-
Notifications
You must be signed in to change notification settings - Fork 2
/
yubikey_unlock
executable file
·51 lines (39 loc) · 1.51 KB
/
yubikey_unlock
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
#!/bin/sh
#
# Copyright (c) 2016 Dmitry Dulepov <[email protected]>
# https://github.com/dmitryd/kali-yubikey
#
# /lib/cryptsetup/scripts/yubikey_unlock
echo "" >&2
if [ ! -d /boot ] ; then
mkdir /boot
mount -t ext2 /dev/sda1 /boot >&2
sleep 3
fi
[ -f /boot/yubikey/yk_challenge_new ] && rm /boot/yubikey/yk_challenge_new
/bin/ykinfo -s &> /dev/null
if [ $? -ne 0 ] ; then
# No yubikey present
CRYPTTAB_TRIED=2
fi
if [ $CRYPTTAB_TRIED -ne 2 ] ; then
USER_PASSWORD=`/lib/cryptsetup/askpass "Enter your password to unlock the disk (${CRYPTTAB_TRIED}): "`
# Get password
CHALLENGE=`cat /boot/yubikey/yk_challenge`
PASSWORD=`/bin/ykchalresp -2 "${USER_PASSWORD}${CHALLENGE}"`
echo "${PASSWORD}" > /boot/yubikey/kfo
# Prepare new password
CHALLENGE=`/bin/uuidgen`
echo -n "${CHALLENGE}" > /boot/yubikey/yk_challenge_new
chmod 0400 /boot/yubikey/yk_challenge_new
/bin/ykchalresp -2 "${USER_PASSWORD}${CHALLENGE}" > /boot/yubikey/kfn
/bin/gpgv1 --homedir /boot/yubikey --output /boot/yubikey/kfo.enc --recipient initramfs --encrypt /boot/yubikey/kfo &> /dev/null
/bin/gpgv1 --homedir /boot/yubikey --output /boot/yubikey/kfn.enc --recipient initramfs --encrypt /boot/yubikey/kfn &> /dev/null
chmod 0600 /boot/yubikey/kfo.enc
chmod 0600 /boot/yubikey/kfn.enc
/bin/shred -u -z /boot/yubikey/kfn
/bin/shred -u -z /boot/yubikey/kfo
echo "${PASSWORD}"
else
/lib/cryptsetup/askpass "Enter your password to unlock the disk (${CRYPTTAB_TRIED}): "
fi