freedomboneeee/src/freedombone-recoverkey

178 lines
4.9 KiB
Bash
Executable File

#!/bin/bash
# _____ _ _
# | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
# | __| _| -_| -_| . | . | | . | . | | -_|
# |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
#
# Freedom in the Cloud
#
# A script which recovers a user's gpg key from a number of fragments
# License
# =======
#
# Copyright (C) 2015-2018 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
PROJECT_NAME='freedombone'
export TEXTDOMAIN=${PROJECT_NAME}-recoverkey
export TEXTDOMAINDIR="/usr/share/locale"
source "$PROJECT_INSTALL_DIR/${PROJECT_NAME}-vars"
# include utils which allow function_check, go and drive mount
UTILS_FILES="/usr/share/${PROJECT_NAME}/utils/${PROJECT_NAME}-utils-*"
for f in $UTILS_FILES
do
source "$f"
done
FRIENDS_SERVERS_LIST=
MY_USERNAME=
function show_help {
echo ''
echo $"${PROJECT_NAME}-recoverkey -u [username]"
echo $' -l [friends servers list filename]'
echo ''
exit 0
}
while [ $# -gt 1 ]
do
key="$1"
case $key in
-h|--help)
show_help
;;
-u|--user)
shift
MY_USERNAME="$1"
;;
# backup list filename
# typically /home/$USER/backup.list
-l|--list)
shift
FRIENDS_SERVERS_LIST="$1"
;;
*)
# unknown option
;;
esac
shift
done
if [ ! "$MY_USERNAME" ]; then
show_help
fi
if [ ! -d "/home/$MY_USERNAME" ]; then
echo $"User $MY_USERNAME does not exist on the system"
exit 7270
fi
if [ ! "$MY_USERNAME" ]; then
echo $'No username given'
exit 3578
fi
if [ ! -d "/home/$MY_USERNAME" ]; then
echo $"User $MY_USERNAME does not exist on the system"
exit 7270
fi
FRAGMENTS_DIR="/home/$MY_USERNAME/.gnupg_fragments"
# if no remote backup list was given then assume recover from USB
if [ ! "$FRIENDS_SERVERS_LIST" ]; then
interactive_gpg_from_usb
exit 0
fi
# obtain shares/fragments from remote locations
if [ "$FRIENDS_SERVERS_LIST" ]; then
# For each remote server
while read -r remote_server
do
# Get the server and its password
# Format is:
# username@domain:/home/username <port number> <ssh password>
REMOTE_SERVER=$(echo "${remote_server}" | awk -F ' ' '{print $1}')
if [ "$REMOTE_SERVER" ]; then
REMOTE_SSH_PORT=$(echo "${remote_server}" | awk -F ' ' '{print $2}')
REMOTE_PASSWORD=$(echo "${remote_server}" | awk -F ' ' '{print $3}')
# create a directory if it doesn't exist
if [ ! -d "/home/$MY_USERNAME/.gnupg_fragments" ]; then
mkdir -p "/home/$MY_USERNAME/.gnupg_fragments"
fi
echo -n $"Starting key retrieval from $REMOTE_SERVER..."
/usr/bin/sshpass -p "$REMOTE_PASSWORD" \
scp -r -P "$REMOTE_SSH_PORT" "$REMOTE_SERVER/.gnupg_fragments/"* "/home/$MY_USERNAME/.gnupg_fragments"
# shellcheck disable=SC2181
if [ ! "$?" = "0" ]; then
echo $'FAILED'
else
echo $'Ok'
fi
fi
done < "$FRIENDS_SERVERS_LIST"
fi
# was a directory created?
if [ ! -d "$FRAGMENTS_DIR" ]; then
echo $'No fragments have been recovered, so the key cannot be recovered'
exit 7483
fi
# was anything downloaded?
cd "$FRAGMENTS_DIR" || exit 24682468
# shellcheck disable=SC2012
no_of_shares=$(ls -afq keyshare.asc.* | wc -l)
if (( no_of_shares == 0 )); then
echo $'No key fragments were retrieved'
exit 76882
fi
# set permissions on the fragments
chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.gnupg_fragments"
# decrypt the file
KEYS_FILE=$FRAGMENTS_DIR/keyshare.asc
cd "$FRAGMENTS_DIR" || exit 482746874624
gfcombine "$KEYS_FILE.*"
if [ ! -f "$KEYS_FILE" ]; then
echo $'Unable to decrypt key. This may mean that not enough fragments are available'
exit 6283
fi
echo $'Key fragments recombined'
# import the gpg key
if ! gpg --homedir="/home/$MY_USERNAME/.gnupg" --allow-secret-key-import --import "$KEYS_FILE"; then
echo $'Unable to import gpg key'
rm "$KEYS_FILE"
exit 3682
fi
rm "$KEYS_FILE"
chown -R "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/.gnupg"
chmod -R 600 "/home/$MY_USERNAME/.gnupg"
echo $'GPG key was recovered'
exit 0