keycrypt

#!/bin/bash

##########################################################################################
#################################    Global Variables    #################################
##########################################################################################

VERSION="0.2.2"
TMP_PASS=""
GKEY=""
OLD_KEY=""

##########################################################################################
##################################    Main Functions    ##################################
##########################################################################################

function defaultKeyLocation() {
	local KEY=$1
	local default="$HOME/.ssh/"

	
	if [[ $KEY == *\/* ]] || [[ $KEY == *\\* ]]; then
		GKEY=$KEY
	else
		GKEY="$default$KEY"
	fi
}

function removeKey() {
	local KEY=$1
	local COMMAND="rm -rf $KEY"

	if [[ -w $KEY ]]; then
		$COMMAND
		echo "$KEY was deleted."
		createKey $KEY
	else
		echo 'Whoops'
		exit 1
	fi	
}

function backupKey() {
	local KEY=$1
	local COMMAND="mv $KEY $KEY.bak"
	local res=""
		
	if [[ -e $KEY ]]; then
		if [[ -e "$KEY.bak" ]]; then
			echo -n "Backup exists, overwrite (y/n): "
			read res
			
			case $res in
				[yY][eE][sS] | [yY] )
				   	$(rm -rf $KEY.bak)
				   	$COMMAND
					;;
				[nN][oO] | [nN] )
					echo "Nothing to be done."
					exit 1
					;;
				* )
					echo "Invalid Selection"
					exit 1
					;;
			esac
		else
			$COMMAND
		fi

	else
		echo "$KEY doesn't exist"
		exit 0
	fi
	
	if [[ -f "$KEY.bak" ]]; then
		OLD_KEY="$KEY.bak"
		echo "Backed up key here: $OLD_KEY"
	else
		echo "Something went wrong"
	fi
}

function fixPermissions() {
	local KEY=$1
	local COMMAND="chmod 600 $KEY"
	$COMMAND
}

function checkEncryptionStatus() {
	local KEY=$1
	
	if [[ -n $(grep -i "Proc-Type: 4,ENCRYPTED" $KEY) ]]; then
		return 1
	elif [[ -n $(grep -i "BEGIN ENCRYPTED PRIVATE KEY" $KEY) ]]; then
		return 1
	else
		return 0
	fi
}

function encryptKey() {
	local KEY=$1
	local COMMAND='openssl pkcs8 -topk8 -v2 des3'
	local PASS=""
	local CONFIRM_PASS=""
	
	read -s -p "Password: " PASS
	echo ""
	read -s -p "Confirm Password: " CONFIRM_PASS
	echo""
	
	if [[ "$PASS" == "$CONFIRM_PASS" ]]; then
		echo "Passwords Match!"
		backupKey $KEY
		
		COMMAND="$COMMAND -in $OLD_KEY -passin pass:$TMP_PASS -out $KEY -passout stdin 1> /dev/null"
		echo $PASS | $COMMAND
		fixPermissions $KEY
	else
		echo "Password don't match"
	fi
	
}

function reencryptKey() {
	local KEY=$1
	local COMMAND='openssl pkcs8 -topk8 -v2 des3'
	local PASS=""
	local CONFIRM_PASS=""
	local CURRENT_PASS=""
	
	res=$(checkEncryptionStatus $KEY)
	
	if [[ $? == 1 ]]; then
		read -s -p "Current Password: " CURRENT_PASS
		echo ""
	else
		echo "No encryption on current key."
	fi	
	
	read -s -p "New Password: " PASS
	echo ""
	read -s -p "Confirm Password: " CONFIRM_PASS
	echo""
	
	if [[ "$PASS" == "$CONFIRM_PASS" ]]; then
		echo "Passwords Match!"
		backupKey $KEY
		
		COMMAND="$COMMAND -in $OLD_KEY -passin stdin -out $KEY -passout stdin 1> /dev/null"
		$COMMAND << EOF
$CURRENT_PASS
$PASS
EOF

		fixPermissions $KEY
	else
		echo "Password don't match"
	fi
}

function createKey() {
	local KEY=$1
	local TYPE
	local BITS
	local OUTPUT_DIR
	local COMMENT
	local PASS="-N $TMP_PASS"
	local COMMAND='ssh-keygen'

	echo -n 'What key type (RSA/DSA)? '
	read TYPE

	if [[ $TYPE == [rR][sS][aA] ]]; then
		TYPE=' -t rsa'
	elif [[ $TYPE == [dD][sS][aA] ]]; then
		TYPE=' -t dsa'
	else
		echo 'This is not a valide type!'
		exit 1
	fi

	echo -n 'Bit size (1024/2048/4096/8192)? '
	read BITS

	if [[ $BITS == '1024' ]]; then
		BITS=' -b 1024'
	elif [[ $BITS == '2048' ]]; then
		BITS=' -b 2048'
	elif [[ $BITS == '4096' ]]; then
		BITS=' -b 4096'
	elif [[ $BITS == '8192' ]]; then
		BITS=' -b 8192'
	else
		echo 'Invalid bit size.'
		exit 1
	fi
	
	OUTPUT_DIR="-f $KEY"
	
	COMMAND="$COMMAND $TYPE $BITS $OUTPUT_DIR $PASS"
	
	$COMMAND 1> /dev/null
}

function checkKeyExistence() {
	local KEY=$1

	if [[ -f $KEY ]]; then
		echo "$KEY exists"
		echo -n 'Would you like to remove (y/n): '
		read USERINPUT

		case $USERINPUT in
			[yY] | [yY][eE][sS] )
				removeKey $KEY
				;;
			[nN] | [nN][oO] )
				echo "$KEY was not deleted. Will now exit."
				exit 1
				;;
			* )
				echo 'Invalid Input.'
				exit 1
				;;
		esac
	else
		echo 'Key does not currently exist will now create.'
		createKey $KEY
	fi
}

function checkCopiedPubKey() {
	local PUBKEY=$(cat $1)
	local PARAMS=$2
	local AUTHORIZED_KEYS
	
	if [[ -n $(ssh $PARAMS "grep '$PUBKEY' $HOME/.ssh/authorized_keys") ]]; then
		echo 'Public Key copied!'
	else
		echo "Key did not copy correctly!"
	fi
}

function copyPubKey() {
	local KEY=$1
	local PUBKEY="$GKEY.pub"
	local ID=""
	local SERVER=""
	local PORT=""
	local PARAMS=""

	echo -n "Remote Server (user@server:port): "
	read SERVER
	
	if [[ $SERVER == *:* ]]; then
		
		PORT="$(cut -d ":" -f 2 <<< $SERVER)"
		SERVER="$(cut -d ":" -f 1 <<< $SERVER)"
		
		PARAMS="$SERVER -p $PORT"
	else
		PARAMS="$SERVER"
	fi

	if [[ -f $PUBKEY ]]	; then
  		if [[ -r "${PUBKEY}" ]] ; then
  			ID="cat ${PUBKEY}"
  		else
  			echo "$PUBKEY is not readable."
		fi
	else
		echo "The key supplied doesn't exist."
	fi
	
	{ eval "$ID" ; } | ssh $PARAMS "umask 077; test -d .ssh || mkdir .ssh ; cat >> .ssh/authorized_keys; test -x /sbin/restorecon && /sbin/restorecon .ssh .ssh/authorized_keys" || checkCopiedPubKey $PUBKEY $PARAMS
}

function askCopyPubKey() {
	local KEY=$1

	echo -n "Would you like to copy this key (y/n)? "
	read INPUT

	case $INPUT in
		[yY][eE][sS] | [yY] )
			copyPubKey $KEY
			;;
		[nN][oO] | [nN] )
			exit 1
			;;
		* )
			echo "Invalid Option"
			exit 1
			;;
	esac
}

function checkApplicationInstalled() {
	local APP=$1
	
	command -v $APP >/dev/null 2>&1 || { echo >&2 "I require $APP but it's not installed.  Aborting."; exit 1; }
}

function generatePassword() {
	TMP_PASS=$(openssl rand -base64 48)
	
}

function usage() {
	cat <<EOF
Usage
------

create (cr) 		This will create a new key and then encrypt it.
					You should supply a keyname and/or path.

encrypt (enc)		This will encrypt a pre-existing key.
					Supply the path to the key.

copy (cp)			Copies the inputted ID to a prompted server.

---------------------------------------------------------

By default keycrypt will insert the key into ~/.ssh

EOF
}

##########################################################################################
##################################      Entry Point     ##################################
##########################################################################################

checkApplicationInstalled "openssl"
generatePassword


case $1 in
	"hello" )
		echo "Hello, $2"
		;;
	[tT][eE][sS][tT] ) #test
		
		;;
	[cC][rR][eE][aA][tT][eE] | [cC][rR] ) #create
		defaultKeyLocation $2
		checkKeyExistence $GKEY
		encryptKey $GKEY
		askCopyPubKey $GKEY
		;;
	[eE][nN][cC][rR][yY][pP][tT] | [eE][nN][cC]) #encrypt
		defaultKeyLocation $2
		reencryptKey $GKEY
		;;
	[cC][oO][pP][yY] | [cC][pP] ) #copy
		defaultKeyLocation $2
		copyPubKey $GKEY
		;;
	[vV][eE][rR][sS][iI][oO][nN] | [vV] | [vV][eE][rR] ) #version
		echo "keygen $VERSION"
		;;
    [cC][oO][pP][yY] | [cC][pP] )
        defaultKeyLocation $2
        copyPubKey $GKEY
        ;;
	[hH][eE][lL][pP] | "?" | [hH] ) #help
		usage
		;;
	* )
		echo 'Invalid Option'
		;;
esac