x509crypt.git

#! /bin/bash

# Paolo Lulli 2014

CONFIG_DIR=$HOME/.x509crypt
GLOBAL_CONFIG=${CONFIG_DIR}/config

setup_global_config(){
  echo "/C=GB/ST=London/L=London/O=Global Security/OU=IT Department"> ${GLOBAL_CONFIG}
  echo "Created config file: [${GLOBAL_CONFIG}]"
  exit 1
}

test -d $CONFIG_DIR || mkdir -p $CONFIG_DIR
test -f $GLOBAL_CONFIG || setup_global_config

generate_keys(){
  echo "GENERATE KEYS"
  profile=$1
  CONFIG_CERT_NAME=${profile}
  organization=$(cat ${GLOBAL_CONFIG})
  openssl genrsa -out $CONFIG_DIR/$profile/certs/$CONFIG_CERT_NAME.key 4096
  
  openssl req -batch -new -key $CONFIG_DIR/$profile/certs/$CONFIG_CERT_NAME.key \
  -subj "$organization/CN=$profile"\
  -out $CONFIG_DIR/$profile/certs/$CONFIG_CERT_NAME.csr
  #-subj "/C=GB/ST=London/L=London/O=Global Security/OU=IT Department/CN=example.com"\
  #-config $CONFIG_DIR/$profile_name/conf/$profile_name-config
  
  openssl x509 -req -days 365 -in $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.csr \
  -signkey $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.key \
  -out $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt
}

export_key(){
  profile_name=$1
  CONFIG_CERT_NAME=${profile}
  cat $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt
}

dump_key(){
  profile_name=$1
  CONFIG_CERT_NAME=${profile}
  cat $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt | openssl x509 -text
}



setup_profile(){
  echo "SETUP PROFILE"
  profile_name=$1
  test -d $CONFIG_DIR/$profile_name || mkdir -p $CONFIG_DIR/$profile_name
  test -d $CONFIG_DIR/$profile_name/conf || mkdir -p $CONFIG_DIR/$profile_name/conf
  test -d $CONFIG_DIR/$profile_name/certs || mkdir -p $CONFIG_DIR/$profile_name/certs
}

file_decrypt(){
  echo "FILE DECRYPT: $1"
  test -d $CONFIG_DIR/$profile_name || echo "profile: [$profile_name] does not exist, EXIT"
  test -d $CONFIG_DIR/$profile_name || exit 1
  decrypted_file=$1".cleartext"
  CONFIG_CERT_NAME=${profile_name}
  #openssl smime -decrypt -binary -in $1 -inform DER -out $decrypted_file -inkey $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.key -passin pass:your_password
  openssl smime -decrypt -binary -in $1 -inform DER -out $decrypted_file -inkey $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.key
}

file_encrypt(){
  echo "FILE ENCRYPT: $1"
  file_size=$(du -s $1 | awk -e '{print $1}')
  if [ ${file_size} -gt 500000 ]; then
    echo "File too big to encrypt with smime"
    exit 1
  fi
  encrypted_file=$1".enc"
  CONFIG_CERT_NAME=${profile_name}
  openssl smime -encrypt -binary -aes-256-cbc -in $1 -out $encrypted_file  -outform DER $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt
}

file_import(){
  echo "FILE IMPORT: $1"
  imported_file=$1
  CONFIG_CERT_NAME=${profile_name}

  test -f $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt && echo "profile: [$profile_name] exists, SKIPPING"
  test -f $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt && exit 1
  
  test -d $CONFIG_DIR/$profile_name || mkdir -p $CONFIG_DIR/$profile_name/certs
  
  cp ${imported_file} $CONFIG_DIR/$profile_name/certs/$CONFIG_CERT_NAME.crt
}


list_profiles(){
  echo "profiles"
  echo "--------"
  for i in $(ls $CONFIG_DIR  | sed -e s/config//); do echo ${i}; done
}

usage(){
  program=$(basename $0)
  echo "${program}  -e  : Encrypt  (safety checks)"
  echo "${program}  -E  : Encrypt "
  
  echo "${program}  -d  : Decrypt "
 
  echo "${program}  -g        : Generate keys"
  
  echo "${program}  -x        : eXport pub key"
  echo "${program}  -X        : eXport pub key details"
  echo "${program}  -i  : Import pub key"
  echo "${program} -l                  : List profiles"
}


if [ "$#" -gt 3 ]; then
  usage
  exit
fi
if [ "$#" -eq 0 ]; then
  usage
  exit
fi

if [ "$#" -eq 1 ]; then
  if [ "$1" == "-l" ]; then
    list_profiles
    exit
  fi
  if [ "$2" == "-x" ]; then
    export_key "${profile}"
    exit
  fi
  usage
fi

if [ "$#" -eq 2 ]; then
  profile=$1
  if [ "$2" == "-g" ]; then
    test -d $CONFIG_DIR/$profile && echo "profile: [$profile] exists, SKIPPING"
    test -d $CONFIG_DIR/$profile && exit 1

    setup_profile "${profile}"
    generate_keys "${profile}"
    exit
  fi
  if [ "$2" == "-x" ]; then
    export_key "${profile}"
    exit
  fi
  if [ "$2" == "-X" ]; then
    dump_key "${profile}"
    exit
  fi
  
  usage
fi
if [ "$#" -eq 3 ]; then
  profile_name=$1
  input_file=$3
  if [ "$2" == "-E" ]; then
    file_encrypt $input_file
    exit
  fi
  if [ "$2" == "-e" ]; then
    file_encrypt $input_file
    file_decrypt $input_file".enc"
    diff $input_file $input_file".enc.cleartext" || echo "ERROR: BAD ENCRYPTION"
    rm $input_file".enc.cleartext"
    exit
  fi
  if [ "$2" == "-d" ]; then
    file_decrypt $input_file
    exit
  fi
  if [ "$2" == "-i" ]; then
    file_import $input_file
    exit
  fi

  usage
fi