Do I need two keys for AES CBC and HMAC or can I use the same key for both operations?
I'd advise you to use a library with a higher level API, such as Keyczar.

That being said:


Don't generate the key using SHA-256. Use a password hash function such as bcrypt or scrypt.
Yes, you must use different keys. For example, you can use the password hash function to generate 64 bytes of key material, and use the first 32-byte half for encryption and the second half for authentication.
Make sure the IV comes from a good randomness source (e.g. /dev/urandom)
Make sure your padding is correct. Or simply use CTR which does not require padding.