#!/bin/bash
#==============================================================================
# passwdehd
#   Copyright © W. Michael Petullo <mike@flyn.org>, 2002
#   Copyright © CC Computer Consultants GmbH, 2005 - 2006
#   Contact: Jan Engelhardt <jengelh [at] computergmbh de>
#
#   This program is free software; you can redistribute it and/or
#   modify it under the terms of the GNU General Public License as
#   published by the Free Software Foundation; either version 2 of
#   the License, or (at your option) any later version.
#
#   This program is distributed in the hope that it will be useful,
#   but WITHOUT ANY WARRANTY; without even the implied warranty of
#   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
#   General Public License for more details.
#
#   You should have received a copy of the GNU General Public
#   License along with this program; if not, write to:
#   Free Software Foundation, Inc., 51 Franklin St, Fifth Floor,
#   Boston, MA  02110-1301  USA
#
#   -- For details, see the file named "LICENSE.GPL2"
#==============================================================================

# This script is usually run by the user, so do not expect root privileges.

CONF=/etc/security/pam_mount.conf

USAGE="[OPTION]...

  -h, -?   print this message"

while :; do
	case "$1" in
		-h | "-?" )
			echo -e "usage: ${0##*/} $USAGE" >&2;
			exit 1 ;;
		-?* )
			echo "${0##*/}: unrecognized option: $1" >&2;
			exit 1 ;;
		* )
			break ;;
	esac
	shift
done

if [ -n "$1" ]; then
	USER="$1";
fi

if [ ! -f "$CONF" ]; then
	echo "${0##*/}: $CONF is missing"
	exit 1
fi

GROUP=`id -gn "$USER"`;
REGEX="^volume[[:space:]]\+\($USER\|*\|@$GROUP\)[[:space:]]\+";
LINE=`grep -m1 "$REGEX" "$CONF"`;
if [ -z "$LINE" ]; then
    echo "${0##*/}: could not find configuration for $USER in $CONF" >&2;
    exit 1;
fi;
CIPHER=`echo "$LINE" | awk '{ print $8 }'`;
KEYPATH=`echo "$LINE" | awk '{ print $9 }' | sed "s/\&/$USER/g"`;

if [ ! -f "$KEYPATH.old" -a "$UID" -ne 0 ]; then
	echo "${0##*/}: $KEYPATH.old does not yet exist and you can't create it"
	exit 1
fi

if [ -z "$OLD_EFSK_PASSWORD" ]; then
	echo -n "(current) EFSK password: "
	stty -echo >/dev/tty;
	read OLD_EFSK_PASSWORD </dev/tty; echo;
	stty echo >/dev/tty;
fi

if [ -z "$NEW_EFSK_PASSWORD" ]; then
	echo -n "New EFSK password: "
	stty -echo >/dev/tty;
	read NEW_EFSK_PASSWORD </dev/tty; echo;
	echo -n "Retype new EFSK password: "
	read VERIFY </dev/tty; echo;
	if [ "$NEW_EFSK_PASSWORD" != "$VERIFY" ]; then
		echo "Sorry, passwords do not match"
		stty echo >/dev/tty;
		exit 1
	fi
	stty echo >/dev/tty;
fi

export OLD_EFSK_PASSWORD
export NEW_EFSK_PASSWORD

cp "$KEYPATH" "$KEYPATH.old";
openssl enc -d -$CIPHER -pass env:OLD_EFSK_PASSWORD -in "$KEYPATH" | \
    openssl enc -$CIPHER -pass env:NEW_EFSK_PASSWORD >"/tmp/passwdehd.$$";
if ! mv "/tmp/passwdehd.$$" "$KEYPATH"; then
    echo "Move the key file manually from /tmp/passwdehd.$$";
    echo "to $KEYPATH and set the permissions correctly.";
fi;
