/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
1
#!/bin/sh
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
2
# This script can be called in the following ways:
3
#
4
# After the package was installed:
5
#       <postinst> configure <old-version>
6
#
7
#
8
# If prerm fails during upgrade or fails on failed upgrade:
9
#       <old-postinst> abort-upgrade <new-version>
10
#
11
# If prerm fails during deconfiguration of a package:
12
#       <postinst> abort-deconfigure in-favour <new-package> <version>
13
#                  removing <old-package> <version>
14
#
15
# If prerm fails during replacement due to conflict:
16
#       <postinst> abort-remove in-favour <new-package> <version>
17
237.7.515 by Teddy Hogeborn
Show debconf note about new TLS key IDs
18
. /usr/share/debconf/confmodule
19
237.11.13 by Teddy Hogeborn
Miscellaneous fixes prompted by lintian:
20
set -e
21
195 by Teddy Hogeborn
* debian/control (mandos, mandos-client): Depend on "adduser".
22
# Update the initial RAM file system image
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
23
update_initramfs()
24
{
237.7.319 by Teddy Hogeborn
Don't use absolute paths to commands in Debian configurations scripts.
25
    update-initramfs -u -k all
258 by Teddy Hogeborn
* debian/mandos-client.postinst: Secure permissions of old
26
    
27
    if dpkg --compare-versions "$2" lt-nl "1.0.10-1"; then
28
        # Make old initrd.img files unreadable too, in case they were
29
        # created with mandos-client 1.0.8 or older.
259 by Teddy Hogeborn
* debian/mandos-client.postinst (update_initramfs): Bug fix: typo.
30
	find /boot -maxdepth 1 -type f -name "initrd.img-*.bak" \
31
	    -print0 | xargs --null --no-run-if-empty chmod o-r
258 by Teddy Hogeborn
* debian/mandos-client.postinst: Secure permissions of old
32
    fi
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
33
}
34
190 by Teddy Hogeborn
* debian/mandos-client.postinst: Use "type" instead of "which". Split
35
# Add user and group
36
add_mandos_user(){
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
37
    # Rename old "mandos" user and group
237.2.111 by Teddy Hogeborn
* debian/mandos-client.postinst (configure): Don't look for user and
38
    if dpkg --compare-versions "$2" lt "1.0.3-1"; then
39
	case "`getent passwd mandos`" in
40
	    *:Mandos\ password\ system,,,:/nonexistent:/bin/false)
41
		usermod --login _mandos mandos
42
		groupmod --new-name _mandos mandos
43
		return
44
		;;
45
	esac
46
    fi
237.2.1 by Teddy Hogeborn
First version of a somewhat complete D-Bus server interface. Also
47
    # Create new user and group
48
    if ! getent passwd _mandos >/dev/null; then
49
	adduser --system --force-badname --quiet --home /nonexistent \
50
	    --no-create-home --group --disabled-password \
51
	    --gecos "Mandos password system" _mandos
190 by Teddy Hogeborn
* debian/mandos-client.postinst: Use "type" instead of "which". Split
52
    fi
53
}
54
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
55
# Create client key pairs
56
create_keys(){
57
    # If the OpenPGP key files do not exist, generate all keys using
58
    # mandos-keygen
59
    if ! [ -r /etc/keys/mandos/pubkey.txt \
60
	      -a -r /etc/keys/mandos/seckey.txt ]; then
61
	mandos-keygen
62
	gpg-connect-agent KILLAGENT /bye || :
63
	return 0
64
    fi
65
237.7.519 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
66
    # Remove any bad TLS keys by 1.8.0-1
67
    if dpkg --compare-versions "$2" eq "1.8.0-1" \
68
       || dpkg --compare-versions "$2" eq "1.8.0-1~bpo9+1"; then
69
	# Is the key bad?
70
	if ! certtool --password='' \
71
	     --load-privkey=/etc/keys/mandos/tls-privkey.pem \
72
	     --outfile=/dev/null --pubkey-info --no-text \
73
	     2>/dev/null; then
74
	    shred --remove -- /etc/keys/mandos/tls-privkey.pem
75
	    rm -- /etc/keys/mandos/tls-pubkey.pem
76
	fi
77
    fi
78
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
79
    # If the TLS keys already exists, do nothing
80
    if [ -r /etc/keys/mandos/tls-privkey.pem \
81
	    -a -r /etc/keys/mandos/tls-pubkey.pem ]; then
82
	return 0
83
    fi
84
237.7.519 by Teddy Hogeborn
Bug fix: Only create TLS key with certtool, and read correct key file
85
    # Try to create the TLS keys
86
87
    TLS_PRIVKEYTMP="`mktemp -t mandos-client-privkey.XXXXXXXXXX`"
88
89
    if certtool --generate-privkey --password='' \
90
		--outfile "$TLS_PRIVKEYTMP" --sec-param ultra \
91
		--key-type=ed25519 --pkcs8 --no-text 2>/dev/null; then
92
93
	local umask=$(umask)
94
	umask 077
95
	cp --archive "$TLS_PRIVKEYTMP" /etc/keys/mandos/tls-privkey.pem
96
	shred --remove -- "$TLS_PRIVKEYTMP"
97
98
	# First try certtool from GnuTLS
99
	if ! certtool --password='' \
100
	     --load-privkey=/etc/keys/mandos/tls-privkey.pem \
101
	     --outfile=/etc/keys/mandos/tls-pubkey.pem --pubkey-info \
102
	     --no-text 2>/dev/null; then
103
	    # Otherwise try OpenSSL
104
	    if ! openssl pkey -in /etc/keys/mandos/tls-privkey.pem \
105
		 -out /etc/keys/mandos/tls-pubkey.pem -pubout; then
106
		rm --force /etc/keys/mandos/tls-pubkey.pem
107
		# None of the commands succeded; give up
108
		umask $umask
109
		return 1
110
	    fi
111
	fi
112
	umask $umask
113
114
	key_id=$(mandos-keygen --passfile=/dev/null \
115
		     | grep --regexp="^key_id[ =]")
116
117
	db_version 2.0
118
	db_fset mandos-client/key_id seen false
119
	db_reset mandos-client/key_id
120
	db_subst mandos-client/key_id key_id $key_id
121
	db_input critical mandos-client/key_id || true
122
	db_go
123
	db_stop
124
    else
125
	shred --remove -- "$TLS_PRIVKEYTMP"
126
    fi
190 by Teddy Hogeborn
* debian/mandos-client.postinst: Use "type" instead of "which". Split
127
}
128
237.7.313 by Teddy Hogeborn
Install client Diffie-Hellman parameters into initramfs.
129
create_dh_params(){
237.7.314 by Teddy Hogeborn
Rename the "client-dhparams.pem" file to simply "dhparams.pem".
130
    if [ -r /etc/keys/mandos/dhparams.pem ]; then
237.7.313 by Teddy Hogeborn
Install client Diffie-Hellman parameters into initramfs.
131
	return 0
132
    fi
133
    # Create a Diffe-Hellman parameters file
134
    DHFILE="`mktemp -t mandos-client-dh-parameters.XXXXXXXXXX.pem`"
135
    # First try certtool from GnuTLS
136
    if ! certtool --generate-dh-params --sec-param high \
137
	 --outfile "$DHFILE"; then
138
	# Otherwise try OpenSSL
139
	if ! openssl genpkey -genparam -algorithm DH -out "$DHFILE" \
140
	     -pkeyopt dh_paramgen_prime_len:3072; then
141
	    # None of the commands succeded; give up
142
	    rm -- "$DHFILE"
143
	    return 1
144
	fi
145
    fi
146
    sed --in-place --expression='0,/^-----BEGIN DH PARAMETERS-----$/d' \
147
	"$DHFILE"
148
    sed --in-place --expression='1i-----BEGIN DH PARAMETERS-----' \
149
	    "$DHFILE"
237.7.314 by Teddy Hogeborn
Rename the "client-dhparams.pem" file to simply "dhparams.pem".
150
    cp --archive "$DHFILE" /etc/keys/mandos/dhparams.pem
237.7.313 by Teddy Hogeborn
Install client Diffie-Hellman parameters into initramfs.
151
    rm -- "$DHFILE"
152
}
153
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
154
case "$1" in
155
    configure)
258 by Teddy Hogeborn
* debian/mandos-client.postinst: Secure permissions of old
156
	add_mandos_user "$@"
237.7.510 by Teddy Hogeborn
Add support for using raw public keys in TLS (RFC 7250)
157
	create_keys "$@"
237.7.313 by Teddy Hogeborn
Install client Diffie-Hellman parameters into initramfs.
158
	create_dh_params "$@" || :
258 by Teddy Hogeborn
* debian/mandos-client.postinst: Secure permissions of old
159
	update_initramfs "$@"
237.7.408 by Teddy Hogeborn
Fix permissions of /etc/mandos/plugin-helpers.
160
	if dpkg --compare-versions "$2" lt-nl "1.7.10-1"; then
237.7.384 by Teddy Hogeborn
Client: Fix permissions on plugin helper directory.
161
	    PLUGINHELPERDIR=/usr/lib/$(dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null)/mandos/plugin-helpers
162
	    if ! dpkg-statoverride --list "$PLUGINHELPERDIR" \
163
		 >/dev/null 2>&1; then
164
		chmod u=rwx,go= -- "$PLUGINHELPERDIR"
165
	    fi
237.7.387 by Teddy Hogeborn
Client: Make plugin helper override directory mode u=rwx,go=
166
	    if ! dpkg-statoverride --list /etc/mandos/plugin-helpers \
167
		 >/dev/null 2>&1; then
168
		chmod u=rwx,go= -- /etc/mandos/plugin-helpers
169
	    fi
237.7.384 by Teddy Hogeborn
Client: Fix permissions on plugin helper directory.
170
	fi
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
171
	;;
172
    abort-upgrade|abort-deconfigure|abort-remove)
173
	;;
174
175
    *)
237.2.38 by Teddy Hogeborn
* debian/mandos-client.postinst: Converted to Bourne shell. Also
176
	echo "$0 called with unknown argument '$1'" 1>&2
185 by Teddy Hogeborn
* .bzr-builddeb/default.conf: New.
177
	exit 1
178
	;;
179
esac
180
181
#DEBHELPER#
182
183
exit 0