Marc S. Weidner
3983b149e6
All checks were successful
🛡️ Shell Script Linting / 🛡️ Shell Script Linting (push) Successful in 1m57s
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
112 lines
4.9 KiB
Bash
112 lines
4.9 KiB
Bash
#!/bin/bash
|
|
# SPDX-Version: 3.0
|
|
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
|
|
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
|
|
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
|
|
# SPDX-FileType: SOURCE
|
|
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
|
|
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
|
|
# SPDX-PackageName: CISS.debian.installer
|
|
# SPDX-Security-Contact: security@coresecret.eu
|
|
|
|
guard_sourcing
|
|
|
|
|
|
declare pw_file="${2}"
|
|
if [[ -z "${pw_file}" ]]; then
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file missing password file path argument.%s%s" "${C_RED}" "${C_RES}" "${NL}" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s' ${C_GRE}" "${C_RES}"
|
|
exit "${ERR_MISS_PWD_P}"
|
|
fi
|
|
|
|
if [[ ! -f "${pw_file}" ]]; then
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file password file '%s' does not exist.%s%s" "${pw_file}" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
|
exit "${ERR_MISS_PWD_F}"
|
|
fi
|
|
|
|
declare owner
|
|
owner=$(stat -c '%U:%G' "${pw_file}")
|
|
if [[ "${owner}" != "root:root" ]]; then
|
|
chown root:root "${pw_file}" || {
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file failed to set owner root:root on '%s'.%s%s" "${pw_file}" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
|
exit "${ERR_OWNS_PWD_F}"
|
|
}
|
|
fi
|
|
|
|
declare perms
|
|
perms=$(stat -c '%a' "${pw_file}")
|
|
if [[ "${perms}" -ne 400 ]]; then
|
|
chmod 400 "${pw_file}" || {
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file failed to set permissions 0400 on '%s'.%s%s" "${pw_file}" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
|
exit "${ERR_RGHT_PWD_F}"
|
|
}
|
|
fi
|
|
|
|
declare plaintext_pw
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
|
if ! IFS= read -r plaintext_pw < "${pw_file}"; then
|
|
:
|
|
fi
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
|
|
|
declare pw_length
|
|
pw_length=${#plaintext_pw}
|
|
if (( pw_length < 20 || pw_length > 64 )); then
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file password MUST be between 20 and 64 characters (got %d).%s%s" "${pw_length}" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
|
exit "${ERR_PASS_LENGH}"
|
|
fi
|
|
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
|
if [[ "${plaintext_pw}" == *\"* ]]; then
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
|
if ! $VAR_HANDLER_AUTOBUILD; then boot_screen_cleaner; fi
|
|
printf "%s❌ Error: --root-password-file password MUST NOT contain double quotes (\").%s%s" >&2
|
|
# shellcheck disable=SC2162
|
|
read -p $'%s✅ Press \'ENTER\' to exit the script ... %s'
|
|
exit "${ERR_PASS_PLICY}"
|
|
fi
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
|
|
|
declare salt
|
|
set +o pipefail
|
|
while :; do
|
|
salt=$(tr -dc 'A-Za-z0-9' </dev/random | head -c 16)
|
|
[[ ${#salt} -eq 16 ]] && break
|
|
done
|
|
set -o pipefail
|
|
|
|
declare hash_temp
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set +x # No tracing for security reasons
|
|
hash_temp=$(mkpasswd --method=sha-512 --salt="${salt}" --rounds=8388608 "${plaintext_pw}")
|
|
[[ "${VAR_EARLY_DEBUG}" == "true" ]] && set -x # Turn on tracing again
|
|
|
|
declare -g VAR_HASHED_PWD="${hash_temp}"
|
|
unset hash_temp plaintext_pw
|
|
|
|
sync
|
|
if shred -vfzu -n 5 "${pw_file}" > /dev/null 2>&1; then
|
|
printf "%s✅ Password file '%s': shred -vfzu -n 5 >> done. %s%s" "${pw_file}" > /dev/null 2>&1
|
|
else
|
|
printf "%s❌ Password file '%s': shred -vfzu -n 5 >> NOT successful. %s%s" "${pw_file}" > /dev/null 2>&1
|
|
fi
|
|
sync
|
|
|
|
|
|
|
|
# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=sh
|