/mandos/trunk

# Mandos key generator - create new keys for a Mandos client

# 

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

# 

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

VERSION="1.7.20"

KEYTYPE=RSA

KEYLENGTH=4096

SUBKEYTYPE=RSA

SUBKEYLENGTH=4096

KEYCOMMENT=""

TLS_KEYTYPE=ed25519

SSH=yes

TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:T:fS \

    --longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,tls-keytype:,force,no-ssh \

basename="`basename "$0"`"

  -t TYPE, --type TYPE  OpenPGP key type.  Default is RSA.

                        OpenPGP key length in bits.  Default is 4096.

                        OpenPGP subkey type.  Default is RSA.

                        OpenPGP subkey length in bits.  Default 4096.

                        Email address of OpenPGP key.  Default empty.

                        Comment field for OpenPGP key.  Default empty.

                        OpenPGP key expire time.  Default is none.

  -T TYPE, --tls-keytype TYPE

                        TLS key type.  Default is ed25519.

  -S, --no-ssh          Don't get SSH key or set "checker" option.

        -T|--tls-keytype) TLS_KEYTYPE="$2"; shift 2;;

        -S|--no-ssh) SSH=no; shift;;

    echo "Unknown arguments: '$*'" >&2

TLS_PRIVKEYFILE="$KEYDIR/tls-privkey.pem"

TLS_PUBKEYFILE="$KEYDIR/tls-pubkey.pem"

    if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ] \

             || [ -e "$TLS_PRIVKEYFILE" ] \

             || [ -e "$TLS_PUBKEYFILE" ]; } \

        && [ "$FORCE" -eq 0 ]; then

shred --remove \"$RINGDIR\"/sec* 2>/dev/null;

        Key-Usage: sign,auth

        Subkey-Usage: encrypt

        %no-protection

    # Backup any old key files

    if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

        2>/dev/null; then

        shred --remove "$TLS_PRIVKEYFILE"

    fi

    if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

        2>/dev/null; then

        rm --force "$TLS_PUBKEYFILE"

    fi

 

    ## Generate TLS private key

 

    # First try certtool from GnuTLS

    if ! certtool --generate-privkey --password='' \

         --outfile "$TLS_PRIVKEYFILE" --sec-param ultra \

         --key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

        # Otherwise try OpenSSL

        if ! openssl genpkey -algorithm X25519 -out \

             /etc/keys/mandos/tls-privkey.pem; then

            rm --force /etc/keys/mandos/tls-privkey.pem

            # None of the commands succeded; give up

            return 1

        fi

    fi

 

    ## TLS public key

 

    # First try certtool from GnuTLS

    if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

         --outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

         2>/dev/null; then

        # Otherwise try OpenSSL

        if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

             -out "$TLS_PUBKEYFILE" -pubout; then

            rm --force "$TLS_PUBKEYFILE"

            # None of the commands succeded; give up

            return 1

        fi

    fi

    

    # Make sure trustdb.gpg exists;

    # this is a workaround for Debian bug #737128

    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

        --homedir "$RINGDIR" \

        --import-ownertrust < /dev/null

    

    # Make SSH be 0 or 1

    case "$SSH" in

        [Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) SSH=1;;

        [Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) SSH=0;;

    esac

    

    if [ $SSH -eq 1 ]; then

        for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do

            set +e

            ssh_fingerprint="`ssh-keyscan -t $ssh_keytype localhost 2>/dev/null`"

            err=$?

            set -e

            if [ $err -ne 0 ]; then

                ssh_fingerprint=""

                continue

            fi

            if [ -n "$ssh_fingerprint" ]; then

                ssh_fingerprint="${ssh_fingerprint#localhost }"

                break

            fi

        done

    fi

    

        --enable-dsa2 --homedir "$RINGDIR" --trust-model always \

    KEY_ID="$(certtool --key-id --hash=sha256 \

                       --infile="$TLS_PUBKEYFILE" 2>/dev/null || :)"

 

    if [ -z "$KEY_ID" ]; then

        KEY_ID=$(openssl pkey -pubin -in /tmp/tls-pubkey.pem \

                         -outform der \

                     | openssl sha256 \

                     | sed --expression='s/^.*[^[:xdigit:]]//')

    fi

    test -n "$KEY_ID"

    

            echo -n "Enter passphrase: " >/dev/tty

            read -r first

            echo -n "Repeat passphrase: " >/dev/tty

            read -r second

        key_id = $KEY_ID

    if [ -n "$ssh_fingerprint" ]; then

        echo 'checker = ssh-keyscan -t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'

        echo "ssh_fingerprint = ${ssh_fingerprint}"

    fi

shred --remove "$RINGDIR"/sec* 2>/dev/null