65 lines
1.4 KiB
Bash
Executable File
65 lines
1.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Store a password in a TPM 2.0 NV index, as plaintext inside the TPM's
|
|
# non-volatile memory (no sealing/encryption layer, no PCR policy).
|
|
# Requires: tpm2-tools, access to /dev/tpmrm0 (tss group or root).
|
|
|
|
set -euo pipefail
|
|
|
|
HANDLE="0x1500016"
|
|
FORCE=0
|
|
|
|
usage() {
|
|
cat <<-EOF
|
|
Usage: $(basename "$0") [-H handle] [-f]
|
|
|
|
-H handle NV index to store the password at (default: ${HANDLE})
|
|
-f Undefine an existing NV index at that handle before storing
|
|
EOF
|
|
}
|
|
|
|
while getopts "H:fh" opt; do
|
|
case "$opt" in
|
|
H) HANDLE="$OPTARG" ;;
|
|
f) FORCE=1 ;;
|
|
h) usage; exit 0 ;;
|
|
*) usage; exit 1 ;;
|
|
esac
|
|
done
|
|
|
|
command -v tpm2_nvdefine >/dev/null || {
|
|
echo "tpm2-tools is required (apt install tpm2-tools)" >&2
|
|
exit 1
|
|
}
|
|
|
|
if tpm2_nvreadpublic | grep -q "^${HANDLE}:"; then
|
|
if [ "$FORCE" -eq 1 ]; then
|
|
tpm2_nvundefine -C o "$HANDLE"
|
|
else
|
|
echo "An NV index already exists at ${HANDLE}; rerun with -f to replace it" >&2
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
umask 077
|
|
|
|
read -r -s -p "Password to store: " PASSWORD
|
|
echo >&2
|
|
read -r -s -p "Confirm password: " PASSWORD_CONFIRM
|
|
echo >&2
|
|
|
|
if [ "$PASSWORD" != "$PASSWORD_CONFIRM" ]; then
|
|
echo "Passwords do not match" >&2
|
|
exit 1
|
|
fi
|
|
|
|
SIZE=$(printf '%s' "$PASSWORD" | wc -c)
|
|
|
|
tpm2_nvdefine -C o -s "$SIZE" -a "ownerread|ownerwrite" "$HANDLE"
|
|
|
|
printf '%s' "$PASSWORD" | tpm2_nvwrite -C o -i- "$HANDLE"
|
|
|
|
unset PASSWORD PASSWORD_CONFIRM
|
|
|
|
echo "Password stored in NV index ${HANDLE}"
|