{ "info": { "author": "Lauri V\u00f5sandi", "author_email": "lauri.vosandi@gmail.com", "bugtrack_url": null, "classifiers": [ "Development Status :: 4 - Beta", "Environment :: Console", "Intended Audience :: Developers", "Intended Audience :: System Administrators", "License :: Freely Distributable", "License :: OSI Approved :: MIT License", "Natural Language :: English", "Operating System :: POSIX :: Linux", "Programming Language :: Python", "Programming Language :: Python :: 3 :: Only" ], "description": "Certidude\n=========\n\n.. image:: https://travis-ci.org/laurivosandi/certidude.svg?branch=master\n :target: https://travis-ci.org/laurivosandi/certidude\n\n.. image:: http://codecov.io/github/laurivosandi/certidude/coverage.svg?branch=master\n :target: http://codecov.io/github/laurivosandi/certidude?branch=master\n\n\nIntroduction\n------------\n\nCertidude is a novel X.509 Certificate Authority management tool\nwith privilege isolation mechanism and Kerberos authentication aiming to\neventually support PKCS#11 and in far future WebCrypto.\n\n.. figure:: doc/usecase-diagram.png\n\nCertidude is mainly designed for VPN gateway operators to make\ndesktop/laptop VPN setup as easy as possible.\nUser certificate management eg. for HTTPS is also made reasonably simple.\nFor a full-blown CA you might want to take a look at\n`EJBCA `_ or\n`OpenCA `_.\n\n\nFeatures\n--------\n\nCommon:\n\n* Standard request, sign, revoke workflow via web interface.\n* Kerberos and basic auth based web interface authentication.\n* PAM and Active Directory compliant authentication backends: Kerberos single sign-on, LDAP simple bind.\n* POSIX groups and Active Directory (LDAP) group membership based authorization.\n* Command-line interface, check out ``certidude list``.\n* Privilege isolation, separate signer process is spawned per private key isolating\n private key use from the the web interface.\n* Certificate serial numbers are intentionally randomized to avoid leaking information about business practices.\n* Server-side events support via `nchan `_.\n* E-mail notifications about pending, signed and revoked certificates.\n\nVirtual private networking:\n\n* OpenVPN integration, check out ``certidude setup openvpn server`` and ``certidude setup openvpn client``.\n* strongSwan integration, check out ``certidude setup strongswan server`` and ``certidude setup strongswan client``.\n* NetworkManager integration, check out ``certidude setup openvpn networkmanager`` and ``certidude setup strongswan networkmanager``.\n\nHTTPS:\n\n* P12 bundle generation for web browsers, seems to work well with Android\n* HTTPS server setup with client verification, check out ``certidude setup nginx``\n\n\nTODO\n----\n\n* `OCSP `_ support, needs a bit hacking since OpenSSL wrappers are not exposing the functionality.\n* `SECP `_ support, a client implementation available `here `_. Not sure if we can implement server-side events within current standard.\n* Deep mailbox integration, eg fetch CSR-s from mailbox via IMAP.\n* WebCrypto support, meanwhile check out `hwcrypto.js `_.\n* Certificate push/pull, making it possible to sign offline.\n* PKCS#11 hardware token support for signatures at command-line.\n* Ability to send ``.ovpn`` bundle URL tokens via e-mail, for simplified VPN adoption.\n* Cronjob for deleting expired certificates\n* Signer process logging.\n\n\nInstall\n-------\n\nTo install Certidude:\n\n.. code:: bash\n\n apt-get install -y python python-pip python-dev cython \\\n python-cffi python-configparser \\\n python-pysqlite2 python-mysql.connector python-ldap \\\n build-essential libffi-dev libssl-dev libkrb5-dev \\\n ldap-utils krb5-user \\\n libsasl2-modules-gssapi-mit\n pip install certidude\n\n\nSetting up authority\n--------------------\n\nFirst make sure the machine used for certificate authority has fully qualified\ndomain name set up properly.\nYou can check it with:\n\n.. code:: bash\n\n hostname -f\n\nThe command should return ``ca.example.com``.\n\nIf necessary tweak machine's fully qualified hostname in ``/etc/hosts``:\n\n.. code::\n\n 127.0.0.1 localhost\n 127.0.1.1 ca.example.com ca\n\nThen proceed to install `nchan `_ and ``uwsgi``:\n\n.. code:: bash\n\n wget https://nchan.slact.net/download/nginx-common.deb https://nchan.slact.net/download/nginx-extras.deb\n dpkg -i nginx-common.deb nginx-extras.deb\n apt-get install nginx uwsgi uwsgi-plugin-python\n\nCertidude can set up certificate authority relatively easily.\nFollowing will set up certificate authority in ``/var/lib/certidude/hostname.domain.tld``,\nconfigure uWSGI in ``/etc/uwsgi/apps-available/certidude.ini``,\nnginx in ``/etc/nginx/sites-available/certidude.conf``,\ncronjobs in ``/etc/cron.hourly/certidude`` and much more:\n\n.. code:: bash\n\n certidude setup authority\n\nTweak the configuration in ``/etc/certidude/server.conf`` until you meet your requirements and\nspawn the signer process:\n\n.. code:: bash\n\n certidude signer spawn\n\nFinally restart services:\n\n.. code:: bash\n\n service nginx restart\n service uwsgi restart\n\n\nCertificate management\n----------------------\n\nUse following command to request a certificate on a machine:\n\n.. code::\n\n certidude setup client ca.example.com\n\nUse following to list signing requests, certificates and revoked certificates on server:\n\n.. code::\n\n certidude list\n\nUse web interface or following to sign a certificate on server:\n\n.. code::\n\n certidude sign client-hostname-or-common-name\n\n\nSetting up Active Directory authentication\n------------------------------------------\n\nFollowing assumes you have already set up Kerberos infrastructure and\nCertidude is simply one of the servers making use of that infrastructure.\n\nInstall dependencies:\n\n.. code:: bash\n\n apt-get install samba-common-bin krb5-user ldap-utils\n\nReset Samba client configuration in ``/etc/samba/smb.conf``:\n\n.. code:: ini\n\n [global]\n security = ads\n netbios name = CA\n workgroup = EXAMPLE\n realm = EXAMPLE.COM\n kerberos method = system keytab\n\nReset Kerberos configuration in ``/etc/krb5.conf``:\n\n.. code:: ini\n\n [libdefaults]\n default_realm = EXAMPLE.COM\n dns_lookup_realm = true\n dns_lookup_kdc = true\n\nInitialize Kerberos credentials:\n\n.. code:: bash\n\n kinit administrator\n\nJoin the machine to domain:\n\n.. code:: bash\n\n net ads join -k\n\nSet up Kerberos keytab for the web service:\n\n.. code:: bash\n\n KRB5_KTNAME=FILE:/etc/certidude/server.keytab net ads keytab add HTTP -k\n chown root:certidude /etc/certidude/server.keytab\n chmod 640 /etc/certidude/server.keytab\n\nReconfigure /etc/certidude/server.conf:\n\n.. code:: ini\n\n [authentication]\n backends = kerberos\n\n [authorization]\n backend = ldap\n ldap gssapi credential cache = /run/certidude/krb5cc\n ldap user filter = (&(objectclass=user)(objectcategory=person)(samaccountname=%s))\n ldap admin filter = (&(memberOf=cn=Domain Admins,cn=Users,dc=example,dc=com)(samaccountname=%s))\n\nUser filter here specified which users can log in to Certidude web interface\nat all eg. for generating user certificates for HTTPS.\nAdmin filter specifies which users are allowed to sign and revoke certificates.\nAdjust admin filter according to your setup.\nAlso make sure there is cron.hourly job for creating GSSAPI credential cache -\nthat's necessary for querying LDAP using Certidude machine's credentials.\n\n\nAutomating certificate setup\n----------------------------\n\nUbuntu 14.04 based desktops come with NetworkManager installed.\nCreate ``/etc/NetworkManager/dispatcher.d/certidude`` with following content:\n\n.. code:: bash\n\n #!/bin/sh -e\n # Set up certificates for IPSec connection\n\n case \"$2\" in\n up)\n LANG=C.UTF-8 /usr/local/bin/certidude request spawn -k\n ;;\n esac\n\nFinally make it executable:\n\n.. code:: bash\n\n chmod +x /etc/NetworkManager/dispatcher.d/certidude\n\nWhenever a wired or wireless connection is brought up,\nthe dispatcher invokes ``certidude`` in order to generate RSA keys,\nsubmit CSR, fetch signed certificate,\ncreate NetworkManager configuration for the VPN connection.\n\n\nDevelopment\n-----------\n\nClone the repository:\n\n.. code:: bash\n\n git clone https://github.com/laurivosandi/certidude\n cd certidude\n\nInstall dependencies as shown above and additionally:\n\n.. code:: bash\n\n pip install -r requirements.txt\n\nTo generate templates:\n\n.. code:: bash\n\n apt-get install npm nodejs\n sudo ln -s nodejs /usr/bin/node # Fix 'env node' on Ubuntu 14.04\n npm install -g nunjucks\n nunjucks-precompile --include \"\\\\.html$\" --include \"\\\\.svg$\" certidude/static/ > certidude/static/js/templates.js\n\nTo run from source tree:\n\n.. code:: bash\n\n PYTHONPATH=. KRB5CCNAME=/run/certidude/krb5cc KRB5_KTNAME=/etc/certidude/server.keytab LANG=C.UTF-8 python misc/certidude\n\nTo install the package from the source:\n\n.. code:: bash\n\n python setup.py install --single-version-externally-managed --root /", "description_content_type": null, "docs_url": null, "download_url": "UNKNOWN", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "http://github.com/laurivosandi/certidude", "keywords": "falcon http jinja2 x509 pkcs11 webcrypto", "license": "MIT", "maintainer": null, "maintainer_email": null, "name": "certidude", "package_url": "https://pypi.org/project/certidude/", "platform": "UNKNOWN", "project_url": "https://pypi.org/project/certidude/", "project_urls": { "Download": "UNKNOWN", "Homepage": "http://github.com/laurivosandi/certidude" }, "release_url": "https://pypi.org/project/certidude/0.1.21/", "requires_dist": null, "requires_python": null, "summary": "Certidude is a novel X.509 Certificate Authority management tool aiming to support PKCS#11 and in far future WebCrypto.", "version": "0.1.21" }, "last_serial": 2034451, "releases": { "0.1.10": [ { "comment_text": "", "digests": { "md5": "5f20a6be05bc8b754e07493846d6d3dc", "sha256": "a38c9b488080fd04928673dd13633bd4809847cd1be50e4569961e9aa3876306" }, "downloads": -1, "filename": "certidude-0.1.10.tar.gz", "has_sig": false, "md5_digest": "5f20a6be05bc8b754e07493846d6d3dc", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61656, "upload_time": "2015-07-29T19:15:12", "url": "https://files.pythonhosted.org/packages/c3/3c/ee28320d351ae1f7a549ee57cee9cb7724ed772f565600ff822651466162/certidude-0.1.10.tar.gz" } ], "0.1.11": [ { "comment_text": "", "digests": { "md5": "48bf608e83540ec8cedd229fb40304bf", "sha256": "e98b34170e5a0f04b244b72758f381da70843e86bc8ca36761a5197aac7147a0" }, "downloads": -1, "filename": "certidude-0.1.11.tar.gz", "has_sig": false, "md5_digest": "48bf608e83540ec8cedd229fb40304bf", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61693, "upload_time": "2015-07-29T19:19:50", "url": "https://files.pythonhosted.org/packages/31/fb/ae0b9c58a2fe859e355b761b04d7bbdc928174c34372cee66dcab61bea2e/certidude-0.1.11.tar.gz" } ], "0.1.12": [ { "comment_text": "", "digests": { "md5": "944f5f08c805f35823baa3b8867f99e5", "sha256": "38a280544f627060c4108bafd8b72e44738701666357c3f6b279a44ebc46935b" }, "downloads": -1, "filename": "certidude-0.1.12.tar.gz", "has_sig": false, "md5_digest": "944f5f08c805f35823baa3b8867f99e5", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61688, "upload_time": "2015-07-29T19:21:17", "url": "https://files.pythonhosted.org/packages/57/87/81abd07b94d3bb70d106ce87ffbc2f4171970c5bd8f872f23aa5f2eca466/certidude-0.1.12.tar.gz" } ], "0.1.13": [ { "comment_text": "", "digests": { "md5": "3b6dc0347769101ec8bfa87bffa43be2", "sha256": "a72ec4bd9ea236ae1a70ef409423fe755d22c9023341fae819faa6517849c81b" }, "downloads": -1, "filename": "certidude-0.1.13.tar.gz", "has_sig": false, "md5_digest": "3b6dc0347769101ec8bfa87bffa43be2", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61743, "upload_time": "2015-07-29T19:58:03", "url": "https://files.pythonhosted.org/packages/91/49/422f7f26f77396c7370a58b1b711b43b6a52c18972d0c9b77b594c0c5c1a/certidude-0.1.13.tar.gz" } ], "0.1.14": [ { "comment_text": "", "digests": { "md5": "6a9c6dac3a6186a24f830f48e50f47d4", "sha256": "c103dbcace9ffe23805a493e78743e60dabbca0339ca6c7b6b992da1a99078a5" }, "downloads": -1, "filename": "certidude-0.1.14.tar.gz", "has_sig": false, "md5_digest": "6a9c6dac3a6186a24f830f48e50f47d4", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61770, "upload_time": "2015-07-29T20:28:17", "url": "https://files.pythonhosted.org/packages/e3/e4/3fdf58e3e69ac2aedf4bf774130d9aaba5f5ba647aa90cfea7b4f951e4a7/certidude-0.1.14.tar.gz" } ], "0.1.15": [ { "comment_text": "", "digests": { "md5": "d619edfd2753ff8210ba645fc7d36997", "sha256": "915bc191b6e0ce684d51f15f6a14f6ae47f9549aee1961ea922f81ac2daf4aa0" }, "downloads": -1, "filename": "certidude-0.1.15.tar.gz", "has_sig": false, "md5_digest": "d619edfd2753ff8210ba645fc7d36997", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61765, "upload_time": "2015-07-30T10:40:18", "url": "https://files.pythonhosted.org/packages/2b/b2/3bb992929432af18bc69a758a08581cb9b304ced3982b2013a13dc2b0a4f/certidude-0.1.15.tar.gz" } ], "0.1.16": [ { "comment_text": "", "digests": { "md5": "e91d362fae2c47204cd3f58b89cb1ace", "sha256": "62e6b52953deffd96c2a29171505180851d952afc60058e144fee84004f37f3f" }, "downloads": -1, "filename": "certidude-0.1.16.tar.gz", "has_sig": false, "md5_digest": "e91d362fae2c47204cd3f58b89cb1ace", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 61864, "upload_time": "2015-08-01T14:03:12", "url": "https://files.pythonhosted.org/packages/7f/62/b2f84d3fece2480fd8ff3eda0c6e5ac688a81a44da3d1dda4a9710873f76/certidude-0.1.16.tar.gz" } ], "0.1.17": [ { "comment_text": "", "digests": { "md5": "59e71e3b3bb2958e4cfc67897f6a895b", "sha256": "79d95df40c776448b4e90e4bf2611e8de294384c32bb28fbc765c6cf4d79b39c" }, "downloads": -1, "filename": "certidude-0.1.17.tar.gz", "has_sig": false, "md5_digest": "59e71e3b3bb2958e4cfc67897f6a895b", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 62475, "upload_time": "2015-08-13T08:10:12", "url": "https://files.pythonhosted.org/packages/26/90/72662f37563d6a7a316f70fb77df0a870e912e1665fa53c880a84d0b4906/certidude-0.1.17.tar.gz" } ], "0.1.18": [ { "comment_text": "", "digests": { "md5": "b230cdd93b4adc6a7601450b2b44ba0d", "sha256": "db38484381a9c4b214c06b9a968da563b02aa90776ec8f413a9b822241d06e4d" }, "downloads": -1, "filename": "certidude-0.1.18.tar.gz", "has_sig": false, "md5_digest": "b230cdd93b4adc6a7601450b2b44ba0d", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 67970, "upload_time": "2015-10-18T08:14:58", "url": "https://files.pythonhosted.org/packages/b8/c2/512cf62bf1eefc4806b7b0a53a9f2e73169b944b9cb5f820cd2e4a9797c9/certidude-0.1.18.tar.gz" } ], "0.1.19": [ { "comment_text": "", "digests": { "md5": "49e172194c662b4ad94eb3e178805bf4", "sha256": "e5cec9ec0469306695131f68acd8bef0201176af7ea92b2130032d97cf3bc040" }, "downloads": -1, "filename": "certidude-0.1.19.tar.gz", "has_sig": false, "md5_digest": "49e172194c662b4ad94eb3e178805bf4", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 89048, "upload_time": "2015-11-19T15:54:49", "url": "https://files.pythonhosted.org/packages/b4/23/27e834d675c5886f86f0b56115d2890d6bc8be891113cc7b671158cd5401/certidude-0.1.19.tar.gz" } ], "0.1.21": [ { "comment_text": "", "digests": { "md5": "0c34cb20c21dc55c85384ad7a9ec51ea", "sha256": "43e369acd947fa9863ba807c9d3c2377ca202a0fb5191c32f13962f2716f9f2a" }, "downloads": -1, "filename": "certidude-0.1.21.tar.gz", "has_sig": false, "md5_digest": "0c34cb20c21dc55c85384ad7a9ec51ea", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 189907, "upload_time": "2016-03-29T19:06:46", "url": "https://files.pythonhosted.org/packages/a7/6b/16cf9c5bcf90342c0b3bfb3380f87710121ee588536587a0f21e9cbeb6ee/certidude-0.1.21.tar.gz" } ], "0.1.3": [ { "comment_text": "", "digests": { "md5": "058c4cba1ffa8bdf2df33c1a86c31d57", "sha256": "0a468a72d226cc3a0880c152a0def01fc9a53017cf3f2d9847cabe6a48bb15fa" }, "downloads": -1, "filename": "certidude-0.1.3.tar.gz", "has_sig": false, "md5_digest": "058c4cba1ffa8bdf2df33c1a86c31d57", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28177, "upload_time": "2015-07-26T20:38:50", "url": "https://files.pythonhosted.org/packages/4b/16/0b1104521427056e23eebeb62ea796d8b731acb54c4c5fb1f9362ee8ffce/certidude-0.1.3.tar.gz" } ], "0.1.4": [ { "comment_text": "", "digests": { "md5": "5684b62d1f7c7495ec3544fa011d69e9", "sha256": "e29a85a53b168b54790bc9997cd585fe61cb10b26760437f9182876b9a7094ee" }, "downloads": -1, "filename": "certidude-0.1.4.tar.gz", "has_sig": false, "md5_digest": "5684b62d1f7c7495ec3544fa011d69e9", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28866, "upload_time": "2015-07-27T13:27:02", "url": "https://files.pythonhosted.org/packages/a6/4d/020edf0b0cfe73919e9ecd550b270b47b5468b1eab75b0bed8e37930e155/certidude-0.1.4.tar.gz" } ], "0.1.5": [ { "comment_text": "", "digests": { "md5": "8a532869efb5cb4670a1f49d4f3c27b1", "sha256": "02e5b8afd8b04a74d815ca96c15163355aeafa3155d1329218fa4d07875adac0" }, "downloads": -1, "filename": "certidude-0.1.5.tar.gz", "has_sig": false, "md5_digest": "8a532869efb5cb4670a1f49d4f3c27b1", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28926, "upload_time": "2015-07-27T14:02:44", "url": "https://files.pythonhosted.org/packages/a5/0c/8c3f6c9447b15c4784f0e5e640fcac0bcc10ccce8d44caf05480e27ad46c/certidude-0.1.5.tar.gz" } ], "0.1.6": [ { "comment_text": "", "digests": { "md5": "1872b718ac3cad8f8c483f5ccb69afb6", "sha256": "5827187022de9f26e7ba311159ace2ee9293ef6cf037277af571ecce73804c0c" }, "downloads": -1, "filename": "certidude-0.1.6.tar.gz", "has_sig": false, "md5_digest": "1872b718ac3cad8f8c483f5ccb69afb6", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28985, "upload_time": "2015-07-27T15:00:49", "url": "https://files.pythonhosted.org/packages/29/83/218502bdf635a60253a7d7c4362c08ca90fddceb8fd96e1d01226f0fe92e/certidude-0.1.6.tar.gz" } ], "0.1.7": [ { "comment_text": "", "digests": { "md5": "259341945d44ef03e3ee24f342335820", "sha256": "7fc2086b710e83a79d4387ad60ddefe8b5782e3147ee3226d338a7c25e1ead53" }, "downloads": -1, "filename": "certidude-0.1.7.tar.gz", "has_sig": false, "md5_digest": "259341945d44ef03e3ee24f342335820", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 29190, "upload_time": "2015-07-27T15:49:01", "url": "https://files.pythonhosted.org/packages/aa/0a/4280c96954ce5fec7ebdb0adfb5371490670d624d950bdfe4ca4d353a9c6/certidude-0.1.7.tar.gz" } ], "0.1.8": [ { "comment_text": "", "digests": { "md5": "43b3e80870baebda5c5a5da8071ae33b", "sha256": "9ee67d8df275669e7b8019f490e3731f9721f75097db8fd70fb1b17fc092cebd" }, "downloads": -1, "filename": "certidude-0.1.8.tar.gz", "has_sig": false, "md5_digest": "43b3e80870baebda5c5a5da8071ae33b", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 60616, "upload_time": "2015-07-29T16:11:31", "url": "https://files.pythonhosted.org/packages/fd/c2/5a68713cd417f1ffc2c7f9349e4b4f1a8f9c10e1d067241635b75cafe659/certidude-0.1.8.tar.gz" } ], "0.1.9": [ { "comment_text": "", "digests": { "md5": "c5a8c93f7dd620d4cc1af2c8e35d244c", "sha256": "9b99e272705de7f236018484eb1de2a631a3974d4a38ad218848aaba7df3003e" }, "downloads": -1, "filename": "certidude-0.1.9.tar.gz", "has_sig": false, "md5_digest": "c5a8c93f7dd620d4cc1af2c8e35d244c", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 31241, "upload_time": "2015-07-29T19:11:29", "url": "https://files.pythonhosted.org/packages/68/ba/26862edfebe2af0e5b8c43bedbd2f70fe96d27437f0a4fb9a3601b01ac55/certidude-0.1.9.tar.gz" } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "0c34cb20c21dc55c85384ad7a9ec51ea", "sha256": "43e369acd947fa9863ba807c9d3c2377ca202a0fb5191c32f13962f2716f9f2a" }, "downloads": -1, "filename": "certidude-0.1.21.tar.gz", "has_sig": false, "md5_digest": "0c34cb20c21dc55c85384ad7a9ec51ea", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 189907, "upload_time": "2016-03-29T19:06:46", "url": "https://files.pythonhosted.org/packages/a7/6b/16cf9c5bcf90342c0b3bfb3380f87710121ee588536587a0f21e9cbeb6ee/certidude-0.1.21.tar.gz" } ] }