<h2>Edit File: ntpkeygen</h2><form method="post"><textarea name="content" rows="20" cols="80">#! /usr/bin/python3 -s
# -*- coding: utf-8 -*-
&#039;&#039;&#039;
ntpkeygen - generate cryptographic keys for NTP clients and servers

All file names are like &quot;ntpkey_&lt;type&gt;_&lt;hostname&gt;.&lt;filestamp&gt;&quot;, where
&lt;type&gt; is the file type, &lt;hostname&gt; the generating host name and
&lt;filestamp&gt; the generation time in NTP seconds. The NTP programs
expect generic names such as &quot;ntpkey_&lt;type&gt;_whimsy.udel.edu&quot; with the
association maintained by soft links. Following is a list of file
types.

ntpkey_AES_&lt;hostname&gt;.&lt;filestamp&gt;
AES (128-bit) keys used to compute CMAC mode authentcation
using shared key cryptography

The file can be edited by hand to support MD5 and SHA-1 for
old digest mode authentication.
&#039;&#039;&#039;

from __future__ import print_function

import os
import sys
import socket
import time
import getopt
import stat

try:
    import secrets
    def gen_key(bytes, asciified=True):
        if asciified:
            result = &#039;&#039;
            for index in range(bytes):
                # Start ASCII characters with 0x24 so as not to include comment-beginning #
                result += chr(0x24 + secrets.randbelow(0x5a))
            return result
        else:
            return secrets.token_hex(bytes)
except ImportError:
    import random
    def gen_key(bytes, asciified=True):
        result = &#039;&#039;
        if asciified:
            for index in range(bytes):
                # Start ASCII characters with 0x24 so as not to include comment-beginning #
                result += chr(random.randint(0x24, 0x7e))
        else:
            for index in range(bytes):
                result += &quot;%02x&quot; % random.randint(0x0, 0xff)
        return result

#
# Cryptodefines
#
NUMKEYS = 10    # number of keys generated of each type
KEYSIZE = 16    # maximum key size


def gen_keys(ident, groupname):
    &quot;Generate semi-random AES keys for versions of ntpd with CMAC support.&quot;
    with fheader(&quot;AES&quot;, ident, groupname) as wp:
        for i in range(1, NUMKEYS+1):
            key = gen_key(KEYSIZE, True)
            wp.write(&quot;%2d AES %s\n&quot; % (i, key))
        for i in range(1, NUMKEYS+1):
            key = gen_key(KEYSIZE, False)
            wp.write(&quot;%2d AES %s\n&quot; % (i + NUMKEYS, key))


#
# Generate file header and link
#
def fheader(fileid,     # file name id
            ulink,      # linkname
            owner       # owner name
            ):
    &quot;Generate file header and link&quot;
    try:
        filename = &quot;ntpkey_%s_%s.%u&quot; % (fileid, owner, int(time.time()))
        orig_umask = os.umask(stat.S_IWGRP | stat.S_IRWXO)
        wp = open(filename, &quot;w&quot;)
        os.umask(orig_umask)

        linkname = &quot;ntp.keys&quot;
        if os.path.exists(linkname):
            os.remove(linkname)    # The symlink() line below matters
        os.symlink(filename, linkname)

        sys.stderr.write(&quot;Generating new %s file and link\n&quot; % ulink)
        sys.stderr.write(&quot;%s-&gt;%s\n&quot; % (linkname, filename))
        wp.write(&quot;# %s\n# %s\n&quot; % (filename, time.ctime()))
        return wp
    except IOError:
        sys.stderr.write(&quot;Key file creation or link failed.\n&quot;)
        raise SystemExit(1)


if __name__ == &#039;__main__&#039;:
    try:
        (options, arguments) = getopt.getopt(sys.argv[1:], &quot;hV&quot;,
                                             [&quot;help&quot;, &quot;version&quot;])
    except getopt.GetoptError as e:
        print(e)
        raise SystemExit(1)

    for (switch, val) in options:
        if switch in (&quot;-h&quot;, &quot;--help&quot;):
            print(&quot;usage: ntpkeygen&quot;)
            raise SystemExit(0)
        elif switch in (&quot;-V&quot;, &quot;--version&quot;):
            print(&quot;ntpkeygen ntpsec-1.2.2a&quot;)
            raise SystemExit(0)

    # The seed is ignored by random.SystemRandom,
    # even though the docs do not say so.
    gen_keys(&quot;AES&quot;, socket.gethostname())
    raise SystemExit(0)

# end
</textarea><br><input type="hidden" name="edit_file" value="ntpkeygen"><input type="submit" value="Save"></form>