V8.00.000.2025.06.17
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -12,100 +12,54 @@
|
||||
|
||||
guard_sourcing
|
||||
|
||||
#######################################
|
||||
# Generates 'nuke=HASH' Bootparameter.
|
||||
# Globals:
|
||||
# DIR_CNF
|
||||
# ERR_READ_NUKE_FILE
|
||||
# VAR_DEBUG_TRACE
|
||||
# VAR_NUKE_HASH
|
||||
# Arguments:
|
||||
# None
|
||||
# Returns:
|
||||
# 0: on success
|
||||
# ERR_READ_NUKE_FILE
|
||||
#######################################
|
||||
nuke_passphrase() {
|
||||
declare -r var_nuke_pwd_file="${DIR_CNF}/password_luks_nuke.txt"
|
||||
declare var_temp_nuke_hash="" var_temp_plain_nuke_pwd="" var_salt=""
|
||||
|
||||
declare pw_file="${2}"
|
||||
if [[ -z "${pw_file}" ]]; then
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file missing password file path argument.%s%s" "${C_RED}" "${C_RES}" "${NL}" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s' ${C_GRE}" "${C_RES}"
|
||||
exit "${ERR_MISS_PWD_P}"
|
||||
fi
|
||||
### No tracing for security reasons
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
|
||||
if [[ ! -f "${var_nuke_pwd_file}" ]] || ! IFS= read -r var_temp_plain_nuke_pwd < "${var_nuke_pwd_file}"; then
|
||||
return "${ERR_READ_NUKE_FILE}"
|
||||
fi
|
||||
### Turn on tracing again
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
|
||||
|
||||
if [[ ! -f "${pw_file}" ]]; then
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file password file '%s' does not exist.%s%s" "${pw_file}" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
||||
exit "${ERR_MISS_PWD_F}"
|
||||
fi
|
||||
var_salt=$(tr -dc 'A-Za-z0-9' < /dev/random | head -c 16)
|
||||
|
||||
declare owner
|
||||
owner=$(stat -c '%U:%G' "${pw_file}")
|
||||
if [[ "${owner}" != "root:root" ]]; then
|
||||
chown root:root "${pw_file}" || {
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file failed to set owner root:root on '%s'.%s%s" "${pw_file}" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
||||
exit "${ERR_OWNS_PWD_F}"
|
||||
}
|
||||
fi
|
||||
### No tracing for security reasons
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set +x
|
||||
var_temp_nuke_hash=$(mkpasswd --method=sha-512 --salt="${var_salt}" --rounds=8388608 "${var_temp_plain_nuke_pwd}")
|
||||
### Turn on tracing again
|
||||
[[ "${VAR_DEBUG_TRACE,,}" == "true" ]] && set -x
|
||||
|
||||
declare perms
|
||||
perms=$(stat -c '%a' "${pw_file}")
|
||||
if [[ "${perms}" -ne 400 ]]; then
|
||||
chmod 400 "${pw_file}" || {
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file failed to set permissions 0400 on '%s'.%s%s" "${pw_file}" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
||||
exit "${ERR_RGHT_PWD_F}"
|
||||
}
|
||||
fi
|
||||
declare -grx VAR_NUKE_HASH="${var_temp_nuke_hash}"
|
||||
unset var_temp_nuke_hash var_temp_plain_nuke_pwd
|
||||
|
||||
declare plaintext_pw
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
||||
if ! IFS= read -r plaintext_pw < "${pw_file}"; then
|
||||
:
|
||||
fi
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
||||
|
||||
declare pw_length
|
||||
pw_length=${#plaintext_pw}
|
||||
if (( pw_length < 20 || pw_length > 64 )); then
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file password MUST be between 20 and 64 characters (got %d).%s%s" "${pw_length}" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
||||
exit "${ERR_PASS_LENGH}"
|
||||
fi
|
||||
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
||||
if [[ "${plaintext_pw}" == *\"* ]]; then
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
||||
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
||||
printf "%s❌ Error: --root-password-file password MUST NOT contain double quotes (\").%s%s" >&2
|
||||
# shellcheck disable=SC2162
|
||||
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
||||
exit "${ERR_PASS_PLICY}"
|
||||
fi
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
||||
|
||||
declare salt
|
||||
set +o pipefail
|
||||
while :; do
|
||||
salt=$(tr -dc 'A-Za-z0-9' </dev/random | head -c 16)
|
||||
[[ ${#salt} -eq 16 ]] && break
|
||||
done
|
||||
set -o pipefail
|
||||
|
||||
declare hash_temp
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
||||
hash_temp=$(mkpasswd --method=sha-512 --salt="${salt}" --rounds=8388608 "${plaintext_pw}")
|
||||
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
||||
|
||||
declare -g VAR_HASHED_PWD="${hash_temp}"
|
||||
unset hash_temp plaintext_pw
|
||||
|
||||
sync
|
||||
if shred -vfzu -n 5 "${pw_file}" > /dev/null 2>&1; then
|
||||
printf "%s✅ Password file '%s': shred -vfzu -n 5 >> done. %s%s" "${pw_file}" > /dev/null 2>&1
|
||||
else
|
||||
printf "%s❌ Password file '%s': shred -vfzu -n 5 >> NOT successful. %s%s" "${pw_file}" > /dev/null 2>&1
|
||||
fi
|
||||
sync
|
||||
do_log "debug" "true" "NUKE hash starts with: ${VAR_NUKE_HASH:0:12}..."
|
||||
|
||||
sync
|
||||
if shred -vfzu -n 5 "${var_nuke_pwd_file}" > /dev/null 2>&1; then
|
||||
do_log "info" "false" "✅ Password file '${var_nuke_pwd_file}': shred -vfzu -n 5 >> done."
|
||||
else
|
||||
do_log "warn" "false" "❌ Password file '${var_nuke_pwd_file}': shred -vfzu -n 5 >> NOT successful."
|
||||
fi
|
||||
sync
|
||||
|
||||
do_log "info" "false" "Nuke Hash generated."
|
||||
return 0
|
||||
}
|
||||
|
||||
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|
||||
|
||||
Reference in New Issue
Block a user