/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
1
#!/bin/sh -e
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
2
# 
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
3
# Mandos key generator - create a new OpenPGP key for a Mandos client
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
4
# 
5
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
6
# 
7
# This program is free software: you can redistribute it and/or modify
8
# it under the terms of the GNU General Public License as published by
9
# the Free Software Foundation, either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
#     This program is distributed in the hope that it will be useful,
13
#     but WITHOUT ANY WARRANTY; without even the implied warranty of
14
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15
#     GNU General Public License for more details.
16
# 
17
# You should have received a copy of the GNU General Public License
18
# along with this program.  If not, see <http://www.gnu.org/licenses/>.
19
# 
20
# Contact the authors at <mandos@fukt.bsnet.se>.
21
# 
22
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
23
VERSION="1.0"
24
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
25
KEYDIR="/etc/mandos"
26
KEYTYPE=DSA
27
KEYLENGTH=1024
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
28
SUBKEYTYPE=ELG-E
29
SUBKEYLENGTH=2048
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
30
KEYNAME="`hostname --fqdn`"
31
KEYEMAIL=""
32
KEYCOMMENT="Mandos client key"
33
KEYEXPIRE=0
34
FORCE=no
35
KEYCOMMENT_ORIG="$KEYCOMMENT"
36
37
# Parse options
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
38
TEMP=`getopt --options vhd:t:l:n:e:c:x:f \
39
    --longoptions version,help,dir:,type:,length:,name:,email:,comment:,expire:,force \
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
40
    --name "$0" -- "$@"`
41
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
42
help(){
43
cat <<EOF
44
Usage: `basename $0` [options]
45
46
Options:
47
  -v, --version         Show program's version number and exit
48
  -h, --help            Show this help message and exit
49
  -d DIR, --dir DIR     Target directory for key files
50
  -t TYPE, --type TYPE  Key type.  Default is DSA.
51
  -l BITS, --length BITS
52
                        Key length in bits.  Default is 1024.
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
53
  -s TYPE, --subtype TYPE
54
                        Subkey type.  Default is ELG-E.
55
  -L BITS, --sublength BITS
56
                        Subkey length in bits.  Default is 2048.
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
57
  -n NAME, --name NAME  Name of key.  Default is the FQDN.
58
  -e EMAIL, --email EMAIL
59
                        Email address of key.  Default is empty.
60
  -c COMMENT, --comment COMMENT
61
                        Comment field for key.  The default value is
62
                        "Mandos client key".
63
  -x TIME, --expire TIME
64
                        Key expire time.  Default is no expiration.
65
                        See gpg(1) for syntax.
66
  -f, --force           Force overwriting old keys.
67
EOF
68
}
69
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
70
eval set -- "$TEMP"
71
while :; do
72
    case "$1" in
73
	-d|--dir) KEYDIR="$2"; shift 2;;
74
	-t|--type) KEYTYPE="$2"; shift 2;;
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
75
	-s|--subtype) SUBKEYTYPE="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
76
	-l|--length) KEYLENGTH="$2"; shift 2;;
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
77
	-L|--sublength) SUBKEYLENGTH="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
78
	-n|--name) KEYNAME="$2"; shift 2;;
79
	-e|--email) KEYEMAIL="$2"; shift 2;;
80
	-c|--comment) KEYCOMMENT="$2"; shift 2;;
87 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages in "plugins.d".
81
	-x|--expire) KEYEXPIRE="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
82
	-f|--force) FORCE=yes; shift;;
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
83
	-v|--version) echo "$0 $VERSION"; exit;;
84
	-h|--help) help; exit;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
85
	--) shift; break;;
86
	*) echo "Internal error" >&2; exit 1;;
87
    esac
88
done
89
if [ "$#" -gt 0 ]; then
90
    echo "Unknown arguments: '$@'" >&2
91
    exit 1
92
fi
93
94
SECKEYFILE="$KEYDIR/seckey.txt"
95
PUBKEYFILE="$KEYDIR/pubkey.txt"
96
97
# Check for some invalid values
98
if [ -d "$KEYDIR" ]; then :; else
99
    echo "$KEYDIR not a directory" >&2
100
    exit 1
101
fi
102
if [ -w "$KEYDIR" ]; then :; else
103
    echo "Directory $KEYDIR not writeable" >&2
104
    exit 1
105
fi
106
107
if [ -z "$KEYTYPE" ]; then
108
    echo "Empty key type" >&2
109
    exit 1
110
fi
111
112
if [ -z "$KEYNAME" ]; then
113
    echo "Empty key name" >&2
114
    exit 1
115
fi
116
117
if [ -z "$KEYLENGTH" ] || [ "$KEYLENGTH" -lt 512 ]; then
118
    echo "Invalid key length" >&2
119
    exit 1
120
fi
121
122
if [ -z "$KEYEXPIRE" ]; then
123
    echo "Empty key expiration" >&2
124
    exit 1
125
fi
126
127
# Make FORCE be 0 or 1
128
case "$FORCE" in
129
    [Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) FORCE=1;;
130
    [Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
131
esac
132
133
if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
134
    && [ "$FORCE" -eq 0 ]; then
135
    echo "Refusing to overwrite old key files; use --force" >&2
136
    exit 1
137
fi
138
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
139
# Set lines for GnuPG batch file
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
140
if [ -n "$KEYCOMMENT" ]; then
141
    KEYCOMMENTLINE="Name-Comment: $KEYCOMMENT"
142
fi
143
if [ -n "$KEYEMAIL" ]; then
144
    KEYEMAILLINE="Name-Email: $KEYEMAIL"
145
fi
146
147
# Create temp files
148
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
149
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
150
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
151
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
152
# Remove temporary files on exit
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
153
trap "
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
154
set +e; \
155
rm --force $PUBRING $BATCHFILE; \
156
shred --remove $SECRING; \
157
stty echo; \
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
158
" EXIT
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
159
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
160
# Create batch file for GnuPG
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
161
cat >"$BATCHFILE" <<EOF
162
Key-Type: $KEYTYPE
163
Key-Length: $KEYLENGTH
164
#Key-Usage: encrypt,sign,auth
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
165
Subkey-Type: $SUBKEYTYPE
166
Subkey-Length: $SUBKEYLENGTH
167
#Subkey-Usage: encrypt,sign,auth
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
168
Name-Real: $KEYNAME
169
$KEYCOMMENTLINE
170
$KEYEMAILLINE
171
Expire-Date: $KEYEXPIRE
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
172
#Preferences: <string>
173
#Handle: <no-spaces>
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
174
%pubring $PUBRING
175
%secring $SECRING
176
%commit
177
EOF
178
179
umask 027
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
180
181
# Generate a new key in the key rings
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
182
gpg --no-random-seed-file --quiet --batch --no-tty \
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
183
    --no-default-keyring --no-options --enable-dsa2 \
70 by Teddy Hogeborn
* initramfs-tools-hook (gpg): Added "--no-random-seed-file" and
184
    --secret-keyring "$SECRING" --keyring "$PUBRING" \
185
    --gen-key "$BATCHFILE"
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
186
rm --force "$BATCHFILE"
187
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
188
# Backup any old key files
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
189
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
190
    2>/dev/null; then
191
    shred --remove "$SECKEYFILE"
192
fi
193
if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \
194
    2>/dev/null; then
195
    rm --force "$PUBKEYFILE"
196
fi
197
198
FILECOMMENT="Mandos client key for $KEYNAME"
199
if [ "$KEYCOMMENT" != "$KEYCOMMENT_ORIG" ]; then
200
    FILECOMMENT="$FILECOMMENT ($KEYCOMMENT)"
201
fi
202
203
if [ -n "$KEYEMAIL" ]; then
204
    FILECOMMENT="$FILECOMMENT <$KEYEMAIL>"
205
fi
206
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
207
# Export keys from key rings to key files
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
208
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
209
    --no-default-keyring --no-options --enable-dsa2 \
210
    --secret-keyring "$SECRING" --keyring "$PUBRING" \
211
    --export-options export-minimal --comment "$FILECOMMENT" \
212
    --output "$SECKEYFILE" --export-secret-keys
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
213
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
214
    --no-default-keyring --no-options --enable-dsa2 \
215
    --secret-keyring "$SECRING" --keyring "$PUBRING" \
216
    --export-options export-minimal --comment "$FILECOMMENT" \
217
    --output "$PUBKEYFILE" --export
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
218
219
trap - EXIT
220
221
# Remove the key rings
222
shred --remove "$SECRING"
223
rm --force "$PUBRING"