/mandos/release : revision 237.7.517

To get this branch, use:

bzr branch
http://bzr.recompile.se/loggerhead/mandos/release

« back to all changes in this revision

Viewing changes to mandos-keygen

Committer: Teddy Hogeborn
Date: 2019-02-10 04:20:26 UTC
mto: (237.7.594 trunk)
mto: This revision was merged to the branch mainline in revision 370.
Revision ID: teddy@recompile.se-20190210042026-3ntr3anw5scz07s0

Update copyright year to 2019

* DBUS-API: Update copyright year to 2019.
* debian/copyright: - '' -
* intro.xml: - '' -
* mandos: - '' -
* mandos-clients.conf.xml: - '' -
* mandos-ctl: - '' -
* mandos-ctl.xml: - '' -
* mandos-keygen: - '' -
* mandos-keygen.xml: - '' -
* mandos-monitor: - '' -
* mandos-monitor.xml: - '' -
* mandos.conf.xml: - '' -
* mandos.xml: - '' -
* plugin-runner.xml: - '' -
* plugins.d/askpass-fifo.xml: - '' -
* plugins.d/mandos-client.c: - '' -
* plugins.d/mandos-client.xml: - '' -
* plugins.d/password-prompt.xml: - '' -
* plugins.d/plymouth.xml: - '' -
* plugins.d/splashy.xml: - '' -
* plugins.d/usplash.xml: - '' -

Show diffs side-by-side

added added

removed removed

mandos-keygen

# Contact the authors at <mandos@recompile.se>.

VERSION="1.8.4"

VERSION="1.7.20"

KEYDIR="/etc/keys/mandos"

KEYTYPE=RSA

187

188

# Create temporary gpg batch file

189

BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"

190

TLS_PRIVKEYTMP="`mktemp -t mandos-keygen-privkey.XXXXXXXXXX`"

191

190

192

191

193

192

if [ "$mode" = password ]; then

202

201

trap "

203

202

set +e; \

204

203

test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \

205

test -n \"$TLS_PRIVKEYTMP\" && shred --remove \"$TLS_PRIVKEYTMP\"; \

206

204

shred --remove \"$RINGDIR\"/sec* 2>/dev/null;

207

205

test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \

208

206

rm --recursive --force \"$RINGDIR\";

243

241

echo -n "Started: "

244

242

date

245

243

246

247

# Generate TLS private key

248

if certtool --generate-privkey --password='' \

249

--outfile "$TLS_PRIVKEYTMP" --sec-param ultra \

250

--key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

251

252

# Backup any old key files

253

if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

254

2>/dev/null; then

255

shred --remove "$TLS_PRIVKEYFILE" 2>/dev/null || :

244

245

# Backup any old key files

246

if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

247

2>/dev/null; then

248

shred --remove "$TLS_PRIVKEYFILE"

249

250

if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

251

2>/dev/null; then

252

rm --force "$TLS_PUBKEYFILE"

253

254

255

## Generate TLS private key

256

257

# First try certtool from GnuTLS

258

if ! certtool --generate-privkey --password='' \

259

--outfile "$TLS_PRIVKEYFILE" --sec-param ultra \

260

--key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

261

# Otherwise try OpenSSL

262

if ! openssl genpkey -algorithm X25519 -out \

263

/etc/keys/mandos/tls-privkey.pem; then

264

rm --force /etc/keys/mandos/tls-privkey.pem

265

# None of the commands succeded; give up

266

return 1

256

267

257

if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

258

2>/dev/null; then

268

269

270

## TLS public key

271

272

# First try certtool from GnuTLS

273

if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

274

--outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

275

2>/dev/null; then

276

# Otherwise try OpenSSL

277

if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

278

-out "$TLS_PUBKEYFILE" -pubout; then

259

279

rm --force "$TLS_PUBKEYFILE"

260

261

cp --archive "$TLS_PRIVKEYTMP" "$TLS_PRIVKEYFILE"

262

shred --remove "$TLS_PRIVKEYTMP" 2>/dev/null || :

263

264

## TLS public key

265

266

# First try certtool from GnuTLS

267

if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

268

--outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

269

2>/dev/null; then

270

# Otherwise try OpenSSL

271

if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

272

-out "$TLS_PUBKEYFILE" -pubout; then

273

rm --force "$TLS_PUBKEYFILE"

274

# None of the commands succeded; give up

275

return 1

276

280

# None of the commands succeded; give up

281

return 1

277

282

278

283

279

284

296

301

# Backup any old key files

297

302

if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \

298

303

2>/dev/null; then

299

shred --remove "$SECKEYFILE" 2>/dev/null || :

304

shred --remove "$SECKEYFILE"

300

305

301

306

if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \

302

307

2>/dev/null; then

364

369

365

370

test -n "$FINGERPRINT"

366

371

367

if [ -r "$TLS_PUBKEYFILE" ]; then

368

KEY_ID="$(certtool --key-id --hash=sha256 \

372

KEY_ID="$(certtool --key-id --hash=sha256 \

369

373

--infile="$TLS_PUBKEYFILE" 2>/dev/null || :)"

370

374

371

if [ -z "$KEY_ID" ]; then

372

KEY_ID=$(openssl pkey -pubin -in "$TLS_PUBKEYFILE" \

373

-outform der \

374

| openssl sha256 \

375

| sed --expression='s/^.*[^[:xdigit:]]//')

376

377

test -n "$KEY_ID"

375

if [ -z "$KEY_ID" ]; then

376

KEY_ID=$(openssl pkey -pubin -in /tmp/tls-pubkey.pem \

377

-outform der \

378

| openssl sha256 \

379

| sed --expression='s/^.*[^[:xdigit:]]//')

378

380

381

test -n "$KEY_ID"

379

382

380

383

FILECOMMENT="Encrypted password for a Mandos client"

381

384

416

419

cat <<-EOF

417

420

[$KEYNAME]

418

421

host = $KEYNAME

419

EOF

420

if [ -n "$KEY_ID" ]; then

421

echo "key_id = $KEY_ID"

422

423

cat <<-EOF

422

key_id = $KEY_ID

424

423

fingerprint = $FINGERPRINT

425

424

secret =

426

425

EOF

444

443

set +e

445

444

# Remove the password file, if any

446

445

if [ -n "$SECFILE" ]; then

447

shred --remove "$SECFILE" 2>/dev/null

446

shred --remove "$SECFILE"

448

447

449

448

# Remove the key rings

450

449

shred --remove "$RINGDIR"/sec* 2>/dev/null

Older »