freedombone-splitkey 4.3KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # A script which splits a user's gpg key into fragments which
  12. # may then be shared
  13. # To get a random fragment
  14. # get a random fragment
  15. # fragment_files=($FRAGMENTS_DIR/*)
  16. # FRAGMENT_FILE="${files[RANDOM % ${#files[@]}]}"
  17. # License
  18. # =======
  19. #
  20. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  21. #
  22. # This program is free software: you can redistribute it and/or modify
  23. # it under the terms of the GNU General Public License as published by
  24. # the Free Software Foundation, either version 3 of the License, or
  25. # (at your option) any later version.
  26. #
  27. # This program is distributed in the hope that it will be useful,
  28. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  29. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  30. # GNU General Public License for more details.
  31. #
  32. # You should have received a copy of the GNU General Public License
  33. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  34. KEY_FRAGMENTS=3
  35. MY_USERNAME=
  36. MY_EMAIL_ADDRESS=
  37. MY_NAME=
  38. function show_help {
  39. echo ''
  40. echo 'freedombone-splitkey -u [username] -n [number of fragments] -e [email address] --fullname [Full name]'
  41. echo ''
  42. exit 0
  43. }
  44. while [[ $# > 1 ]]
  45. do
  46. key="$1"
  47. case $key in
  48. -h|--help)
  49. show_help
  50. ;;
  51. -u|--user)
  52. shift
  53. MY_USERNAME="$1"
  54. ;;
  55. -n|--fragments)
  56. shift
  57. KEY_FRAGMENTS=$1
  58. ;;
  59. -e|--email)
  60. shift
  61. MY_EMAIL_ADDRESS=$1
  62. ;;
  63. --fullname)
  64. shift
  65. MY_NAME=$1
  66. ;;
  67. *)
  68. # unknown option
  69. ;;
  70. esac
  71. shift
  72. done
  73. if [ ! $MY_USERNAME ]; then
  74. show_help
  75. fi
  76. if [ ! -d /home/$MY_USERNAME ]; then
  77. echo "User $MY_USERNAME does not exist on the system"
  78. exit 7270
  79. fi
  80. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  81. echo 'No gpg key found'
  82. exit 5393
  83. fi
  84. FRAGMENTS_DIR=/home/$MY_USERNAME/.gnupg_fragments
  85. if [ -d $FRAGMENTS_DIR ]; then
  86. exit 0
  87. fi
  88. # get the gpg key ID
  89. if [ ! $MY_EMAIL_ADDRESS ]; then
  90. MY_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
  91. fi
  92. KEYID=$(su -c "gpg --list-keys $MY_EMAIL_ADDRESS | grep 'pub '" - \
  93. $MY_USERNAME | awk -F ' ' '{print $2}' | awk -F '/' '{print $2}')
  94. if [ ${#KEYID} -lt 4 ]; then
  95. echo "gpg key for $MY_EMAIL_ADDRESS was not found"
  96. return 3682
  97. fi
  98. MY_BACKUP_KEY_ID=$(gpg --list-keys "$MY_NAME (backup key)" | \
  99. grep 'pub ' | awk -F ' ' '{print $2}' | \
  100. awk -F '/' '{print $2}')
  101. if [ ${#MY_BACKUP_KEY_ID} -lt 4 ]; then
  102. echo "gpg backup key for '$MY_NAME' was not found"
  103. return 58213
  104. fi
  105. # create the key file
  106. mkdir -p $FRAGMENTS_DIR
  107. KEYS_FILE=$FRAGMENTS_DIR/keyshare.asc
  108. gpg --output $FRAGMENTS_DIR/pubkey.txt --armor --export $KEYID
  109. if [ ! "$?" = "0" ]; then
  110. echo "Unable to extract public key for $KEYID"
  111. exit 7835
  112. fi
  113. gpg --output $FRAGMENTS_DIR/privkey.txt \
  114. --armor --export-secret-key $KEYID
  115. if [ ! "$?" = "0" ]; then
  116. echo "Unable to extract private key for $KEYID"
  117. exit 7823
  118. fi
  119. gpg --output $FRAGMENTS_DIR/backup_pubkey.txt \
  120. --armor --export $MY_BACKUP_KEY_ID
  121. if [ ! "$?" = "0" ]; then
  122. echo "Unable to extract backup public key for $MY_BACKUP_KEY_ID"
  123. exit 62928
  124. fi
  125. gpg --output $FRAGMENTS_DIR/backup_privkey.txt \
  126. --armor --export-secret-key $MY_BACKUP_KEY_ID
  127. if [ ! "$?" = "0" ]; then
  128. echo "Unable to extract backup private key for $MY_BACKUP_KEY_ID"
  129. exit 13783
  130. fi
  131. cat $FRAGMENTS_DIR/pubkey.txt \
  132. $FRAGMENTS_DIR/privkey.txt \
  133. $FRAGMENTS_DIR/backup_pubkey.txt \
  134. $FRAGMENTS_DIR/backup_privkey.txt > $KEYS_FILE
  135. shred -zu $FRAGMENTS_DIR/privkey.txt
  136. shred -zu $FRAGMENTS_DIR/pubkey.txt
  137. shred -zu $FRAGMENTS_DIR/backup_privkey.txt
  138. shred -zu $FRAGMENTS_DIR/backup_pubkey.txt
  139. KEY_SHARES=$((KEY_FRAGMENTS * 2))
  140. gfsplit -n $KEY_FRAGMENTS -m $KEY_SHARES $KEYS_FILE
  141. if [ ! "$?" = "0" ]; then
  142. echo "Unable to split the gpg key"
  143. rm -rf $FRAGMENTS_DIR
  144. if [ -f $KEYS_FILE ]; then
  145. shred -zu $KEYS_FILE
  146. fi
  147. exit 63028
  148. fi
  149. shred -zu $KEYS_FILE
  150. # set permissions
  151. chown -R $MY_USERNAME:$MY_USERNAME $FRAGMENTS_DIR
  152. chmod -R 600 $FRAGMENTS_DIR
  153. echo "$KEY_SHARES key shares created"
  154. exit 0