/mandos/release

To get this branch, use:
bzr branch http://bzr.recompile.se/loggerhead/mandos/release
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
1
#!/bin/sh -e
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
2
# 
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
3
# Mandos key generator - create a new OpenPGP key for a Mandos client
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
4
# 
237.7.447 by Teddy Hogeborn
Update copyright year to 2017
5
# Copyright © 2008-2017 Teddy Hogeborn
6
# Copyright © 2008-2017 Björn Påhlsson
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
7
# 
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
8
# This file is part of Mandos.
9
#
10
# Mandos is free software: you can redistribute it and/or modify it
11
# under the terms of the GNU General Public License as published by
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
12
# the Free Software Foundation, either version 3 of the License, or
13
# (at your option) any later version.
14
#
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
15
#     Mandos is distributed in the hope that it will be useful, but
16
#     WITHOUT ANY WARRANTY; without even the implied warranty of
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
17
#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
#     GNU General Public License for more details.
19
# 
20
# You should have received a copy of the GNU General Public License
237.7.455 by Teddy Hogeborn
Alter copyright notices slightly. Actual license is unchanged!
21
# along with Mandos.  If not, see <http://www.gnu.org/licenses/>.
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
22
# 
237.11.2 by Teddy Hogeborn
Change "fukt.bsnet.se" to "recompile.se" throughout.
23
# Contact the authors at <mandos@recompile.se>.
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
24
# 
25
359 by Teddy Hogeborn
* Makefile (version): Change to 1.7.15.
26
VERSION="1.7.15"
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
27
163 by Teddy Hogeborn
* Makefile (PIDDIR, USER, GROUP): Removed.
28
KEYDIR="/etc/keys/mandos"
237.7.169 by Teddy Hogeborn
* debian/mandos-client.README.Debian: Update Linux documentation link.
29
KEYTYPE=RSA
30
KEYLENGTH=4096
31
SUBKEYTYPE=RSA
32
SUBKEYLENGTH=4096
196 by Teddy Hogeborn
* mandos-keygen (KEYNAME): Fall back to plain "hostname" if the
33
KEYNAME="`hostname --fqdn 2>/dev/null || hostname`"
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
34
KEYEMAIL=""
237.7.179 by Teddy Hogeborn
* mandos (priority): Bug fix: Add even more magic to make the old
35
KEYCOMMENT=""
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
36
KEYEXPIRE=0
37
FORCE=no
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
38
SSH=yes
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
39
KEYCOMMENT_ORIG="$KEYCOMMENT"
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
40
mode=keygen
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
41
179 by Teddy Hogeborn
* INSTALL: New file.
42
if [ ! -d "$KEYDIR" ]; then
43
    KEYDIR="/etc/mandos/keys"
44
fi
45
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
46
# Parse options
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
47
TEMP=`getopt --options vhpF:d:t:l:s:L:n:e:c:x:fS \
48
    --longoptions version,help,password,passfile:,dir:,type:,length:,subtype:,sublength:,name:,email:,comment:,expire:,force,no-ssh \
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
49
    --name "$0" -- "$@"`
50
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
51
help(){
237.7.288 by Teddy Hogeborn
mandos-keygen: Fix some stylistic quoting issues.
52
basename="`basename "$0"`"
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
53
cat <<EOF
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
54
Usage: $basename [ -v | --version ]
55
       $basename [ -h | --help ]
56
   Key creation:
57
       $basename [ OPTIONS ]
58
   Encrypted password creation:
59
       $basename { -p | --password } [ --name NAME ] [ --dir DIR]
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
60
       $basename { -F | --passfile } FILE [ --name NAME ] [ --dir DIR]
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
61
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
62
Key creation options:
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
63
  -v, --version         Show program's version number and exit
64
  -h, --help            Show this help message and exit
65
  -d DIR, --dir DIR     Target directory for key files
237.7.169 by Teddy Hogeborn
* debian/mandos-client.README.Debian: Update Linux documentation link.
66
  -t TYPE, --type TYPE  Key type.  Default is RSA.
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
67
  -l BITS, --length BITS
237.7.169 by Teddy Hogeborn
* debian/mandos-client.README.Debian: Update Linux documentation link.
68
                        Key length in bits.  Default is 4096.
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
69
  -s TYPE, --subtype TYPE
237.7.175 by Teddy Hogeborn
* mandos-keygen: Bug fix: Specify key usage to avoid creating keys
70
                        Subkey type.  Default is RSA.
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
71
  -L BITS, --sublength BITS
237.7.169 by Teddy Hogeborn
* debian/mandos-client.README.Debian: Update Linux documentation link.
72
                        Subkey length in bits.  Default is 4096.
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
73
  -n NAME, --name NAME  Name of key.  Default is the FQDN.
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
74
  -e ADDRESS, --email ADDRESS
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
75
                        Email address of key.  Default is empty.
123 by Teddy Hogeborn
* mandos-keygen: Minor help text change.
76
  -c TEXT, --comment TEXT
237.7.179 by Teddy Hogeborn
* mandos (priority): Bug fix: Add even more magic to make the old
77
                        Comment field for key.  The default is empty.
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
78
  -x TIME, --expire TIME
79
                        Key expire time.  Default is no expiration.
80
                        See gpg(1) for syntax.
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
81
  -f, --force           Force overwriting old key files.
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
82
83
Password creation options:
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
84
  -p, --password        Create an encrypted password using the key in
85
                        the key directory.  All options other than
86
                        --dir and --name are ignored.
87
  -F FILE, --passfile FILE
88
                        Encrypt a password from FILE using the key in
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
89
                        the key directory.  All options other than
123 by Teddy Hogeborn
* mandos-keygen: Minor help text change.
90
                        --dir and --name are ignored.
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
91
  -S, --no-ssh          Don't get SSH key or set "checker" option.
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
92
EOF
93
}
94
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
95
eval set -- "$TEMP"
96
while :; do
97
    case "$1" in
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
98
	-p|--password) mode=password; shift;;
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
99
	-F|--passfile) mode=password; PASSFILE="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
100
	-d|--dir) KEYDIR="$2"; shift 2;;
101
	-t|--type) KEYTYPE="$2"; shift 2;;
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
102
	-s|--subtype) SUBKEYTYPE="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
103
	-l|--length) KEYLENGTH="$2"; shift 2;;
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
104
	-L|--sublength) SUBKEYLENGTH="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
105
	-n|--name) KEYNAME="$2"; shift 2;;
106
	-e|--email) KEYEMAIL="$2"; shift 2;;
107
	-c|--comment) KEYCOMMENT="$2"; shift 2;;
87 by Teddy Hogeborn
* Makefile: Bug fix: fixed creation of man pages in "plugins.d".
108
	-x|--expire) KEYEXPIRE="$2"; shift 2;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
109
	-f|--force) FORCE=yes; shift;;
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
110
	-S|--no-ssh) SSH=no; shift;;
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
111
	-v|--version) echo "$0 $VERSION"; exit;;
112
	-h|--help) help; exit;;
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
113
	--) shift; break;;
114
	*) echo "Internal error" >&2; exit 1;;
115
    esac
116
done
117
if [ "$#" -gt 0 ]; then
237.7.288 by Teddy Hogeborn
mandos-keygen: Fix some stylistic quoting issues.
118
    echo "Unknown arguments: '$*'" >&2
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
119
    exit 1
120
fi
121
122
SECKEYFILE="$KEYDIR/seckey.txt"
123
PUBKEYFILE="$KEYDIR/pubkey.txt"
124
125
# Check for some invalid values
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
126
if [ ! -d "$KEYDIR" ]; then
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
127
    echo "$KEYDIR not a directory" >&2
128
    exit 1
129
fi
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
130
if [ ! -r "$KEYDIR" ]; then
131
    echo "Directory $KEYDIR not readable" >&2
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
132
    exit 1
133
fi
134
135
if [ "$mode" = keygen ]; then
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
136
    if [ ! -w "$KEYDIR" ]; then
137
	echo "Directory $KEYDIR not writeable" >&2
138
	exit 1
139
    fi
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
140
    if [ -z "$KEYTYPE" ]; then
141
	echo "Empty key type" >&2
142
	exit 1
143
    fi
144
    
145
    if [ -z "$KEYNAME" ]; then
146
	echo "Empty key name" >&2
147
	exit 1
148
    fi
149
    
150
    if [ -z "$KEYLENGTH" ] || [ "$KEYLENGTH" -lt 512 ]; then
151
	echo "Invalid key length" >&2
152
	exit 1
153
    fi
237.2.37 by Teddy Hogeborn
* mandos-keygen (password): Remove bashism "${PIPESTATUS}".
154
    
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
155
    if [ -z "$KEYEXPIRE" ]; then
156
	echo "Empty key expiration" >&2
157
	exit 1
158
    fi
159
    
160
    # Make FORCE be 0 or 1
161
    case "$FORCE" in
162
	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) FORCE=1;;
163
	[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) FORCE=0;;
164
    esac
165
    
237.7.452 by Teddy Hogeborn
Use || instead of -o in shell scripts.
166
    if { [ -e "$SECKEYFILE" ] || [ -e "$PUBKEYFILE" ]; } \
167
	&& [ "$FORCE" -eq 0 ]; then
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
168
	echo "Refusing to overwrite old key files; use --force" >&2
169
	exit 1
170
    fi
171
    
172
    # Set lines for GnuPG batch file
173
    if [ -n "$KEYCOMMENT" ]; then
174
	KEYCOMMENTLINE="Name-Comment: $KEYCOMMENT"
175
    fi
176
    if [ -n "$KEYEMAIL" ]; then
177
	KEYEMAILLINE="Name-Email: $KEYEMAIL"
178
    fi
237.2.37 by Teddy Hogeborn
* mandos-keygen (password): Remove bashism "${PIPESTATUS}".
179
    
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
180
    # Create temporary gpg batch file
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
181
    BATCHFILE="`mktemp -t mandos-keygen-batch.XXXXXXXXXX`"
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
182
fi
183
184
if [ "$mode" = password ]; then
185
    # Create temporary encrypted password file
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
186
    SECFILE="`mktemp -t mandos-keygen-secfile.XXXXXXXXXX`"
187
fi
188
189
# Create temporary key ring directory
190
RINGDIR="`mktemp -d -t mandos-keygen-keyrings.XXXXXXXXXX`"
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
191
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
192
# Remove temporary files on exit
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
193
trap "
96 by Teddy Hogeborn
* Makefile (PREFIX, CONFDIR, MANDIR): Use $(DESTDIR).
194
set +e; \
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
195
test -n \"$SECFILE\" && shred --remove \"$SECFILE\"; \
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
196
shred --remove \"$RINGDIR\"/sec* 2>/dev/null;
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
197
test -n \"$BATCHFILE\" && rm --force \"$BATCHFILE\"; \
198
rm --recursive --force \"$RINGDIR\";
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
199
tty --quiet && stty echo; \
94 by Teddy Hogeborn
* clients.conf ([DEFAULT]/checker): Update to new default value.
200
" EXIT
67 by Teddy Hogeborn
* mandos-keygen: New program to generate new client keys on
201
237.2.215 by teddy at bsnet
* debian/control (Standards-Version): Updated to "3.9.1".
202
set -e
203
166 by Teddy Hogeborn
* Makefile (confdir/clients.conf): Tighten permissions to "u=rw".
204
umask 077
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
205
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
206
if [ "$mode" = keygen ]; then
207
    # Create batch file for GnuPG
208
    cat >"$BATCHFILE" <<-EOF
209
	Key-Type: $KEYTYPE
210
	Key-Length: $KEYLENGTH
237.7.175 by Teddy Hogeborn
* mandos-keygen: Bug fix: Specify key usage to avoid creating keys
211
	Key-Usage: sign,auth
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
212
	Subkey-Type: $SUBKEYTYPE
213
	Subkey-Length: $SUBKEYLENGTH
237.7.175 by Teddy Hogeborn
* mandos-keygen: Bug fix: Specify key usage to avoid creating keys
214
	Subkey-Usage: encrypt
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
215
	Name-Real: $KEYNAME
216
	$KEYCOMMENTLINE
217
	$KEYEMAILLINE
218
	Expire-Date: $KEYEXPIRE
219
	#Preferences: <string>
220
	#Handle: <no-spaces>
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
221
	#%pubring pubring.gpg
222
	#%secring secring.gpg
237.7.427 by Teddy Hogeborn
Fix bug when generating keys in a chroot environment.
223
	%no-protection
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
224
	%commit
225
	EOF
226
    
237.2.156 by Teddy Hogeborn
* mandos-keygen (keygen): Warn about long key generation time.
227
    if tty --quiet; then
228
	cat <<-EOF
229
	Note: Due to entropy requirements, key generation could take
230
	anything from a few minutes to SEVERAL HOURS.  Please be
231
	patient and/or supply the system with more entropy if needed.
232
	EOF
233
	echo -n "Started: "
234
	date
235
    fi
236
    
237.7.211 by Teddy Hogeborn
* mandos-keygen (keygen): Add workaround for Debian bug #737128.
237
    # Make sure trustdb.gpg exists;
238
    # this is a workaround for Debian bug #737128
239
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
240
	--homedir "$RINGDIR" \
241
	--import-ownertrust < /dev/null
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
242
    # Generate a new key in the key rings
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
243
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
244
	--homedir "$RINGDIR" --trust-model always \
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
245
	--gen-key "$BATCHFILE"
246
    rm --force "$BATCHFILE"
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
247
    
237.2.156 by Teddy Hogeborn
* mandos-keygen (keygen): Warn about long key generation time.
248
    if tty --quiet; then
249
	echo -n "Finished: "
250
	date
251
    fi
252
    
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
253
    # Backup any old key files
254
    if cp --backup=numbered --force "$SECKEYFILE" "$SECKEYFILE" \
255
	2>/dev/null; then
256
	shred --remove "$SECKEYFILE"
257
    fi
258
    if cp --backup=numbered --force "$PUBKEYFILE" "$PUBKEYFILE" \
259
	2>/dev/null; then
260
	rm --force "$PUBKEYFILE"
261
    fi
262
    
263
    FILECOMMENT="Mandos client key for $KEYNAME"
264
    if [ "$KEYCOMMENT" != "$KEYCOMMENT_ORIG" ]; then
265
	FILECOMMENT="$FILECOMMENT ($KEYCOMMENT)"
266
    fi
267
    
268
    if [ -n "$KEYEMAIL" ]; then
269
	FILECOMMENT="$FILECOMMENT <$KEYEMAIL>"
270
    fi
271
    
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
272
    # Export key from key rings to key files
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
273
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
274
	--homedir "$RINGDIR" --armor --export-options export-minimal \
275
	--comment "$FILECOMMENT" --output "$SECKEYFILE" \
276
	--export-secret-keys
277
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
278
	--homedir "$RINGDIR" --armor --export-options export-minimal \
279
	--comment "$FILECOMMENT" --output "$PUBKEYFILE" --export
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
280
fi
281
282
if [ "$mode" = password ]; then
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
283
    
284
    # Make SSH be 0 or 1
285
    case "$SSH" in
286
	[Yy][Ee][Ss]|[Tt][Rr][Uu][Ee]) SSH=1;;
287
	[Nn][Oo]|[Ff][Aa][Ll][Ss][Ee]|*) SSH=0;;
288
    esac
289
    
290
    if [ $SSH -eq 1 ]; then
237.7.396 by Teddy Hogeborn
mandos-keygen: Try to use ECDSA keys with ssh-keyscan(1) by default.
291
	for ssh_keytype in ecdsa-sha2-nistp256 ed25519 rsa; do
237.7.295 by Teddy Hogeborn
mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan
292
	    set +e
293
	    ssh_fingerprint="`ssh-keyscan -t $ssh_keytype localhost 2>/dev/null`"
237.7.451 by Teddy Hogeborn
Bug fix: Detect failure of ssh-keyscan in mandos-keygen --password.
294
	    err=$?
237.7.295 by Teddy Hogeborn
mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan
295
	    set -e
237.7.451 by Teddy Hogeborn
Bug fix: Detect failure of ssh-keyscan in mandos-keygen --password.
296
	    if [ $err -ne 0 ]; then
237.7.295 by Teddy Hogeborn
mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan
297
		ssh_fingerprint=""
298
		continue
299
	    fi
300
	    if [ -n "$ssh_fingerprint" ]; then
301
		ssh_fingerprint="${ssh_fingerprint#localhost }"
302
		break
303
	    fi
304
	done
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
305
    fi
306
    
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
307
    # Import key into temporary key rings
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
308
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
309
	--homedir "$RINGDIR" --trust-model always --armor \
310
	--import "$SECKEYFILE"
311
    gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
312
	--homedir "$RINGDIR" --trust-model always --armor \
313
	--import "$PUBKEYFILE"
314
    
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
315
    # Get fingerprint of key
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
316
    FINGERPRINT="`gpg --quiet --batch --no-tty --no-options \
237.7.288 by Teddy Hogeborn
mandos-keygen: Fix some stylistic quoting issues.
317
	--enable-dsa2 --homedir "$RINGDIR" --trust-model always \
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
318
	--fingerprint --with-colons \
168 by Teddy Hogeborn
* initramfs-tools-hook: Use long options where available. Use only
319
	| sed --quiet \
320
	--expression='/^fpr:/{s/^fpr:.*:\\([0-9A-Z]*\\):\$/\\1/p;q}'`"
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
321
    
322
    test -n "$FINGERPRINT"
323
    
324
    FILECOMMENT="Encrypted password for a Mandos client"
325
    
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
326
    while [ ! -s "$SECFILE" ]; do
327
	if [ -n "$PASSFILE" ]; then
328
	    cat "$PASSFILE"
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
329
	else
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
330
	    tty --quiet && stty -echo
237.7.428 by Teddy Hogeborn
Output the passphrase prompt to the TTY, not stderr.
331
	    echo -n "Enter passphrase: " >/dev/tty
237.7.444 by Teddy Hogeborn
Use "read -r" in shell scripts to avoid backslash escapes
332
	    read -r first
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
333
	    tty --quiet && echo >&2
237.7.428 by Teddy Hogeborn
Output the passphrase prompt to the TTY, not stderr.
334
	    echo -n "Repeat passphrase: " >/dev/tty
237.7.444 by Teddy Hogeborn
Use "read -r" in shell scripts to avoid backslash escapes
335
	    read -r second
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
336
	    if tty --quiet; then
337
		echo >&2
338
		stty echo
339
	    fi
340
	    if [ "$first" != "$second" ]; then
341
		echo "Passphrase mismatch" >&2
342
		touch "$RINGDIR"/mismatch
343
	    else
344
		echo -n "$first"
345
	    fi
346
	fi | gpg --quiet --batch --no-tty --no-options --enable-dsa2 \
347
	    --homedir "$RINGDIR" --trust-model always --armor \
348
	    --encrypt --sign --recipient "$FINGERPRINT" --comment \
349
	    "$FILECOMMENT" > "$SECFILE"
350
	if [ -e "$RINGDIR"/mismatch ]; then
351
	    rm --force "$RINGDIR"/mismatch
352
	    if tty --quiet; then
353
		> "$SECFILE"
354
	    else
355
		exit 1
356
	    fi
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
357
	fi
237.7.42 by Teddy Hogeborn
* mandos-keygen: Loop until passwords match when run interactively.
358
    done
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
359
    
360
    cat <<-EOF
361
	[$KEYNAME]
99 by Teddy Hogeborn
* mandos (fingerprint): Bug fix: Check crtverify.value, not crtverify.
362
	host = $KEYNAME
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
363
	fingerprint = $FINGERPRINT
364
	secret =
198 by Teddy Hogeborn
* mandos-keygen: New "--passfile" option. Confirm entered password.
365
	EOF
168 by Teddy Hogeborn
* initramfs-tools-hook: Use long options where available. Use only
366
    sed --quiet --expression='
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
367
	/^-----BEGIN PGP MESSAGE-----$/,/^-----END PGP MESSAGE-----$/{
368
	    /^$/,${
103 by Teddy Hogeborn
* mandos-keygen: Strip 24-bit checksum of Radix-64 from output to make
369
		# Remove 24-bit Radix-64 checksum
370
		s/=....$//
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
371
		# Indent four spaces
372
		/^[^-]/s/^/    /p
373
	    }
374
	}' < "$SECFILE"
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
375
    if [ -n "$ssh_fingerprint" ]; then
237.7.295 by Teddy Hogeborn
mandos-keygen: Bug fix: Only use one SSH key from ssh-keyscan
376
	echo 'checker = ssh-keyscan -t '"$ssh_keytype"' %%(host)s 2>/dev/null | grep --fixed-strings --line-regexp --quiet --regexp=%%(host)s" %(ssh_fingerprint)s"'
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
377
	echo "ssh_fingerprint = ${ssh_fingerprint}"
378
    fi
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
379
fi
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
380
381
trap - EXIT
382
97 by Teddy Hogeborn
* mandos-keygen: Bug fix: Recognize new options --subtype and
383
set +e
384
# Remove the password file, if any
385
if [ -n "$SECFILE" ]; then
386
    shred --remove "$SECFILE"
387
fi
73 by Teddy Hogeborn
* Makefile (COVERAGE): Change back to "--coverage".
388
# Remove the key rings
237.7.256 by Teddy Hogeborn
mandos-keygen: Generate "checker" option to use SSH fingerprints.
389
shred --remove "$RINGDIR"/sec* 2>/dev/null
159 by Teddy Hogeborn
* Makefile (run-client): Do not depend on the key ring files.
390
rm --recursive --force "$RINGDIR"