/mandos/trunk

# Mandos key generator - create new keys for a Mandos client

# 

# Copyright © 2008-2019 Teddy Hogeborn

# Copyright © 2008-2019 Björn Påhlsson

# 

# This file is part of Mandos.

#

# Mandos is free software: you can redistribute it and/or modify it

# under the terms of the GNU General Public License as published by

#     Mandos is distributed in the hope that it will be useful, but

#     WITHOUT ANY WARRANTY; without even the implied warranty of

# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.

VERSION="1.8.17"

TLS_KEYTYPE=ed25519

SSH=yes

TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:T:fS \

    --longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,tls-keytype:,force,no-ssh \

basename="`basename "$0"`"

  -t TYPE, --type TYPE  OpenPGP key type.  Default is RSA.

                        OpenPGP key length in bits.  Default is 4096.

                        OpenPGP subkey type.  Default is RSA.

                        OpenPGP subkey length in bits.  Default 4096.

                        Email address of OpenPGP key.  Default empty.

                        Comment field for OpenPGP key.  Default empty.

                        OpenPGP key expire time.  Default is none.

  -T TYPE, --tls-keytype TYPE

                        TLS key type.  Default is ed25519.

  -S, --no-ssh          Don't get SSH key or set "checker" option.

        -T|--tls-keytype) TLS_KEYTYPE="$2"; shift 2;;

        -S|--no-ssh) SSH=no; shift;;

    echo "Unknown arguments: '$*'" >&2

TLS_PRIVKEYFILE="$KEYDIR/tls-privkey.pem"

TLS_PUBKEYFILE="$KEYDIR/tls-pubkey.pem"

 

 

 

 

 

    if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ] \

             || [ -e "$TLS_PRIVKEYFILE" ] \

             || [ -e "$TLS_PUBKEYFILE" ]; } \

        && [ "$FORCE" -eq 0 ]; then

 

 

    TLS_PRIVKEYTMP="`mktemp -t mandos-keygen-privkey.XXXXXXXXXX`"

test -n \"$TLS_PRIVKEYTMP\" && shred --remove \"$TLS_PRIVKEYTMP\"; \

shred --remove \"$RINGDIR\"/sec* 2>/dev/null;

        %no-protection

 

 

    # Generate TLS private key

    if certtool --generate-privkey --password='' \

                --outfile "$TLS_PRIVKEYTMP" --sec-param ultra \

                --key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

        

        # Backup any old key files

        if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

              2>/dev/null; then

            shred --remove "$TLS_PRIVKEYFILE" 2>/dev/null || :

        fi

        if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

              2>/dev/null; then

            rm --force "$TLS_PUBKEYFILE"

        fi

        cp --archive "$TLS_PRIVKEYTMP" "$TLS_PRIVKEYFILE"

        shred --remove "$TLS_PRIVKEYTMP" 2>/dev/null || :

 

        ## TLS public key

 

        # First try certtool from GnuTLS

        if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

             --outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

             2>/dev/null; then

            # Otherwise try OpenSSL

            if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

                 -out "$TLS_PUBKEYFILE" -pubout; then

                rm --force "$TLS_PUBKEYFILE"

                # None of the commands succeded; give up

                return 1

            fi

        fi

    fi

 

 

 

        shred --remove "$SECKEYFILE" 2>/dev/null || :

 

 

 

 

    # Make SSH be 0 or 1

    case "$SSH" in

        [Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) SSH=1;;

        [Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) SSH=0;;

    esac

 

    if [ $SSH -eq 1 ]; then

        # The -q option is new in OpenSSH 9.8

        for ssh_keyscan_quiet in "-q " ""; do

            for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do

                set +e

                ssh_fingerprint="`ssh-keyscan ${ssh_keyscan_quiet}-t $ssh_keytype localhost 2>/dev/null`"

                err=$?

                set -e

                if [ $err -ne 0 ]; then

                    ssh_fingerprint=""

                    continue

                fi

                if [ -n "$ssh_fingerprint" ]; then

                    ssh_fingerprint="${ssh_fingerprint#localhost }"

                    break 2

                fi

            done

        done

    fi

 

 

        --enable-dsa2 --homedir "$RINGDIR" --trust-model always \

 

 

    if [ -r "$TLS_PUBKEYFILE" ]; then

       KEY_ID="$(certtool --key-id --hash=sha256 \

                       --infile="$TLS_PUBKEYFILE" 2>/dev/null || :)"

 

       if [ -z "$KEY_ID" ]; then

           KEY_ID=$(openssl pkey -pubin -in "$TLS_PUBKEYFILE" \

                            -outform der \

                        | openssl sha256 \

                        | sed --expression='s/^.*[^[:xdigit:]]//')

       fi

       test -n "$KEY_ID"

    fi

 

 

            cat -- "$PASSFILE"

            echo -n "Enter passphrase: " >/dev/tty

            read -r first

            echo -n "Repeat passphrase: " >/dev/tty

            read -r second

                printf "%s" "$first"

 

        EOF

    if [ -n "$KEY_ID" ]; then

        echo "key_id = $KEY_ID"

    fi

    cat <<-EOF

    if [ -n "$ssh_fingerprint" ]; then

        if [ -n "$ssh_keyscan_quiet" ]; then

            echo "# Note: if the Mandos server has OpenSSH older than 9.8, the ${ssh_keyscan_quiet}"

            echo "# option *must* be removed from the 'checker' setting below"

        fi

        echo 'checker = ssh-keyscan '"$ssh_keyscan_quiet"'-t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'

        echo "ssh_fingerprint = ${ssh_fingerprint}"

    fi

    shred --remove "$SECFILE" 2>/dev/null

shred --remove "$RINGDIR"/sec* 2>/dev/null