From 93b64f269122525335f4ee347506aa4176f37859 Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Thu, 19 Sep 2013 03:24:18 +0200 Subject: Use debconf to get the options. --- fripost-install.template | 21 ++++++++ post-install-msg.sh | 4 +- pre-partman.sh | 136 ++++++++++++++++++++++++++++++++++++----------- slurpkey-msg.sh | 58 -------------------- 4 files changed, 128 insertions(+), 91 deletions(-) create mode 100644 fripost-install.template delete mode 100755 slurpkey-msg.sh diff --git a/fripost-install.template b/fripost-install.template new file mode 100644 index 0000000..696d6e0 --- /dev/null +++ b/fripost-install.template @@ -0,0 +1,21 @@ +# Fripost's debconf configuration +# +# Copyright 2013 Guilhem Moulin +# +# Licensed under the GNU GPL version 3 or higher. + +Template: fripost-install/full-disk-encryption +Type: boolean +Default: true +Description: Should the system disk be fully encrypted? (Excluding /boot.) + +Template: fripost-install/full-disk-encryption-password +Type: password +Default: +Description: Password for full-disk encryption. + +Template: fripost-install/full-disk-encryption-fillrandom +Type: select +Default: badblocks +Choices: none, badblocks, urandom, random +Description: How to fill the disk with random data before encryption. diff --git a/post-install-msg.sh b/post-install-msg.sh index 8c5d5d7..8fecde4 100755 --- a/post-install-msg.sh +++ b/post-install-msg.sh @@ -25,11 +25,11 @@ template=$(mktemp) cat > "$template" < /tmp/initramfs-modules -anna-install cryptsetup-udeb openssh-server-udeb -mkdir -pm0755 /etc/ssh/ -ssh-keygen -b 4096 -t rsa -N '' -C /etc/ssh/ssh_host_rsa_key -f /etc/ssh/ssh_host_rsa_key +anna-install cryptsetup-udeb + +db_input high fripost-install/full-disk-encryption-password || true +db_go +db_get fripost-install/full-disk-encryption-password + +if [ -n "$RET" ]; then + touch ~root/root.key + chmod 0644 ~root/root.key + echo $RET >> ~root/root.key #TODO we don't want echo there + # TODO: remove passord from debconf +else + anna-install openssh-server-udeb + + mkdir -pm0755 /etc/ssh/ + sshHostKey=/etc/ssh/ssh_host_rsa_key + ssh-keygen -b 4096 -t rsa -N '' -C $sshHostKey -f $sshHostKey + + cat > /etc/ssh/sshd_config <<- EOF + Port 22 + Protocol 2 + HostKey $sshHostKey + UsePrivilegeSeparation no + + PasswordAuthentication no + ChallengeResponseAuthentication no + HostbasedAuthentication no + PubkeyAuthentication yes + + PermitRootLogin yes + AllowUsers root + StrictModes yes + + ForceCommand /bin/sh -c 'umask 0077; cat > ~root/root.key' + EOF + + # Populate the authorized keys. TODO: make something more generic + test -d ~root/.ssh || mkdir -m 0700 ~root/.ssh + cat > ~root/.ssh/authorized_keys <<- EOF + no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa ... + EOF + chmod og-rwx ~root/.ssh/authorized_keys -cat > /etc/ssh/sshd_config << EOF -Port 22 -Protocol 2 -HostKey /etc/ssh/ssh_host_rsa_key -UsePrivilegeSeparation no + # Start the SSH daemon + touch /var/log/lastlog + /usr/sbin/sshd -PasswordAuthentication no -ChallengeResponseAuthentication no -HostbasedAuthentication no -PubkeyAuthentication yes + # Tell the user we're ready + ipv4="$(ip addr show eth0 | sed -nr 's/^\s+inet\s([0-9.]{4,32}).*/\1/p')" + template=$(mktemp) -PermitRootLogin yes -AllowUsers root -StrictModes yes + cat > "$template" <<- EOF + Template: cryptsetup-ssh-slurpkey/title + Type: note + Description: Waiting for passphrase -ForceCommand /bin/sh -c 'umask 0077; cat > ~root/root.key' -EOF + Template: cryptsetup-ssh-slurpkey/text + Type: note + Description: Press 'continue' once you have sent the key + You now need to send the encryption key for LUKS/dm-crypt to + this special-purpose SSH server: + . + ssh -T -p 22 -l root $ipv4 < /path/to/key + . + To defeat MiTM-attacks, please ensure that the server fingerprint matches + . + $(ssh-keygen -lf $sshHostKey) + . + Key(s) that are granted access have the following fingerprint: + . + EOF + while read pk; do + # ssh-keygen can't read from STDIN, and ash doesn't have the '<<<' + # construct, so we save each pubkey in a temporary file + pkf=$(mktemp) + echo "$pk" > "$pkf" + echo " - $(ssh-keygen -lf $pkf)" >> "$template" + rm "$pkf" + done < ~root/.ssh/authorized_keys + cat >> $template <<- EOF + . + Note: This server is ephemeral, and will be replaced with a full-blown + one toward the end of the installation. + EOF -# Populate the authorized keys. TODO: make something more generic -test -d ~root/.ssh || mkdir -m 0700 ~root/.ssh -cat > ~root/.ssh/authorized_keys << EOF -no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-rsa ... -EOF -chmod og-rwx ~root/.ssh/authorized_keys + debconf-loadtemplate cryptsetup-ssh-slurpkey "$template" + # Anything sent to the SSH is stored into ~root/root.key, which is our + # LUKS key. + until test -r ~root/root.key; do + db_settitle cryptsetup-ssh-slurpkey/title + db_input critical cryptsetup-ssh-slurpkey/text + db_go + done -# Start the SSH daemon -touch /var/log/lastlog -/usr/sbin/sshd + kill `cat /var/run/sshd.pid` || true +fi -# Tell the user we're ready -/cdrom/preseed/slurpkey-msg.sh -kill `cat /var/run/sshd.pid` || true +db_input high fripost-install/full-disk-encryption-fillrandom || true +db_go +db_get fripost-install/full-disk-encryption-fillrandom # Encrypt -## fill the disk with random crap +## fill the disk with random crap (TODO: progress) ## partition the disk ## format /boot to ext2 ## gptsync diff --git a/slurpkey-msg.sh b/slurpkey-msg.sh deleted file mode 100755 index 800e1e2..0000000 --- a/slurpkey-msg.sh +++ /dev/null @@ -1,58 +0,0 @@ -#! /bin/sh -# -# Tell the user that the machine is ready to slurp the key for full disk -# encryption. -# -# Copyright 2013 Guilhem Moulin -# -# Licensed under the GNU GPL version 3 or higher. - -set -ue - -. /usr/share/debconf/confmodule - -ipv4="$(ip addr show eth0 | sed -nr 's/^\s+inet\s([0-9.]{4,32}).*/\1/p')" -template=$(mktemp) - -cat > "$template" < "$pkf" - echo " - $(ssh-keygen -lf $pkf)" >> "$template" - rm "$pkf" -done < ~root/.ssh/authorized_keys -cat >> $template <