35
35
KEYCOMMENT_ORIG="$KEYCOMMENT"
38
if [ ! -d "$KEYDIR" ]; then
39
KEYDIR="/etc/mandos/keys"
39
43
TEMP=`getopt --options vhd:t:l:n:e:c:x:f \
40
44
--longoptions version,help,password,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,force \
108
112
PUBKEYFILE="$KEYDIR/pubkey.txt"
110
114
# Check for some invalid values
111
if [ -d "$KEYDIR" ]; then :; else
115
if [ ! -d "$KEYDIR" ]; then
112
116
echo "$KEYDIR not a directory" >&2
115
if [ -w "$KEYDIR" ]; then :; else
116
echo "Directory $KEYDIR not writeable" >&2
120
if [ "$mode" = password -a -e "$KEYDIR/trustdb.gpg.lock" ]; then
121
echo "Key directory has locked trustdb; aborting." >&2
119
if [ ! -r "$KEYDIR" ]; then
120
echo "Directory $KEYDIR not readable" >&2
125
124
if [ "$mode" = keygen ]; then
125
if [ ! -w "$KEYDIR" ]; then
126
echo "Directory $KEYDIR not writeable" >&2
126
129
if [ -z "$KEYTYPE" ]; then
127
130
echo "Empty key type" >&2
149
152
[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
152
if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
153
&& [ "$FORCE" -eq 0 ]; then
155
if [ \( -e "$SECKEYFILE" -o -e "$PUBKEYFILE" \) \
156
-a "$FORCE" -eq 0 ]; then
154
157
echo "Refusing to overwrite old key files; use --force" >&2
166
169
# Create temporary gpg batch file
167
BATCHFILE="`mktemp -t mandos-gpg-batch.XXXXXXXXXX`"
170
BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"
170
173
if [ "$mode" = password ]; then
171
174
# Create temporary encrypted password file
172
SECFILE="`mktemp -t mandos-gpg-secfile.XXXXXXXXXX`"
175
# Create temporary key rings
176
SECRING="`mktemp -t mandos-gpg-secring.XXXXXXXXXX`"
177
PUBRING="`mktemp -t mandos-gpg-pubring.XXXXXXXXXX`"
179
if [ "$mode" = password ]; then
180
# If a trustdb.gpg file does not already exist, schedule it for
181
# deletion when we are done.
182
if ! [ -e "$KEYDIR/trustdb.gpg" ]; then
183
TRUSTDB="$KEYDIR/trustdb.gpg"
175
SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"
178
# Create temporary key ring directory
179
RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"
187
181
# Remove temporary files on exit
190
rm --force $PUBRING ${PUBRING}~ $BATCHFILE $TRUSTDB; \
191
shred --remove $SECRING $SECFILE; \
184
test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \
185
shred --remove \"$RINGDIR\"/sec*;
186
test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \
187
rm --recursive --force \"$RINGDIR\";
197
193
if [ "$mode" = keygen ]; then
198
194
# Create batch file for GnuPG
209
205
Expire-Date: $KEYEXPIRE
210
206
#Preferences: <string>
211
207
#Handle: <no-spaces>
208
#%pubring pubring.gpg
209
#%secring secring.gpg
217
213
# Generate a new key in the key rings
218
gpg --no-random-seed-file --quiet --batch --no-tty \
219
--no-default-keyring --no-options --enable-dsa2 \
220
--secret-keyring "$SECRING" --keyring "$PUBRING" \
214
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
215
--homedir "$RINGDIR" --trust-model always \
221
216
--gen-key "$BATCHFILE"
222
217
rm --force "$BATCHFILE"
224
219
# Backup any old key files
225
220
if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
226
221
2>/dev/null; then
243
238
# Export keys from key rings to key files
244
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
245
--no-default-keyring --no-options --enable-dsa2 \
246
--secret-keyring "$SECRING" --keyring "$PUBRING" \
247
--export-options export-minimal --comment "$FILECOMMENT" \
248
--output "$SECKEYFILE" --export-secret-keys
249
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
250
--no-default-keyring --no-options --enable-dsa2 \
251
--secret-keyring "$SECRING" --keyring "$PUBRING" \
252
--export-options export-minimal --comment "$FILECOMMENT" \
253
--output "$PUBKEYFILE" --export
239
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
240
--homedir "$RINGDIR" --armor --export-options export-minimal \
241
--comment "$FILECOMMENT" --output "$SECKEYFILE" \
243
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
244
--homedir "$RINGDIR" --armor --export-options export-minimal \
245
--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export
256
248
if [ "$mode" = password ]; then
257
249
# Import keys into temporary key rings
258
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
259
--no-default-keyring --no-options --enable-dsa2 \
260
--homedir "$KEYDIR" --no-permission-warning \
261
--secret-keyring "$SECRING" --keyring "$PUBRING" \
262
--trust-model always --import "$SECKEYFILE"
263
gpg --no-random-seed-file --quiet --batch --no-tty --armor \
264
--no-default-keyring --no-options --enable-dsa2 \
265
--homedir "$KEYDIR" --no-permission-warning \
266
--secret-keyring "$SECRING" --keyring "$PUBRING" \
267
--trust-model always --import "$PUBKEYFILE"
250
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
251
--homedir "$RINGDIR" --trust-model always --armor \
252
--import "$SECKEYFILE"
253
gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
254
--homedir "$RINGDIR" --trust-model always --armor \
255
--import "$PUBKEYFILE"
269
257
# Get fingerprint of key
270
FINGERPRINT="`gpg --no-random-seed-file --quiet --batch --no-tty \
271
--armor --no-default-keyring --no-options --enable-dsa2 \
272
--homedir \"$KEYDIR\" --no-permission-warning \
273
--secret-keyring \"$SECRING\" --keyring \"$PUBRING\" \
274
--trust-model always --fingerprint --with-colons \
275
| sed -n -e '/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
258
FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \
259
--enable-dsa2 --homedir \"$RINGDIR\" --trust-model always \
260
--fingerprint --with-colons \
262
--expression='/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
277
264
test -n "$FINGERPRINT"
282
269
echo -n "Enter passphrase: " >&2
284
| gpg --no-random-seed-file --batch --no-tty --armor \
285
--no-default-keyring --no-options --enable-dsa2 \
286
--homedir "$KEYDIR" --no-permission-warning \
287
--secret-keyring "$SECRING" --keyring "$PUBRING" \
288
--trust-model always --encrypt --recipient "$FINGERPRINT" \
289
--comment "$FILECOMMENT" \
270
head --lines=1 | tr --delete '\n' \
271
| gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
272
--homedir "$RINGDIR" --trust-model always --armor --encrypt \
273
--recipient "$FINGERPRINT" --comment "$FILECOMMENT" \
316
300
shred --remove "$SECFILE"
318
302
# Remove the key rings
319
shred --remove "$SECRING"
320
rm --force "$PUBRING" "${PUBRING}~"
321
# Remove the trustdb, if one did not exist when we started
322
if [ -n "$TRUSTDB" ]; then
323
rm --force "$TRUSTDB"
303
shred --remove "$RINGDIR"/sec*
304
rm --recursive --force "$RINGDIR"
added
removed
mandos-keygen
