1*a9710349SColin Percival#!/bin/sh 2*a9710349SColin Percival 3*a9710349SColin Percival# KEYWORD: firstboot 4*a9710349SColin Percival# PROVIDE: ec2_setpass 5*a9710349SColin Percival# REQUIRE: ec2_fetchkey 6*a9710349SColin Percival# BEFORE: LOGIN 7*a9710349SColin Percival 8*a9710349SColin Percival# Define ec2_setpass_enable=YES in /etc/rc.conf to enable setting the 9*a9710349SColin Percival# account password and printing in encrypted format to the console. 10*a9710349SColin Percival: ${ec2_setpass_enable=NO} 11*a9710349SColin Percival 12*a9710349SColin Percival# We reuse the user name from ec2_fetchkey since that creates the user 13*a9710349SColin Percival# and fetches the SSH key which is used to encrypt the password. 14*a9710349SColin Percival: ${ec2_fetchkey_user=ec2-user} 15*a9710349SColin Percival 16*a9710349SColin Percival. /etc/rc.subr 17*a9710349SColin Percival 18*a9710349SColin Percivalname="ec2_setpass" 19*a9710349SColin Percivalrcvar=ec2_setpass_enable 20*a9710349SColin Percivalstart_cmd="ec2_setpass_run" 21*a9710349SColin Percivalstop_cmd=":" 22*a9710349SColin Percival 23*a9710349SColin Percivalec2_setpass_run() 24*a9710349SColin Percival{ 25*a9710349SColin Percival 26*a9710349SColin Percival # If the user does not exist or has no SSH key, return. 27*a9710349SColin Percival HOMEDIR=$(pw user show ${ec2_fetchkey_user} 2>/dev/null | awk -F: '{print $9}') 28*a9710349SColin Percival SSHKEYFILE="${HOMEDIR}/.ssh/authorized_keys" 29*a9710349SColin Percival if [ -z "${HOMEDIR}" ] || ! [ -f "${SSHKEYFILE}" ]; then 30*a9710349SColin Percival return 31*a9710349SColin Percival fi 32*a9710349SColin Percival 33*a9710349SColin Percival # Print the RDP certificate fingerprint 34*a9710349SColin Percival echo "HOSTNAME: freebsd" 35*a9710349SColin Percival echo "RDPCERTIFICATE-SUBJECTNAME: freebsd" 36*a9710349SColin Percival FINGERSHA1=$(openssl x509 -in /usr/local/etc/xrdp/cert.pem \ 37*a9710349SColin Percival -noout -fingerprint -sha1 | cut -f 2- -d = | tr -d :) 38*a9710349SColin Percival FINGERSHA256=$(openssl x509 -in /usr/local/etc/xrdp/cert.pem \ 39*a9710349SColin Percival -noout -fingerprint -sha256 | cut -f 2- -d = | tr A-F a-f) 40*a9710349SColin Percival echo "RDPCERTIFICATE-THUMBPRINT: ${FINGERSHA1}" 41*a9710349SColin Percival echo "RDPCERTIFICATE-THUMBPRINT256: ${FINGERSHA256}" 42*a9710349SColin Percival 43*a9710349SColin Percival # Set a random password, and print it in encrypted format 44*a9710349SColin Percival PUBKEY=$(mktemp -t ec2_setpass) 45*a9710349SColin Percival ssh-keygen -e -m PKCS8 -f ${SSHKEYFILE} > ${PUBKEY} 46*a9710349SColin Percival PASSWD=`jot -cr 16 / z | tr '\\`' '-+' | rs -g 0` 47*a9710349SColin Percival echo "${PASSWD}" | pw usermod ${ec2_fetchkey_user} -h 0 48*a9710349SColin Percival echo "Username: ${ec2_fetchkey_user}" 49*a9710349SColin Percival echo "Password: <Password>" 50*a9710349SColin Percival printf "%s" "${PASSWD}" | 51*a9710349SColin Percival openssl pkeyutl -encrypt -pubin -inkey ${PUBKEY} -pkeyopt rsa_padding_mode:pkcs1 | 52*a9710349SColin Percival base64 -w 0 53*a9710349SColin Percival echo "</Password>" 54*a9710349SColin Percival echo 'Message: Windows is Ready to use' 55*a9710349SColin Percival} 56*a9710349SColin Percival 57*a9710349SColin Percivalload_rc_config $name 58*a9710349SColin Percivalrun_rc_command "$1" 59