Postupak za sigurnosno kopiranje i vraćanje CA ključeva i certifikata.

#!/bin/bash
# ca-backup.sh - Stvaranje CA sigurnosne kopije
 
BACKUP_DIR="/backup/pki/$(date +%Y%m%d)"
ENCRYPTION_KEY="/etc/pki/backup-key.pem"  # RSA javni ključ za šifriranje
 
mkdir -p "$BACKUP_DIR"
 
# 1. Privatni ključevi (šifrirano)
echo "Spremam privatne ključeve..."
for key in /etc/pki/CA/*.key; do
    keyname=$(basename "$key" .key)
 
    # Šifriranje s AES-256
    openssl enc -aes-256-cbc -salt -pbkdf2 \
        -in "$key" \
        -out "$BACKUP_DIR/${keyname}.key.enc" \
        -pass file:/etc/pki/backup-passphrase.txt
done
 
# 2. Certifikati
echo "Spremam certifikate..."
cp /etc/pki/CA/*.pem "$BACKUP_DIR/"
 
# 3. CA baza podataka
echo "Spremam CA bazu podataka..."
cp /etc/pki/CA/index.txt "$BACKUP_DIR/"
cp /etc/pki/CA/serial "$BACKUP_DIR/"
cp /etc/pki/CA/crlnumber "$BACKUP_DIR/"
 
# 4. Konfiguracija
cp /etc/pki/CA/openssl.cnf "$BACKUP_DIR/"
 
# 5. Izdani certifikati
tar czf "$BACKUP_DIR/issued-certs.tar.gz" /etc/pki/CA/newcerts/
 
# 6. Kontrolne sume
cd "$BACKUP_DIR"
sha256sum * > SHA256SUMS
 
echo "Sigurnosna kopija završena: $BACKUP_DIR"

#!/bin/bash
# hsm-backup.sh - HSM backup ključeva
 
# Luna HSM
/usr/safenet/lunaclient/bin/lunacm << EOF
partition backup
    partition name = ca-partition
    backup file = /backup/hsm/ca-partition-$(date +%Y%m%d).bak
EOF
 
# AWS CloudHSM
aws cloudhsmv2 create-cluster-backup --cluster-id <cluster-id>

#!/bin/bash
# shamir-split.sh - Distribucija ključa na povjerenike
 
KEY_FILE="/etc/pki/CA/root-ca.key"
SHARES=5
THRESHOLD=3
 
# S ssss-split (Shamir's Secret Sharing Scheme)
cat "$KEY_FILE" | ssss-split -t $THRESHOLD -n $SHARES -w root-ca
 
# Rezultat: 5 datoteka (root-ca-1 do root-ca-5)
# Minimalno 3 potrebne za vraćanje
 
echo "Distribucija Shares na povjerenike:"
echo "  Share 1 -> Povjerenik A"
echo "  Share 2 -> Povjerenik B"
echo "  Share 3 -> Povjerenik C"
echo "  Share 4 -> Off-Site sef"
echo "  Share 5 -> HSM Escrow"

#!/bin/bash
# ca-restore.sh - Vraćanje CA iz sigurnosne kopije
 
BACKUP_FILE="$1"
RESTORE_DIR="/etc/pki/CA"
 
if [ -z "$BACKUP_FILE" ]; then
    echo "Uporaba: $0 <backup-file.tar.gz>"
    exit 1
fi
 
echo "=== CA RESTORE ==="
echo "Sigurnosna kopija: $BACKUP_FILE"
read -p "Nastaviti? (da/ne): " confirm
[ "$confirm" != "da" ] && exit 1
 
# 1. Spremanje trenutnog stanja
echo "Spremam trenutno stanje..."
mv "$RESTORE_DIR" "${RESTORE_DIR}.pre-restore-$(date +%Y%m%d%H%M%S)"
 
# 2. Raspakiranje sigurnosne kopije
echo "Raspakiravam sigurnosnu kopiju..."
mkdir -p "$RESTORE_DIR"
tar xzf "$BACKUP_FILE" -C "$RESTORE_DIR" --strip-components=1
 
# 3. Dešifriranje privatnih ključeva
echo "Dešifriram privatne ključeve..."
for enc_key in "$RESTORE_DIR"/*.key.enc; do
    keyname=$(basename "$enc_key" .key.enc)
    openssl enc -aes-256-cbc -d -pbkdf2 \
        -in "$enc_key" \
        -out "$RESTORE_DIR/${keyname}.key" \
        -pass file:/etc/pki/backup-passphrase.txt
    rm "$enc_key"
done
 
# 4. Postavljanje dozvola
chmod 600 "$RESTORE_DIR"/*.key
chmod 644 "$RESTORE_DIR"/*.pem
chown -R root:root "$RESTORE_DIR"
 
# 5. Verifikacija
echo "Verificiram vraćanje..."
for key in "$RESTORE_DIR"/*.key; do
    cert="${key%.key}.pem"
    if [ -f "$cert" ]; then
        key_mod=$(openssl rsa -in "$key" -noout -modulus 2>/dev/null | md5sum)
        cert_mod=$(openssl x509 -in "$cert" -noout -modulus 2>/dev/null | md5sum)
        if [ "$key_mod" = "$cert_mod" ]; then
            echo "OK $(basename "$key"): Key/Cert podudaranje"
        else
            echo "GRESKA $(basename "$key"): NEPODUDARANJE!"
        fi
    fi
done
 
# 6. Pokretanje CA servisa
echo "Pokrećem CA servise..."
systemctl start pki-ca
systemctl start ocsp-responder
 
echo "=== RESTORE ZAVRŠEN ==="

• Key Ceremony - Sigurno generiranje ključeva
• Hitni opoziv - Pri kompromitaciji
• Rad - Svakodnevno održavanje

« <- Disaster Recovery | -> Key Ceremony »

Wolfgang van der Stille @ EMSR DATA d.o.o. - Post-Quantum Cryptography Professional