|
|
@@ -0,0 +1,166 @@
|
|
|
1
|
+#!/bin/bash
|
|
|
2
|
+#
|
|
|
3
|
+# .---. . .
|
|
|
4
|
+# | | |
|
|
|
5
|
+# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
|
|
|
6
|
+# | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
|
|
|
7
|
+# ' ' --' --' -' - -' ' ' -' -' -' ' - --'
|
|
|
8
|
+#
|
|
|
9
|
+# Freedom in the Cloud
|
|
|
10
|
+#
|
|
|
11
|
+# Encryption key related functions
|
|
|
12
|
+
|
|
|
13
|
+# License
|
|
|
14
|
+# =======
|
|
|
15
|
+#
|
|
|
16
|
+# Copyright (C) 2015-2016 Bob Mottram <bob@robotics.uk.to>
|
|
|
17
|
+#
|
|
|
18
|
+# This program is free software: you can redistribute it and/or modify
|
|
|
19
|
+# it under the terms of the GNU Affero General Public License as published by
|
|
|
20
|
+# the Free Software Foundation, either version 3 of the License, or
|
|
|
21
|
+# (at your option) any later version.
|
|
|
22
|
+#
|
|
|
23
|
+# This program is distributed in the hope that it will be useful,
|
|
|
24
|
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
25
|
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
26
|
+# GNU Affero General Public License for more details.
|
|
|
27
|
+#
|
|
|
28
|
+# You should have received a copy of the GNU Affero General Public License
|
|
|
29
|
+# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
30
|
+
|
|
|
31
|
+function reconstruct_key {
|
|
|
32
|
+ if [ ! -d /home/$MY_USERNAME/.gnupg_fragments ]; then
|
|
|
33
|
+ return
|
|
|
34
|
+ fi
|
|
|
35
|
+ cd /home/$MY_USERNAME/.gnupg_fragments
|
|
|
36
|
+ no_of_shares=$(ls -afq keyshare.asc.* | wc -l)
|
|
|
37
|
+ if (( no_of_shares < 4 )); then
|
|
|
38
|
+ dialog --title $"Recover Encryption Keys" --msgbox $'Not enough fragments to reconstruct the key' 6 70
|
|
|
39
|
+ exit 7348
|
|
|
40
|
+ fi
|
|
|
41
|
+ apt-get -yq install libgfshare-bin gnupg
|
|
|
42
|
+ gfcombine /home/$MY_USERNAME/.gnupg_fragments/keyshare*
|
|
|
43
|
+ if [ ! "$?" = "0" ]; then
|
|
|
44
|
+ dialog --title $"Recover Encryption Keys" --msgbox $'Unable to reconstruct the key' 6 70
|
|
|
45
|
+ exit 7348
|
|
|
46
|
+ fi
|
|
|
47
|
+
|
|
|
48
|
+ KEYS_FILE=/home/$MY_USERNAME/.gnupg_fragments/keyshare.asc
|
|
|
49
|
+ if [ ! -f $KEYS_FILE ]; then
|
|
|
50
|
+ dialog --title $"Recover Encryption Keys" --msgbox $'Unable to reconstruct the key' 6 70
|
|
|
51
|
+ fi
|
|
|
52
|
+
|
|
|
53
|
+ su -c "gpg --allow-secret-key-import --import $KEYS_FILE" - $MY_USERNAME
|
|
|
54
|
+ if [ ! "$?" = "0" ]; then
|
|
|
55
|
+ echo $'Unable to import gpg key'
|
|
|
56
|
+ shred -zu $KEYS_FILE
|
|
|
57
|
+ rm -rf /home/$MY_USERNAME/.tempgnupg
|
|
|
58
|
+ exit 9654
|
|
|
59
|
+ fi
|
|
|
60
|
+ shred -zu $KEYS_FILE
|
|
|
61
|
+
|
|
|
62
|
+ dialog --title $"Recover Encryption Keys" --msgbox $'Key has been reconstructed' 6 70
|
|
|
63
|
+}
|
|
|
64
|
+
|
|
|
65
|
+function interactive_gpg_from_usb {
|
|
|
66
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
67
|
+ --msgbox $'Plug in a USB keydrive containing a copy of your full key or key fragment' 6 70
|
|
|
68
|
+
|
|
|
69
|
+ HOME_DIR=/home/$MY_USERNAME
|
|
|
70
|
+ GPG_LOADING="yes"
|
|
|
71
|
+ SSH_IMPORTED="no"
|
|
|
72
|
+ GPG_CTR=0
|
|
|
73
|
+ while [[ $GPG_LOADING == "yes" ]]
|
|
|
74
|
+ do
|
|
|
75
|
+ detect_usb_drive
|
|
|
76
|
+
|
|
|
77
|
+ if [ ! -b $USB_DRIVE ]; then
|
|
|
78
|
+ if (( GPG_CTR > 0 )); then
|
|
|
79
|
+ reconstruct_key
|
|
|
80
|
+ return 0
|
|
|
81
|
+ fi
|
|
|
82
|
+ dialog --title $"Recover Encryption Keys" --msgbox $'No USB drive found' 6 30
|
|
|
83
|
+ exit 739836
|
|
|
84
|
+ fi
|
|
|
85
|
+
|
|
|
86
|
+ GPG_USB_MOUNT='/mnt/usb'
|
|
|
87
|
+ umount -f $GPG_USB_MOUNT
|
|
|
88
|
+ if [ ! -d $GPG_USB_MOUNT ]; then
|
|
|
89
|
+ mkdir -p $GPG_USB_MOUNT
|
|
|
90
|
+ fi
|
|
|
91
|
+
|
|
|
92
|
+ if [ -f /dev/mapper/encrypted_usb ]; then
|
|
|
93
|
+ rm -rf /dev/mapper/encrypted_usb
|
|
|
94
|
+ fi
|
|
|
95
|
+ cryptsetup luksClose encrypted_usb
|
|
|
96
|
+ cryptsetup luksOpen $USB_DRIVE encrypted_usb
|
|
|
97
|
+ if [ "$?" = "0" ]; then
|
|
|
98
|
+ USB_DRIVE=/dev/mapper/encrypted_usb
|
|
|
99
|
+ fi
|
|
|
100
|
+ mount $USB_DRIVE $GPG_USB_MOUNT
|
|
|
101
|
+ if [ ! "$?" = "0" ]; then
|
|
|
102
|
+ if (( GPG_CTR > 0 )); then
|
|
|
103
|
+ rm -rf $GPG_USB_MOUNT
|
|
|
104
|
+ reconstruct_key
|
|
|
105
|
+ return 0
|
|
|
106
|
+ fi
|
|
|
107
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
108
|
+ --msgbox $"There was a problem mounting the USB drive to $GPG_USB_MOUNT" 6 70
|
|
|
109
|
+ rm -rf $GPG_USB_MOUNT
|
|
|
110
|
+ exit 74393
|
|
|
111
|
+ fi
|
|
|
112
|
+
|
|
|
113
|
+ if [ ! -d $GPG_USB_MOUNT/.gnupg ]; then
|
|
|
114
|
+ if [ ! -d $GPG_USB_MOUNT/.gnupg_fragments ]; then
|
|
|
115
|
+ if (( GPG_CTR > 0 )); then
|
|
|
116
|
+ umount -f $GPG_USB_MOUNT
|
|
|
117
|
+ rm -rf $GPG_USB_MOUNT
|
|
|
118
|
+ reconstruct_key
|
|
|
119
|
+ return 0
|
|
|
120
|
+ fi
|
|
|
121
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
122
|
+ --msgbox $"The directory $GPG_USB_MOUNT/.gnupg or $GPG_USB_MOUNT/.gnupg_fragments was not found" 6 70
|
|
|
123
|
+ umount -f $GPG_USB_MOUNT
|
|
|
124
|
+ rm -rf $GPG_USB_MOUNT
|
|
|
125
|
+ exit 723814
|
|
|
126
|
+ fi
|
|
|
127
|
+ fi
|
|
|
128
|
+
|
|
|
129
|
+ if [ -d $GPG_USB_MOUNT/.gnupg ]; then
|
|
|
130
|
+ if [ ! -d $HOME_DIR/.gnupg ]; then
|
|
|
131
|
+ mkdir $HOME_DIR/.gnupg
|
|
|
132
|
+ fi
|
|
|
133
|
+ cp -r $GPG_USB_MOUNT/.gnupg/* $HOME_DIR/.gnupg
|
|
|
134
|
+ GPG_LOADING="no"
|
|
|
135
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
136
|
+ --msgbox $"GPG Keyring loaded to $HOME_DIR" 6 70
|
|
|
137
|
+ else
|
|
|
138
|
+ if [ ! -d $HOME_DIR/.gnupg_fragments ]; then
|
|
|
139
|
+ mkdir $HOME_DIR/.gnupg_fragments
|
|
|
140
|
+ fi
|
|
|
141
|
+ cp -r $GPG_USB_MOUNT/.gnupg_fragments/* $HOME_DIR/.gnupg_fragments
|
|
|
142
|
+ fi
|
|
|
143
|
+
|
|
|
144
|
+ if [[ $SSH_IMPORTED == "no" ]]; then
|
|
|
145
|
+ if [ -d $GPG_USB_MOUNT/.ssh ]; then
|
|
|
146
|
+ if [ ! -d $HOME_DIR/.ssh ]; then
|
|
|
147
|
+ mkdir $HOME_DIR/.ssh
|
|
|
148
|
+ fi
|
|
|
149
|
+ cp $GPG_USB_MOUNT/.ssh/* $HOME_DIR/.ssh
|
|
|
150
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
151
|
+ --msgbox $"ssh keys imported" 6 70
|
|
|
152
|
+ SSH_IMPORTED="yes"
|
|
|
153
|
+ fi
|
|
|
154
|
+ fi
|
|
|
155
|
+
|
|
|
156
|
+ umount -f $GPG_USB_MOUNT
|
|
|
157
|
+ rm -rf $GPG_USB_MOUNT
|
|
|
158
|
+ if [[ $GPG_LOADING == "yes" ]]; then
|
|
|
159
|
+ dialog --title $"Recover Encryption Keys" \
|
|
|
160
|
+ --msgbox $"Now remove the USB drive. Insert the next drive containing a key fragment, or select Ok to finish" 6 70
|
|
|
161
|
+ fi
|
|
|
162
|
+ GPG_CTR=$((GPG_CTR + 1))
|
|
|
163
|
+ done
|
|
|
164
|
+}
|
|
|
165
|
+
|
|
|
166
|
+# NOTE: deliberately there is no "exit 0"
|
Bob Mottram
8 years ago