瀏覽代碼

Fix creation of backup key

Bob Mottram 7 年之前
父節點
當前提交
8e77c68ac0
共有 4 個檔案被更改,包括 27 行新增49 行删除
  1. 1
    0
      src/freedombone-adduser
  2. 5
    27
      src/freedombone-base-email
  3. 2
    22
      src/freedombone-utils-backup
  4. 19
    0
      src/freedombone-utils-gpg

+ 1
- 0
src/freedombone-adduser 查看文件

157
     userdel -r $ADD_USERNAME
157
     userdel -r $ADD_USERNAME
158
     exit 7
158
     exit 7
159
 fi
159
 fi
160
+gpg_allow_tty $ADD_USERNAME
160
 
161
 
161
 # add a monkeysphere subkey
162
 # add a monkeysphere subkey
162
 #echo $'Adding monkeysphere subkey'
163
 #echo $'Adding monkeysphere subkey'

+ 5
- 27
src/freedombone-base-email 查看文件

1646
         fi
1646
         fi
1647
         MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
1647
         MY_GPG_PUBLIC_KEY=/tmp/public_key.gpg
1648
         su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --output $MY_GPG_PUBLIC_KEY --armor --export $MY_GPG_PUBLIC_KEY_ID" - $MY_USERNAME
1648
         su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --output $MY_GPG_PUBLIC_KEY --armor --export $MY_GPG_PUBLIC_KEY_ID" - $MY_USERNAME
1649
+    fi
1649
 
1650
 
1650
-        if grep -q "install_email" $COMPLETION_FILE; then
1651
-            if ! grep -q $"Change your GPG password" /home/$MY_USERNAME/README; then
1652
-                echo '' >> /home/$MY_USERNAME/README
1653
-                echo '' >> /home/$MY_USERNAME/README
1654
-                echo $'# Change your GPG password' >> /home/$MY_USERNAME/README
1655
-                echo $"It's very important to add a password to your GPG key so that" >> /home/$MY_USERNAME/README
1656
-                echo $"if anyone does get access to your email they still won't be able" >> /home/$MY_USERNAME/README
1657
-                echo $'to read them without knowning the GPG password.' >> /home/$MY_USERNAME/README
1658
-                echo $'You can change the it with:' >> /home/$MY_USERNAME/README
1659
-                echo '' >> /home/$MY_USERNAME/README
1660
-                echo "  gpg --edit-key $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
1661
-                echo '  passwd' >> /home/$MY_USERNAME/README
1662
-                echo '  save' >> /home/$MY_USERNAME/README
1663
-                echo '  quit' >> /home/$MY_USERNAME/README
1664
-            fi
1665
-            if ! grep -q $"Publish your GPG public key" /home/$MY_USERNAME/README; then
1666
-                echo '' >> /home/$MY_USERNAME/README
1667
-                echo '' >> /home/$MY_USERNAME/README
1668
-                echo $'# Publish your GPG public key' >> /home/$MY_USERNAME/README
1669
-                echo $'So that others can send emails to you securely you should' >> /home/$MY_USERNAME/README
1670
-                echo $'publish your GPG public key with the command:' >> /home/$MY_USERNAME/README
1671
-                echo '' >> /home/$MY_USERNAME/README
1672
-                echo "  gpg --send-keys $MY_GPG_PUBLIC_KEY_ID" >> /home/$MY_USERNAME/README
1673
-            fi
1674
-            chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/README
1675
-            chmod 600 /home/$MY_USERNAME/README
1676
-        fi
1651
+    if [ ! -d /root/.gnupg ]; then
1652
+        cp -r /home/$MY_USERNAME/.gnupg /root/
1677
     fi
1653
     fi
1654
+    gpg_allow_tty root
1655
+    gpg_allow_tty $MY_USERNAME
1678
 
1656
 
1679
     mark_completed $FUNCNAME
1657
     mark_completed $FUNCNAME
1680
 }
1658
 }

+ 2
- 22
src/freedombone-utils-backup 查看文件

51
     SUSPENDED_SITE=
51
     SUSPENDED_SITE=
52
 }
52
 }
53
 
53
 
54
-function backup_create_password {
55
-    BACKUP_PASSWORD_FILE=$(mktemp /tmp/fileXXXXX)
56
-    # Note: this doesn't need to be secure, it's just a way of
57
-    # getting around the forced interactivity of the gpg agent
58
-    echo -n "$BACKUP_DUMMY_PASSWORD" > $BACKUP_PASSWORD_FILE
59
-}
60
-
61
-function backup_remove_password {
62
-    if [ ! $BACKUP_PASSWORD_FILE ]; then
63
-        return
64
-    fi
65
-    if [ -f $BACKUP_PASSWORD_FILE ]; then
66
-        shred -zu $BACKUP_PASSWORD_FILE
67
-    fi
68
-}
69
-
70
 function configure_backup_key {
54
 function configure_backup_key {
71
     if [[ $(is_completed $FUNCNAME) == "1" ]]; then
55
     if [[ $(is_completed $FUNCNAME) == "1" ]]; then
72
         return
56
         return
104
         fi
88
         fi
105
     fi
89
     fi
106
 
90
 
107
-    backup_create_password
108
-
109
     MY_BACKUP_KEY_ID=$(su -c "gpg --list-keys \"$MY_NAME (backup key)\"" - $MY_USERNAME | sed -n '2p' | sed 's/^[ \t]*//')
91
     MY_BACKUP_KEY_ID=$(su -c "gpg --list-keys \"$MY_NAME (backup key)\"" - $MY_USERNAME | sed -n '2p' | sed 's/^[ \t]*//')
110
     echo "Backup key: $MY_BACKUP_KEY_ID"
92
     echo "Backup key: $MY_BACKUP_KEY_ID"
111
     MY_BACKUP_KEY=/home/$MY_USERNAME/backup_key
93
     MY_BACKUP_KEY=/home/$MY_USERNAME/backup_key
112
     su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --output ${MY_BACKUP_KEY}_public.asc --armor --export $MY_BACKUP_KEY_ID" - $MY_USERNAME
94
     su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --output ${MY_BACKUP_KEY}_public.asc --armor --export $MY_BACKUP_KEY_ID" - $MY_USERNAME
113
-    su -m root -c "gpg --homedir /home/$MY_USERNAME/.gnupg --output ${MY_BACKUP_KEY}_private.asc --armor --passphrase-fd $BACKUP_PASSWORD_FILE --export-secret-key $MY_BACKUP_KEY_ID" - $MY_USERNAME
95
+    su -m root -c "echo '$BACKUP_DUMMY_PASSWORD' | gpg --homedir /home/$MY_USERNAME/.gnupg --output ${MY_BACKUP_KEY}_private.asc --armor --batch --passphrase-fd 0 --export-secret-key $MY_BACKUP_KEY_ID" - $MY_USERNAME
96
+
114
     if [ ! -f ${MY_BACKUP_KEY}_public.asc ]; then
97
     if [ ! -f ${MY_BACKUP_KEY}_public.asc ]; then
115
-        backup_remove_password
116
         echo 'Public backup key could not be exported'
98
         echo 'Public backup key could not be exported'
117
         exit 36829
99
         exit 36829
118
     fi
100
     fi
119
     if [ ! -f ${MY_BACKUP_KEY}_private.asc ]; then
101
     if [ ! -f ${MY_BACKUP_KEY}_private.asc ]; then
120
-        backup_remove_password
121
         echo 'Private backup key could not be exported'
102
         echo 'Private backup key could not be exported'
122
         exit 29235
103
         exit 29235
123
     fi
104
     fi
128
 
109
 
129
     shred -zu ${MY_BACKUP_KEY}_public.asc
110
     shred -zu ${MY_BACKUP_KEY}_public.asc
130
     shred -zu ${MY_BACKUP_KEY}_private.asc
111
     shred -zu ${MY_BACKUP_KEY}_private.asc
131
-    backup_remove_password
132
 
112
 
133
     mark_completed $FUNCNAME
113
     mark_completed $FUNCNAME
134
 }
114
 }

+ 19
- 0
src/freedombone-utils-gpg 查看文件

28
 # You should have received a copy of the GNU Affero General Public License
28
 # You should have received a copy of the GNU Affero General Public License
29
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
29
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
30
 
30
 
31
+function gpg_allow_tty {
32
+    gpg_username=$1
33
+
34
+    if [[ $gpg_username == 'root' ]]; then
35
+        if ! grep -q 'GPG_TTY' /root/.bashrc; then
36
+            echo '' >> /root/.bashrc
37
+            echo 'GPG_TTY=$(tty)' >> /root/.bashrc
38
+            echo 'export GPG_TTY' >> /root/.bashrc
39
+        fi
40
+    else
41
+        if ! grep -q 'GPG_TTY' /home/$gpg_username/.bashrc; then
42
+            echo '' >> /home/$gpg_username/.bashrc
43
+            echo 'GPG_TTY=$(tty)' >> /home/$gpg_username/.bashrc
44
+            echo 'export GPG_TTY' >> /home/$gpg_username/.bashrc
45
+            chown $gpg_username:$gpg_username /home/$gpg_username/.bashrc
46
+        fi
47
+    fi
48
+}
49
+
31
 function gpg_pubkey_from_email {
50
 function gpg_pubkey_from_email {
32
     key_owner_username=$1
51
     key_owner_username=$1
33
     key_email_address=$2
52
     key_email_address=$2