yubikey-luks-enroll

#!/bin/sh
SLOT=7
DISK="/dev/sda3"
CLEAR_SLOT=0
TMP_FILE=/tmp/new_key
set -e



while getopts ":s:d:hc" opt; do
  case $opt in
	s)
		SLOT=$OPTARG
		echo "setting slot to $OPTARG."
		;;
	d)
		DISK=$OPTARG
		echo "setting disk to $OPTARG."
		;;
	c)      CLEAR_SLOT=1
		echo "clearing slot"
		;;
	h)
		echo 
		echo " -d <partition>: set the partition"
		echo " -s <slot>     : set the slot"
                echo " -c            : clear the slot prior to writing"
		echo
		exit 1
		;;
	\?)
		echo "Invalid option: -$OPTARG" >&2
		;;
  esac
done

echo "This script will utilize slot $SLOT on drive $DISK.  If this is not what you intended, exit now!"

if [ $CLEAR_SLOT -eq 1 ]; then
	echo "Killing LUKS slot $SLOT"
	cryptsetup luksKillSlot $DISK $SLOT
fi
echo "Adding yubikey to initrd"
P1=$(/lib/cryptsetup/askpass "Please insert a yubikey and enter a new password. This is the password that will only work while your yubikey is installed in your computer.")
P2=$(/lib/cryptsetup/askpass "Please enter the yubikey password again:")
if [ "$P1" != "$P2" ]; then
	echo "Passwords do not match"
	exit 1
fi
echo "You may now be prompted for an existing passphrase. This is NOT the passphrase you just entered, this is the passphrase that you currently use to unlock your LUKS encrypted drive."
R="$(ykchalresp -2 "$P1" 2>/dev/null || true)"
touch $TMP_FILE
chmod 600 $TMP_FILE
echo -n "$R" > $TMP_FILE
cryptsetup --key-slot=$SLOT luksAddKey $DISK $TMP_FILE
rm $TMP_FILE
exit 0