3
# Mandos key generator - create a new OpenPGP key for a Mandos client
5
# Copyright © 2007-2008 Teddy Hogeborn & Björn Påhlsson
7
# This program is free software: you can redistribute it and/or modify
8
# it under the terms of the GNU General Public License as published by
9
# the Free Software Foundation, either version 3 of the License, or
10
# (at your option) any later version.
12
# This program is distributed in the hope that it will be useful,
13
# but WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
17
# You should have received a copy of the GNU General Public License
18
# along with this program. If not, see <http://www.gnu.org/licenses/>.
20
# Contact the authors at <mandos@fukt.bsnet.se>.
30
KEYNAME="`hostname --fqdn`"
32
KEYCOMMENT="Mandos client key"
35
KEYCOMMENT_ORIG="$KEYCOMMENT"
38
TEMP=`getopt --options vhd:t:l:n:e:c:x:f \
39
--longoptions version,help,dir:,type:,length:,name:,email:,comment:,expire:,force \
44
Usage: `basename $0` [options]
47
-v, --version Show program's version number and exit
48
-h, --help Show this help message and exit
49
-d DIR, --dir DIR Target directory for key files
50
-t TYPE, --type TYPE Key type. Default is DSA.
51
-l BITS, --length BITS
52
Key length in bits. Default is 1024.
53
-s TYPE, --subtype TYPE
54
Subkey type. Default is ELG-E.
55
-L BITS, --sublength BITS
56
Subkey length in bits. Default is 2048.
57
-n NAME, --name NAME Name of key. Default is the FQDN.
58
-e EMAIL, --email EMAIL
59
Email address of key. Default is empty.
60
-c COMMENT, --comment COMMENT
61
Comment field for key. The default value is
63
-x TIME, --expire TIME
64
Key expire time. Default is no expiration.
65
See gpg(1) for syntax.
66
-f, --force Force overwriting old keys.
73
-d|--dir) KEYDIR="$2"; shift 2;;
74
-t|--type) KEYTYPE="$2"; shift 2;;
75
-s|--subtype) SUBKEYTYPE="$2"; shift 2;;
76
-l|--length) KEYLENGTH="$2"; shift 2;;
77
-L|--sublength) SUBKEYLENGTH="$2"; shift 2;;
78
-n|--name) KEYNAME="$2"; shift 2;;
79
-e|--email) KEYEMAIL="$2"; shift 2;;
80
-c|--comment) KEYCOMMENT="$2"; shift 2;;
81
-x|--expire) KEYEXPIRE="$2"; shift 2;;
82
-f|--force) FORCE=yes; shift;;
83
-v|--version) echo "$0 $VERSION"; exit;;
84
-h|--help) help; exit;;
86
*) echo "Internal error" >&2; exit 1;;
89
if [ "$#" -gt 0 ]; then
90
echo "Unknown arguments: '$@'" >&2
94
SECKEYFILE="$KEYDIR/seckey.txt"
95
PUBKEYFILE="$KEYDIR/pubkey.txt"
97
# Check for some invalid values
98
if [ -d "$KEYDIR" ]; then :; else
99
echo "$KEYDIR not a directory" >&2
102
if [ -w "$KEYDIR" ]; then :; else
103
echo "Directory $KEYDIR not writeable" >&2
107
if [ -z "$KEYTYPE" ]; then
108
echo "Empty key type" >&2
112
if [ -z "$KEYNAME" ]; then
113
echo "Empty key name" >&2
117
if [ -z "$KEYLENGTH" ] || [ "$KEYLENGTH" -lt 512 ]; then
118
echo "Invalid key length" >&2
122
if [ -z "$KEYEXPIRE" ]; then
123
echo "Empty key expiration" >&2
127
# Make FORCE be 0 or 1
129
[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) FORCE=1;;
130
[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
133
if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
134
&& [ "$FORCE" -eq 0 ]; then
135
echo "Refusing to overwrite old key files; use --force" >&2
139
# Set lines for GnuPG batch file
140
if [ -n "$KEYCOMMENT" ]; then
141
KEYCOMMENTLINE="Name-Comment: $KEYCOMMENT"
143
if [ -n "$KEYEMAIL" ]; then
144
KEYEMAILLINE="Name-Email: $KEYEMAIL"
148
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
149
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
150
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
152
# Remove temporary files on exit
155
rm --force $PUBRING $BATCHFILE; \
156
shred --remove $SECRING; \
160
# Create batch file for GnuPG
161
cat >"$BATCHFILE" <<EOF
163
Key-Length: $KEYLENGTH
164
#Key-Usage: encrypt,sign,auth
165
Subkey-Type: $SUBKEYTYPE
166
Subkey-Length: $SUBKEYLENGTH
167
#Subkey-Usage: encrypt,sign,auth
171
Expire-Date: $KEYEXPIRE
172
#Preferences: <string>
181
# Generate a new key in the key rings
182
gpg --no-random-seed-file --quiet --batch --no-tty \
183
--no-default-keyring --no-options --enable-dsa2 \
184
--secret-keyring "$SECRING" --keyring "$PUBRING" \
185
--gen-key "$BATCHFILE"
186
rm --force "$BATCHFILE"
188
# Backup any old key files
189
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
191
shred --remove "$SECKEYFILE"
193
if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \
195
rm --force "$PUBKEYFILE"
198
FILECOMMENT="Mandos client key for $KEYNAME"
199
if [ "$KEYCOMMENT" != "$KEYCOMMENT_ORIG" ]; then
200
FILECOMMENT="$FILECOMMENT ($KEYCOMMENT)"
203
if [ -n "$KEYEMAIL" ]; then
204
FILECOMMENT="$FILECOMMENT <$KEYEMAIL>"
207
# Export keys from key rings to key files
208
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
209
--no-default-keyring --no-options --enable-dsa2 \
210
--secret-keyring "$SECRING" --keyring "$PUBRING" \
211
--export-options export-minimal --comment "$FILECOMMENT" \
212
--output "$SECKEYFILE" --export-secret-keys
213
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
214
--no-default-keyring --no-options --enable-dsa2 \
215
--secret-keyring "$SECRING" --keyring "$PUBRING" \
216
--export-options export-minimal --comment "$FILECOMMENT" \
217
--output "$PUBKEYFILE" --export
221
# Remove the key rings
222
shred --remove "$SECRING"
223
rm --force "$PUBRING"
added
removed
mandos-keygen
