freedombone-keydrive 8.9KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # Makes a USB drive containing a gpg key fragment
  12. #
  13. # License
  14. # =======
  15. #
  16. # Copyright (C) 2015-2018 Bob Mottram <bob@freedombone.net>
  17. #
  18. # This program is free software: you can redistribute it and/or modify
  19. # it under the terms of the GNU Affero General Public License as published by
  20. # the Free Software Foundation, either version 3 of the License, or
  21. # (at your option) any later version.
  22. #
  23. # This program is distributed in the hope that it will be useful,
  24. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  25. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  26. # GNU Affero General Public License for more details.
  27. #
  28. # You should have received a copy of the GNU Affero General Public License
  29. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  30. PROJECT_NAME='freedombone'
  31. export TEXTDOMAIN=${PROJECT_NAME}-keydrive
  32. export TEXTDOMAINDIR="/usr/share/locale"
  33. USB_DRIVE=/dev/sdb1
  34. USB_MOUNT=/mnt/usb
  35. KEY_FRAGMENTS=3
  36. FRAGMENTS_DIR=$USB_MOUNT/.gnupg_fragments
  37. MY_USERNAME=$USER
  38. MASTER_DRIVE="no"
  39. FORMAT="no"
  40. function show_help {
  41. echo ''
  42. echo $"${PROJECT_NAME}-keydrive -u [username] -d [device, eg. sdb] --master [yes/no] -n [no of fragments] --format [yes/no]"
  43. echo ''
  44. exit 0
  45. }
  46. while [ $# -gt 1 ]
  47. do
  48. key="$1"
  49. case $key in
  50. -h|--help)
  51. show_help
  52. ;;
  53. -u|--user)
  54. shift
  55. MY_USERNAME="$1"
  56. ;;
  57. -d|--dev)
  58. shift
  59. if [[ "${1}" != '/dev/'* ]]; then
  60. USB_DRIVE=/dev/${1}1
  61. else
  62. USB_DRIVE=${1}
  63. fi
  64. ;;
  65. -m|--master)
  66. shift
  67. MASTER_DRIVE="$1"
  68. ;;
  69. -n|--fragments)
  70. shift
  71. KEY_FRAGMENTS=$1
  72. ;;
  73. -f|--format)
  74. shift
  75. FORMAT="yes"
  76. ;;
  77. *)
  78. # unknown option
  79. ;;
  80. esac
  81. shift
  82. done
  83. if [ ! "$MY_USERNAME" ]; then
  84. echo $'No username given'
  85. exit 69350
  86. fi
  87. if [ ! -d "/home/$MY_USERNAME" ]; then
  88. echo $"Home directory for $MY_USERNAME not found. This user may not exist on the system"
  89. exit 72378
  90. fi
  91. if [ ! -b "$USB_DRIVE" ]; then
  92. echo $'Please attach a USB drive'
  93. exit 65743
  94. fi
  95. umount -f $USB_MOUNT
  96. if [ ! -d $USB_MOUNT ]; then
  97. mkdir $USB_MOUNT
  98. fi
  99. if [ -f /dev/mapper/encrypted_usb ]; then
  100. rm -rf /dev/mapper/encrypted_usb
  101. fi
  102. cryptsetup luksClose encrypted_usb
  103. # optionally format the drive
  104. if [[ $FORMAT == "yes" ]]; then
  105. if ! "${PROJECT_NAME}-format" "${USB_DRIVE::-1}"; then
  106. exit 36823
  107. fi
  108. fi
  109. if cryptsetup luksOpen "$USB_DRIVE" encrypted_usb; then
  110. USB_DRIVE=/dev/mapper/encrypted_usb
  111. fi
  112. if ! mount $USB_DRIVE $USB_MOUNT; then
  113. echo $"There was a problem mounting the USB drive to $USB_MOUNT"
  114. rm -rf $USB_MOUNT
  115. exit 78543
  116. fi
  117. # optionally create a master drive which contains the full GPG keyring
  118. if [[ $MASTER_DRIVE == "yes" || $MASTER_DRIVE == "y" || $MASTER_DRIVE == "1" ]]; then
  119. if [ ! -d "/home/$MY_USERNAME/.gnupg" ]; then
  120. echo $"No .gnupg directory was found for $MY_USERNAME"
  121. umount -f $USB_MOUNT
  122. rm -rf $USB_MOUNT
  123. exit 73025
  124. fi
  125. # export the gpg key and backup key as text
  126. # so that it may be imported at the beginning of new installs
  127. GPG_TTY=$(tty)
  128. export GPG_TTY
  129. USER_EMAIL_ADDRESS=$MY_USERNAME@$HOSTNAME
  130. GPG_ID=$(su -m root -c "gpg --list-keys $USER_EMAIL_ADDRESS | sed -n '2p' | sed 's/^[ \\t]*//'" - "$MY_USERNAME")
  131. GPG_BACKUP_ID=$(su -m root -c "gpg --list-keys \"(backup key)\" | sed -n '2p' | sed 's/^[ \\t]*//'" - "$MY_USERNAME")
  132. gpgerrstr=$'error'
  133. gpgkey=$(gpg --homedir="/home/$MY_USERNAME/.gnupg" --armor --export "$GPG_ID")
  134. if [[ "$gpgkey" == *"$gpgerrstr"* ]]; then
  135. echo $'Problem exporting public gpg key'
  136. echo "$gpgkey"
  137. exit 735282
  138. fi
  139. echo ''
  140. echo $'Enter your gpg private key passphrase:'
  141. gpgprivkey=$(gpg --homedir="/home/$MY_USERNAME/.gnupg" --armor --export-secret-key "$GPG_ID")
  142. if [[ "$gpgprivkey" == *"$gpgerrstr"* ]]; then
  143. echo $'Problem exporting private gpg key'
  144. echo "$gpgprivkey"
  145. gpgprivkey=
  146. exit 629362
  147. fi
  148. # Dummy password to get around not being able to create a key without passphrase
  149. BACKUP_DUMMY_PASSWORD='backup'
  150. backupgpgkey=$(gpg --homedir="/home/$MY_USERNAME/.gnupg" --armor --export "$GPG_BACKUP_ID")
  151. if [[ "$backupgpgkey" == *"$gpgerrstr"* ]]; then
  152. echo $'Problem exporting public gpg backup key'
  153. echo "$backupgpgkey"
  154. exit 735282
  155. fi
  156. backupgpgprivkey=$(echo "$BACKUP_DUMMY_PASSWORD" | gpg --batch --passphrase-fd 0 --homedir="/home/$MY_USERNAME/.gnupg" --armor --export-secret-key "$GPG_BACKUP_ID")
  157. if [[ "$backupgpgprivkey" == *"$gpgerrstr"* ]]; then
  158. echo $'Problem exporting private gpg backup key'
  159. echo "$backupgpgprivkey"
  160. backupgpgprivkey=
  161. exit 629362
  162. fi
  163. echo "$gpgkey" > $USB_MOUNT/.mastergpgkey
  164. echo "$gpgprivkey" >> $USB_MOUNT/.mastergpgkey
  165. echo "$backupgpgkey" > $USB_MOUNT/.backupgpgkey
  166. echo "$backupgpgprivkey" >> $USB_MOUNT/.backupgpgkey
  167. cp -rf "/home/$MY_USERNAME/.gnupg" $USB_MOUNT
  168. if [ -d /etc/letsencrypt ]; then
  169. cp -rf /etc/letsencrypt $USB_MOUNT
  170. echo $"LetsEncrypt keys copied to $USB_DRIVE"
  171. fi
  172. if [ -d $USB_MOUNT/.gnupg ]; then
  173. echo $"GPG Keyring copied to $USB_DRIVE. You may now remove the drive."
  174. else
  175. echo $"Unable to copy gpg keyring to $USB_DRIVE"
  176. fi
  177. umount -f $USB_MOUNT
  178. rm -rf $USB_MOUNT
  179. exit 0
  180. fi
  181. # Don't use the USB drive if it already contains a full keyring
  182. if [ -d $USB_MOUNT/.gnupg ]; then
  183. echo $'A full GPG keyring already exists on the USB drive.'
  184. echo $'Either reformat the USB drive or use a different drive.'
  185. umount -f $USB_MOUNT
  186. rm -rf $USB_MOUNT
  187. exit 3392
  188. fi
  189. # Append the username as a subdirectory.
  190. # This has a down side in that it does identify a given fragment
  191. # as belonging to a given user, but has the convenience upside
  192. # of being able to carry key fragments for multiple friends on
  193. # the same USB drive
  194. FRAGMENTS_DIR=$FRAGMENTS_DIR/$MY_USERNAME
  195. # make a directory to contain the fragments
  196. if [ ! -d "$FRAGMENTS_DIR" ]; then
  197. mkdir -p "$FRAGMENTS_DIR"
  198. echo $"Made directory $FRAGMENTS_DIR"
  199. fi
  200. if [ ! -d "$FRAGMENTS_DIR" ]; then
  201. echo $"There was a problem making the directory $FRAGMENTS_DIR"
  202. umount -f $USB_MOUNT
  203. rm -rf $USB_MOUNT
  204. exit 6843
  205. fi
  206. cd "$FRAGMENTS_DIR" || exit 13389478368
  207. # shellcheck disable=SC2012
  208. if ! no_of_usb_shares=$(ls -afq keyshare.asc.* | wc -l); then
  209. no_of_usb_shares=0
  210. fi
  211. if (( no_of_usb_shares > 0 )); then
  212. echo $"A key fragment already exists on the drive for the user $MY_USERNAME"
  213. cd ~/ || exit 34678264583
  214. umount -f $USB_MOUNT
  215. rm -rf $USB_MOUNT
  216. exit 58945
  217. fi
  218. # copy a random fragment to the drive
  219. LOCAL_FRAGMENTS_DIR=/home/$MY_USERNAME/.gnupg_fragments
  220. if [ ! -d "$LOCAL_FRAGMENTS_DIR" ]; then
  221. "${PROJECT_NAME}-splitkey" -u "$MY_USERNAME" -n "$KEY_FRAGMENTS"
  222. fi
  223. cd "$LOCAL_FRAGMENTS_DIR" || exit 7822452644
  224. # shellcheck disable=SC2012
  225. if ! no_of_local_shares=$(ls -afq keyshare.asc.* | wc -l); then
  226. no_of_local_shares=0
  227. fi
  228. if (( no_of_local_shares < 3 )); then
  229. "${PROJECT_NAME}-splitkey" -u "$MY_USERNAME" -n "$KEY_FRAGMENTS"
  230. cd "$LOCAL_FRAGMENTS_DIR" || exit 724524242
  231. # shellcheck disable=SC2012
  232. if ! no_of_local_shares=$(ls -afq keyshare.asc.* | wc -l); then
  233. no_of_local_shares=0
  234. fi
  235. fi
  236. if (( no_of_local_shares < 3 )); then
  237. echo $"Not enough key fragments available ${no_of_local_shares}"
  238. cd ~/ || exit 7245267457
  239. umount -f $USB_MOUNT
  240. rm -rf $USB_MOUNT
  241. exit 63386
  242. fi
  243. share_files=("$LOCAL_FRAGMENTS_DIR/keyshare.asc.*")
  244. SHARE_FILENAME=${share_files[RANDOM % ${#share_files[@]}]}
  245. cp -f "$SHARE_FILENAME" "$FRAGMENTS_DIR"
  246. cd "$FRAGMENTS_DIR" || exit 2543244726
  247. # shellcheck disable=SC2012
  248. no_of_usb_shares=$(ls -afq keyshare.asc.* | wc -l)
  249. echo $"Number of fragments on the drive: ${no_of_usb_shares}"
  250. if (( no_of_usb_shares > 1 )); then
  251. echo $"Too many key fragments exist in $FRAGMENTS_DIR"
  252. ls "$FRAGMENTS_DIR"
  253. cd ~/ || 357836582645
  254. umount -f $USB_MOUNT
  255. rm -rf $USB_MOUNT
  256. exit 54292
  257. fi
  258. if (( no_of_usb_shares <= 0 )); then
  259. echo $"There was a problem copying the key fragment to $USB_DRIVE"
  260. echo $"Files found: ${no_of_usb_shares}"
  261. ls "$FRAGMENTS_DIR"
  262. cd ~/ || exit 743452452
  263. umount -f $USB_MOUNT
  264. rm -rf $USB_MOUNT
  265. exit 54292
  266. fi
  267. cd ~/ || exit 245672457
  268. umount -f $USB_MOUNT
  269. rm -rf $USB_MOUNT
  270. echo $"Key fragment copied to $USB_DRIVE. You may now remove the drive."
  271. exit 0