/mandos/trunk

# Mandos key generator - create new keys for a Mandos client

# 

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

# 

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

VERSION="1.8.7"

KEYTYPE=RSA

KEYLENGTH=4096

SUBKEYTYPE=RSA

SUBKEYLENGTH=4096

KEYCOMMENT=""

TLS_KEYTYPE=ed25519

SSH=yes

TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:T:fS \

    --longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,tls-keytype:,force,no-ssh \

basename="`basename "$0"`"

  -t TYPE, --type TYPE  OpenPGP key type.  Default is RSA.

                        OpenPGP key length in bits.  Default is 4096.

                        OpenPGP subkey type.  Default is RSA.

                        OpenPGP subkey length in bits.  Default 4096.

                        Email address of OpenPGP key.  Default empty.

                        Comment field for OpenPGP key.  Default empty.

                        OpenPGP key expire time.  Default is none.

  -T TYPE, --tls-keytype TYPE

                        TLS key type.  Default is ed25519.

  -S, --no-ssh          Don't get SSH key or set "checker" option.

        -T|--tls-keytype) TLS_KEYTYPE="$2"; shift 2;;

        -S|--no-ssh) SSH=no; shift;;

    echo "Unknown arguments: '$*'" >&2

TLS_PRIVKEYFILE="$KEYDIR/tls-privkey.pem"

TLS_PUBKEYFILE="$KEYDIR/tls-pubkey.pem"

    if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ] \

             || [ -e "$TLS_PRIVKEYFILE" ] \

             || [ -e "$TLS_PUBKEYFILE" ]; } \

        && [ "$FORCE" -eq 0 ]; then

    TLS_PRIVKEYTMP="`mktemp -t mandos-keygen-privkey.XXXXXXXXXX`"

test -n \"$TLS_PRIVKEYTMP\" && shred --remove \"$TLS_PRIVKEYTMP\"; \

shred --remove \"$RINGDIR\"/sec* 2>/dev/null;

        Key-Usage: sign,auth

        Subkey-Usage: encrypt

        %no-protection

 

    # Generate TLS private key

    if certtool --generate-privkey --password='' \

                --outfile "$TLS_PRIVKEYTMP" --sec-param ultra \

                --key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

        

        # Backup any old key files

        if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

              2>/dev/null; then

            shred --remove "$TLS_PRIVKEYFILE" 2>/dev/null || :

        fi

        if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

              2>/dev/null; then

            rm --force "$TLS_PUBKEYFILE"

        fi

        cp --archive "$TLS_PRIVKEYTMP" "$TLS_PRIVKEYFILE"

        shred --remove "$TLS_PRIVKEYTMP" 2>/dev/null || :

 

        ## TLS public key

 

        # First try certtool from GnuTLS

        if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

             --outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

             2>/dev/null; then

            # Otherwise try OpenSSL

            if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

                 -out "$TLS_PUBKEYFILE" -pubout; then

                rm --force "$TLS_PUBKEYFILE"

                # None of the commands succeded; give up

                return 1

            fi

        fi

    fi

    # Make sure trustdb.gpg exists;

    # this is a workaround for Debian bug #737128

    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

        --homedir "$RINGDIR" \

        --import-ownertrust < /dev/null

        shred --remove "$SECKEYFILE" 2>/dev/null || :

    

    # Make SSH be 0 or 1

    case "$SSH" in

        [Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) SSH=1;;

        [Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) SSH=0;;

    esac

    

    if [ $SSH -eq 1 ]; then

        for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do

            set +e

            ssh_fingerprint="`ssh-keyscan -t $ssh_keytype localhost 2>/dev/null`"

            err=$?

            set -e

            if [ $err -ne 0 ]; then

                ssh_fingerprint=""

                continue

            fi

            if [ -n "$ssh_fingerprint" ]; then

                ssh_fingerprint="${ssh_fingerprint#localhost }"

                break

            fi

        done

    fi

    

        --enable-dsa2 --homedir "$RINGDIR" --trust-model always \

    if [ -r "$TLS_PUBKEYFILE" ]; then

       KEY_ID="$(certtool --key-id --hash=sha256 \

                       --infile="$TLS_PUBKEYFILE" 2>/dev/null || :)"

 

       if [ -z "$KEY_ID" ]; then

           KEY_ID=$(openssl pkey -pubin -in "$TLS_PUBKEYFILE" \

                            -outform der \

                        | openssl sha256 \

                        | sed --expression='s/^.*[^[:xdigit:]]//')

       fi

       test -n "$KEY_ID"

    fi

    

            cat -- "$PASSFILE"

            echo -n "Enter passphrase: " >/dev/tty

            read -r first

            echo -n "Repeat passphrase: " >/dev/tty

            read -r second

        EOF

    if [ -n "$KEY_ID" ]; then

        echo "key_id = $KEY_ID"

    fi

    cat <<-EOF

    if [ -n "$ssh_fingerprint" ]; then

        echo 'checker = ssh-keyscan -t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'

        echo "ssh_fingerprint = ${ssh_fingerprint}"

    fi

    shred --remove "$SECFILE" 2>/dev/null

shred --remove "$RINGDIR"/sec* 2>/dev/null