blob: 88b68eb5e26a13e50c5702a1dfc1c9a73a50a558 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
#!/bin/bash
#
# Create keys for new nodes.
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as
# published by the Free Software Foundation, either version 3 of the
# License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public
# License along with this program. If not, see
# <http://www.gnu.org/licenses/>.
function hydra_newkeys {
# Generates ssh and gpg keys for new or existing nodes
# GPG keys should be manually imported in the nodes
local node
local which
if [ -z "$1" ]; then
which="new"
else
which="$1"
fi
if [ ! -z "$2" ]; then
shift
NODES="$*"
else
NODES="`hydra $HYDRA nodes`"
fi
for node in $NODES; do
node="`hydra_get_fqdn_from_nodename $node`"
sshkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/ssh/id_rsa.asc"
gpgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/gpg/key.asc"
borgkey="$HYDRA_FOLDER/keyring/keys/nodes/$node/borg/key.asc"
if [ "$which" == "all" ]; then
hydra_genpairs ssh $node
hydra_genpairs openpgp $node
elif [ "$which" == "new" ]; then
if [ ! -e "$sshkey" ]; then
hydra_genpairs ssh $node
fi
if [ ! -e "$gpgkey" ]; then
hydra_genpairs openpgp $node
fi
if [ ! -e "$borgkey" ]; then
hydra_newkeys_borg $node
fi
elif [ "$which" == "ssh" ]; then
hydra_genpairs ssh $node
elif [ "$which" == "openpgp" ]; then
hydra_genpairs openpgp $node
elif [ ! -e "$borg" ]; then
hydra_newkeys_borg $node
fi
done
}
function hydra_newkeys_borg {
# Check for borg
if ! which borg &> /dev/null; then
echo "Please install borgbackup to be able to generate borg keys"
return 1
fi
# Set working folder
hydra_set_tmpfile hydra.newkeys.borg -d
mkdir -p $TMPWORK/keys
# Set password
# BORG_PASSCOMMAND is supported only on recent borg
#read -s -rep "Borg key password: " password
#export BORG_PASSCOMMAND='keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/nul'
keyringer $HYDRA pwgen nodes/$node/borg/key.passwd
password="`keyringer $HYDRA decrypt nodes/$node/borg/key.passwd 2> /dev/null`"
export BORG_PASSPHRASE="$password"
# Set borg parameters
export BORG_CONFIG_DIR="$TMPWORK"
export BORG_KEY_FILE="$TMPWORK/keys/key"
# Create key
borg init --encryption=keyfile $TMPWORK/repo
# Encrypt key
cat $BORG_KEY_FILE | keyringer $HYDRA encrypt nodes/$node/borg/key
# Cleanup
if which wipe &> /dev/null; then
wipe -rf $TMPWORK
else
rm -rf $TMPWORK
fi
}
function hydra_genpairs {
BASEDIR="/tmp"
local which="$1"
local node="$2"
if [ "$which" == "openpgp" ]; then
keyringer $HYDRA genpair gpg nodes/$node/gpg/key $node
elif [ "$which" == "ssh" ]; then
keyringer $HYDRA genpair ssh nodes/$node/ssh/id_rsa $node
else
return
fi
hydra_set_tmpfile genpair
echo "Importing $which keys for $node" > $TMPWORK
keyringer $HYDRA git commit -F $TMPWORK
keyringer $HYDRA git push
hydra_unset_tmpfile $TMPWORK
}
# Load.
source $APP_BASE/lib/hydra/functions || exit 1
hydra_config_load
# Check for keyringer.
if ! which keyringer &> /dev/null; then
hydra_install_package keyringer
fi
hydra_newkeys $*
|
