/mandos/trunk : revision 102

24

25

KEYDIR="/etc/mandos"

26

KEYTYPE=DSA

27

KEYLENGTH=2048

27

KEYLENGTH=1024

28

SUBKEYTYPE=ELG-E

29

SUBKEYLENGTH=2048

30

KEYNAME="`hostname --fqdn`"

56

-d DIR, --dir DIR Target directory for key files

57

-t TYPE, --type TYPE Key type. Default is DSA.

58

-l BITS, --length BITS

59

Key length in bits. Default is 2048.

59

Key length in bits. Default is 1024.

60

-s TYPE, --subtype TYPE

61

Subkey type. Default is ELG-E.

62

-L BITS, --sublength BITS

64

-n NAME, --name NAME Name of key. Default is the FQDN.

65

-e ADDRESS, --email ADDRESS

66

Email address of key. Default is empty.

67

-c TEXT, --comment TEXT

67

-c COMMENT, --comment COMMENT

68

Comment field for key. The default value is

69

"Mandos client key".

70

-x TIME, --expire TIME

75

Password creation options:

76

-p, --password Create an encrypted password using the keys in

77

the key directory. All options other than

78

--dir and --name are ignored.

78

--keydir and --name are ignored.

79

EOF

80

}

81

108

PUBKEYFILE="$KEYDIR/pubkey.txt"

109

110

# Check for some invalid values

111

if [ ! -d "$KEYDIR" ]; then

111

if [ -d "$KEYDIR" ]; then :; else

112

echo "$KEYDIR not a directory" >&2

113

exit 1

114

fi

115

if [ ! -r "$KEYDIR" ]; then

116

echo "Directory $KEYDIR not readable" >&2

115

if [ -w "$KEYDIR" ]; then :; else

116

echo "Directory $KEYDIR not writeable" >&2

117

exit 1

118

fi

119

120

if [ "$mode" = password -a -e "$KEYDIR/trustdb.gpg.lock" ]; then

121

echo "Key directory has locked trustdb; aborting." >&2

117

122

exit 1

118

123

fi

119

124

120

125

if [ "$mode" = keygen ]; then

121

if [ ! -w "$KEYDIR" ]; then

122

echo "Directory $KEYDIR not writeable" >&2

123

exit 1

124

fi

125

126

if [ -z "$KEYTYPE" ]; then

126

127

echo "Empty key type" >&2

127

128

exit 1

163

164

fi

164

165

166

# Create temporary gpg batch file

166

BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"

167

BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"

167

168

fi

168

169

170

if [ "$mode" = password ]; then

170

171

# Create temporary encrypted password file

171

SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"

172

fi

173

174

# Create temporary key ring directory

175

RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"

172

SECFILE="`mktemp -t mandos-gpg-secfile.XXXXXXXXXX`"

173

fi

174

175

# Create temporary key rings

176

SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"

177

PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"

178

179

if [ "$mode" = password ]; then

180

# If a trustdb.gpg file does not already exist, schedule it for

181

# deletion when we are done.

182

if ! [ -e "$KEYDIR/trustdb.gpg" ]; then

183

TRUSTDB="$KEYDIR/trustdb.gpg"

184

fi

185

fi

176

186

177

187

# Remove temporary files on exit

178

188

trap "

179

189

set +e; \

180

test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \

181

shred --remove \"$RINGDIR\"/sec*;

182

test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \

183

rm --recursive --force \"$RINGDIR\";

190

rm --force $PUBRING ${PUBRING}~ $BATCHFILE $TRUSTDB; \

191

shred --remove $SECRING $SECFILE; \

184

192

stty echo; \

185

193

" EXIT

186

194

201

209

Expire-Date: $KEYEXPIRE

202

210

#Preferences: <string>

203

211

#Handle: <no-spaces>

204

#%pubring pubring.gpg

205

#%secring secring.gpg

212

%pubring $PUBRING

213

%secring $SECRING

206

214

%commit

207

215

EOF

208

216

209

217

# Generate a new key in the key rings

210

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

211

--homedir "$RINGDIR" --trust-model always \

218

gpg --no-random-seed-file --quiet --batch --no-tty \

219

--no-default-keyring --no-options --enable-dsa2 \

220

--secret-keyring "$SECRING" --keyring "$PUBRING" \

212

221

--gen-key "$BATCHFILE"

213

222

rm --force "$BATCHFILE"

214

223

215

224

# Backup any old key files

216

225

if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \

217

226

2>/dev/null; then

232

241

fi

233

242

234

243

# Export keys from key rings to key files

235

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

236

--homedir "$RINGDIR" --armor --export-options export-minimal \

237

--comment "$FILECOMMENT" --output "$SECKEYFILE" \

238

--export-secret-keys

239

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

240

--homedir "$RINGDIR" --armor --export-options export-minimal \

241

--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export

244

gpg --no-random-seed-file --quiet --batch --no-tty --armor \

245

--no-default-keyring --no-options --enable-dsa2 \

246

--secret-keyring "$SECRING" --keyring "$PUBRING" \

247

--export-options export-minimal --comment "$FILECOMMENT" \

248

--output "$SECKEYFILE" --export-secret-keys

249

gpg --no-random-seed-file --quiet --batch --no-tty --armor \

250

--no-default-keyring --no-options --enable-dsa2 \

251

--secret-keyring "$SECRING" --keyring "$PUBRING" \

252

--export-options export-minimal --comment "$FILECOMMENT" \

253

--output "$PUBKEYFILE" --export

242

254

fi

243

255

244

256

if [ "$mode" = password ]; then

245

257

# Import keys into temporary key rings

246

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

247

--homedir "$RINGDIR" --trust-model always --armor \

248

--import "$SECKEYFILE"

249

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

250

--homedir "$RINGDIR" --trust-model always --armor \

251

--import "$PUBKEYFILE"

252

258

gpg --no-random-seed-file --quiet --batch --no-tty --armor \

259

--no-default-keyring --no-options --enable-dsa2 \

260

--homedir "$KEYDIR" --no-permission-warning \

261

--secret-keyring "$SECRING" --keyring "$PUBRING" \

262

--trust-model always --import "$SECKEYFILE"

263

gpg --no-random-seed-file --quiet --batch --no-tty --armor \

264

--no-default-keyring --no-options --enable-dsa2 \

265

--homedir "$KEYDIR" --no-permission-warning \

266

--secret-keyring "$SECRING" --keyring "$PUBRING" \

267

--trust-model always --import "$PUBKEYFILE"

268

253

269

# Get fingerprint of key

254

FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \

255

--enable-dsa2 --homedir \"$RINGDIR\" --trust-model always \

256

--fingerprint --with-colons \

270

FINGERPRINT="`gpg --no-random-seed-file --quiet --batch --no-tty \

271

--armor --no-default-keyring --no-options --enable-dsa2 \

272

--homedir \"$KEYDIR\" --no-permission-warning \

273

--secret-keyring \"$SECRING\" --keyring \"$PUBRING\" \

274

--trust-model always --fingerprint --with-colons \

257

275

| sed -n -e '/^fpr:/{s/^fpr:.*:\$[0-9A-Z]*\$:\$/\\1/p;q}'`"

258

276

259

277

test -n "$FINGERPRINT"

263

281

stty -echo

264

282

echo -n "Enter passphrase: " >&2

265

283

sed -e '1q' \

266

| gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

267

--homedir "$RINGDIR" --trust-model always --armor --encrypt \

268

--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \

284

| gpg --no-random-seed-file --batch --no-tty --armor \

285

--no-default-keyring --no-options --enable-dsa2 \

286

--homedir "$KEYDIR" --no-permission-warning \

287

--secret-keyring "$SECRING" --keyring "$PUBRING" \

288

--trust-model always --encrypt --recipient "$FINGERPRINT" \

289

--comment "$FILECOMMENT" \

269

290

> "$SECFILE"

270

291

echo >&2

271

292

stty echo

279

300

sed -n -e '

280

301

/^-----BEGIN PGP MESSAGE-----$/,/^-----END PGP MESSAGE-----$/{

281

302

/^$/,${

282

# Remove 24-bit Radix-64 checksum

283

s/=....$//

284

303

# Indent four spaces

285

304

/^[^-]/s/^/ /p

286

305

}

295

314

shred --remove "$SECFILE"

296

315

fi

297

316

# Remove the key rings

298

shred --remove "$RINGDIR"/sec*

299

rm --recursive --force "$RINGDIR"

317

shred --remove "$SECRING"

318

rm --force "$PUBRING" "${PUBRING}~"

319

# Remove the trustdb, if one did not exist when we started

320

if [ -n "$TRUSTDB" ]; then

321

rm --force "$TRUSTDB"

322

fi