freedombone-keydrive 6.0KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Makes a USB drive containing a gpg key fragment
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015 Bob Mottram <bob@robotics.uk.to>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. USB_DRIVE=/dev/sdb1
  31. USB_MOUNT=/mnt/usb
  32. KEY_FRAGMENTS=3
  33. FRAGMENTS_DIR=$USB_MOUNT/.gnupg_fragments
  34. MY_USERNAME=$USER
  35. MASTER_DRIVE="no"
  36. FORMAT="no"
  37. function show_help {
  38. echo ''
  39. echo 'freedombone-keydrive -u [username] -d [device, eg. sdb] --master [yes/no] -n [no of fragments] --format [yes/no]'
  40. echo ''
  41. exit 0
  42. }
  43. while [[ $# > 1 ]]
  44. do
  45. key="$1"
  46. case $key in
  47. -h|--help)
  48. show_help
  49. ;;
  50. -u|--user)
  51. shift
  52. MY_USERNAME="$1"
  53. ;;
  54. -d|--dev)
  55. shift
  56. USB_DRIVE=/dev/${1}1
  57. ;;
  58. -m|--master)
  59. shift
  60. MASTER_DRIVE="$1"
  61. ;;
  62. -n|--fragments)
  63. shift
  64. KEY_FRAGMENTS=$1
  65. ;;
  66. -f|--format)
  67. shift
  68. FORMAT="yes"
  69. ;;
  70. *)
  71. # unknown option
  72. ;;
  73. esac
  74. shift
  75. done
  76. if [ ! $MY_USERNAME ]; then
  77. echo 'No username given'
  78. exit 69350
  79. fi
  80. if [ ! -d /home/$MY_USERNAME ]; then
  81. echo "Home directory for $MY_USERNAME not found. This user may not exist on the system"
  82. exit 72378
  83. fi
  84. if [ ! -b $USB_DRIVE ]; then
  85. echo 'Please attach a USB drive'
  86. exit 65743
  87. fi
  88. umount -f $USB_MOUNT
  89. if [ ! -d $USB_MOUNT ]; then
  90. mkdir $USB_MOUNT
  91. fi
  92. if [ -f /dev/mapper/encrypted_usb ]; then
  93. rm -rf /dev/mapper/encrypted_usb
  94. fi
  95. cryptsetup luksClose encrypted_usb
  96. # optionally format the drive
  97. if [[ $FORMAT == "yes" ]]; then
  98. freedombone-format ${USB_DRIVE::-1}
  99. if [ ! "$?" = "0" ]; then
  100. exit 36823
  101. fi
  102. fi
  103. cryptsetup luksOpen $USB_DRIVE encrypted_usb
  104. if [ "$?" = "0" ]; then
  105. USB_DRIVE=/dev/mapper/encrypted_usb
  106. fi
  107. mount $USB_DRIVE $USB_MOUNT
  108. if [ ! "$?" = "0" ]; then
  109. echo "There was a problem mounting the USB drive to $USB_MOUNT"
  110. rm -rf $USB_MOUNT
  111. exit 78543
  112. fi
  113. # optionally create a master drive which contains the full GPG keyring
  114. if [[ $MASTER_DRIVE == "yes" || $MASTER_DRIVE == "y" || $MASTER_DRIVE == "1" ]]; then
  115. if [ ! -d /home/$MY_USERNAME/.gnupg ]; then
  116. echo "No .gnupg directory was found for $MY_USERNAME"
  117. umount -f $USB_MOUNT
  118. rm -rf $USB_MOUNT
  119. exit 73025
  120. fi
  121. cp -rf /home/$MY_USERNAME/.gnupg $USB_MOUNT
  122. if [ -d $USB_MOUNT/.gnupg ]; then
  123. echo "GPG Keyring copied to $USB_DRIVE. You may now remove the drive."
  124. else
  125. echo "Unable to copy gpg keyring to $USB_DRIVE"
  126. fi
  127. umount -f $USB_MOUNT
  128. rm -rf $USB_MOUNT
  129. exit 0
  130. fi
  131. # Don't use the USB drive if it already contains a full keyring
  132. if [ -d $USB_MOUNT/.gnupg ]; then
  133. echo 'A full GPG keyring already exists on the USB drive.'
  134. echo 'Either reformat the USB drive or use a different drive.'
  135. umount -f $USB_MOUNT
  136. rm -rf $USB_MOUNT
  137. exit 3392
  138. fi
  139. # Append the username as a subdirectory.
  140. # This has a down side in that it does identify a given fragment
  141. # as belonging to a given user, but has the convenience upside
  142. # of being able to carry key fragments for multiple friends on
  143. # the same USB drive
  144. FRAGMENTS_DIR=$FRAGMENTS_DIR/$MY_USERNAME
  145. # make a directory to contain the fragments
  146. if [ ! -d $FRAGMENTS_DIR ]; then
  147. mkdir -p $FRAGMENTS_DIR
  148. echo "Made directory $FRAGMENTS_DIR"
  149. fi
  150. if [ ! -d $FRAGMENTS_DIR ]; then
  151. echo "There was a problem making the directory $FRAGMENTS_DIR"
  152. umount -f $USB_MOUNT
  153. rm -rf $USB_MOUNT
  154. exit 6843
  155. fi
  156. cd $FRAGMENTS_DIR
  157. no_of_usb_shares=$(ls -afq keyshare.asc.* | wc -l)
  158. if [ ! "$?" = "0" ]; then
  159. no_of_usb_shares=0
  160. fi
  161. if (( no_of_usb_shares > 0 )); then
  162. echo "A key fragment already exists on the drive for the user $MY_USERNAME"
  163. cd ~/
  164. umount -f $USB_MOUNT
  165. rm -rf $USB_MOUNT
  166. exit 58945
  167. fi
  168. # copy a random fragment to the drive
  169. LOCAL_FRAGMENTS_DIR=/home/$MY_USERNAME/.gnupg_fragments
  170. if [ ! -d $LOCAL_FRAGMENTS_DIR ]; then
  171. freedombone-splitkey -u $MY_USERNAME -n $KEY_FRAGMENTS
  172. fi
  173. cd $LOCAL_FRAGMENTS_DIR
  174. no_of_local_shares=$(ls -afq keyshare.asc.* | wc -l)
  175. if [ ! "$?" = "0" ]; then
  176. no_of_local_shares=0
  177. fi
  178. if (( no_of_local_shares < 3 )); then
  179. freedombone-splitkey -u $MY_USERNAME -n $KEY_FRAGMENTS
  180. cd $LOCAL_FRAGMENTS_DIR
  181. no_of_local_shares=$(ls -afq keyshare.asc.* | wc -l)
  182. if [ ! "$?" = "0" ]; then
  183. no_of_local_shares=0
  184. fi
  185. fi
  186. if (( no_of_local_shares < 3 )); then
  187. echo "Not enough key fragments available ${no_of_local_shares}"
  188. cd ~/
  189. umount -f $USB_MOUNT
  190. rm -rf $USB_MOUNT
  191. exit 63386
  192. fi
  193. share_files=($LOCAL_FRAGMENTS_DIR/keyshare.asc.*)
  194. SHARE_FILENAME=${share_files[RANDOM % ${#share_files[@]}]}
  195. cp -f $SHARE_FILENAME $FRAGMENTS_DIR
  196. cd $FRAGMENTS_DIR
  197. no_of_usb_shares=$(ls -afq keyshare.asc.* | wc -l)
  198. echo "Number of fragments on the drive: ${no_of_usb_shares}"
  199. if (( no_of_usb_shares > 1 )); then
  200. echo "Too many key fragments exist in $FRAGMENTS_DIR"
  201. ls $FRAGMENTS_DIR
  202. cd ~/
  203. umount -f $USB_MOUNT
  204. rm -rf $USB_MOUNT
  205. exit 54292
  206. fi
  207. if (( no_of_usb_shares <= 0 )); then
  208. echo "There was a problem copying the key fragment to $USB_DRIVE"
  209. echo "Files found: ${no_of_usb_shares}"
  210. ls $FRAGMENTS_DIR
  211. cd ~/
  212. umount -f $USB_MOUNT
  213. rm -rf $USB_MOUNT
  214. exit 54292
  215. fi
  216. cd ~/
  217. umount -f $USB_MOUNT
  218. rm -rf $USB_MOUNT
  219. echo "Key fragment copied to $USB_DRIVE. You may now remove the drive."
  220. exit 0