35
35
KEYCOMMENT_ORIG="$KEYCOMMENT"
38
39
TEMP=`getopt --options vhd:t:l:n:e:c:x:f \
39
--longoptions version,help,dir:,type:,length:,name:,email:,comment:,expire:,force \
40
--longoptions version,help,password,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,force \
40
41
--name "$0" -- "$@"`
44
basename="`basename $0`"
44
Usage: `basename $0` [options]
46
Usage: $basename [ -v | --version ]
47
$basename [ -h | --help ]
50
Encrypted password creation:
51
$basename { -p | --password } [ --name NAME ] [ --dir DIR]
47
54
-v, --version Show program's version number and exit
48
55
-h, --help Show this help message and exit
49
56
-d DIR, --dir DIR Target directory for key files
50
57
-t TYPE, --type TYPE Key type. Default is DSA.
51
58
-l BITS, --length BITS
52
Key length in bits. Default is 1024.
59
Key length in bits. Default is 2048.
53
60
-s TYPE, --subtype TYPE
54
61
Subkey type. Default is ELG-E.
55
62
-L BITS, --sublength BITS
56
63
Subkey length in bits. Default is 2048.
57
64
-n NAME, --name NAME Name of key. Default is the FQDN.
58
-e EMAIL, --email EMAIL
65
-e ADDRESS, --email ADDRESS
59
66
Email address of key. Default is empty.
60
-c COMMENT, --comment COMMENT
67
-c TEXT, --comment TEXT
61
68
Comment field for key. The default value is
62
69
"Mandos client key".
63
70
-x TIME, --expire TIME
64
71
Key expire time. Default is no expiration.
65
72
See gpg(1) for syntax.
66
73
-f, --force Force overwriting old keys.
75
Password creation options:
76
-p, --password Create an encrypted password using the keys in
77
the key directory. All options other than
78
--dir and --name are ignored.
70
82
eval set -- "$TEMP"
85
-p|--password) mode=password; shift;;
73
86
-d|--dir) KEYDIR="$2"; shift 2;;
74
87
-t|--type) KEYTYPE="$2"; shift 2;;
75
88
-s|--subtype) SUBKEYTYPE="$2"; shift 2;;
95
108
PUBKEYFILE="$KEYDIR/pubkey.txt"
97
110
# Check for some invalid values
98
if [ -d "$KEYDIR" ]; then :; else
111
if [ ! -d "$KEYDIR" ]; then
99
112
echo "$KEYDIR not a directory" >&2
102
if [ -w "$KEYDIR" ]; then :; else
103
echo "Directory $KEYDIR not writeable" >&2
107
if [ -z "$KEYTYPE" ]; then
108
echo "Empty key type" >&2
112
if [ -z "$KEYNAME" ]; then
113
echo "Empty key name" >&2
117
if [ -z "$KEYLENGTH" ] || [ "$KEYLENGTH" -lt 512 ]; then
118
echo "Invalid key length" >&2
122
if [ -z "$KEYEXPIRE" ]; then
123
echo "Empty key expiration" >&2
127
# Make FORCE be 0 or 1
129
[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) FORCE=1;;
130
[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
133
if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
134
&& [ "$FORCE" -eq 0 ]; then
135
echo "Refusing to overwrite old key files; use --force" >&2
139
# Set lines for GnuPG batch file
140
if [ -n "$KEYCOMMENT" ]; then
141
KEYCOMMENTLINE="Name-Comment: $KEYCOMMENT"
143
if [ -n "$KEYEMAIL" ]; then
144
KEYEMAILLINE="Name-Email: $KEYEMAIL"
148
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
149
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
150
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
115
if [ ! -r "$KEYDIR" ]; then
116
echo "Directory $KEYDIR not readable" >&2
120
if [ "$mode" = keygen ]; then
121
if [ ! -w "$KEYDIR" ]; then
122
echo "Directory $KEYDIR not writeable" >&2
125
if [ -z "$KEYTYPE" ]; then
126
echo "Empty key type" >&2
130
if [ -z "$KEYNAME" ]; then
131
echo "Empty key name" >&2
135
if [ -z "$KEYLENGTH" ] || [ "$KEYLENGTH" -lt 512 ]; then
136
echo "Invalid key length" >&2
140
if [ -z "$KEYEXPIRE" ]; then
141
echo "Empty key expiration" >&2
145
# Make FORCE be 0 or 1
147
[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) FORCE=1;;
148
[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
151
if [ \( -e "$SECKEYFILE" -o -e "$PUBKEYFILE" \) \
152
-a "$FORCE" -eq 0 ]; then
153
echo "Refusing to overwrite old key files; use --force" >&2
157
# Set lines for GnuPG batch file
158
if [ -n "$KEYCOMMENT" ]; then
159
KEYCOMMENTLINE="Name-Comment: $KEYCOMMENT"
161
if [ -n "$KEYEMAIL" ]; then
162
KEYEMAILLINE="Name-Email: $KEYEMAIL"
165
# Create temporary gpg batch file
166
BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"
169
if [ "$mode" = password ]; then
170
# Create temporary encrypted password file
171
SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"
174
# Create temporary key ring directory
175
RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"
152
177
# Remove temporary files on exit
155
rm --force $PUBRING $BATCHFILE; \
156
shred --remove $SECRING; \
180
test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \
181
shred --remove \"$RINGDIR\"/sec*;
182
test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \
183
rm --recursive --force \"$RINGDIR\";
160
# Create batch file for GnuPG
161
cat >"$BATCHFILE" <<EOF
163
Key-Length: $KEYLENGTH
164
#Key-Usage: encrypt,sign,auth
165
Subkey-Type: $SUBKEYTYPE
166
Subkey-Length: $SUBKEYLENGTH
167
#Subkey-Usage: encrypt,sign,auth
171
Expire-Date: $KEYEXPIRE
172
#Preferences: <string>
189
if [ "$mode" = keygen ]; then
190
# Create batch file for GnuPG
191
cat >"$BATCHFILE" <<-EOF
193
Key-Length: $KEYLENGTH
194
#Key-Usage: encrypt,sign,auth
195
Subkey-Type: $SUBKEYTYPE
196
Subkey-Length: $SUBKEYLENGTH
197
#Subkey-Usage: encrypt,sign,auth
201
Expire-Date: $KEYEXPIRE
202
#Preferences: <string>
204
#%pubring pubring.gpg
205
#%secring secring.gpg
209
# Generate a new key in the key rings
210
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
211
--homedir "$RINGDIR" --trust-model always \
212
--gen-key "$BATCHFILE"
213
rm --force "$BATCHFILE"
215
# Backup any old key files
216
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
218
shred --remove "$SECKEYFILE"
220
if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \
222
rm --force "$PUBKEYFILE"
225
FILECOMMENT="Mandos client key for $KEYNAME"
226
if [ "$KEYCOMMENT" != "$KEYCOMMENT_ORIG" ]; then
227
FILECOMMENT="$FILECOMMENT ($KEYCOMMENT)"
230
if [ -n "$KEYEMAIL" ]; then
231
FILECOMMENT="$FILECOMMENT <$KEYEMAIL>"
234
# Export keys from key rings to key files
235
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
236
--homedir "$RINGDIR" --armor --export-options export-minimal \
237
--comment "$FILECOMMENT" --output "$SECKEYFILE" \
239
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
240
--homedir "$RINGDIR" --armor --export-options export-minimal \
241
--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export
244
if [ "$mode" = password ]; then
245
# Import keys into temporary key rings
246
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
247
--homedir "$RINGDIR" --trust-model always --armor \
248
--import "$SECKEYFILE"
249
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
250
--homedir "$RINGDIR" --trust-model always --armor \
251
--import "$PUBKEYFILE"
253
# Get fingerprint of key
254
FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \
255
--enable-dsa2 --homedir \"$RINGDIR\" --trust-model always \
256
--fingerprint --with-colons \
258
--expression='/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
260
test -n "$FINGERPRINT"
262
FILECOMMENT="Encrypted password for a Mandos client"
265
echo -n "Enter passphrase: " >&2
266
head --lines=1 | tr --delete '\n' \
267
| gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
268
--homedir "$RINGDIR" --trust-model always --armor --encrypt \
269
--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
277
fingerprint = $FINGERPRINT
181
# Generate a new key in the key rings
182
gpg --no-random-seed-file --quiet --batch --no-tty \
183
--no-default-keyring --no-options --enable-dsa2 \
184
--secret-keyring "$SECRING" --keyring "$PUBRING" \
185
--gen-key "$BATCHFILE"
186
rm --force "$BATCHFILE"
188
# Backup any old key files
189
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
191
shred --remove "$SECKEYFILE"
193
if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \
195
rm --force "$PUBKEYFILE"
198
FILECOMMENT="Mandos client key for $KEYNAME"
199
if [ "$KEYCOMMENT" != "$KEYCOMMENT_ORIG" ]; then
200
FILECOMMENT="$FILECOMMENT ($KEYCOMMENT)"
203
if [ -n "$KEYEMAIL" ]; then
204
FILECOMMENT="$FILECOMMENT <$KEYEMAIL>"
207
# Export keys from key rings to key files
208
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
209
--no-default-keyring --no-options --enable-dsa2 \
210
--secret-keyring "$SECRING" --keyring "$PUBRING" \
211
--export-options export-minimal --comment "$FILECOMMENT" \
212
--output "$SECKEYFILE" --export-secret-keys
213
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
214
--no-default-keyring --no-options --enable-dsa2 \
215
--secret-keyring "$SECRING" --keyring "$PUBRING" \
216
--export-options export-minimal --comment "$FILECOMMENT" \
217
--output "$PUBKEYFILE" --export
280
sed --quiet --expression='
281
/^-----BEGIN PGP MESSAGE-----$/,/^-----END PGP MESSAGE-----$/{
283
# Remove 24-bit Radix-64 checksum
294
# Remove the password file, if any
295
if [ -n "$SECFILE" ]; then
296
shred --remove "$SECFILE"
221
298
# Remove the key rings
222
shred --remove "$SECRING"
223
rm --force "$PUBRING"
299
shred --remove "$RINGDIR"/sec*
300
rm --recursive --force "$RINGDIR"