yubico_refresh

#!/bin/sh
#
# Copyright (c) 2016 Dmitry Dulepov <dmitry.dulepov@gmail.com>
# https://github.com/dmitryd/kali-yubikey
#
#/usr/share/initramfs-tools/scripts/local-bottom/

set -e

PREREQ=""

prereqs()
{
    echo "$PREREQ"
}

case $1 in
    prereqs)
        prereqs
        exit 0
        ;;
esac

. /scripts/functions

/bin/ykinfo -s &> /dev/null
if [ $? -eq 0 ] ; then
    # Yubikey found, set new LUKS key
    if [ -f /boot/yubikey/yk_challenge_new ] && [ -f /boot/yubikey/kfo.enc ] && [ -f /boot/yubikey/kfn.enc ] ; then

        [ -f /tmp/kfn ] && shred -u -z /tmp/kfn
        [ -f /tmp/kfo ] && shred -u -z /tmp/kfo

        /bin/gpgv1 --no-random-seed-file --lock-never --homedir=/root/root/.gnupg --output /tmp/kfo --recipient initramfs --decrypt /boot/yubikey/kfo.enc &> /dev/null
        /bin/gpgv1 --no-random-seed-file --lock-never --homedir=/root/root/.gnupg --output /tmp/kfn --recipient initramfs --decrypt /boot/yubikey/kfn.enc &> /dev/null

        if [ -f /tmp/kfo ] && [ -f /tmp/kfn ] ; then
            cat /tmp/kfo | cryptsetup --key-file=- luksChangeKey --key-slot 2 /dev/sda5 /tmp/kfn
            EC="$?"
            if [ $EC -eq 0 ] ; then
                # All fine
                rm /boot/yubikey/yk_challenge
                mv /boot/yubikey/yk_challenge_new /boot/yubikey/yk_challenge
                echo "LUKS key was updated."
            else
                echo "Failed to update LUKS key with exit code $EC. Next boot will reuse the same key."
                sleep 5
            fi
        else
            echo "Could not find LUKS keys. Next boot will reuse the same key."
            sleep 5
        fi
    else
        echo "Could not find yubikey files."
        sleep 5
    fi
fi

[ -f /tmp/kfn ] && shred -u -z /tmp/kfn
[ -f /tmp/kfo ] && shred -u -z /tmp/kfo
[ -f /boot/yubikey/kfn.enc ] && shred -u -z /boot/yubikey/kfn.enc
[ -f /boot/yubikey/kfo.enc ] && shred -u -z /boot/yubikey/kfo.enc