freedombone-utils-keys 11KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Encryption key related functions
  12. # License
  13. # =======
  14. #
  15. # Copyright (C) 2015-2016 Bob Mottram <bob@freedombone.net>
  16. #
  17. # This program is free software: you can redistribute it and/or modify
  18. # it under the terms of the GNU Affero General Public License as published by
  19. # the Free Software Foundation, either version 3 of the License, or
  20. # (at your option) any later version.
  21. #
  22. # This program is distributed in the hope that it will be useful,
  23. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  24. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  25. # GNU Affero General Public License for more details.
  26. #
  27. # You should have received a copy of the GNU Affero General Public License
  28. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  29. function interactive_gpg_from_usb {
  30. dialog --title $"Recover Encryption Keys" \
  31. --msgbox $'Plug in a USB keydrive containing a copy of your full key or key fragment' 6 70
  32. HOME_DIR=/home/$MY_USERNAME
  33. GPG_LOADING="yes"
  34. SSH_IMPORTED="no"
  35. GPG_CTR=0
  36. while [[ $GPG_LOADING == "yes" ]]
  37. do
  38. detect_usb_drive
  39. if [ ! -b $USB_DRIVE ]; then
  40. if (( GPG_CTR > 0 )); then
  41. gpg_reconstruct_key $MY_USERNAME interactive
  42. gpg_update_mutt $MY_USERNAME
  43. return 0
  44. fi
  45. dialog --title $"Recover Encryption Keys" --msgbox $'No USB drive found' 6 30
  46. exit 739836
  47. fi
  48. backup_mount_drive ${USB_DRIVE} ${MY_USERNAME}
  49. if [ ! -d $USB_MOUNT ]; then
  50. if (( GPG_CTR > 0 )); then
  51. backup_unmount_drive ${USB_DRIVE}
  52. gpg_reconstruct_key $MY_USERNAME interactive
  53. return 0
  54. fi
  55. dialog --title $"Recover Encryption Keys" \
  56. --msgbox $"There was a problem mounting the USB drive $USB_DRIVE to $USB_MOUNT" 6 70
  57. backup_unmount_drive ${USB_DRIVE}
  58. exit 74393
  59. fi
  60. if [ ! -d $USB_MOUNT/.gnupg ]; then
  61. if [ ! -d $USB_MOUNT/.gnupg_fragments ]; then
  62. if (( GPG_CTR > 0 )); then
  63. backup_unmount_drive ${USB_DRIVE}
  64. gpg_reconstruct_key $MY_USERNAME interactive
  65. gpg_update_mutt $MY_USERNAME
  66. return 0
  67. fi
  68. dialog --title $"Recover Encryption Keys" \
  69. --msgbox $"The directory $USB_MOUNT/.gnupg or $USB_MOUNT/.gnupg_fragments was not found" 6 70
  70. backup_unmount_drive ${USB_DRIVE}
  71. exit 723814
  72. fi
  73. fi
  74. if [ -d $USB_MOUNT/letsencrypt ]; then
  75. if [ ! -d /etc/letsencrypt ]; then
  76. mkdir /etc/letsencrypt
  77. fi
  78. echo $'Recovering LetsEncrypt keys'
  79. cp -r $USB_MOUNT/letsencrypt/* /etc/letsencrypt
  80. addgroup ssl-cert
  81. chown -R root:ssl-cert /etc/letsencrypt
  82. fi
  83. if [ -f $USB_MOUNT/.mastergpgkey ]; then
  84. # Recovering keys from file rather than just copying the gnupg
  85. # directory may help to avoid problems during upgrades/reinstalls
  86. if [ ! -f $USB_MOUNT/.backupgpgkey ]; then
  87. echo $'No backup key file found on USB drive'
  88. exit 725729
  89. fi
  90. CURR_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
  91. CURR_GPG_ID=$(gpg --homedir=$HOME_DIR/.gnupg --list-keys $CURR_EMAIL_ADDRESS | sed -n '2p' | sed 's/^[ \t]*//')
  92. CURR_GPG_BACKUP_ID=$(gpg --homedir=$HOME_DIR/.gnupg --list-keys "(backup key)" | sed -n '2p' | sed 's/^[ \t]*//')
  93. # If the default key is specified within gpg.conf
  94. if [ -f $HOME_DIR/gpg.conf ]; then
  95. if grep -q "default-key" $HOME_DIR/gpg.conf; then
  96. default_gpg_key=$(cat $HOME_DIR/gpg.conf | grep "default-key")
  97. if [[ "$default_gpg_key" != *'#'* ]]; then
  98. default_gpg_key=$(cat $HOME_DIR/gpg.conf | grep "default-key" | awk -F ' ' '{print $2}')
  99. if [ ${#default_gpg_key} -gt 3 ]; then
  100. CURR_GPG_ID=$(gpg --homedir=$HOME_DIR/.gnupg --list-keys $default_gpg_key | sed -n '2p' | sed 's/^[ \t]*//')
  101. fi
  102. fi
  103. fi
  104. fi
  105. echo $'Making backup copy of existing gpg keys'
  106. if [ -d $HOME_DIR/.gnupg ]; then
  107. if [ -d $HOME_DIR/.gnupg_old ]; then
  108. rm -rf $HOME_DIR/.gnupg_old
  109. fi
  110. cp -r $HOME_DIR/.gnupg $HOME_DIR/.gnupg_old
  111. chmod 700 $HOME_DIR/.gnupg_old
  112. chmod -R 600 $HOME_DIR/.gnupg_old/*
  113. chown -R $MY_USERNAME:$MY_USERNAME $HOME_DIR/.gnupg_old
  114. fi
  115. echo $'Removing old gpg keys'
  116. gpg_delete_key $MY_USERNAME $CURR_GPG_BACKUP_ID
  117. gpg_delete_key $MY_USERNAME $CURR_GPG_ID
  118. echo $'Importing master keys'
  119. gpg --homedir=$HOME_DIR/.gnupg --allow-secret-key-import --import $USB_MOUNT/.mastergpgkey
  120. echo "$BACKUP_DUMMY_PASSWORD" | gpg --batch --passphrase-fd 0 --homedir=$HOME_DIR/.gnupg --allow-secret-key-import --import $USB_MOUNT/.backupgpgkey
  121. if [ -d $HOME_DIR/.gnupg ]; then
  122. echo $'Setting permissions'
  123. gpg_set_permissions $MY_USERNAME
  124. echo $"Updating muttrc for $MY_USERNAME"
  125. gpg_update_mutt $MY_USERNAME
  126. fi
  127. GPG_LOADING="no"
  128. dialog --title $"Recover Encryption Keys" \
  129. --msgbox $"GPG Keyring loaded to $HOME_DIR from master keydrive" 6 70
  130. else
  131. if [ -d $USB_MOUNT/.gnupg ]; then
  132. if [ ! -d $HOME_DIR/.gnupg ]; then
  133. mkdir $HOME_DIR/.gnupg
  134. fi
  135. echo $'Recovering GPG keys'
  136. cp -r $USB_MOUNT/.gnupg/* $HOME_DIR/.gnupg
  137. GPG_LOADING="no"
  138. dialog --title $"Recover Encryption Keys" \
  139. --msgbox $"GPG Keyring directory loaded to $HOME_DIR" 6 70
  140. else
  141. # Collect fragments from the USB drive
  142. if [ ! -d $HOME_DIR/.gnupg_fragments ]; then
  143. mkdir $HOME_DIR/.gnupg_fragments
  144. fi
  145. cp -r $USB_MOUNT/.gnupg_fragments/* $HOME_DIR/.gnupg_fragments
  146. fi
  147. fi
  148. if [[ $SSH_IMPORTED == "no" ]]; then
  149. if [ -d $USB_MOUNT/.ssh ]; then
  150. if [ ! -d $HOME_DIR/.ssh ]; then
  151. mkdir $HOME_DIR/.ssh
  152. fi
  153. cp $USB_MOUNT/.ssh/* $HOME_DIR/.ssh
  154. dialog --title $"Recover Encryption Keys" \
  155. --msgbox $"ssh keys imported" 6 70
  156. SSH_IMPORTED="yes"
  157. fi
  158. fi
  159. if [ -d $USB_MOUNT ]; then
  160. backup_unmount_drive ${USB_DRIVE}
  161. fi
  162. if [[ $GPG_LOADING == "yes" ]]; then
  163. dialog --title $"Recover Encryption Keys" \
  164. --msgbox $"Now remove the USB drive. Insert the next drive containing a key fragment, or select Ok to finish" 6 70
  165. fi
  166. GPG_CTR=$((GPG_CTR + 1))
  167. done
  168. }
  169. function interactive_gpg_from_remote {
  170. REMOTE_SERVERS_LIST=/home/$MY_USERNAME/keyshareservers.txt
  171. # get a list of remote servers
  172. ${PROJECT_NAME}-remote -u $MY_USERNAME -l $REMOTE_SERVERS_LIST -t "Remote server"
  173. if [ ! -f $REMOTE_SERVERS_LIST ]; then
  174. dialog --title $"Encryption Keys Recovery" --msgbox $'Error obtaining server list' 6 70
  175. return 1
  176. fi
  177. # check the number of entries in the file
  178. no_of_servers=$(cat $REMOTE_SERVERS_LIST | wc -l)
  179. if (( no_of_servers < 3 )); then
  180. dialog --title $"Encryption Keys Recovery" \
  181. --msgbox $'There must be at least three servers to recover the key' 6 70
  182. return 2
  183. fi
  184. # try to recover the key from the servers
  185. ${PROJECT_NAME}-recoverkey -u $MY_USERNAME -l $REMOTE_SERVERS_LIST
  186. if [ ! "$?" = "0" ]; then
  187. dialog --title $"Encryption Keys Recovery" --msgbox $'Your key could not be recovered' 6 70
  188. return 3
  189. fi
  190. dialog --title $"Encryption Keys Recovery" --msgbox $'Your key has been recovered' 6 70
  191. return 0
  192. }
  193. function interactive_gpg {
  194. GPG_CONFIGURED="no"
  195. while [[ $GPG_CONFIGURED != "yes" ]]
  196. do
  197. GPG_CONFIGURED="yes"
  198. data=$(tempfile 2>/dev/null)
  199. trap "rm -f $data" 0 1 2 5 15
  200. dialog --backtitle $"Freedombone Configuration" \
  201. --radiolist $"GPG/PGP keys for your system:" 13 70 3 \
  202. 1 $"Generate new keys (new user)" on \
  203. 2 $"Import keys from USB drive/s" off \
  204. 3 $"Retrieve keys from friends servers" off 2> $data
  205. sel=$?
  206. case $sel in
  207. 1) exit 1;;
  208. 255) exit 2;;
  209. esac
  210. case $(cat $data) in
  211. 1) if [ -d /home/${MY_USERNAME}/.gnupg ]; then
  212. rm -rf /home/${MY_USERNAME}/.gnupg
  213. fi
  214. break;;
  215. 2) interactive_gpg_from_usb
  216. break;;
  217. 3) interactive_gpg_from_remote
  218. if [ ! "$?" = "0" ]; then
  219. GPG_CONFIGURED="no"
  220. fi;;
  221. esac
  222. done
  223. }
  224. function interactive_key_recovery {
  225. data=$(tempfile 2>/dev/null)
  226. trap "rm -f $data" 0 1 2 5 15
  227. dialog --title $"Encryption Keys Recovery" \
  228. --backtitle $"Freedombone Configuration" \
  229. --defaultno \
  230. --yesno $"Do you wish to recover your previous encryption keys from a USB master keydrive?" 7 60
  231. sel=$?
  232. case $sel in
  233. 1) return;;
  234. 255) return;;
  235. esac
  236. clear
  237. apt-get -yq install cryptsetup
  238. ${PROJECT_NAME}-recoverkey -u $MY_USERNAME
  239. if [ -d /home/$MY_USERNAME/.gnupg ]; then
  240. cp -rf /home/$MY_USERNAME/.gnupg /root
  241. chmod 700 /root/.gnupg
  242. chmod 600 /root/.gnupg/*
  243. fi
  244. }
  245. function set_password_for_all_users {
  246. app_name="$1"
  247. change_password="$2"
  248. for d in /home/*/ ; do
  249. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  250. if [[ $(is_valid_user "$USERNAME") == "1" ]]; then
  251. ${PROJECT_NAME}-pass -u "${USERNAME}" -a "${app_name}" -p "${change_password}"
  252. fi
  253. done
  254. }
  255. # NOTE: deliberately there is no "exit 0"