cryptonas/cryptobox.conf.d/usr/lib/cryptobox/cbox-manage.sh

368 lines
8.5 KiB
Bash
Raw Normal View History

#!/bin/sh
#
# this script does EVERYTHING
# all other scripts are only frontends :)
#
2005-07-21 21:53:49 +02:00
# called by:
# - some rc-scripts
# - the web frontend cgi
#
set -eu
# parse config file
. /etc/cryptobox/cryptobox.conf
## configuration
2005-07-21 21:53:49 +02:00
CONFIG_MARKER="$CONFIG_DIR/cryptobox.marker"
CERT_TEMP=/tmp/stunnel.pem
#####
function error_msg()
# parameters: ExitCode ErrorMessage
{
echo "[`date`] - $2" | tee -a "$LOG_FILE" >&2
# print the execution stack - not usable with busybox
#caller | sed 's/^/\t/' >&2
exit "$1"
}
function initial_checks()
# Parameter: device
{
local device="$1"
[ ! -b "$device" ] && echo "blockdevice $device does not exist" && return 1
## check if we have an existing configpartition
## TODO: why this config_mount_test?
# config_mount_test "$device"
[ ! -x "$WIPE" ] && echo "$WIPE not found" && return 1
[ ! -x "$SFDISK" ] && echo "$SFDISK not found" && return 1
for a in $ALGO $HASH
do grep -q "^name *: $a$" /proc/crypto || modprobe "$a"
grep -q "^name *: $a$" /proc/crypto || { echo "$a is not supported by kernel" && return 1; }
done
mount | grep -q "^$device[ 1-9] " && echo "$device is mounted" && return 1
return 0
}
function create_partitions()
# Parameter: device
{
local device="$1"
# first partition size is 1 sector, second goes til end
# sfdisk -n doesn't actually write (for testing purpose)
echo -e "0,1,L \n,,L\n" | $SFDISK "$device"
}
function config_set_value()
# parameters: SettingName SettingValue
{
mount -o rw,remount "$CONFIG_DIR"
echo "$2" > "$CONFIG_DIR/$1"
mount -o ro,remount "$CONFIG_DIR"
}
function config_get_value()
# parameters: SettingName
{
# use mounted config, if it exists - otherwise use defaults
local conf_dir
if is_config_mounted
then conf_dir=$CONFIG_DIR
else conf_dir=$CONFIG_DEFAULTS_DIR
fi
[ -z "$1" ] && error_msg 1 "empty setting name"
[ ! -e "$conf_dir/$1" ] && error_msg 2 "unknown configuration value ($1)"
cat "$conf_dir/$1"
}
function create_config()
# Parameter: device
{
local device="${1}1"
$MKFS_CONFIG "$device"
# mount the config partition rw
mount "$device" "$CONFIG_DIR"
# create a marker to recognize a cryptobox partition
2005-07-21 21:53:49 +02:00
date -I >"$CONFIG_MARKER"
## write (network) interfaces
cp -a "$CONFIG_DEFAULTS_DIR/." "$CONFIG_DIR"
# copy stunnel cert
cp -p "$CERT_TEMP" "$CERT_FILE"
# beware: config_set_value remounts the config partition read-only
config_set_value "device" "$1"
config_set_value "ip" "$(get_current_ip)"
# reinitialise configuration
umount "$CONFIG_DIR"
mount_config
}
function get_current_ip()
# not necessarily the same as configured (necessary for validation)
{
ifconfig $NET_IFACE | grep "inet" | cut -d ":" -f2 | cut -d " " -f1
}
function create_crypto()
# Parameter: device
{
local device="$1"
# flood the crypto partition with noise
# - not needed -
#$WIPE -kq -R /dev/urandom "${device}2"
# passphrase may be passed via command line
$CRYPTSETUP -h "$HASH" -c "$ALGO" create "`basename $CRYPTMAPPER_DEV`" "${device}2"
}
function mkfs_crypto()
# split from create_crypto to allow background execution via web interface
{
$MKFS_DATA "$CRYPTMAPPER_DEV"
}
function config_mount_test()
# Parameter: device
{
local device="${1}"
local STATUS=0
mount "${device}1" "$CONFIG_DIR" &>/dev/null || true
is_config_mounted && STATUS=1
umount "$CONFIG_DIR" &>/dev/null || true
# return code is the result of this expression
[ 1 -eq "$STATUS" ] && return 0
return 1
}
function is_config_mounted()
{
2005-07-21 21:53:49 +02:00
mount | grep -q " ${CONFIG_DIR} " && [ -f "$CONFIG_MARKER" ]
}
function is_crypto_mounted()
{
mount | grep -q " ${CRYPTO_DIR} "
}
function is_init_running()
{
ps -e | grep -q -E "$MKFS_DATA|$WIPE"
}
function find_harddisk()
# look for the harddisk to be partitioned
{
local dev=$(
if is_config_mounted
then config_get_value "device"
else for a in $SCAN_DEVICES
do grep -q " `basename $a`$" /proc/partitions && echo "$a" && break
done
fi )
[ -z "$dev" ] && error_msg 4 "no valid partition for initialisation found!"
echo -n "$dev"
}
function mount_config()
{
is_config_mounted && error_msg 3 "configuration directory ($CONFIG_DIR) is already mounted!"
local device=$(
for a in $SCAN_DEVICES
do echo "Trying to load configuration from $a ..." >&2
config_mount_test "$a" && echo "$a" && break
done )
if [ -n "$device" ] && mount "${device}1" "$CONFIG_DIR"
then echo "configuraton found on $device" >&2
config_set_value "device" "$device"
return 0
else echo "failed to locate harddisk" >&2
return 1
fi
}
function mount_crypto()
{
is_crypto_mounted && echo "Das Crypto-Dateisystem ist bereits aktiv!"
local device=`find_harddisk`
# passphrase is read from stdin
$CRYPTSETUP -h "$HASH" -c "$ALGO" create "`basename $CRYPTMAPPER_DEV`" "${device}2"
if mount "$CRYPTMAPPER_DEV" "$CRYPTO_DIR"
then /etc/init.d/samba start
else dmsetup remove "$CRYPTMAPPER_DEV"
return 1
fi
}
function umount_crypto()
{
# do not break on error
set +e
/etc/init.d/samba stop
ps -e | grep -q " smbd$" && killall smbd
ps -e | grep -q " nmbd$" && killall nmbd
ps -e | grep -q " smbd$" && killall -9 smbd
ps -e | grep -q " nmbd$" && killall -9 nmbd
umount "$CRYPTO_DIR"
$CRYPTSETUP remove "$CRYPTMAPPER_DEV"
set -e
}
function init_cryptobox_part1()
# this is only the first part of initialisation that takes no time - good for a smooth web interface
{
umount_crypto || true
umount "$CONFIG_DIR" || true
local device=`find_harddisk`
initial_checks "$device" || error_msg 5 "Failure during initialisation - bye, bye"
create_partitions "$device"
create_config "$device"
create_crypto "$device"
}
function init_cryptobox_part2()
# some things to be done in the background
# these are the final steps of initialisation
# thuid must be changed at the first time, therfore it needs to be
# mounted
{
mkfs_crypto
mount "$CRYPTMAPPER_DEV" "$CRYPTO_DIR"
chown $SAMBA_USER "$CRYPTO_DIR"
umount_crypto
}
function init_cryptobox_complete()
{
init_cryptobox_part1
init_cryptobox_part2
}
### main ###
# set PATH because thttpd removes /sbin and /usr/sbin for cgis
export PATH=/usr/sbin:/usr/bin:/sbin:/bin
ACTION=help
[ $# -gt 0 ] && ACTION="$1"
case "$ACTION" in
config-up )
# die cruft option hilft vielleicht bei dem Fehler "interleaved files not (yet) supported"
mount -o remount,cruft /
if mount_config
then echo "Cryptobox configuration successfully loaded"
else error_msg 3 "Could not find a configuration partition!"
fi
;;
config-down )
umount "$CONFIG_DIR"
;;
network-up )
kudzu -s -q --class network
conf_ip=$(config_get_value "ip")
ifconfig $NET_IFACE "$conf_ip"
echo "Configured network interface for $NET_IFACE: $conf_ip"
2005-07-21 21:53:49 +02:00
$FIREWALL_SCRIPT start
# start stunnel
if [ -f "$CERT_FILE" ]
then USE_CERT=$CERT_FILE
else USE_CERT=$CERT_TEMP
2005-07-21 21:53:49 +02:00
$MAKE_CERT_SCRIPT "$CERT_TEMP" >>"$LOG_FILE" 2>&1
fi
stunnel -p "$USE_CERT" -r localhost:80 -d 443 \
|| echo "$USE_CERT not found - not starting stunnel"
# this ping allows other hosts to get the IP of
# the box, in case of misconfiguration
ping -b -c 1 $(ifconfig $NET_IFACE | grep Bcast | cut -d ":" -f 3 | cut -d " " -f 1) &>/dev/null
;;
network-down )
2005-07-21 21:53:49 +02:00
$FIREWALL_SCRIPT stop
killall stunnel
ifconfig $NET_IFACE down
;;
services-up )
/etc/init.d/thttpd start
;;
services-down )
/etc/init.d/samba stop
/etc/init.d/thttpd stop
;;
box-init )
# this is good for commandline only, as it takes a lot of time
init_cryptobox_complete >>"$LOG_FILE" 2>&1
;;
box-init-fg )
# only partitioning and configuration
# this is nice for the web interface, as it is fast
# output redirection does not work, as it prevents cryptsetup from asking
# for a password
init_cryptobox_part1 >>"$LOG_FILE" 2>&1
;;
box-init-bg )
# do it in the background to provide a smoother web interface
# messages and errors get written to $LOG_FILE
# the 'exec' output redirection does not work, if called by a cgi, so
# redirect it as usual
init_cryptobox_part2 </dev/null >>"$LOG_FILE" 2>&1 &
;;
is_crypto_mounted )
is_crypto_mounted
;;
is_config_mounted )
is_config_mounted
;;
is_init_running )
is_init_running
;;
crypto-mount )
mount_crypto
;;
crypto-umount )
umount_crypto
;;
set_config )
[ $# -ne 3 ] && error_msg 7 "'set_config' requires two parameters"
config_set_value "$2" "$3"
;;
get_config )
[ $# -ne 2 ] && error_msg 6 "'get_config' requires exactly one parameter"
config_get_value "$2"
;;
diskinfo )
$SFDISK -L -q -l `find_harddisk`
;;
get_current_ip )
get_current_ip
;;
* )
# TODO: update this!
echo "Syntax: `basename $0` { mount_config | umount_config | init }"
echo
;;
esac