-
-
Save kfoxton/84a1b4e1a8c60ff4d0f785d6eac9be64 to your computer and use it in GitHub Desktop.
Check SMTP server revocation status
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env bash | |
if [ "$#" -eq 0 ]; | |
then | |
echo "pass host to scan" | |
exit 1 | |
fi | |
server=$1 | |
mxserver=`dig mx $server +short 2>/dev/null | tail -1 | cut -d ' ' -f2` | |
if [ -z "$mxserver" ]; | |
then | |
echo "$server [unable to find MX]" | |
exit 2 | |
fi | |
#echo "Host: ${server}" | |
#echo "MX: ${mxserver}" | |
details=$(echo EOF | timeout 3 openssl s_client -CApath /etc/ssl/certs/ -starttls smtp -crlf -showcerts -connect ${mxserver}:25 2>/dev/null) | |
if [ -z "$details" ]; | |
then | |
echo "$server: SSL Timeout" | |
exit 5 | |
fi | |
verify=$(echo "${details}" | grep "Verify return code:" | cut -d ':' -f 2) | |
verifyCode=$(echo ${verify} | cut -d ' ' -f 1) | |
if [ ${verifyCode} != "0" ]; then | |
echo "${verify}" | |
exit 4 | |
fi | |
cert=$(echo "${details}" | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p') | |
crl_url=$(echo "${cert}" | openssl x509 -text | grep crl | cut -d':' -f 2- ) | |
if [ -z "$crl_url" ]; | |
then | |
echo "No CRL_URL found!" | |
exit 3 | |
fi | |
#echo "CRL_URL: ${crl_url}" | |
crl=$(curl -s ${crl_url} | openssl crl -inform der) | |
result=$(echo "${cert}" | openssl verify -crl_check -CAfile <(echo -e "${cert}\n${crl}") | tail -1) | |
result=$(echo "${result}" | cut -d ':' -f 2) | |
echo "${result}" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment