|
@@ -13,7 +13,7 @@
|
13
|
13
|
# License
|
14
|
14
|
# =======
|
15
|
15
|
#
|
16
|
|
-# Copyright (C) 2015-2016 Bob Mottram <bob@freedombone.net>
|
|
16
|
+# Copyright (C) 2015-2017 Bob Mottram <bob@freedombone.net>
|
17
|
17
|
#
|
18
|
18
|
# This program is free software: you can redistribute it and/or modify
|
19
|
19
|
# it under the terms of the GNU Affero General Public License as published by
|
|
@@ -50,41 +50,41 @@ function show_help {
|
50
|
50
|
|
51
|
51
|
while [[ $# > 1 ]]
|
52
|
52
|
do
|
53
|
|
-key="$1"
|
54
|
|
-
|
55
|
|
-case $key in
|
56
|
|
- -h|--help)
|
57
|
|
- show_help
|
58
|
|
- ;;
|
59
|
|
- -u|--user)
|
60
|
|
- shift
|
61
|
|
- MY_USERNAME="$1"
|
62
|
|
- ;;
|
63
|
|
- -d|--dev)
|
64
|
|
- shift
|
65
|
|
- if [[ "${1}" != '/dev/'* ]]; then
|
66
|
|
- USB_DRIVE=/dev/${1}1
|
67
|
|
- else
|
68
|
|
- USB_DRIVE=${1}
|
69
|
|
- fi
|
70
|
|
- ;;
|
71
|
|
- -m|--master)
|
72
|
|
- shift
|
73
|
|
- MASTER_DRIVE="$1"
|
74
|
|
- ;;
|
75
|
|
- -n|--fragments)
|
|
53
|
+ key="$1"
|
|
54
|
+
|
|
55
|
+ case $key in
|
|
56
|
+ -h|--help)
|
|
57
|
+ show_help
|
|
58
|
+ ;;
|
|
59
|
+ -u|--user)
|
|
60
|
+ shift
|
|
61
|
+ MY_USERNAME="$1"
|
|
62
|
+ ;;
|
|
63
|
+ -d|--dev)
|
|
64
|
+ shift
|
|
65
|
+ if [[ "${1}" != '/dev/'* ]]; then
|
|
66
|
+ USB_DRIVE=/dev/${1}1
|
|
67
|
+ else
|
|
68
|
+ USB_DRIVE=${1}
|
|
69
|
+ fi
|
|
70
|
+ ;;
|
|
71
|
+ -m|--master)
|
|
72
|
+ shift
|
|
73
|
+ MASTER_DRIVE="$1"
|
|
74
|
+ ;;
|
|
75
|
+ -n|--fragments)
|
|
76
|
+ shift
|
|
77
|
+ KEY_FRAGMENTS=$1
|
|
78
|
+ ;;
|
|
79
|
+ -f|--format)
|
|
80
|
+ shift
|
|
81
|
+ FORMAT="yes"
|
|
82
|
+ ;;
|
|
83
|
+ *)
|
|
84
|
+ # unknown option
|
|
85
|
+ ;;
|
|
86
|
+ esac
|
76
|
87
|
shift
|
77
|
|
- KEY_FRAGMENTS=$1
|
78
|
|
- ;;
|
79
|
|
- -f|--format)
|
80
|
|
- shift
|
81
|
|
- FORMAT="yes"
|
82
|
|
- ;;
|
83
|
|
- *)
|
84
|
|
- # unknown option
|
85
|
|
- ;;
|
86
|
|
-esac
|
87
|
|
-shift
|
88
|
88
|
done
|
89
|
89
|
|
90
|
90
|
if [ ! $MY_USERNAME ]; then
|
|
@@ -98,118 +98,118 @@ if [ ! -d /home/$MY_USERNAME ]; then
|
98
|
98
|
fi
|
99
|
99
|
|
100
|
100
|
if [ ! -b $USB_DRIVE ]; then
|
101
|
|
- echo $'Please attach a USB drive'
|
102
|
|
- exit 65743
|
|
101
|
+ echo $'Please attach a USB drive'
|
|
102
|
+ exit 65743
|
103
|
103
|
fi
|
104
|
104
|
|
105
|
105
|
umount -f $USB_MOUNT
|
106
|
106
|
if [ ! -d $USB_MOUNT ]; then
|
107
|
|
- mkdir $USB_MOUNT
|
|
107
|
+ mkdir $USB_MOUNT
|
108
|
108
|
fi
|
109
|
109
|
if [ -f /dev/mapper/encrypted_usb ]; then
|
110
|
|
- rm -rf /dev/mapper/encrypted_usb
|
|
110
|
+ rm -rf /dev/mapper/encrypted_usb
|
111
|
111
|
fi
|
112
|
112
|
cryptsetup luksClose encrypted_usb
|
113
|
113
|
|
114
|
114
|
# optionally format the drive
|
115
|
115
|
if [[ $FORMAT == "yes" ]]; then
|
116
|
|
- ${PROJECT_NAME}-format ${USB_DRIVE::-1}
|
117
|
|
- if [ ! "$?" = "0" ]; then
|
118
|
|
- exit 36823
|
119
|
|
- fi
|
|
116
|
+ ${PROJECT_NAME}-format ${USB_DRIVE::-1}
|
|
117
|
+ if [ ! "$?" = "0" ]; then
|
|
118
|
+ exit 36823
|
|
119
|
+ fi
|
120
|
120
|
fi
|
121
|
121
|
|
122
|
122
|
cryptsetup luksOpen $USB_DRIVE encrypted_usb
|
123
|
123
|
if [ "$?" = "0" ]; then
|
124
|
|
- USB_DRIVE=/dev/mapper/encrypted_usb
|
|
124
|
+ USB_DRIVE=/dev/mapper/encrypted_usb
|
125
|
125
|
fi
|
126
|
126
|
mount $USB_DRIVE $USB_MOUNT
|
127
|
127
|
if [ ! "$?" = "0" ]; then
|
128
|
|
- echo $"There was a problem mounting the USB drive to $USB_MOUNT"
|
129
|
|
- rm -rf $USB_MOUNT
|
130
|
|
- exit 78543
|
|
128
|
+ echo $"There was a problem mounting the USB drive to $USB_MOUNT"
|
|
129
|
+ rm -rf $USB_MOUNT
|
|
130
|
+ exit 78543
|
131
|
131
|
fi
|
132
|
132
|
|
133
|
133
|
# optionally create a master drive which contains the full GPG keyring
|
134
|
134
|
if [[ $MASTER_DRIVE == "yes" || $MASTER_DRIVE == "y" || $MASTER_DRIVE == "1" ]]; then
|
135
|
|
- if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
|
136
|
|
- echo $"No .gnupg directory was found for $MY_USERNAME"
|
137
|
|
- umount -f $USB_MOUNT
|
138
|
|
- rm -rf $USB_MOUNT
|
139
|
|
- exit 73025
|
140
|
|
- fi
|
141
|
|
-
|
142
|
|
- # export the gpg key and backup key as text
|
143
|
|
- # so that it may be imported at the beginning of new installs
|
144
|
|
- GPG_TTY=$(tty)
|
145
|
|
- export GPG_TTY
|
146
|
|
-
|
147
|
|
- USER_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
|
148
|
|
- GPG_ID=$(su -m root -c "gpg --list-keys $USER_EMAIL_ADDRESS | sed -n '2p' | sed 's/^[ \t]*//'" - $MY_USERNAME)
|
149
|
|
- GPG_BACKUP_ID=$(su -m root -c "gpg --list-keys \"(backup key)\" | sed -n '2p' | sed 's/^[ \t]*//'" - $MY_USERNAME)
|
150
|
|
-
|
151
|
|
- gpgerrstr=$'error'
|
152
|
|
- gpgkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export $GPG_ID)
|
153
|
|
- if [[ "$gpgkey" == *"$gpgerrstr"* ]]; then
|
154
|
|
- echo $'Problem exporting public gpg key'
|
155
|
|
- echo "$gpgkey"
|
156
|
|
- exit 735282
|
157
|
|
- fi
|
158
|
|
- echo ''
|
159
|
|
- echo $'Enter your gpg private key passphrase:'
|
160
|
|
- gpgprivkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export-secret-key $GPG_ID)
|
161
|
|
- if [[ "$gpgprivkey" == *"$gpgerrstr"* ]]; then
|
162
|
|
- echo $'Problem exporting private gpg key'
|
163
|
|
- echo "$gpgprivkey"
|
164
|
|
- gpgprivkey=
|
165
|
|
- exit 629362
|
166
|
|
- fi
|
167
|
|
-
|
168
|
|
- # Dummy password to get around not being able to create a key without passphrase
|
169
|
|
- BACKUP_DUMMY_PASSWORD='backup'
|
170
|
|
-
|
171
|
|
- backupgpgkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export $GPG_BACKUP_ID)
|
172
|
|
- if [[ "$backupgpgkey" == *"$gpgerrstr"* ]]; then
|
173
|
|
- echo $'Problem exporting public gpg backup key'
|
174
|
|
- echo "$backupgpgkey"
|
175
|
|
- exit 735282
|
176
|
|
- fi
|
177
|
|
- backupgpgprivkey=$(echo "$BACKUP_DUMMY_PASSWORD" | gpg --batch --passphrase-fd 0 --homedir=/home/$MY_USERNAME/.gnupg --armor --export-secret-key $GPG_BACKUP_ID)
|
178
|
|
- if [[ "$backupgpgprivkey" == *"$gpgerrstr"* ]]; then
|
179
|
|
- echo $'Problem exporting private gpg backup key'
|
180
|
|
- echo "$backupgpgprivkey"
|
181
|
|
- backupgpgprivkey=
|
182
|
|
- exit 629362
|
183
|
|
- fi
|
184
|
|
-
|
185
|
|
- echo "$gpgkey" > $USB_MOUNT/.mastergpgkey
|
186
|
|
- echo "$gpgprivkey" >> $USB_MOUNT/.mastergpgkey
|
187
|
|
- echo "$backupgpgkey" > $USB_MOUNT/.backupgpgkey
|
188
|
|
- echo "$backupgpgprivkey" >> $USB_MOUNT/.backupgpgkey
|
189
|
|
-
|
190
|
|
- cp -rf /home/$MY_USERNAME/.gnupg $USB_MOUNT
|
191
|
|
-
|
192
|
|
- if [ -d /etc/letsencrypt ]; then
|
193
|
|
- cp -rf /etc/letsencrypt $USB_MOUNT
|
194
|
|
- echo $"LetsEncrypt keys copied to $USB_DRIVE"
|
195
|
|
- fi
|
196
|
|
- if [ -d $USB_MOUNT/.gnupg ]; then
|
197
|
|
- echo $"GPG Keyring copied to $USB_DRIVE. You may now remove the drive."
|
198
|
|
- else
|
199
|
|
- echo $"Unable to copy gpg keyring to $USB_DRIVE"
|
200
|
|
- fi
|
201
|
|
- umount -f $USB_MOUNT
|
202
|
|
- rm -rf $USB_MOUNT
|
203
|
|
- exit 0
|
|
135
|
+ if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
|
|
136
|
+ echo $"No .gnupg directory was found for $MY_USERNAME"
|
|
137
|
+ umount -f $USB_MOUNT
|
|
138
|
+ rm -rf $USB_MOUNT
|
|
139
|
+ exit 73025
|
|
140
|
+ fi
|
|
141
|
+
|
|
142
|
+ # export the gpg key and backup key as text
|
|
143
|
+ # so that it may be imported at the beginning of new installs
|
|
144
|
+ GPG_TTY=$(tty)
|
|
145
|
+ export GPG_TTY
|
|
146
|
+
|
|
147
|
+ USER_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
|
|
148
|
+ GPG_ID=$(su -m root -c "gpg --list-keys $USER_EMAIL_ADDRESS | sed -n '2p' | sed 's/^[ \t]*//'" - $MY_USERNAME)
|
|
149
|
+ GPG_BACKUP_ID=$(su -m root -c "gpg --list-keys \"(backup key)\" | sed -n '2p' | sed 's/^[ \t]*//'" - $MY_USERNAME)
|
|
150
|
+
|
|
151
|
+ gpgerrstr=$'error'
|
|
152
|
+ gpgkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export $GPG_ID)
|
|
153
|
+ if [[ "$gpgkey" == *"$gpgerrstr"* ]]; then
|
|
154
|
+ echo $'Problem exporting public gpg key'
|
|
155
|
+ echo "$gpgkey"
|
|
156
|
+ exit 735282
|
|
157
|
+ fi
|
|
158
|
+ echo ''
|
|
159
|
+ echo $'Enter your gpg private key passphrase:'
|
|
160
|
+ gpgprivkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export-secret-key $GPG_ID)
|
|
161
|
+ if [[ "$gpgprivkey" == *"$gpgerrstr"* ]]; then
|
|
162
|
+ echo $'Problem exporting private gpg key'
|
|
163
|
+ echo "$gpgprivkey"
|
|
164
|
+ gpgprivkey=
|
|
165
|
+ exit 629362
|
|
166
|
+ fi
|
|
167
|
+
|
|
168
|
+ # Dummy password to get around not being able to create a key without passphrase
|
|
169
|
+ BACKUP_DUMMY_PASSWORD='backup'
|
|
170
|
+
|
|
171
|
+ backupgpgkey=$(gpg --homedir=/home/$MY_USERNAME/.gnupg --armor --export $GPG_BACKUP_ID)
|
|
172
|
+ if [[ "$backupgpgkey" == *"$gpgerrstr"* ]]; then
|
|
173
|
+ echo $'Problem exporting public gpg backup key'
|
|
174
|
+ echo "$backupgpgkey"
|
|
175
|
+ exit 735282
|
|
176
|
+ fi
|
|
177
|
+ backupgpgprivkey=$(echo "$BACKUP_DUMMY_PASSWORD" | gpg --batch --passphrase-fd 0 --homedir=/home/$MY_USERNAME/.gnupg --armor --export-secret-key $GPG_BACKUP_ID)
|
|
178
|
+ if [[ "$backupgpgprivkey" == *"$gpgerrstr"* ]]; then
|
|
179
|
+ echo $'Problem exporting private gpg backup key'
|
|
180
|
+ echo "$backupgpgprivkey"
|
|
181
|
+ backupgpgprivkey=
|
|
182
|
+ exit 629362
|
|
183
|
+ fi
|
|
184
|
+
|
|
185
|
+ echo "$gpgkey" > $USB_MOUNT/.mastergpgkey
|
|
186
|
+ echo "$gpgprivkey" >> $USB_MOUNT/.mastergpgkey
|
|
187
|
+ echo "$backupgpgkey" > $USB_MOUNT/.backupgpgkey
|
|
188
|
+ echo "$backupgpgprivkey" >> $USB_MOUNT/.backupgpgkey
|
|
189
|
+
|
|
190
|
+ cp -rf /home/$MY_USERNAME/.gnupg $USB_MOUNT
|
|
191
|
+
|
|
192
|
+ if [ -d /etc/letsencrypt ]; then
|
|
193
|
+ cp -rf /etc/letsencrypt $USB_MOUNT
|
|
194
|
+ echo $"LetsEncrypt keys copied to $USB_DRIVE"
|
|
195
|
+ fi
|
|
196
|
+ if [ -d $USB_MOUNT/.gnupg ]; then
|
|
197
|
+ echo $"GPG Keyring copied to $USB_DRIVE. You may now remove the drive."
|
|
198
|
+ else
|
|
199
|
+ echo $"Unable to copy gpg keyring to $USB_DRIVE"
|
|
200
|
+ fi
|
|
201
|
+ umount -f $USB_MOUNT
|
|
202
|
+ rm -rf $USB_MOUNT
|
|
203
|
+ exit 0
|
204
|
204
|
fi
|
205
|
205
|
|
206
|
206
|
# Don't use the USB drive if it already contains a full keyring
|
207
|
207
|
if [ -d $USB_MOUNT/.gnupg ]; then
|
208
|
|
- echo $'A full GPG keyring already exists on the USB drive.'
|
209
|
|
- echo $'Either reformat the USB drive or use a different drive.'
|
210
|
|
- umount -f $USB_MOUNT
|
211
|
|
- rm -rf $USB_MOUNT
|
212
|
|
- exit 3392
|
|
208
|
+ echo $'A full GPG keyring already exists on the USB drive.'
|
|
209
|
+ echo $'Either reformat the USB drive or use a different drive.'
|
|
210
|
+ umount -f $USB_MOUNT
|
|
211
|
+ rm -rf $USB_MOUNT
|
|
212
|
+ exit 3392
|
213
|
213
|
fi
|
214
|
214
|
|
215
|
215
|
# Append the username as a subdirectory.
|
|
@@ -221,14 +221,14 @@ FRAGMENTS_DIR=$FRAGMENTS_DIR/$MY_USERNAME
|
221
|
221
|
|
222
|
222
|
# make a directory to contain the fragments
|
223
|
223
|
if [ ! -d $FRAGMENTS_DIR ]; then
|
224
|
|
- mkdir -p $FRAGMENTS_DIR
|
225
|
|
- echo $"Made directory $FRAGMENTS_DIR"
|
|
224
|
+ mkdir -p $FRAGMENTS_DIR
|
|
225
|
+ echo $"Made directory $FRAGMENTS_DIR"
|
226
|
226
|
fi
|
227
|
227
|
if [ ! -d $FRAGMENTS_DIR ]; then
|
228
|
|
- echo $"There was a problem making the directory $FRAGMENTS_DIR"
|
229
|
|
- umount -f $USB_MOUNT
|
230
|
|
- rm -rf $USB_MOUNT
|
231
|
|
- exit 6843
|
|
228
|
+ echo $"There was a problem making the directory $FRAGMENTS_DIR"
|
|
229
|
+ umount -f $USB_MOUNT
|
|
230
|
+ rm -rf $USB_MOUNT
|
|
231
|
+ exit 6843
|
232
|
232
|
fi
|
233
|
233
|
|
234
|
234
|
cd $FRAGMENTS_DIR
|