/mandos/trunk : revision 958

1

#!/bin/sh -e

2

#

3

# Mandos key generator - create new keys for a Mandos client

3

# Mandos key generator - create a new OpenPGP key for a Mandos client

4

#

5

6

23

# Contact the authors at <mandos@recompile.se>.

24

#

25

26

VERSION="1.7.20"

26

VERSION="1.7.19"

27

28

KEYDIR="/etc/keys/mandos"

29

KEYTYPE=RSA

34

KEYEMAIL=""

35

KEYCOMMENT=""

36

KEYEXPIRE=0

37

TLS_KEYTYPE=ed25519

38

37

FORCE=no

39

38

SSH=yes

40

39

KEYCOMMENT_ORIG="$KEYCOMMENT"

45

44

fi

46

45

47

46

# Parse options

48

TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:T:fS \

49

--longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,tls-keytype:,force,no-ssh \

47

TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:fS \

48

--longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,force,no-ssh \

50

49

--name "$0" -- "$@"`

51

50

52

51

help(){

64

63

-v, --version Show program's version number and exit

65

64

-h, --help Show this help message and exit

66

65

-d DIR, --dir DIR Target directory for key files

67

-t TYPE, --type TYPE OpenPGP key type. Default is RSA.

66

-t TYPE, --type TYPE Key type. Default is RSA.

68

67

-l BITS, --length BITS

69

OpenPGP key length in bits. Default is 4096.

68

Key length in bits. Default is 4096.

70

69

-s TYPE, --subtype TYPE

71

OpenPGP subkey type. Default is RSA.

70

Subkey type. Default is RSA.

72

71

-L BITS, --sublength BITS

73

OpenPGP subkey length in bits. Default 4096.

72

Subkey length in bits. Default is 4096.

74

73

-n NAME, --name NAME Name of key. Default is the FQDN.

75

74

-e ADDRESS, --email ADDRESS

76

Email address of OpenPGP key. Default empty.

75

Email address of key. Default is empty.

77

76

-c TEXT, --comment TEXT

78

Comment field for OpenPGP key. Default empty.

77

Comment field for key. The default is empty.

79

78

-x TIME, --expire TIME

80

OpenPGP key expire time. Default is none.

79

Key expire time. Default is no expiration.

81

80

See gpg(1) for syntax.

82

-T TYPE, --tls-keytype TYPE

83

TLS key type. Default is ed25519.

84

81

-f, --force Force overwriting old key files.

85

82

86

83

Password creation options:

109

106

-e|--email) KEYEMAIL="$2"; shift 2;;

110

107

-c|--comment) KEYCOMMENT="$2"; shift 2;;

111

108

-x|--expire) KEYEXPIRE="$2"; shift 2;;

112

-T|--tls-keytype) TLS_KEYTYPE="$2"; shift 2;;

113

109

-f|--force) FORCE=yes; shift;;

114

110

-S|--no-ssh) SSH=no; shift;;

115

111

-v|--version) echo "$0 $VERSION"; exit;;

125

121

126

122

SECKEYFILE="$KEYDIR/seckey.txt"

127

123

PUBKEYFILE="$KEYDIR/pubkey.txt"

128

TLS_PRIVKEYFILE="$KEYDIR/tls-privkey.pem"

129

TLS_PUBKEYFILE="$KEYDIR/tls-pubkey.pem"

130

124

131

125

# Check for some invalid values

132

126

if [ ! -d "$KEYDIR" ]; then

169

163

[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;

170

164

esac

171

165

172

if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ] \

173

|| [ -e "$TLS_PRIVKEYFILE" ] \

174

|| [ -e "$TLS_PUBKEYFILE" ]; } \

166

if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \

175

167

&& [ "$FORCE" -eq 0 ]; then

176

168

echo "Refusing to overwrite old key files; use --force" >&2

177

169

exit 1

242

234

date

243

235

fi

244

236

245

# Backup any old key files

246

if cp --backup=numbered --force "$TLS_PRIVKEYFILE" "$TLS_PRIVKEYFILE" \

247

2>/dev/null; then

248

shred --remove "$TLS_PRIVKEYFILE"

249

fi

250

if cp --backup=numbered --force "$TLS_PUBKEYFILE" "$TLS_PUBKEYFILE" \

251

2>/dev/null; then

252

rm --force "$TLS_PUBKEYFILE"

253

fi

254

255

## Generate TLS private key

256

257

# First try certtool from GnuTLS

258

if ! certtool --generate-privkey --password='' \

259

--outfile "$TLS_PRIVKEYFILE" --sec-param ultra \

260

--key-type="$TLS_KEYTYPE" --pkcs8 --no-text 2>/dev/null; then

261

# Otherwise try OpenSSL

262

if ! openssl genpkey -algorithm X25519 -out \

263

/etc/keys/mandos/tls-privkey.pem; then

264

rm --force /etc/keys/mandos/tls-privkey.pem

265

# None of the commands succeded; give up

266

return 1

267

fi

268

fi

269

270

## TLS public key

271

272

# First try certtool from GnuTLS

273

if ! certtool --password='' --load-privkey="$TLS_PRIVKEYFILE" \

274

--outfile="$TLS_PUBKEYFILE" --pubkey-info --no-text \

275

2>/dev/null; then

276

# Otherwise try OpenSSL

277

if ! openssl pkey -in "$TLS_PRIVKEYFILE" \

278

-out "$TLS_PUBKEYFILE" -pubout; then

279

rm --force "$TLS_PUBKEYFILE"

280

# None of the commands succeded; give up

281

return 1

282

fi

283

fi

284

285

237

# Make sure trustdb.gpg exists;

286

238

# this is a workaround for Debian bug #737128

287

239

gpg --quiet --batch --no-tty --no-options --enable-dsa2 \

369

321

370

322

test -n "$FINGERPRINT"

371

323

372

KEY_ID="$(certtool --key-id --hash=sha256 \

373

--infile="$TLS_PUBKEYFILE" 2>/dev/null || :)"

374

375

if [ -z "$KEY_ID" ]; then

376

KEY_ID=$(openssl pkey -pubin -in /tmp/tls-pubkey.pem \

377

-outform der \

378

| openssl sha256 \

379

| sed --expression='s/^.*[^[:xdigit:]]//')

380

fi

381

test -n "$KEY_ID"

382

383

324

FILECOMMENT="Encrypted password for a Mandos client"

384

325

385

326

while [ ! -s "$SECFILE" ]; do

419

360

cat <<-EOF

420

361

[$KEYNAME]

421

362

host = $KEYNAME

422

key_id = $KEY_ID

423

363

fingerprint = $FINGERPRINT

424

364

secret =

425

365

EOF