You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
smartcardauth/usr/bin/setupcard.sh

1001 lines
38 KiB

#!/bin/bash
# Smart Card Management Tool (c) 2009 Timothy Pearson
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
# The [secure] temporary directory for authentication
SECURE_DIRECTORY=/tmp/smartauth
# Create the secure directory and lock it down
mkdir -p $SECURE_DIRECTORY
chown root $SECURE_DIRECTORY
chgrp root $SECURE_DIRECTORY
chmod 600 $SECURE_DIRECTORY
SECURE_DIRECTORY=$(mktemp /tmp/smartauth/setupcard.XXXXXXXXXX)
rm -rf $SECURE_DIRECTORY
mkdir -p $SECURE_DIRECTORY
chown root $SECURE_DIRECTORY
chgrp root $SECURE_DIRECTORY
chmod 600 $SECURE_DIRECTORY
# See if required programs are installed
scriptor=$(whereis scriptor)
if [[ $scriptor == "scriptor:" ]]; then
echo "ERROR: scriptor is not installed! This program cannot continue!"
zenity --error --text "ERROR: scriptor is not installed!\nThis program cannot continue!\n\nUsually, scriptor is part of the pcsc-tools package."
exit
fi
opensc=$(whereis opensc-explorer)
if [[ $opensc == "opensc-explorer:" ]]; then
echo "ERROR: opensc-explorer is not installed! This program cannot continue!"
zenity --error --text "ERROR: opensc-explorer is not installed!\nThis program cannot continue!\n\nUsually, opensc-explorer is part of the opensc package."
exit
fi
if [[ $# -eq 0 ]]; then
# Get card ATR
FOUND_SUPPORTED_CARD=0
echo "RESET" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
authokresponse="OK: "
response1=$(cat $SECURE_DIRECTORY/response2 | grep "$authokresponse")
if [[ $response1 != "" ]]; then
cat $SECURE_DIRECTORY/response2 | tr -d '\n' > $SECURE_DIRECTORY/response4
stringtoreplace="Using T=0 protocolRESET> RESET< OK: "
newstring=""
sed -i "s#${stringtoreplace}#${newstring}#g" $SECURE_DIRECTORY/response4
smartatr=$(cat $SECURE_DIRECTORY/response4)
echo "Got ATR: $smartatr"
if [[ $smartatr == "3B BE 18 00 00 41 05 10 00 00 00 00 00 00 00 00 00 90 00 " ]]; then
echo "Detected ACOS5 card"
COMMAND_MODE="acos"
CARD_NICE_NAME="ACOS5"
FOUND_SUPPORTED_CARD=1
fi
if [[ $smartatr == "3B 02 14 50 " ]]; then
echo "Detected Schlumberger CryptoFlex card"
COMMAND_MODE="cryptoflex"
CARD_NICE_NAME="Schlumberger CryptoFlex"
FOUND_SUPPORTED_CARD=1
fi
else
echo "No card detected!"
zenity --error --text "ERROR: No SmartCard detected!"
exit 1
fi
if [[ $FOUND_SUPPORTED_CARD -eq 0 ]]; then
echo "Unsupported SmartCard detected! ATR: $smartatr"
zenity --error --text "ERROR: Unsupported SmartCard detected!\n\nATR: $smartatr"
exit 1
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
GET_CHALLENGE="C0 84 00 00 08"
EXTERNAL_AUTH="C0 82 00 00 07 01"
SELECT_FILE="C0 A4 00 00 02"
DELETE_FILE="F0 E4 00 00 02"
fi
if [[ $COMMAND_MODE == "acos" ]]; then
GET_CHALLENGE="00 84 00 00 08"
EXTERNAL_AUTH1="00 82 00 81 08"
EXTERNAL_AUTH2="00 82 00 82 08"
EXTERNAL_AUTH3="00 82 00 83 08"
SELECT_FILE="00 A4 00 00 02"
DELETE_FILE="00 E4 00 00 00"
READ_BINARY="00 B0 00 00 FF"
UPDATE_BINARY="00 D6 00 00 FF"
ACTIVATE_FILE="00 44 00 00 02"
fi
fi
CREATE_LIFE_CYCLE="01"
createfile ()
{
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
# Create transparent file with permissions:
# delete, terminate, activate, deactivate, update, read for Key 1 and Key 2 only
echo "F0 E0 00 FF 10 FF FF 00 $1 $2 01 3F 44 FF 44 01 03 11 FF 11" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
fi
if [[ $COMMAND_MODE == "acos" ]]; then
# Create transparent file with permissions:
# delete, terminate, activate, deactivate, update, read for Key 1, Key 2, and Key 3 only (SE 04)
# created in DF 1000 under MF, SE file is 10FE
# SIZE TRANSPARENT
echo "00 E0 00 00 1A 62 18 80 02 00 $1 82 01 01 83 02 $2 8A 01 $CREATE_LIFE_CYCLE 8C 08 7F 04 04 04 04 04 04 04" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
echo $(cat $SECURE_DIRECTORY/response2)
fi
}
updatekey ()
{
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
echo "$SELECT_FILE 00 11" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
echo "C0 D6 00 0D 0C 08 00 $1 05 05" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
fi
}
hexcvt ()
{
echo ""$1" "16" o p" | dc
}
initializeacos () {
if [[ $COMMAND_MODE == "acos" ]]; then
# Set MF Offset
echo "00 D6 30 86 02 80 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Set EEPROM Limit
echo "00 D6 30 8C 02 FF FF" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Enable Clear Card
echo "00 D6 30 88 01 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Create MF
echo "00 E0 00 00 0A 62 08 82 02 3F FF 83 02 3F 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select MF
echo "00 A4 00 00 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Create DF 1000 under MF, SE file is 10FE
echo "00 E0 00 00 2C 62 2A 82 01 38 83 02 10 00 84 10 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8A 01 $CREATE_LIFE_CYCLE 8C 08 7F 04 04 04 04 04 04 04 8D 02 10 FE" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select DF 1000 under MF
echo "$SELECT_FILE 10 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Under DF 1000, create Key File EF2, file ID 10FD, read access never, SFI 02
echo "00 E0 00 00 1D 62 1B 82 05 0C 01 00 15 04 83 02 10 FD 88 01 02 8A 01 $CREATE_LIFE_CYCLE 8C 08 7F 04 04 04 04 04 04 FF" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select EF 10FD under DF 1000
echo "$SELECT_FILE 10 FD" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Initialize key records in file 10FD
# Key 1, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT1] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 00 0C 81 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Key 2, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT2] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 02 0C 82 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Key 3, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT3] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 02 0C 83 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Create SE file 10FE, SFI 03
echo "00 E0 00 00 1C 62 1A 82 05 0C 01 00 11 04 83 02 10 FE 88 01 03 8A 01 $CREATE_LIFE_CYCLE 8C 07 7E 04 04 04 04 04 04" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select MF
echo "00 A4 00 00 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select DF 1000 under MF
echo "$SELECT_FILE 10 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Select EF 10FE under DF 1000
echo "$SELECT_FILE 10 FE" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Initialize SE file 10FE
# SE 01: External authentication of local key 1
echo "00 DC 00 00 0B 80 01 01 A4 06 83 01 81 95 01 80" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# SE 02: External authentication of local key 2
echo "00 DC 00 02 0B 80 01 02 A4 06 83 01 82 95 01 80" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# SE 03: External authentication of local key 3
echo "00 DC 00 02 0B 80 01 03 A4 06 83 01 83 95 01 80" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# SE 04: External authentication of local key 1, 2, or 3
echo "00 DC 00 02 11 80 01 04 A4 0C 83 01 81 83 01 82 83 01 83 95 01 80" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Create authentication files
createfile "FF" "10 01"
createfile "FF" "10 02"
createfile "FF" "10 03"
createfile "FF" "10 04"
createfile "FF" "10 05"
createfile "FF" "10 06"
createfile "FF" "10 07"
createfile "FF" "10 08"
createfile "FF" "10 09"
createfile "FF" "10 0A"
# Activate security on files
echo "$ACTIVATE_FILE 10 01" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 02" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 03" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 04" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 05" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 06" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 07" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 08" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 09" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 0A" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 FD" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
echo "$ACTIVATE_FILE 10 FE" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
fi
}
authenticatecard () {
if [[ $authenticated != "1" ]]; then
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the 16-character Smart Card transport key [$1] in hexidecimal. Example: 0123456789abcdef")
if [[ ${#autkey} -eq 16 ]]; then
if [[ $COMMAND_MODE == "acos" ]]; then
# Select MF
echo "00 A4 00 00 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Make sure DF 1000 is selected
echo "$SELECT_FILE 10 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
fi
# Authenticate card
echo $GET_CHALLENGE > $SECURE_DIRECTORY/authscript
scriptor $SECURE_DIRECTORY/authscript | grep 'Normal processing' > $SECURE_DIRECTORY/challenge
perl -pi -e 's/ //g' $SECURE_DIRECTORY/challenge
perl -pi -e 's/:Normalprocessing.//g' $SECURE_DIRECTORY/challenge
perl -pi -e 's/<//g' $SECURE_DIRECTORY/challenge
xxd -r -p $SECURE_DIRECTORY/challenge $SECURE_DIRECTORY/challenge
# Now DES encrypt the challenge
# Later, change the initialization vector to random if possible
openssl des-ecb -in $SECURE_DIRECTORY/challenge -out $SECURE_DIRECTORY/response -K $autkey -iv 1
if [[ $COMMAND_MODE == "acos" ]]; then
# Truncate to 8 bytes
dd if=$SECURE_DIRECTORY/response of=$SECURE_DIRECTORY/response2 bs=1 count=8
# Expand to standard hex listing format
xxd -g 1 $SECURE_DIRECTORY/response2 $SECURE_DIRECTORY/response
dd if=$SECURE_DIRECTORY/response of=$SECURE_DIRECTORY/response2 bs=1 count=23 skip=9
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
# Truncate to 6 bytes
dd if=$SECURE_DIRECTORY/response of=$SECURE_DIRECTORY/response2 bs=1 count=6
# Expand to standard hex listing format
xxd -g 1 $SECURE_DIRECTORY/response2 $SECURE_DIRECTORY/response
dd if=$SECURE_DIRECTORY/response of=$SECURE_DIRECTORY/response2 bs=1 count=17 skip=9
fi
# Assemble the response file
response2=$(cat $SECURE_DIRECTORY/response2)
if [[ $COMMAND_MODE == "acos" ]]; then
if [[ $1 == "AUT1" ]]; then
response1="$EXTERNAL_AUTH1 ${response2}"
fi
if [[ $1 == "AUT2" ]]; then
response1="$EXTERNAL_AUTH2 ${response2}"
fi
if [[ $1 == "AUT3" ]]; then
response1="$EXTERNAL_AUTH3 ${response2}"
fi
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
response1="$EXTERNAL_AUTH ${response2}"
fi
echo $response1 > $SECURE_DIRECTORY/response
# Send the response!
scriptor $SECURE_DIRECTORY/response > $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Get the result
authokresponse="< 90 00 : Normal processing"
response1=$(cat $SECURE_DIRECTORY/response2 | grep "$authokresponse")
echo $response1
if [[ $response1 != "" ]]; then
echo "Smart card validation successfull!"
echo "Smart card login successfull!"
authenticated="1"
else
echo "Login failed"
zenity --error --text "That transport key is incorrect!\n\nPlease remember that there are a limited number\nof failed login attempts for this key,\nafter which your SmartCard will become useless."
fi
else
echo "AUT1 key not 16 characters!"
zenity --error --text "That transport key is invalid!"
fi
fi
}
get_file () {
if [[ $COMMAND_MODE == "acos" ]]; then
# Select EF $1 under DF 1000
echo "$SELECT_FILE $1" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Read binary
echo "$READ_BINARY" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
authokresponse="90 00 : Normal processing"
response1=$(cat $SECURE_DIRECTORY/response2 | grep "$authokresponse")
if [[ $response1 != "" ]]; then
cat $SECURE_DIRECTORY/response2 | tr -d '\n' > $SECURE_DIRECTORY/response4
stringtoreplace="Using T=0 protocol00 B0 00 00 FF> 00 B0 00 00 FF< "
newstring=""
sed -i "s#${stringtoreplace}#${newstring}#g" $SECURE_DIRECTORY/response4
stringtoreplace=" 90 00 : Normal processing."
newstring=""
sed -i "s#${stringtoreplace}#${newstring}#g" $SECURE_DIRECTORY/response4
if [[ $2 == "text" ]]; then
stringtoreplace=" 00"
newstring=""
sed -i "s#${stringtoreplace}#${newstring}#g" $SECURE_DIRECTORY/response4
fi
echo $(cat $SECURE_DIRECTORY/response4)
rm -f $SECURE_DIRECTORY/lukskey
xxd -r -p $SECURE_DIRECTORY/response4 $SECURE_DIRECTORY/lukskey
RESPONSE=$SECURE_DIRECTORY/lukskey
fi
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
FILE=${1/ /}
echo "get $FILE" | opensc-explorer
RESPONSE="3F00_$FILE"
fi
}
update_file () {
if [[ $COMMAND_MODE == "acos" ]]; then
# Select EF $1 under DF 1000
echo "$SELECT_FILE $1" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Update existing file
# Zero pad input file
dd if=/dev/zero of=$SECURE_DIRECTORY/response2 bs=1 count=255
dd if=$2 of=$SECURE_DIRECTORY/response2 bs=1 count=255 conv=notrunc
# Truncate to 255 bytes and expand to standard hex listing format
xxd -l 255 -ps -c 1 $SECURE_DIRECTORY/response2 > $SECURE_DIRECTORY/response
cat $SECURE_DIRECTORY/response | tr '\n' ' ' > $SECURE_DIRECTORY/hexready
echo "$UPDATE_BINARY $(cat $SECURE_DIRECTORY/hexready)" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
echo $(cat $SECURE_DIRECTORY/response2)
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
# Delete old file
echo "$DELETE_FILE $1" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2 2>/dev/null
echo $(cat $SECURE_DIRECTORY/response2)
# Create new file
createfile "FF" $1
FILE=${1/ /}
echo "put $FILE $2" | opensc-explorer
fi
}
insertnewtext () {
FOUNDTEXT=$(cat $2 | grep $1)
echo $FOUNDTEXT;
if [[ $FOUNDTEXT != "" ]]; then
echo "$1 already exists in $2"
else
echo $1 >> $2
fi
}
getcolumn () {
perl -ne '@cols = split; print "$cols['$1']\n"' ;
}
function createlukskey {
ROOTPARTITION=$(mount | grep 'on / ' | getcolumn 0)
if [ -e $ROOTPARTITION ]; then
ROOTPARTITION=$(echo $ROOTPARTITION | sed 's/\/dev\/mapper\///')
CRYPTPARTITION=$(cat /etc/crypttab | grep $ROOTPARTITION | getcolumn 1)
if [ -e $CRYPTPARTITION ]; then
zenity --question --ok-label="Yes" --cancel-label="No" --text="I have detected that $ROOTPARTITION is your root partition, \nand therefore $CRYPTPARTITION is your encrypted root partition. \nIs this correct?"
correct=$?
if [[ correct -eq 0 ]] ; then
echo "Confirmed--proceeding"
insertnewtext dm_mod /etc/initramfs-tools/modules
insertnewtext dm_crypt /etc/initramfs-tools/modules
insertnewtext aes_x86_64 /etc/initramfs-tools/modules
insertnewtext sha256 /etc/initramfs-tools/modules
insertnewtext vfat /etc/initramfs-tools/modules
insertnewtext fat /etc/initramfs-tools/modules
insertnewtext nls_cp437 /etc/initramfs-tools/modules
insertnewtext nls_iso8859_1 /etc/initramfs-tools/modules
insertnewtext hci_usb /etc/initramfs-tools/modules
insertnewtext usb_storage /etc/initramfs-tools/modules
insertnewtext libusual /etc/initramfs-tools/modules
insertnewtext ehci_hcd /etc/initramfs-tools/modules
insertnewtext uhci_hcd /etc/initramfs-tools/modules
insertnewtext usbcore /etc/initramfs-tools/modules
insertnewtext ext2 /etc/initramfs-tools/modules
insertnewtext reiserfs /etc/initramfs-tools/modules
echo "/etc/initramfs-tools/modules updated"
mkdir -p /etc/crypto
head -c 255 /dev/urandom > /etc/crypto/smart.key
chown -R root /etc/crypto
chgrp -R root /etc/crypto
chmod -R 600 /etc/crypto
echo "$(zenity --entry --hide-text --title="LUKS Password" --text="Please enter the LUKS password for $CRYPTPARTITION")" > $SECURE_DIRECTORY/lukspass
cat $SECURE_DIRECTORY/lukspass | cryptsetup luksAddKey $CRYPTPARTITION /etc/crypto/smart.key
rm $SECURE_DIRECTORY/lukspass
correct=$?
if [[ correct -eq 0 ]] ; then
echo "OK!"
OLDCRYPTLINE=$(cat /etc/crypttab | grep $ROOTPARTITION)
NEWCRYPTLINE="$ROOTPARTITION $CRYPTPARTITION smart.key luks,keyscript=/usr/bin/cryptosmartcard.sh"
sed -i "s#${OLDCRYPTLINE}#${NEWCRYPTLINE}#g" /etc/crypttab
echo "Crypttab updated"
cp -Rp /etc/smartauth/smartauth.sh.in /usr/bin/smartauth.sh
OLDKEY="<your key in hexidecimal>"
authenticatecard "AUT3"
if [[ $authenticated = "1" ]]; then
NEWKEY=$autkey
echo $NEWKEY > /etc/smartauth/smartauth.key
sed -i "s#${OLDKEY}#${NEWKEY}#g" /usr/bin/smartauth.sh
chmod 600 /usr/bin/smartauth.sh
chmod a+x /usr/bin/smartauth.sh
echo "Updating initramfs"
update-initramfs -u -k all
echo "Securing directories..."
chmod 600 "/boot/initrd.img-$(uname -r)"
chmod -R 600 /etc/smartauth
else
rm -rf /etc/crypto/smart.key
rm -rf /usr/share/initramfs-tools/hooks/cryptlukssc
rm -f /usr/bin/smartauth.sh
fi
else
echo "LUKS add key failed!"
zenity --error --text "Failed to add LUKS key!\nReverting all changes..."
rm -rf /etc/crypto/smart.key
rm -rf /usr/share/initramfs-tools/hooks/cryptlukssc
fi
fi
else
zenity --error --text "Either I am unable to properly detect your encrypted partition,\nor your hard disk is not encrypted.\nNo changes to your system have been made."
fi
else
zenity --error --text "I am unable to properly detect your root partition.\nNo changes to your system have been made."
fi
}
function importlukskey {
ROOTPARTITION=$(mount | grep 'on / ' | getcolumn 0)
if [ -e $ROOTPARTITION ]; then
ROOTPARTITION=$(echo $ROOTPARTITION | sed 's/\/dev\/mapper\///')
CRYPTPARTITION=$(cat /etc/crypttab | grep $ROOTPARTITION | getcolumn 1)
if [ -e $CRYPTPARTITION ]; then
zenity --question --ok-label="Yes" --cancel-label="No" --text="I have detected that $ROOTPARTITION is your root partition, \nand therefore $CRYPTPARTITION is your encrypted root partition. \nIs this correct?"
correct=$?
if [[ correct -eq 0 ]] ; then
echo "Confirmed--proceeding"
FILE=$(zenity --file-selection --title="Select the new LUKS encryption key file")
case $? in
0)
continueluksupdate=1;;
1)
continueluksupdate=0;;
-1)
continueluksupdate=0;;
esac
if [[ $continueluksupdate -eq 1 ]]; then
echo "File selected--proceeding"
insertnewtext dm_mod /etc/initramfs-tools/modules
insertnewtext dm_crypt /etc/initramfs-tools/modules
insertnewtext aes_x86_64 /etc/initramfs-tools/modules
insertnewtext sha256 /etc/initramfs-tools/modules
insertnewtext vfat /etc/initramfs-tools/modules
insertnewtext fat /etc/initramfs-tools/modules
insertnewtext nls_cp437 /etc/initramfs-tools/modules
insertnewtext nls_iso8859_1 /etc/initramfs-tools/modules
insertnewtext hci_usb /etc/initramfs-tools/modules
insertnewtext usb_storage /etc/initramfs-tools/modules
insertnewtext libusual /etc/initramfs-tools/modules
insertnewtext ehci_hcd /etc/initramfs-tools/modules
insertnewtext uhci_hcd /etc/initramfs-tools/modules
insertnewtext usbcore /etc/initramfs-tools/modules
insertnewtext ext2 /etc/initramfs-tools/modules
insertnewtext reiserfs /etc/initramfs-tools/modules
echo "/etc/initramfs-tools/modules updated"
mkdir -p /etc/crypto
cp -Rp $FILE /etc/crypto/smart.key
chown -R root /etc/crypto
chgrp -R root /etc/crypto
chmod -R 600 /etc/crypto
echo "$(zenity --entry --hide-text --title="LUKS Password" --text="Please enter the LUKS password for $CRYPTPARTITION")" > $SECURE_DIRECTORY/lukspass
cat $SECURE_DIRECTORY/lukspass | cryptsetup luksAddKey $CRYPTPARTITION /etc/crypto/smart.key
rm $SECURE_DIRECTORY/lukspass
correct=$?
if [[ correct -eq 0 ]] ; then
echo "OK!"
OLDCRYPTLINE=$(cat /etc/crypttab | grep $ROOTPARTITION)
NEWCRYPTLINE="$ROOTPARTITION $CRYPTPARTITION smart.key luks,keyscript=/usr/bin/cryptosmartcard.sh"
sed -i "s#${OLDCRYPTLINE}#${NEWCRYPTLINE}#g" /etc/crypttab
echo "Crypttab updated"
cp -Rp /etc/smartauth/smartauth.sh.in /usr/bin/smartauth.sh
OLDKEY="<your key in hexidecimal>"
authenticatecard "AUT3"
if [[ $authenticated = "1" ]]; then
NEWKEY=$autkey
echo $NEWKEY > /etc/smartauth/smartauth.key
sed -i "s#${OLDKEY}#${NEWKEY}#g" /usr/bin/smartauth.sh
chmod 600 /usr/bin/smartauth.sh
chmod a+x /usr/bin/smartauth.sh
echo "Updating initramfs"
update-initramfs -u -k all
echo "Securing directories..."
chmod 600 "/boot/initrd.img-$(uname -r)"
chmod -R 600 /etc/smartauth
else
rm -rf /etc/crypto/smart.key
rm -rf /usr/share/initramfs-tools/hooks/cryptlukssc
rm -f /usr/bin/smartauth.sh
fi
else
echo "LUKS add key failed!"
zenity --error --text "Failed to add LUKS key!\nReverting all changes..."
rm -rf /etc/crypto/smart.key
rm -rf /usr/share/initramfs-tools/hooks/cryptlukssc
fi
else
zenity --error --text "No changes to your system have been made."
fi
fi
else
zenity --error --text "Either I am unable to properly detect your encrypted partition,\nor your hard disk is not encrypted.\nNo changes to your system have been made."
fi
else
zenity --error --text "I am unable to properly detect your root partition.\nNo changes to your system have been made."
fi
}
function loadlukskey {
echo "Loading LUKS key..."
authenticatecard "AUT1"
if [[ $authenticated = "1" ]]; then
update_file "10 01" "/etc/crypto/smart.key"
fi
}
function loadusername {
echo "Loading username..."
authenticatecard "AUT1"
if [[ $authenticated = "1" ]]; then
zenity --entry --title="SmartCard Username" --text="Please enter the username of the account to be associated with this SmartCard" > $SECURE_DIRECTORY/username
update_file "10 02" "$SECURE_DIRECTORY/username"
rm -f $SECURE_DIRECTORY/username
fi
}
function loadpassword {
echo "Loading password..."
authenticatecard "AUT1"
if [[ $authenticated = "1" ]]; then
zenity --entry --hide-text --title="SmartCard Password" --text="Please enter the password of the account that is associated with this SmartCard" > $SECURE_DIRECTORY/password
update_file "10 03" "$SECURE_DIRECTORY/password"
rm -f $SECURE_DIRECTORY/password
fi
}
GREETER="Welcome to the SmartCard authentication setup utility!\n\nAUT1 is the manual update key\nAUT2 is the login key\nAUT3 is the LUKS decrypt key\n\nCard ATR: $smartatr\nDetected: $CARD_NICE_NAME\n\nPlease select an action from the list below:"
while [[ 1 -eq 1 ]]; do
if [ -e "/etc/smartauth/smartauthmon.key" ]; then
LOGINOPTION="Disable automatic login for TDE"
else
LOGINOPTION="Enable automatic login for TDE"
fi
if [[ $COMMAND_MODE == "acos" ]]; then
ACOS_INIT_OPTION="FALSE Initialize-blank-ACOS"
# See if the card has an MF yet
# Select MF
echo "00 A4 00 00 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
authokresponse="< 61 "
response1=$(cat $SECURE_DIRECTORY/response2 | grep "$authokresponse")
echo $response1
if [[ $response1 != "" ]]; then
echo "MF exists, checking for DF 1000"
# MF exists, check for DF 1000
echo "00 A4 00 00 02 10 00" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
authokresponse="< 61 "
response1=$(cat $SECURE_DIRECTORY/response2 | grep "$authokresponse")
echo $response1
if [[ $response1 != "" ]]; then
echo "DF 1000 exists, this card was already initialized!"
ACOS_INIT_OPTION=""
fi
fi
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
ACOS_INIT_OPTION=""
fi
if [[ $# -eq 0 ]]; then
if [ -e "/etc/crypto/smart.key" ]; then
selection=$(zenity --width=400 --height=550 --list --radiolist --title="SmartCard Authentication Setup" \
--text="$GREETER" \
--column="" --column="Action" \
TRUE "Update LUKS Initramfs Transport Key [AUT3]" \
FALSE "Import LUKS encryption key from file to system" \
FALSE "Get LUKS encryption key from Smart Card [File 1001]" \
FALSE "Load LUKS encryption key into Smart Card [File 1001]" \
FALSE "Load username into Smart Card [File 1002]" \
FALSE "Load password into Smart Card [File 1003]" \
FALSE "Update Smart Card Transport Keys [AUT1-AUT3]" \
FALSE "$LOGINOPTION" \
$ACOS_INIT_OPTION);
else
selection=$(zenity --width=400 --height=550 --list --radiolist --title="SmartCard Authentication Setup" \
--text="$GREETER" \
--column="" --column="Action" \
TRUE "First-Time Setup Wizard" \
FALSE "Create New LUKS Key" \
FALSE "Update LUKS Initramfs Transport Key [AUT3]" \
FALSE "Import LUKS encryption key from file to system" \
FALSE "Get LUKS encryption key from Smart Card [File 1001]" \
FALSE "Load LUKS encryption key into Smart Card [File 1001]" \
FALSE "Load username into Smart Card [File 1002]" \
FALSE "Load password into Smart Card [File 1003]" \
FALSE "Update Smart Card Transport Keys [AUT1-AUT3]" \
FALSE "$LOGINOPTION" \
$ACOS_INIT_OPTION);
fi
else
if [[ $1 = "upgrade" ]]; then
echo "Upgrade mode"
if [ -e "/etc/smartauth/smartauth.key" ]; then
OLDKEY="<your key in hexidecimal>"
NEWKEY=$(cat /etc/smartauth/smartauth.key)
cp -Rp /etc/smartauth/smartauth.sh.in /usr/bin/smartauth.sh
sed -i "s#${OLDKEY}#${NEWKEY}#g" /usr/bin/smartauth.sh
chmod 600 /usr/bin/smartauth.sh
chmod a+x /usr/bin/smartauth.sh
echo "Updating initramfs"
update-initramfs -u -k all
echo "Securing directories..."
chmod 600 "/boot/initrd.img-$(uname -r)"
chmod -R 600 /etc/smartauth
fi
if [ -e "/etc/smartauth/smartauthmon.key" ]; then
OLDKEY="<your key in hexadecimal>"
NEWKEY=$(cat /etc/smartauth/smartauthmon.key)
fi
fi
fi
if [[ $selection = "Import LUKS encryption key from file to system" ]]; then
importlukskey
fi
if [[ $selection = "First-Time Setup Wizard" ]]; then
echo "Running first-time setup wizard..."
zenity --info --text "This setup wizard will prepare your encrypted computer for automatic LUKS unlock and login via SmartCard"
createlukskey
if [[ $authenticated = "1" ]]; then
loadlukskey
loadusername
loadpassword
fi
fi
if [[ $selection = "Create New LUKS Key" ]]; then
echo "Creating new LUKS key..."
createlukskey
fi
if [[ $selection = "Get LUKS encryption key from Smart Card [File 1001]" ]]; then
echo "Getting LUKS key..."
authenticatecard "AUT1"
if [[ $authenticated = "1" ]]; then
get_file "10 01"
zenity --info --text "LUKS key is currently in file:\n$RESPONSE\n\nThis file will be deleted upon completion of this script."
fi
fi
if [[ $selection = "Load LUKS encryption key into Smart Card [File 1001]" ]]; then
loadlukskey
fi
if [[ $selection = "Load username into Smart Card [File 1002]" ]]; then
loadusername
fi
if [[ $selection = "Load password into Smart Card [File 1003]" ]]; then
loadpassword
fi
if [[ $selection = "Update LUKS Initramfs Transport Key [AUT3]" ]]; then
cp -Rp /etc/smartauth/smartauth.sh.in /usr/bin/smartauth.sh
OLDKEY="<your key in hexidecimal>"
authenticatecard "AUT3"
if [[ $authenticated = "1" ]]; then
NEWKEY=$autkey
echo $NEWKEY > /etc/smartauth/smartauth.key
sed -i "s#${OLDKEY}#${NEWKEY}#g" /usr/bin/smartauth.sh
chmod 600 /usr/bin/smartauth.sh
chmod a+x /usr/bin/smartauth.sh
echo "Updating initramfs"
update-initramfs -u -k all
echo "Securing directories..."
chmod 600 "/boot/initrd.img-$(uname -r)"
chmod -R 600 /etc/smartauth
if [ -e "/etc/smartauth/smartauthmon.key" ]; then
echo "TDE login disabled; not altering"
else
selection="Enable automatic login for TDE"
fi
else
zenity --error --text "A SmartCard authentication error has occurred.\nNo changes have been made to your system."
fi
fi
if [[ $selection = "Update Smart Card Transport Keys [AUT1-AUT3]" ]]; then
echo "Updating AUT1..."
authenticatecard "AUT1"
if [[ $authenticated = "1" ]]; then
if [[ $COMMAND_MODE == "acos" ]]; then
# Select EF 10FD under DF 1000
echo "$SELECT_FILE 10 FD" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Initialize key records in file 10FD
# Key 1, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT1] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 00 0C 81 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Key 2, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT2] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 02 0C 82 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
# Key 3, 8-byte 1DES authentication only
autkey=""
while [[ ${#autkey} != 16 ]]; do
autkey=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT3] in hexidecimal. Example: 0123456789abcdef")
done
autkey2=${autkey:0:2}
autkey2="${autkey2} ${autkey:2:2}"
autkey2="${autkey2} ${autkey:4:2}"
autkey2="${autkey2} ${autkey:6:2}"
autkey2="${autkey2} ${autkey:8:2}"
autkey2="${autkey2} ${autkey:10:2}"
autkey2="${autkey2} ${autkey:12:2}"
autkey2="${autkey2} ${autkey:14:2}"
echo "00 DC 00 02 0C 83 01 55 05 $autkey2" > $SECURE_DIRECTORY/query
scriptor $SECURE_DIRECTORY/query 1> $SECURE_DIRECTORY/response2
echo $(cat $SECURE_DIRECTORY/response2)
fi
if [[ $COMMAND_MODE == "cryptoflex" ]]; then
autkey4=$(zenity --entry --hide-text --title="SmartCard Transport Key" --text="Please enter the new 16-character Smart Card transport key [AUT1] in hexidecimal. Example: 0123456789abcdef")
if [[ ${#autkey4} -eq 16 ]]; then
autkey2=${autkey4:0:2}
autkey2="${autkey2} ${autkey4:2:2}"
autkey2="${autkey2} ${autkey4:4:2}"
autkey2="${autkey2} ${autkey4:6:2}"
autkey2="${autkey2} ${autkey4:8:2}"
autkey2="${autkey2} ${autkey4:10:2}"
autkey2="${autkey2} ${autkey4:12:2}"
autkey2="${autkey2} ${autkey4:14:2}"
echo "Attempting Smart Card key update..."
updatekey ${autkey2}
autkey=$autkey4
if [[ $authenticated = "1" ]]; then
cp -Rp /etc/smartauth/smartauth.sh.in /usr/bin/smartauth.sh
OLDKEY="<your key in hexidecimal>"
authenticatecard "AUT3"
if [[ $authenticated = "1" ]]; then
NEWKEY=$autkey
echo $NEWKEY > /etc/smartauth/smartauth.key
sed -i "s#${OLDKEY}#${NEWKEY}#g" /usr/bin/smartauth.sh
chmod 600 /usr/bin/smartauth.sh
chmod a+x /usr/bin/smartauth.sh
echo "Updating initramfs"
update-initramfs -u -k all
echo "Securing directories..."
chmod 600 "/boot/initrd.img-$(uname -r)"
chmod -R 600 /etc/smartauth
if [ -e "/etc/smartauth/smartauthmon.key" ]; then
selection="Enable automatic login for TDE"
else
echo "TDE login disabled; not altering"
fi
else
zenity --error --text "A SmartCard authentication error has occurred."
fi
else
zenity --error --text "A SmartCard authentication error has occurred."
fi
else
echo "AUT1 key not 16 characters!"
zenity --error --text "The new transport key is invalid!"
fi
fi
fi
fi
if [[ $selection = "Enable automatic login for TDE" ]]; then
OLDKEY="<your key in hexadecimal>"
authenticatecard "AUT2"
if [[ $authenticated = "1" ]]; then
NEWKEY=$autkey
echo $NEWKEY > /etc/smartauth/smartauthmon.key
update-rc.d smartauthlogin defaults
/etc/init.d/smartauthlogin stop
/etc/init.d/smartauthlogin start
fi
fi
if [[ $selection = "Disable automatic login for TDE" ]]; then
/etc/init.d/smartauthlogin stop
rm -rf /etc/smartauth/smartauthmon.key
update-rc.d -f smartauthlogin remove
fi
#if [[ $selection = "Initialize blank ACOS card" ]]; then
if [[ $selection = "Initialize-blank-ACOS" ]]; then
initializeacos
fi
if [[ $selection = "" ]]; then
echo "Exiting!"
rm -rf $SECURE_DIRECTORY
chmod -R 600 /etc/smartauth
chown -R root /etc/smartauth
chmod a+x /usr/bin/smartauth.sh
chmod 600 "/boot/initrd.img-$(uname -r)"
chown root "/boot/initrd.img-$(uname -r)"
exit
fi
done