOS_PASS in ENV variables. You can delete it after you have successfully deployed the certs."
return 1
else
# Generate a new API key if no valid API key is found