35
35
KEYCOMMENT_ORIG="$KEYCOMMENT"
38
if [ ! -d "$KEYDIR" ]; then
39
KEYDIR="/etc/mandos/keys"
43
39
TEMP=`getopt --options vhd:t:l:n:e:c:x:f \
44
40
--longoptions version,help,password,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,force \
112
108
PUBKEYFILE="$KEYDIR/pubkey.txt"
114
110
# Check for some invalid values
115
if [ ! -d "$KEYDIR" ]; then
111
if [ -d "$KEYDIR" ]; then :; else
116
112
echo "$KEYDIR not a directory" >&2
119
if [ ! -r "$KEYDIR" ]; then
120
echo "Directory $KEYDIR not readable" >&2
115
if [ -w "$KEYDIR" ]; then :; else
116
echo "Directory $KEYDIR not writeable" >&2
120
if [ "$mode" = password -a -e "$KEYDIR/trustdb.gpg.lock" ]; then
121
echo "Key directory has locked trustdb; aborting." >&2
124
125
if [ "$mode" = keygen ]; then
125
if [ ! -w "$KEYDIR" ]; then
126
echo "Directory $KEYDIR not writeable" >&2
129
126
if [ -z "$KEYTYPE" ]; then
130
127
echo "Empty key type" >&2
152
149
[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
155
if [ \( -e "$SECKEYFILE" -o -e "$PUBKEYFILE" \) \
156
-a "$FORCE" -eq 0 ]; then
152
if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
153
&& [ "$FORCE" -eq 0 ]; then
157
154
echo "Refusing to overwrite old key files; use --force" >&2
169
166
# Create temporary gpg batch file
170
BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"
167
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
173
170
if [ "$mode" = password ]; then
174
171
# Create temporary encrypted password file
175
SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"
178
# Create temporary key ring directory
179
RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"
172
SECFILE="`mktemp -t mandos-gpg-secfile.XXXXXXXXXX`"
175
# Create temporary key rings
176
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
177
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
179
if [ "$mode" = password ]; then
180
# If a trustdb.gpg file does not already exist, schedule it for
181
# deletion when we are done.
182
if ! [ -e "$KEYDIR/trustdb.gpg" ]; then
183
TRUSTDB="$KEYDIR/trustdb.gpg"
181
187
# Remove temporary files on exit
184
test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \
185
shred --remove \"$RINGDIR\"/sec*;
186
test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \
187
rm --recursive --force \"$RINGDIR\";
190
rm --force $PUBRING ${PUBRING}~ $BATCHFILE $TRUSTDB; \
191
shred --remove $SECRING $SECFILE; \
193
197
if [ "$mode" = keygen ]; then
194
198
# Create batch file for GnuPG
205
209
Expire-Date: $KEYEXPIRE
206
210
#Preferences: <string>
207
211
#Handle: <no-spaces>
208
#%pubring pubring.gpg
209
#%secring secring.gpg
213
217
# Generate a new key in the key rings
214
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
215
--homedir "$RINGDIR" --trust-model always \
218
gpg --no-random-seed-file --quiet --batch --no-tty \
219
--no-default-keyring --no-options --enable-dsa2 \
220
--secret-keyring "$SECRING" --keyring "$PUBRING" \
216
221
--gen-key "$BATCHFILE"
217
222
rm --force "$BATCHFILE"
219
224
# Backup any old key files
220
225
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
221
226
2>/dev/null; then
238
243
# Export keys from key rings to key files
239
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
240
--homedir "$RINGDIR" --armor --export-options export-minimal \
241
--comment "$FILECOMMENT" --output "$SECKEYFILE" \
243
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
244
--homedir "$RINGDIR" --armor --export-options export-minimal \
245
--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export
244
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
245
--no-default-keyring --no-options --enable-dsa2 \
246
--secret-keyring "$SECRING" --keyring "$PUBRING" \
247
--export-options export-minimal --comment "$FILECOMMENT" \
248
--output "$SECKEYFILE" --export-secret-keys
249
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
250
--no-default-keyring --no-options --enable-dsa2 \
251
--secret-keyring "$SECRING" --keyring "$PUBRING" \
252
--export-options export-minimal --comment "$FILECOMMENT" \
253
--output "$PUBKEYFILE" --export
248
256
if [ "$mode" = password ]; then
249
257
# Import keys into temporary key rings
250
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
251
--homedir "$RINGDIR" --trust-model always --armor \
252
--import "$SECKEYFILE"
253
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
254
--homedir "$RINGDIR" --trust-model always --armor \
255
--import "$PUBKEYFILE"
258
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
259
--no-default-keyring --no-options --enable-dsa2 \
260
--homedir "$KEYDIR" --no-permission-warning \
261
--secret-keyring "$SECRING" --keyring "$PUBRING" \
262
--trust-model always --import "$SECKEYFILE"
263
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
264
--no-default-keyring --no-options --enable-dsa2 \
265
--homedir "$KEYDIR" --no-permission-warning \
266
--secret-keyring "$SECRING" --keyring "$PUBRING" \
267
--trust-model always --import "$PUBKEYFILE"
257
269
# Get fingerprint of key
258
FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \
259
--enable-dsa2 --homedir \"$RINGDIR\" --trust-model always \
260
--fingerprint --with-colons \
262
--expression='/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
270
FINGERPRINT="`gpg --no-random-seed-file --quiet --batch --no-tty \
271
--armor --no-default-keyring --no-options --enable-dsa2 \
272
--homedir \"$KEYDIR\" --no-permission-warning \
273
--secret-keyring \"$SECRING\" --keyring \"$PUBRING\" \
274
--trust-model always --fingerprint --with-colons \
275
| sed -n -e '/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
264
277
test -n "$FINGERPRINT"
269
282
echo -n "Enter passphrase: " >&2
270
head --lines=1 | tr --delete '\n' \
271
| gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
272
--homedir "$RINGDIR" --trust-model always --armor --encrypt \
273
--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
284
| gpg --no-random-seed-file --batch --no-tty --armor \
285
--no-default-keyring --no-options --enable-dsa2 \
286
--homedir "$KEYDIR" --no-permission-warning \
287
--secret-keyring "$SECRING" --keyring "$PUBRING" \
288
--trust-model always --encrypt --recipient "$FINGERPRINT" \
289
--comment "$FILECOMMENT" \
300
316
shred --remove "$SECFILE"
302
318
# Remove the key rings
303
shred --remove "$RINGDIR"/sec*
304
rm --recursive --force "$RINGDIR"
319
shred --remove "$SECRING"
320
rm --force "$PUBRING" "${PUBRING}~"
321
# Remove the trustdb, if one did not exist when we started
322
if [ -n "$TRUSTDB" ]; then
323
rm --force "$TRUSTDB"
added
removed
mandos-keygen
