You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
226 lines
6.1 KiB
226 lines
6.1 KiB
#!/bin/sh
|
|
|
|
# Part of passwordless cryptofs setup in Debian Etch.
|
|
# See: http://wejn.org/how-to-make-passwordless-cryptsetup.html
|
|
# Author: Wejn <wejn at box dot cz>
|
|
#
|
|
# Updated by Rodolfo Garcia (kix) <kix at kix dot com>
|
|
# For multiple partitions
|
|
# http://www.kix.es/
|
|
#
|
|
# Updated by TJ <linux@tjworld.net> 7 July 2008
|
|
# For use with Ubuntu Hardy, usplash, automatic detection of USB devices,
|
|
# detection and examination of *all* partitions on the device (not just partition #1),
|
|
# automatic detection of partition type, refactored, commented, debugging code.
|
|
#
|
|
# Update by Timothy Pearson <kb9vqf@pearsoncomputing.net> 8/28/2008
|
|
# Modified for use with SmartCard script instead of USB key
|
|
#
|
|
# Updated by Timothy Pearson <kb9vqf@pearsoncomputing.net> 4/19/2010
|
|
# Added Plymouth detection and support
|
|
#
|
|
# Updated by Timothy Pearson <kb9vqf@pearsoncomputing.net> 9/15/2015
|
|
# Rewrite to use on-card RSA encryption
|
|
#
|
|
# Updated by Timothy Pearson <kb9vqf@pearsoncomputing.net> 6/02/2020
|
|
# Use central variable for PKCS library location
|
|
#
|
|
# Updated by Timothy Pearson <kb9vqf@pearsoncomputing.net> 6/03/2020
|
|
# Fix random pool start detection on new kernels
|
|
|
|
# define counter-intuitive shell logic values (based on /bin/true & /bin/false)
|
|
TRUE=0
|
|
FALSE=1
|
|
|
|
# set DEBUG=$TRUE to display debug messages, DEBUG=$FALSE to be quiet
|
|
DEBUG=$FALSE
|
|
|
|
# Fix the aggressive usplash timeout
|
|
if [ -x /sbin/usplash_write ]; then
|
|
/sbin/usplash_write "TIMEOUT 180" || true
|
|
fi
|
|
|
|
# Find plymouth
|
|
PLYDIR=/bin/plymouth
|
|
|
|
# Determine multiarch directory
|
|
ARCHDIR=$(ldd $SHELL | grep libc\.so |\
|
|
sed -e "s|^.*=> \(.*\)/[^/]*$|\1|" -e "s|^/usr||" -e "s|^/||")
|
|
if [ -z "$ARCHDIR" ] && [ -n "$HOSTTYPE" ] && [ -n "$OSTYPE" ]; then
|
|
ARCHDIR=$HOSTTYPE-$OSTYPE
|
|
fi
|
|
if [ -z "$ARCHDIR" ]; then
|
|
ARCHDIR=$(uname -i)
|
|
if [ "$ARCHDIR" = "unknown" ]; then
|
|
ARCHDIR=$(uname -m)
|
|
fi
|
|
if [ "$ARCHDIR" = "ppc64le" ]; then
|
|
ARCHDIR="powerpc64"
|
|
fi
|
|
if [ "$ARCHDIR" = "ppc64el" ]; then
|
|
ARCHDIR="powerpc64"
|
|
fi
|
|
ARCHDIR="*${ARCHDIR}*"
|
|
fi
|
|
|
|
# Set system PKCS library path
|
|
SYSTEM_PKCS_LIBRARY=opensc-pkcs11.so
|
|
for x in /${ARCHDIR} /lib /usr/${ARCHDIR} /usr/lib; do
|
|
if [ -e $x/$SYSTEM_PKCS_LIBRARY ]; then
|
|
SYSTEM_PKCS_LIBRARY=$(echo $x/$SYSTEM_PKCS_LIBRARY)
|
|
break
|
|
fi
|
|
done
|
|
|
|
# print message to usplash or stderr
|
|
# usage: msg <command> "message" [switch]
|
|
# command: TEXT | STATUS | SUCCESS | FAILURE | CLEAR (see 'man usplash_write' for all commands)
|
|
# switch : switch used for echo to stderr (ignored for usplash)
|
|
# when using usplash the command will cause "message" to be
|
|
# printed according to the usplash <command> definition.
|
|
# using the switch -n will allow echo to write multiple messages
|
|
# to the same line
|
|
# msg ()
|
|
# {
|
|
# if [ -p /dev/.initramfs/usplash_outfifo ] && [ -x /sbin/usplash_write ]; then
|
|
# usplash_write "TEXT-URGENT $@"
|
|
# else
|
|
# echo "$@" >&2
|
|
# fi
|
|
# return 0
|
|
# }
|
|
|
|
msg ()
|
|
{
|
|
HAS_PLYMOUTH=0
|
|
if [ -e $PLYDIR ]; then
|
|
plymouth --ping
|
|
if [ $? -eq 0 ]; then
|
|
HAS_PLYMOUTH=1
|
|
fi
|
|
fi
|
|
if [ $HAS_PLYMOUTH -eq 1 ]; then
|
|
plymouth message --text="$@"
|
|
else
|
|
if [ -p /dev/.initramfs/usplash_outfifo ] && [ -x /sbin/usplash_write ]; then
|
|
usplash_write "TEXT-URGENT $@"
|
|
else
|
|
echo "$@" >&2
|
|
fi
|
|
fi
|
|
return 0
|
|
}
|
|
|
|
[ $DEBUG -eq $TRUE ] && msg "Executing cryptosmartcard.sh ..."
|
|
# flag tracking key-file availability
|
|
OPENED=$FALSE
|
|
|
|
# Terminate the PC/SC subsystem
|
|
killall -9 pcscd > /dev/null 2>&1 || true
|
|
|
|
# Is the USB driver loaded?
|
|
cat /proc/modules | busybox grep usb_storage >/dev/null 2>&1
|
|
USBLOAD=0$?
|
|
if [ $USBLOAD -gt 0 ]; then
|
|
[ $DEBUG -eq $TRUE ] && msg "Loading driver 'usb_storage'"
|
|
modprobe usb_storage >/dev/null 2>&1
|
|
fi
|
|
|
|
# Make sure USB device nodes have loaded
|
|
udevadm settle
|
|
|
|
# Relaunch the PC/SC subsystem
|
|
pcscd > /dev/null 2>&1
|
|
|
|
CARD_INSERTED=$FALSE
|
|
OPENED=$FALSE
|
|
LUKS_KEY_DIR=/tde_luks_keys
|
|
LUKS_KEY_COUNT=$(ls -1 $LUKS_KEY_DIR/ 2> /dev/null | wc -l)
|
|
|
|
DISK_UUID=$(blkid -s UUID -o value $CRYPTTAB_SOURCE)
|
|
|
|
if [ $LUKS_KEY_COUNT -gt 0 ]; then
|
|
if [ "$DISK_UUID" != "" ]; then
|
|
# Disk UUID found and LUKS keys are present
|
|
# Check for card presence...
|
|
pkcs15-tool --list-certificates > /dev/null 2>&1
|
|
RET=$?
|
|
if [ $RET -eq 0 ]; then
|
|
# Card present
|
|
CARD_INSERTED=$TRUE
|
|
msg "SmartCard inserted, attempting to authenticate"
|
|
|
|
if [ -e /dev/kmsg ]; then
|
|
# Linux specific!
|
|
# Wait for nonblocking random driver to start.
|
|
# Without waiting, the pincheck utility can stall
|
|
# for a very long time (forever?) waiting
|
|
# for enough random data to start PKCS11.
|
|
dmesg | grep -q "random: nonblocking pool is initialized" &> /dev/null
|
|
RET=$?
|
|
if [ $RET -ne 0 ]; then
|
|
dmesg | grep -q "random: fast init done" &> /dev/null
|
|
RET=$?
|
|
fi
|
|
LOOPS=0
|
|
if [ $RET -ne 0 ]; then
|
|
msg "Waiting for nonblocking random pool to start..."
|
|
sleep 1
|
|
while [ $RET -ne 0 ]; do
|
|
dmesg | grep -q "random: nonblocking pool is initialized" &> /dev/null
|
|
RET=$?
|
|
if [ $RET -ne 0 ]; then
|
|
sleep 1
|
|
LOOPS=$((LOOPS+1))
|
|
if [ $LOOPS -eq 10 ]; then
|
|
msg "Random pool initialization is slow. Try pressing keys or moving the mouse to speed it up..."
|
|
fi
|
|
fi
|
|
done
|
|
msg "Nonblocking pool started, continuing!"
|
|
fi
|
|
rm -f /tmp/kmsg
|
|
fi
|
|
|
|
PIN=$(cardpincheck $SYSTEM_PKCS_LIBRARY)
|
|
RET=$?
|
|
if [ $RET -eq 0 ]; then
|
|
# PIN valid
|
|
msg "SmartCard unlocked"
|
|
for KEYFILE in ${LUKS_KEY_DIR}/${DISK_UUID}_slot*; do
|
|
# Try decrypting
|
|
echo "$PIN" | cardpincheck $SYSTEM_PKCS_LIBRARY $KEYFILE 2> /dev/null
|
|
RET=$?
|
|
if [ $RET -eq 0 ]; then
|
|
OPENED=$TRUE
|
|
break
|
|
fi
|
|
done
|
|
else
|
|
msg "SmartCard authentication failed"
|
|
fi
|
|
fi
|
|
fi
|
|
fi
|
|
|
|
killall -9 pcscd > /dev/null 2>&1 || true
|
|
|
|
if [ $OPENED -eq $FALSE ]; then
|
|
if [ $CARD_INSERTED -eq $TRUE ]; then
|
|
msg "SmartCard LUKS keyfile invalid or incorrect SmartCard inserted"
|
|
exit 0
|
|
else
|
|
msg "No SmartCard inserted or no LUKS keyfiles available on this system"
|
|
fi
|
|
if [ $HAS_PLYMOUTH -eq 1 ]; then
|
|
plymouth ask-for-password --prompt="Please enter the LUKS password"
|
|
else
|
|
msg "Please enter the LUKS password: "
|
|
read -s -r A < /dev/console
|
|
echo -n "$A"
|
|
msg "Attempting to authenticate..."
|
|
fi
|
|
fi
|
|
|
|
exit 0
|