From 5502a4db196ed0bbe51fea1d6a0f9bc19a8e63d0 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 25 Dec 2017 17:51:17 +0800 Subject: [PATCH 01/23] change var --- openvpn-install.sh | 36 +++++++++++++++++++----------------- 1 file changed, 19 insertions(+), 17 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index fc9932f..51d7765 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -67,20 +67,21 @@ newclient () { homeDir="/root" fi # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "key-direction 1" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn + file_client="$homeDir/$1.ovpn" + cp ${file_client_tpl} ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} + echo "" >> ${file_client} + echo "key-direction 1" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/tls-auth.key >> ${file_client} + echo "" >> ${file_client} } # Try to get our IP from the system and fallback to the Internet. @@ -658,11 +659,12 @@ verb 3" >> /etc/openvpn/server.conf fi fi # client-template.txt is created so we have a template to add further users later - echo "client" > /etc/openvpn/client-template.txt + file_client_tpl=/etc/openvpn/client-template.txt + echo "client" > ${file_client_tpl} if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/client-template.txt + echo "proto udp" >> ${file_client_tpl} elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> /etc/openvpn/client-template.txt + echo "proto tcp-client" >> ${file_client_tpl} fi echo "remote $IP $PORT dev tun From 3564221dfc43a424c8a4104fdc31a80ce9c63f86 Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 28 Dec 2017 13:25:17 +0800 Subject: [PATCH 02/23] tmp save --- openvpn-install.sh | 180 ++++++++++++++++++++++++--------------------- 1 file changed, 98 insertions(+), 82 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 51d7765..00cfdba 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -19,38 +19,46 @@ if grep -qs "CentOS release 5" "/etc/redhat-release"; then exit 3 fi +VAR_LIST(){ + : +} +dir_openvpn='/etc/openvpn' +dir_easy="${dir_openvpn}/easy-rsa" +bin_easy='${dir_easy}/easyrsa' +file_client_tpl='${dir_openvpn}/client-template.txt' +file_openvpn_conf='${dir_openvpn}/server.conf' +IPTABLES='/etc/iptables/iptables.rules' + + + if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.conf' if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then - echo "Your version of Debian/Ubuntu is not supported." + echo 'Your version of Debian/Ubuntu is not supported.' echo "I can't install a recent version of OpenVPN on your system." - echo "" + echo '' echo "However, if you're using Debian unstable/testing, or Ubuntu beta," - echo "then you can continue, a recent version of OpenVPN is available on these." - echo "Keep in mind they are not supported, though." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e CONTINUE + echo 'then you can continue, a recent version of OpenVPN is available on these.' + echo 'Keep in mind they are not supported, though.' + while [[ 'y' != $CONTINUE && 'n' != $CONTINUE ]]; do + read -p 'Continue ? [y/n]: ' -e CONTINUE done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" + if [[ 'n' = "$CONTINUE" ]]; then + echo 'Ok, bye !' exit 4 fi fi elif [[ -e /etc/centos-release || -e /etc/redhat-release && ! -e /etc/fedora-release ]]; then - OS=centos - IPTABLES='/etc/iptables/iptables.rules' + OS='centos' SYSCTL='/etc/sysctl.conf' elif [[ -e /etc/arch-release ]]; then - OS=arch - IPTABLES='/etc/iptables/iptables.rules' + OS='arch' SYSCTL='/etc/sysctl.d/openvpn.conf' elif [[ -e /etc/fedora-release ]]; then - OS=fedora - IPTABLES='/etc/iptables/iptables.rules' + OS='fedora' SYSCTL='/etc/sysctl.d/openvpn.conf' else echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" @@ -70,17 +78,17 @@ newclient () { file_client="$homeDir/$1.ovpn" cp ${file_client_tpl} ${file_client} echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} + cat ${dir_easy}/pki/ca.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} + cat ${dir_easy}/pki/issued/$1.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} + cat ${dir_easy}/pki/private/$1.key >> ${file_client} echo "" >> ${file_client} echo "key-direction 1" >> ${file_client} echo "" >> ${file_client} - cat /etc/openvpn/tls-auth.key >> ${file_client} + cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} } @@ -94,28 +102,30 @@ fi # Get Internet network interface with default route NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) -if [[ -e /etc/openvpn/server.conf ]]; then +if [[ -e ${file_openvpn_conf} ]]; then while : do - clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" - echo "" - echo "Looks like OpenVPN is already installed" - echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" - echo " 3) Remove OpenVPN" - echo " 4) Exit" - read -p "Select an option [1-4]: " option + clear +cat <<'EOF' +OpenVPN-install (github.com/Angristan/OpenVPN-install) + +Looks like OpenVPN is already installed + +What do you want to do? + 1) Add a cert for a new user + 2) Revoke existing user cert + 3) Remove OpenVPN + 4) Exit +EOF + read -p 'Select an option [1-4]: ' option case $option in 1) echo "" echo "Tell me a name for the client cert" echo "Please, use one word only, no special characters" read -p "Client name: " -e -i client CLIENT - cd /etc/openvpn/easy-rsa/ - ./easyrsa build-client-full $CLIENT nopass + cd ${dir_easy} + ${bin_easy} build-client-full $CLIENT nopass # Generates the custom client.ovpn newclient "$CLIENT" echo "" @@ -123,7 +133,8 @@ if [[ -e /etc/openvpn/server.conf ]]; then exit ;; 2) - NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") + file_index="${dir_easy}/pki/index.txt" + NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") if [[ "$NUMBEROFCLIENTS" = '0' ]]; then echo "" echo "You have no existing clients!" @@ -131,22 +142,22 @@ if [[ -e /etc/openvpn/server.conf ]]; then fi echo "" echo "Select the existing client certificate you want to revoke" - tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' if [[ "$NUMBEROFCLIENTS" = '1' ]]; then read -p "Select one client [1]: " CLIENTNUMBER else read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER fi - CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) - cd /etc/openvpn/easy-rsa/ - ./easyrsa --batch revoke $CLIENT - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) + cd ${dir_easy} + ${bin_easy} --batch revoke $CLIENT + EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl rm -rf pki/reqs/$CLIENT.req rm -rf pki/private/$CLIENT.key rm -rf pki/issued/$CLIENT.crt rm -rf /etc/openvpn/crl.pem - cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem - chmod 644 /etc/openvpn/crl.pem + cp ${dir_easy}/pki/crl.pem ${dir_openvpn}/crl.pem + chmod 644 ${dir_openvpn}/crl.pem echo "" echo "Certificate for client $CLIENT revoked" echo "Exiting..." @@ -155,8 +166,8 @@ if [[ -e /etc/openvpn/server.conf ]]; then 3) echo "" read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ "$REMOVE" = 'y' ]]; then - PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) + if [[ 'y' = "$REMOVE" ]]; then + PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) if pgrep firewalld; then # Using both permanent and not permanent rules to avoid a firewalld reload. firewall-cmd --zone=public --remove-port=$PORT/udp @@ -189,7 +200,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then else yum remove openvpn -y fi - rm -rf /etc/openvpn + rm -rf ${dir_openvpn} rm -rf /usr/share/doc/openvpn* echo "" echo "OpenVPN removed!" @@ -202,17 +213,21 @@ if [[ -e /etc/openvpn/server.conf ]]; then 4) exit;; esac done -else +fi + +## OpenVPN setup and first user creation +if [[ ! -e ${file_openvpn_conf} ]]; then clear - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" - echo "" - # OpenVPN setup and first user creation - echo "I need to ask you a few questions before starting the setup" - echo "You can leave the default options and just press enter if you are ok with them" - echo "" - echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." - echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" - echo "Otherwise, it should be your public IPv4 address." +cat <> /etc/openvpn/server.conf fi fi # client-template.txt is created so we have a template to add further users later - file_client_tpl=/etc/openvpn/client-template.txt echo "client" > ${file_client_tpl} if [[ "$PROTOCOL" = 'UDP' ]]; then echo "proto udp" >> ${file_client_tpl} @@ -680,7 +696,7 @@ tls-client tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 setenv opt block-outside-dns -verb 3" >> /etc/openvpn/client-template.txt +verb 3" >> ${file_client_tpl} # Generate the custom client.ovpn newclient "$CLIENT" From 5ce4278bbf164d6a0ee0cfb9977911c377e9670e Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 4 Jan 2018 13:42:43 +0800 Subject: [PATCH 03/23] yes ,my comment --xia. --- openvpn-install.sh | 218 +++++++++++++++++++++------------------------ 1 file changed, 104 insertions(+), 114 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 00cfdba..d7487e8 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -65,6 +65,69 @@ else exit 4 fi +install_easyrsa(){ + # An old version of easy-rsa was available by default in some openvpn packages + if [[ -d /etc/openvpn/easy-rsa/ ]]; then + rm -rf /etc/openvpn/easy-rsa/ + fi + # Get easy-rsa + wget -O ~/EasyRSA-3.0.3.tgz 'https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' + tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ + mv ~/EasyRSA-3.0.3 /etc/openvpn/easy-rsa + chown -R root:root /etc/openvpn/easy-rsa/ + rm -rf ~/EasyRSA-3.0.3.tgz +} + +set_firewall(){ + # Create the sysctl configuration file if needed (mainly for Arch Linux) + if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL + fi + + # Enable net.ipv4.ip_forward for the system + sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL + if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL + fi + # Avoid an unneeded reboot + echo 1 > /proc/sys/net/ipv4/ip_forward + # Set NAT for the VPN subnet + iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + # Save persitent iptables rules + iptables-save > $IPTABLES + if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules + iptables-save > $IPTABLES + fi + # If SELinux is enabled and a custom port was selected, we need this + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi + fi +} + newclient () { # Where to write the custom client.ovpn? if [ -e /home/$1 ]; then # if $1 is a user name @@ -72,7 +135,7 @@ newclient () { elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root - homeDir="/root" + homeDir="${dir_openvpn}" fi # Generates the custom client.ovpn file_client="$homeDir/$1.ovpn" @@ -106,7 +169,7 @@ if [[ -e ${file_openvpn_conf} ]]; then while : do clear -cat <<'EOF' +cat < $IPTABLES fi @@ -235,8 +294,8 @@ EOF echo "" echo "What protocol do you want for OpenVPN?" echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + while [[ $PROTOCOL != "udp" && $PROTOCOL != "tcp" ]]; do + read -p "Protocol [udp/tcp]: " -e -i udp PROTOCOL done cat < /etc/systemd/system/iptables.service echo "Not doing that could cause problems between dependencies, or missing files in repositories." echo "" echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + while [[ $CONTINUE != [yn] ]]; do read -p "Continue ? [y/n]: " -e -i y CONTINUE done if [[ "$CONTINUE" = "n" ]]; then @@ -474,18 +533,9 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service else NOGROUP=nobody fi - - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ - fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz + ## function install_easyrsa + install_easyrsa + cd /etc/openvpn/easy-rsa/ echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars # Create the PKI, set up the CA, the DH params and the server + client certificates @@ -498,18 +548,14 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service # generate tls-auth key openvpn --genkey --secret /etc/openvpn/tls-auth.key # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/ # Make cert revocation list readable for non-root chmod 644 /etc/openvpn/crl.pem # Generate server.conf - echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - echo "dev tun + echo "port $PORT +proto ${PROTOCOL} +dev tun user nobody group $NOGROUP persist-key @@ -523,37 +569,37 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf 1) # Obtain the resolvers from resolv.conf and use them for OpenVPN grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf + echo "push \"dhcp-option DNS $line\"" done ;; 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 9.9.9.9"' ;; 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 80.67.169.12"' + echo 'push "dhcp-option DNS 80.67.169.40"' ;; 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 84.200.69.80"' + echo 'push "dhcp-option DNS 84.200.70.40"' ;; 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 208.67.222.222"' + echo 'push "dhcp-option DNS 208.67.220.220"' ;; 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 8.8.8.8"' + echo 'push "dhcp-option DNS 8.8.4.4"' ;; 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 77.88.8.8"' + echo 'push "dhcp-option DNS 77.88.8.1"' ;; 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.130"' + echo 'push "dhcp-option DNS 176.103.130.131"' ;; - esac + esac >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem ca ca.crt @@ -569,66 +615,9 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn.log verb 3" >> /etc/openvpn/server.conf - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi - - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/udp - firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/tcp - firewall-cmd --permanent --zone=public --add-port=$PORT/tcp - fi - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then - iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - iptables -I INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi - fi - fi - fi + ## function set_firewall + set_firewall + # And finally, restart OpenVPN if [[ "$OS" = 'debian' ]]; then # Little hack to check for systemd @@ -675,12 +664,13 @@ verb 3" >> /etc/openvpn/server.conf IP=$USEREXTERNALIP fi fi + # client-template.txt is created so we have a template to add further users later echo "client" > ${file_client_tpl} - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> ${file_client_tpl} - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> ${file_client_tpl} + if [[ "$PROTOCOL" = 'udp' ]]; then + echo "proto ${PROTOCOL}" >> ${file_client_tpl} + elif [[ "$PROTOCOL" = 'tcp' ]]; then + echo "proto ${PROTOCOL}-client" >> ${file_client_tpl} fi echo "remote $IP $PORT dev tun @@ -698,7 +688,7 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 setenv opt block-outside-dns verb 3" >> ${file_client_tpl} - # Generate the custom client.ovpn + # function Generate the custom client.ovpn newclient "$CLIENT" echo "" echo "Finished!" From 58298ba12e9dec88b81106017a70911f1a31544e Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 4 Jan 2018 13:43:18 +0800 Subject: [PATCH 04/23] remove func VAR_LIST --- openvpn-install.sh | 5 ----- 1 file changed, 5 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index d7487e8..47ca42d 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -19,17 +19,12 @@ if grep -qs "CentOS release 5" "/etc/redhat-release"; then exit 3 fi -VAR_LIST(){ - : -} dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" bin_easy='${dir_easy}/easyrsa' file_client_tpl='${dir_openvpn}/client-template.txt' file_openvpn_conf='${dir_openvpn}/server.conf' IPTABLES='/etc/iptables/iptables.rules' - - if [[ -e /etc/debian_version ]]; then OS="debian" From de3afc9f89c3dedd3519b4b680a3a22cea8dafce Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 4 Jan 2018 13:51:23 +0800 Subject: [PATCH 05/23] fix ' to " --- openvpn-install.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 47ca42d..3feb175 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -21,9 +21,9 @@ fi dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" -bin_easy='${dir_easy}/easyrsa' -file_client_tpl='${dir_openvpn}/client-template.txt' -file_openvpn_conf='${dir_openvpn}/server.conf' +bin_easy="${dir_easy}/easyrsa" +file_client_tpl="${dir_openvpn}/client-template.txt" +file_openvpn_conf="${dir_openvpn}/server.conf" IPTABLES='/etc/iptables/iptables.rules' if [[ -e /etc/debian_version ]]; then From a89536c12fa0be45956beecc50aa95cb1a18d785 Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 4 Jan 2018 20:24:38 +0800 Subject: [PATCH 06/23] my comment --xia. change some var and if --- openvpn-install.sh | 52 ++++++++++++++++++++++++++-------------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 3feb175..ffc2ea8 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -21,10 +21,13 @@ fi dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" +dir_pki="${dir_easy}/pki" + bin_easy="${dir_easy}/easyrsa" + file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" -IPTABLES='/etc/iptables/iptables.rules' +file_iptables='/etc/iptables/iptables.rules' if [[ -e /etc/debian_version ]]; then OS="debian" @@ -38,7 +41,7 @@ if [[ -e /etc/debian_version ]]; then echo "However, if you're using Debian unstable/testing, or Ubuntu beta," echo 'then you can continue, a recent version of OpenVPN is available on these.' echo 'Keep in mind they are not supported, though.' - while [[ 'y' != $CONTINUE && 'n' != $CONTINUE ]]; do + while [[ "$CONTINUE" != [yn] ]]; do read -p 'Continue ? [y/n]: ' -e CONTINUE done if [[ 'n' = "$CONTINUE" ]]; then @@ -62,15 +65,17 @@ fi install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ + if [[ -d ${dir_easy}/ ]]; then + rm -rf ${dir_easy}/ fi # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz 'https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3 /etc/openvpn/easy-rsa - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz + url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' + file_easy=${url_easy##*/} + wget -O ~/${file_easy} ${url_easy} + tar xzf ~/${file_easy} -C ~/ + mv ~/${file_easy%.tgz} ${dir_easy} + chown -R root:root ${dir_easy}/ + rm -rf ~/${file_easy} } set_firewall(){ @@ -89,7 +94,7 @@ set_firewall(){ # Set NAT for the VPN subnet iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE # Save persitent iptables rules - iptables-save > $IPTABLES + iptables-save > $file_iptables if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to @@ -107,7 +112,7 @@ set_firewall(){ iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # Save persitent OpenVPN rules - iptables-save > $IPTABLES + iptables-save > $file_iptables fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then @@ -160,6 +165,7 @@ fi # Get Internet network interface with default route NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) +#### server.conf exist. if [[ -e ${file_openvpn_conf} ]]; then while : do @@ -175,12 +181,15 @@ What do you want to do? 3) Remove OpenVPN 4) Exit EOF + file_index="${dir_easy}/pki/index.txt" read -p 'Select an option [1-4]: ' option case $option in 1) echo "" echo "Tell me a name for the client cert" echo "Please, use one word only, no special characters" + echo "Here are the files that already exist,do not repeat that" + tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' read -p "Client name: " -e -i client CLIENT cd ${dir_easy} ${bin_easy} build-client-full $CLIENT nopass @@ -191,7 +200,6 @@ EOF exit ;; 2) - file_index="${dir_easy}/pki/index.txt" NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") if [[ "$NUMBEROFCLIENTS" = '0' ]]; then echo "" @@ -210,11 +218,9 @@ EOF cd ${dir_easy} ${bin_easy} --batch revoke $CLIENT EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl - rm -rf pki/reqs/$CLIENT.req - rm -rf pki/private/$CLIENT.key - rm -rf pki/issued/$CLIENT.crt - rm -rf /etc/openvpn/crl.pem - cp ${dir_easy}/pki/crl.pem ${dir_openvpn}/crl.pem + rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt + #rm -f ${dir_openvpn}/crl.pem + /bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem chmod 644 ${dir_openvpn}/crl.pem echo "" echo "Certificate for client $CLIENT revoked" @@ -228,18 +234,18 @@ EOF PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) if pgrep firewalld; then # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/udp + firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/udp + firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 fi if iptables -L -n | grep -qE 'REJECT|DROP'; then iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES + iptables-save > $file_iptables fi iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES + iptables-save > $file_iptables if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -531,7 +537,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service ## function install_easyrsa install_easyrsa - cd /etc/openvpn/easy-rsa/ + cd ${dir_easy}/ echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars # Create the PKI, set up the CA, the DH params and the server + client certificates ./easyrsa init-pki @@ -543,7 +549,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service # generate tls-auth key openvpn --genkey --secret /etc/openvpn/tls-auth.key # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/ + cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key ${dir_easy}/pki/crl.pem /etc/openvpn/ # Make cert revocation list readable for non-root chmod 644 /etc/openvpn/crl.pem From 9cd45d257e8adf31242742f8b2af323cbba6f620 Mon Sep 17 00:00:00 2001 From: xiagw Date: Thu, 4 Jan 2018 20:51:46 +0800 Subject: [PATCH 07/23] my comment --xia. add step number change debian apt-get update --- openvpn-install.sh | 46 ++++++++++++++++++++++++---------------------- 1 file changed, 24 insertions(+), 22 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index ffc2ea8..0e26ba8 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -232,6 +232,7 @@ EOF read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE if [[ 'y' = "$REMOVE" ]]; then PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${file_openvpn_conf} | cut -d " " -f 2) if pgrep firewalld; then # Using both permanent and not permanent rules to avoid a firewalld reload. firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} @@ -249,7 +250,7 @@ EOF if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p udp $PORT + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT fi fi fi @@ -260,8 +261,7 @@ EOF else yum remove openvpn -y fi - rm -rf ${dir_openvpn} - rm -rf /usr/share/doc/openvpn* + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* echo "" echo "OpenVPN removed!" else @@ -275,6 +275,8 @@ EOF done fi + + ## OpenVPN setup and first user creation if [[ ! -e ${file_openvpn_conf} ]]; then clear @@ -293,13 +295,13 @@ EOF echo "What port do you want for OpenVPN?" read -p "Port: " -e -i 1194 PORT echo "" - echo "What protocol do you want for OpenVPN?" + echo "1/6.What protocol do you want for OpenVPN?" echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" while [[ $PROTOCOL != "udp" && $PROTOCOL != "tcp" ]]; do read -p "Protocol [udp/tcp]: " -e -i udp PROTOCOL done cat < /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update + os_vername=wheezy + bin_apt=apt-get fi # Debian 8 if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update + os_vername=jessie + bin_apt=apt fi # Ubuntu 12.04 if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update + os_vername=precise + bin_apt=apt-get fi # Ubuntu 14.04 if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update + os_vername=trusty + bin_apt=apt-get fi + echo "deb http://build.openvpn.net/debian/openvpn/stable ${os_vername} main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + ${bin_apt} update # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN + + ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y # Install iptables service if [[ ! -e /etc/systemd/system/iptables.service ]]; then From f50c33722c62fb3b6324c3828454efc10500945e Mon Sep 17 00:00:00 2001 From: xiagw Date: Fri, 5 Jan 2018 13:09:37 +0800 Subject: [PATCH 08/23] use main function for all function --- openvpn-install.sh | 293 +++++++++++++++++++++++++-------------------- 1 file changed, 162 insertions(+), 131 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 0e26ba8..ed7d55e 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -19,6 +19,7 @@ if grep -qs "CentOS release 5" "/etc/redhat-release"; then exit 3 fi +## Global variables dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" dir_pki="${dir_easy}/pki" @@ -28,7 +29,10 @@ bin_easy="${dir_easy}/easyrsa" file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" file_iptables='/etc/iptables/iptables.rules' - + +## function determine the operating system version +detect_os_ver(){ + if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available @@ -62,6 +66,8 @@ else echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" exit 4 fi +} + install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages @@ -155,130 +161,9 @@ newclient () { echo "" >> ${file_client} } -# Try to get our IP from the system and fallback to the Internet. -# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) -# and to avoid getting an IPv6. -IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) -if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) -fi -# Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) -#### server.conf exist. -if [[ -e ${file_openvpn_conf} ]]; then - while : - do - clear -cat < $file_iptables - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $file_iptables - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf ${dir_openvpn} /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi - exit - ;; - 4) exit;; - esac - done -fi - - - -## OpenVPN setup and first user creation -if [[ ! -e ${file_openvpn_conf} ]]; then +## function for install openvpn server +install_openvpn(){ clear cat < /etc/iptables/iptables.rules + iptables-save > ${file_iptables} echo "#!/bin/sh iptables -F iptables -X @@ -457,8 +344,8 @@ Before=network-pre.target Wants=network-pre.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStart=/sbin/iptables-restore ${file_iptables} +ExecReload=/sbin/iptables-restore ${file_iptables} ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] @@ -474,7 +361,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service # Install iptables service if [[ ! -e /etc/systemd/system/iptables.service ]]; then mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules + iptables-save > ${file_iptables} echo "#!/bin/sh iptables -F iptables -X @@ -493,8 +380,8 @@ Before=network-pre.target Wants=network-pre.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStart=/sbin/iptables-restore ${file_iptables} +ExecReload=/sbin/iptables-restore ${file_iptables} ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] @@ -524,7 +411,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service if [[ "$OS" = 'arch' ]]; then # Install dependencies pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + iptables-save > ${file_iptables} # iptables won't start if this file does not exist systemctl daemon-reload systemctl enable iptables systemctl start iptables @@ -698,5 +585,149 @@ verb 3" >> ${file_client_tpl} echo "" echo "Your client config is available at $homeDir/$CLIENT.ovpn" echo "If you want to add more clients, you simply need to run this script another time!" +} + +detect_IP_NIC(){ +# Try to get our IP from the system and fallback to the Internet. +# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) +# and to avoid getting an IPv6. +IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) +if [[ "$IP" = "" ]]; then + IP=$(wget -qO- ipv4.icanhazip.com) fi +# Get Internet network interface with default route +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) + + +} + +config_openvpn(){ + + + while : + do + clear +cat < $file_iptables + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $file_iptables + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" + else + echo "" + echo "Removal aborted!" + fi + exit + ;; + 4) exit;; + esac + done + +} + + +################################# main ################################# +detect_os_ver +detect_IP_NIC + +## OpenVPN setup and first user creation +if [[ ! -e ${file_openvpn_conf} ]]; then + install_openvpn +fi + +#### server.conf exist. +if [[ -e ${file_openvpn_conf} ]]; then + config_openvpn +fi + + + exit 0; From f103339165b0adcfd969545d76662120ee5f81d5 Mon Sep 17 00:00:00 2001 From: xiagw Date: Fri, 5 Jan 2018 15:15:01 +0800 Subject: [PATCH 09/23] function for all . --- openvpn-install.sh | 1041 ++++++++++++++++++++++---------------------- 1 file changed, 525 insertions(+), 516 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index ed7d55e..04d9729 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -30,58 +30,21 @@ file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" file_iptables='/etc/iptables/iptables.rules' -## function determine the operating system version -detect_os_ver(){ - -if [[ -e /etc/debian_version ]]; then - OS="debian" - # Getting the version number, to verify that a recent version of OpenVPN is available - VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then - echo 'Your version of Debian/Ubuntu is not supported.' - echo "I can't install a recent version of OpenVPN on your system." - echo '' - echo "However, if you're using Debian unstable/testing, or Ubuntu beta," - echo 'then you can continue, a recent version of OpenVPN is available on these.' - echo 'Keep in mind they are not supported, though.' - while [[ "$CONTINUE" != [yn] ]]; do - read -p 'Continue ? [y/n]: ' -e CONTINUE - done - if [[ 'n' = "$CONTINUE" ]]; then - echo 'Ok, bye !' - exit 4 - fi - fi -elif [[ -e /etc/centos-release || -e /etc/redhat-release && ! -e /etc/fedora-release ]]; then - OS='centos' - SYSCTL='/etc/sysctl.conf' -elif [[ -e /etc/arch-release ]]; then - OS='arch' - SYSCTL='/etc/sysctl.d/openvpn.conf' -elif [[ -e /etc/fedora-release ]]; then - OS='fedora' - SYSCTL='/etc/sysctl.d/openvpn.conf' -else - echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" - exit 4 -fi -} - install_easyrsa(){ - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d ${dir_easy}/ ]]; then - rm -rf ${dir_easy}/ - fi - # Get easy-rsa - url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' - file_easy=${url_easy##*/} - wget -O ~/${file_easy} ${url_easy} - tar xzf ~/${file_easy} -C ~/ - mv ~/${file_easy%.tgz} ${dir_easy} - chown -R root:root ${dir_easy}/ - rm -rf ~/${file_easy} + +# An old version of easy-rsa was available by default in some openvpn packages +if [[ -d ${dir_easy}/ ]]; then + rm -rf ${dir_easy}/ +fi +# Get easy-rsa +url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' +file_easy=${url_easy##*/} +wget -O ~/${file_easy} ${url_easy} +tar xzf ~/${file_easy} -C ~/ +mv ~/${file_easy%.tgz} ${dir_easy} +chown -R root:root ${dir_easy}/ +rm -rf ~/${file_easy} } set_firewall(){ @@ -134,37 +97,39 @@ set_firewall(){ fi } -newclient () { - # Where to write the custom client.ovpn? - if [ -e /home/$1 ]; then # if $1 is a user name - homeDir="/home/$1" - elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER - homeDir="/home/${SUDO_USER}" - else # if not SUDO_USER, use /root - homeDir="${dir_openvpn}" - fi - # Generates the custom client.ovpn - file_client="$homeDir/$1.ovpn" - cp ${file_client_tpl} ${file_client} - echo "" >> ${file_client} - cat ${dir_easy}/pki/ca.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat ${dir_easy}/pki/issued/$1.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat ${dir_easy}/pki/private/$1.key >> ${file_client} - echo "" >> ${file_client} - echo "key-direction 1" >> ${file_client} - echo "" >> ${file_client} - cat ${dir_openvpn}/tls-auth.key >> ${file_client} - echo "" >> ${file_client} +generate_newclient() { + +# Where to write the custom client.ovpn? +if [ -e /home/$1 ]; then # if $1 is a user name + homeDir="/home/$1" +elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" +else # if not SUDO_USER, use /root + homeDir="${dir_openvpn}" +fi +# Generates the custom client.ovpn +file_client="$homeDir/$1.ovpn" +cp ${file_client_tpl} ${file_client} +echo "" >> ${file_client} +cat ${dir_easy}/pki/ca.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_easy}/pki/issued/$1.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_easy}/pki/private/$1.key >> ${file_client} +echo "" >> ${file_client} +echo "key-direction 1" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_openvpn}/tls-auth.key >> ${file_client} +echo "" >> ${file_client} } ## function for install openvpn server install_openvpn(){ - clear + +clear cat < /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - ${bin_apt} update - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - - ## The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > ${file_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${file_iptables} -ExecReload=/sbin/iptables-restore ${file_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi - elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - fi - yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > ${file_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${file_iptables} -ExecReload=/sbin/iptables-restore ${file_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi - else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != [yn] ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi +echo "" +echo "4/6.Choose what size of Diffie-Hellman key you want to use:" +echo " 1) 2048 bits (fastest)" +echo " 2) 3072 bits (recommended, best compromise)" +echo " 3) 4096 bits (most secure)" +while [[ $DH_KEY_SIZE != [1-3] ]]; do + read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE +done +case $DH_KEY_SIZE in + 1) + DH_KEY_SIZE="2048" + ;; + 2) + DH_KEY_SIZE="3072" + ;; + 3) + DH_KEY_SIZE="4096" + ;; +esac - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > ${file_iptables} # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi +echo "" +echo "5/6.Choose what size of RSA key you want to use:" +echo " 1) 2048 bits (fastest)" +echo " 2) 3072 bits (recommended, best compromise)" +echo " 3) 4096 bits (most secure)" +while [[ $RSA_KEY_SIZE != [1-3] ]]; do + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE +done +case $RSA_KEY_SIZE in + 1) + RSA_KEY_SIZE="2048" + ;; + 2) + RSA_KEY_SIZE="3072" + ;; + 3) + RSA_KEY_SIZE="4096" + ;; +esac + +echo "" +echo "6/6.Finally, tell me a name for the client certificate and configuration" +while [[ $CLIENT = "" ]]; do + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT +done + +echo "" +echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" +read -n1 -r -p "Press any key to continue..." + +if [[ "$OS" = 'debian' ]]; then + apt-get install ca-certificates -y + # We add the OpenVPN repo to get the latest version. + # Debian 7 + if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then + os_vername=wheezy + bin_apt=apt-get fi - # Find out if the machine uses nogroup or nobody for the permissionless group - if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup - else - NOGROUP=nobody + # Debian 8 + if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then + os_vername=jessie + bin_apt=apt fi - ## function install_easyrsa - install_easyrsa + # Ubuntu 12.04 + if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then + os_vername=precise + bin_apt=apt-get + fi + # Ubuntu 14.04 + if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then + os_vername=trusty + bin_apt=apt-get + fi + echo "deb http://build.openvpn.net/debian/openvpn/stable ${os_vername} main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + ${bin_apt} update + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - cd ${dir_easy}/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars - # Create the PKI, set up the CA, the DH params and the server + client certificates - ./easyrsa init-pki - ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE - ./easyrsa build-server-full server nopass - ./easyrsa build-client-full $CLIENT nopass - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key - # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key ${dir_easy}/pki/crl.pem /etc/openvpn/ - # Make cert revocation list readable for non-root - chmod 644 /etc/openvpn/crl.pem + ## The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > ${file_iptables} + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore ${file_iptables} +ExecReload=/sbin/iptables-restore ${file_iptables} +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi +elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then + if [[ "$OS" = 'centos' ]]; then + yum install epel-release -y + fi + yum install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > ${file_iptables} + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore ${file_iptables} +ExecReload=/sbin/iptables-restore ${file_iptables} +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi +else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != [yn] ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi - # Generate server.conf - echo "port $PORT + if [[ "$OS" = 'arch' ]]; then + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > ${file_iptables} # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi +fi + +# Find out if the machine uses nogroup or nobody for the permissionless group +if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup +else + NOGROUP=nobody +fi +## function install_easyrsa +install_easyrsa + +cd ${dir_easy}/ +echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars +# Create the PKI, set up the CA, the DH params and the server + client certificates +./easyrsa init-pki +./easyrsa --batch build-ca nopass +openssl dhparam -out dh.pem $DH_KEY_SIZE +./easyrsa build-server-full server nopass +./easyrsa build-client-full $CLIENT nopass +EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl +# generate tls-auth key +openvpn --genkey --secret /etc/openvpn/tls-auth.key +# Move all the generated files +cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key ${dir_easy}/pki/crl.pem /etc/openvpn/ +# Make cert revocation list readable for non-root +chmod 644 /etc/openvpn/crl.pem + +# Generate server.conf +echo "port $PORT proto ${PROTOCOL} dev tun user nobody @@ -454,42 +426,42 @@ keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf - # DNS resolvers - case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" - done - ;; - 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' - ;; - 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' - echo 'push "dhcp-option DNS 80.67.169.40"' - ;; - 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' - echo 'push "dhcp-option DNS 84.200.70.40"' - ;; - 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' - echo 'push "dhcp-option DNS 208.67.220.220"' - ;; - 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' - echo 'push "dhcp-option DNS 8.8.4.4"' - ;; - 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' - echo 'push "dhcp-option DNS 77.88.8.1"' - ;; - 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' - echo 'push "dhcp-option DNS 176.103.130.131"' - ;; - esac >> /etc/openvpn/server.conf +# DNS resolvers +case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" + done + ;; + 2) #Quad9 + echo 'push "dhcp-option DNS 9.9.9.9"' + ;; + 3) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' + echo 'push "dhcp-option DNS 80.67.169.40"' + ;; + 4) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' + echo 'push "dhcp-option DNS 84.200.70.40"' + ;; + 5) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' + echo 'push "dhcp-option DNS 208.67.220.220"' + ;; + 6) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' + echo 'push "dhcp-option DNS 8.8.4.4"' + ;; + 7) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' + echo 'push "dhcp-option DNS 77.88.8.1"' + ;; + 8) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' + echo 'push "dhcp-option DNS 176.103.130.131"' + ;; +esac >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem ca ca.crt @@ -505,64 +477,64 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn.log verb 3" >> /etc/openvpn/server.conf - ## function set_firewall - set_firewall +## call function set_firewall +set_firewall - # And finally, restart OpenVPN - if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - #Workaround to fix OpenVPN service on OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service - systemctl daemon-reload - systemctl restart openvpn - systemctl enable openvpn +# And finally, restart OpenVPN +if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + #Workaround to fix OpenVPN service on OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service + systemctl daemon-reload + systemctl restart openvpn + systemctl enable openvpn + else + /etc/init.d/openvpn restart + fi +else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then + #Workaround to avoid rewriting the entire script for Arch & Fedora + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service else - /etc/init.d/openvpn restart + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service fi else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then - #Workaround to avoid rewriting the entire script for Arch & Fedora - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi + service openvpn restart + chkconfig openvpn on fi - # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users - EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) - if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi +fi +# Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users +EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) +if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP fi +fi - # client-template.txt is created so we have a template to add further users later - echo "client" > ${file_client_tpl} - if [[ "$PROTOCOL" = 'udp' ]]; then - echo "proto ${PROTOCOL}" >> ${file_client_tpl} - elif [[ "$PROTOCOL" = 'tcp' ]]; then - echo "proto ${PROTOCOL}-client" >> ${file_client_tpl} - fi - echo "remote $IP $PORT +# client-template.txt is created so we have a template to add further users later +echo "client" > ${file_client_tpl} +if [[ "$PROTOCOL" = 'udp' ]]; then + echo "proto ${PROTOCOL}" >> ${file_client_tpl} +elif [[ "$PROTOCOL" = 'tcp' ]]; then + echo "proto ${PROTOCOL}-client" >> ${file_client_tpl} +fi +echo "remote $IP $PORT dev tun resolv-retry infinite nobind @@ -578,36 +550,22 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 setenv opt block-outside-dns verb 3" >> ${file_client_tpl} - # function Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" - echo "If you want to add more clients, you simply need to run this script another time!" +# call function Generate the custom client.ovpn +generate_newclient "$CLIENT" +echo "" +echo "Finished!" +echo "" +echo "Your client config is available at $homeDir/$CLIENT.ovpn" +echo "If you want to add more clients, you simply need to run this script another time!" } -detect_IP_NIC(){ -# Try to get our IP from the system and fallback to the Internet. -# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) -# and to avoid getting an IPv6. -IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) -if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) -fi -# Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) - - -} config_openvpn(){ - - while : - do - clear -cat < $file_iptables - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + if iptables -L -n | grep -qE 'REJECT|DROP'; then + iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT iptables-save > $file_iptables - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT - fi + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $file_iptables + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT fi fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf ${dir_openvpn} /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" fi - exit - ;; - 4) exit;; - esac - done + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" + else + echo "" + echo "Removal aborted!" + fi + exit + ;; + 4) exit;; + esac +done } +## function: determine the operating system version +detect_os_ver(){ + +if [[ -e /etc/debian_version ]]; then + OS="debian" + # Getting the version number, to verify that a recent version of OpenVPN is available + VERSION_ID=$(grep "VERSION_ID" /etc/os-release) + SYSCTL='/etc/sysctl.conf' + if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then + echo 'Your version of Debian/Ubuntu is not supported.' + echo "I can't install a recent version of OpenVPN on your system." + echo '' + echo "However, if you're using Debian unstable/testing, or Ubuntu beta," + echo 'then you can continue, a recent version of OpenVPN is available on these.' + echo 'Keep in mind they are not supported, though.' + while [[ "$CONTINUE" != [yn] ]]; do + read -p 'Continue ? [y/n]: ' -e CONTINUE + done + if [[ 'n' = "$CONTINUE" ]]; then + echo 'Ok, bye !' + exit 4 + fi + fi +elif [[ -e /etc/centos-release || -e /etc/redhat-release && ! -e /etc/fedora-release ]]; then + OS='centos' + SYSCTL='/etc/sysctl.conf' +elif [[ -e /etc/arch-release ]]; then + OS='arch' + SYSCTL='/etc/sysctl.d/openvpn.conf' +elif [[ -e /etc/fedora-release ]]; then + OS='fedora' + SYSCTL='/etc/sysctl.d/openvpn.conf' +else + echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" + exit 4 +fi +} + +detect_IP_NIC(){ + +# Try to get our IP from the system and fallback to the Internet. +# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) +# and to avoid getting an IPv6. +IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) +if [[ "$IP" = "" ]]; then + IP=$(wget -qO- ipv4.icanhazip.com) +fi +# Get Internet network interface with default route +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) +} ################################# main ################################# -detect_os_ver -detect_IP_NIC +main(){ +detect_os_ver ## call function +detect_IP_NIC ## call function ## OpenVPN setup and first user creation if [[ ! -e ${file_openvpn_conf} ]]; then - install_openvpn + install_openvpn ## call function fi #### server.conf exist. if [[ -e ${file_openvpn_conf} ]]; then - config_openvpn + config_openvpn ## call function fi +} - - -exit 0; +main $@ +# exit 0; From e051f53b5df1154bb696e69b1ad2f490cd0a4f0d Mon Sep 17 00:00:00 2001 From: xiagw Date: Fri, 5 Jan 2018 18:10:08 +0800 Subject: [PATCH 10/23] change function location revert debian repo function for iptables --- openvpn-install.sh | 245 ++++++++++++++++++++------------------------- 1 file changed, 111 insertions(+), 134 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 04d9729..b97f210 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -23,9 +23,7 @@ fi dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" dir_pki="${dir_easy}/pki" - bin_easy="${dir_easy}/easyrsa" - file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" file_iptables='/etc/iptables/iptables.rules' @@ -48,53 +46,54 @@ rm -rf ~/${file_easy} } set_firewall(){ - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules +# Create the sysctl configuration file if needed (mainly for Arch Linux) +if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL +fi + +# Enable net.ipv4.ip_forward for the system +sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL +if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL +fi +# Avoid an unneeded reboot +echo 1 > /proc/sys/net/ipv4/ip_forward +# Set NAT for the VPN subnet +iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE +# Save persitent iptables rules +iptables-save > $file_iptables +if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 +fi +if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules iptables-save > $file_iptables - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $file_iptables - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT +fi +# If SELinux is enabled and a custom port was selected, we need this +if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y fi + semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT fi fi +fi } generate_newclient() { @@ -125,6 +124,41 @@ cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} } +## function: install iptables for debian +install_iptables_service(){ + +# Install iptables service +if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > ${file_iptables} + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore ${file_iptables} +ExecReload=/sbin/iptables-restore ${file_iptables} +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service +fi +} ## function for install openvpn server install_openvpn(){ @@ -268,101 +302,44 @@ if [[ "$OS" = 'debian' ]]; then # We add the OpenVPN repo to get the latest version. # Debian 7 if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - os_vername=wheezy - bin_apt=apt-get + echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update fi # Debian 8 if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then os_vername=jessie - bin_apt=apt + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update fi # Ubuntu 12.04 if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then os_vername=precise - bin_apt=apt-get + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update fi # Ubuntu 14.04 if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then os_vername=trusty - bin_apt=apt-get + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update fi - echo "deb http://build.openvpn.net/debian/openvpn/stable ${os_vername} main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - ${bin_apt} update # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > ${file_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${file_iptables} -ExecReload=/sbin/iptables-restore ${file_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi + install_iptables_service ## call function elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then if [[ "$OS" = 'centos' ]]; then yum install epel-release -y fi yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > ${file_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${file_iptables} -ExecReload=/sbin/iptables-restore ${file_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi + install_iptables_service ## call function + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld else # Else, the distro is ArchLinux echo "" @@ -395,8 +372,8 @@ if grep -qs "^nogroup:" /etc/group; then else NOGROUP=nobody fi -## function install_easyrsa -install_easyrsa + +install_easyrsa ## call function cd ${dir_easy}/ echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars @@ -407,14 +384,14 @@ openssl dhparam -out dh.pem $DH_KEY_SIZE ./easyrsa build-server-full server nopass ./easyrsa build-client-full $CLIENT nopass EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl -# generate tls-auth key -openvpn --genkey --secret /etc/openvpn/tls-auth.key -# Move all the generated files -cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key ${dir_easy}/pki/crl.pem /etc/openvpn/ -# Make cert revocation list readable for non-root -chmod 644 /etc/openvpn/crl.pem +## generate tls-auth key +openvpn --genkey --secret ${dir_openvpn}/tls-auth.key +## Move all the generated files +cp ${dir_pki}/ca.crt ${dir_pki}/private/ca.key dh.pem ${dir_pki}/issued/server.crt ${dir_pki}/private/server.key ${dir_pki}/crl.pem ${dir_openvpn}/ +## Make cert revocation list readable for non-root +chmod 644 ${dir_openvpn}/crl.pem -# Generate server.conf +## Generate server.conf echo "port $PORT proto ${PROTOCOL} dev tun @@ -425,7 +402,7 @@ persist-tun keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf +ifconfig-pool-persist ipp.txt" >> ${file_openvpn_conf} # DNS resolvers case $DNS in 1) @@ -461,8 +438,8 @@ case $DNS in echo 'push "dhcp-option DNS 176.103.130.130"' echo 'push "dhcp-option DNS 176.103.130.131"' ;; -esac >> /etc/openvpn/server.conf -echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf +esac >> ${file_openvpn_conf} +echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${file_openvpn_conf} echo "crl-verify crl.pem ca ca.crt cert server.crt @@ -475,10 +452,9 @@ tls-server tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn.log -verb 3" >> /etc/openvpn/server.conf +verb 3" >> ${file_openvpn_conf} -## call function set_firewall -set_firewall +set_firewall ## call function # And finally, restart OpenVPN if [[ "$OS" = 'debian' ]]; then @@ -512,6 +488,7 @@ else chkconfig openvpn on fi fi + # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) if [[ "$IP" != "$EXTERNALIP" ]]; then @@ -576,7 +553,7 @@ What do you want to do? 3) Remove OpenVPN 4) Exit EOF - file_index="${dir_easy}/pki/index.txt" + file_index="${dir_pki}/index.txt" read -p 'Select an option [1-4]: ' option case $option in 1) From 13d5265b595fb75e738b39d62376960742222231 Mon Sep 17 00:00:00 2001 From: xiagw Date: Fri, 5 Jan 2018 19:14:49 +0800 Subject: [PATCH 11/23] fix something --- openvpn-install.sh | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index b97f210..8dca302 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -127,9 +127,12 @@ echo "" >> ${file_client} ## function: install iptables for debian install_iptables_service(){ +dir_ipt='/etc/iptables' +file_ipt_svc='/etc/systemd/system/iptables.service' +file_ipt_sh="${dir_ipt}/flush-iptables.sh" # Install iptables service -if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables +if [[ ! -e ${file_ipt_svc} ]]; then + mkdir ${dir_ipt} iptables-save > ${file_iptables} echo "#!/bin/sh iptables -F @@ -140,8 +143,8 @@ iptables -t mangle -F iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh +iptables -P OUTPUT ACCEPT" > ${file_ipt_sh} + chmod +x ${file_ipt_sh} echo "[Unit] Description=Packet Filtering Framework DefaultDependencies=no @@ -154,7 +157,7 @@ ExecReload=/sbin/iptables-restore ${file_iptables} ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service +WantedBy=multi-user.target" > ${file_ipt_svc} systemctl daemon-reload systemctl enable iptables.service fi @@ -586,7 +589,7 @@ EOF else read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER fi - CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) + CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) cd ${dir_easy} ${bin_easy} --batch revoke $CLIENT EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl From 593e59763056bd59177a4e3663ef101afc98ea3b Mon Sep 17 00:00:00 2001 From: xiagw Date: Sat, 6 Jan 2018 15:38:54 +0800 Subject: [PATCH 12/23] fix config firewall --- openvpn-install.sh | 53 +++++++++++++++++++++++++++++----------------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 8dca302..fbb7782 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -26,7 +26,7 @@ dir_pki="${dir_easy}/pki" bin_easy="${dir_easy}/easyrsa" file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" -file_iptables='/etc/iptables/iptables.rules' +file_iptables='/etc/sysconfig/iptables.rules' install_easyrsa(){ @@ -125,7 +125,7 @@ echo "" >> ${file_client} } ## function: install iptables for debian -install_iptables_service(){ +install_ipt_service(){ dir_ipt='/etc/iptables' file_ipt_svc='/etc/systemd/system/iptables.service' @@ -160,9 +160,15 @@ RemainAfterExit=yes WantedBy=multi-user.target" > ${file_ipt_svc} systemctl daemon-reload systemctl enable iptables.service + if [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi fi } + ## function for install openvpn server install_openvpn(){ @@ -333,16 +339,17 @@ if [[ "$OS" = 'debian' ]]; then # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y - install_iptables_service ## call function -elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos' ]]; then + install_ipt_service ## call function +elif [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + if [[ "$OS" = 'centos7' ]]; then yum install epel-release -y fi yum install openvpn iptables openssl wget ca-certificates curl -y - install_iptables_service ## call function - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld + # install_ipt_service ## call function +elif [[ "$OS" = 'centos6' ]]; then + yum install epel-release -y + yum install openvpn iptables openssl wget ca-certificates curl -y + # install_ipt_service ## call function else # Else, the distro is ArchLinux echo "" @@ -536,7 +543,7 @@ echo "" echo "Finished!" echo "" echo "Your client config is available at $homeDir/$CLIENT.ovpn" -echo "If you want to add more clients, you simply need to run this script another time!" +echo "If you want to add more clients, you simply need to run this script again!" } @@ -657,9 +664,16 @@ detect_os_ver(){ if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available - VERSION_ID=$(grep "VERSION_ID" /etc/os-release) + # VERSION_ID=$(grep "VERSION_ID" /etc/os-release) + source /etc/os-release SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then + # if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then + # if [[ "$VERSION_ID" != [789] && "$VERSION_ID" != '12.04' && "$VERSION_ID" != '14.04' && "$VERSION_ID" != '16.04' && "$VERSION_ID" != '16.10' && "$VERSION_ID" != '17.04' ]]; then + case "$VERSION_ID" in + 7|8|9|12.04|14.04|16.04|16.10|17.04) + : + ;; + *) echo 'Your version of Debian/Ubuntu is not supported.' echo "I can't install a recent version of OpenVPN on your system." echo '' @@ -673,9 +687,13 @@ if [[ -e /etc/debian_version ]]; then echo 'Ok, bye !' exit 4 fi - fi + esac + # fi elif [[ -e /etc/centos-release || -e /etc/redhat-release && ! -e /etc/fedora-release ]]; then - OS='centos' + # rpm -q --queryformat '%{VERSION}' centos-release + # rpm -q --queryformat '%{RELEASE}' redhat-release-server | awk -F. '{print $1}' + # grep -oE '[0-9]+\.[0-9]+' /etc/redhat-release + OS="centos$(rpm -q --queryformat '%{VERSION}' centos-release)" SYSCTL='/etc/sysctl.conf' elif [[ -e /etc/arch-release ]]; then OS='arch' @@ -708,13 +726,10 @@ detect_os_ver ## call function detect_IP_NIC ## call function ## OpenVPN setup and first user creation -if [[ ! -e ${file_openvpn_conf} ]]; then - install_openvpn ## call function -fi - -#### server.conf exist. if [[ -e ${file_openvpn_conf} ]]; then config_openvpn ## call function +else + install_openvpn ## call function fi } From 182c651c944385e4720e651795aaefdc2e6e50e6 Mon Sep 17 00:00:00 2001 From: xiagw Date: Sat, 6 Jan 2018 16:13:31 +0800 Subject: [PATCH 13/23] fix something --- openvpn-install.sh | 131 ++++++++++++++++++++++++--------------------- 1 file changed, 71 insertions(+), 60 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index fbb7782..99e62d4 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -29,22 +29,6 @@ file_openvpn_conf="${dir_openvpn}/server.conf" file_iptables='/etc/sysconfig/iptables.rules' -install_easyrsa(){ - -# An old version of easy-rsa was available by default in some openvpn packages -if [[ -d ${dir_easy}/ ]]; then - rm -rf ${dir_easy}/ -fi -# Get easy-rsa -url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' -file_easy=${url_easy##*/} -wget -O ~/${file_easy} ${url_easy} -tar xzf ~/${file_easy} -C ~/ -mv ~/${file_easy%.tgz} ${dir_easy} -chown -R root:root ${dir_easy}/ -rm -rf ~/${file_easy} -} - set_firewall(){ # Create the sysctl configuration file if needed (mainly for Arch Linux) @@ -124,6 +108,24 @@ cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} } +install_easyrsa(){ + +# An old version of easy-rsa was available by default in some openvpn packages +if [[ -d ${dir_easy}/ ]]; then + rm -rf ${dir_easy}/ +else + mkdir -p ${dir_easy} +fi +# Get easy-rsa +url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' +file_easy=${url_easy##*/} +wget -O ~/${file_easy} ${url_easy} +tar xzf ~/${file_easy} -C ~/ +mv ~/${file_easy%.tgz} ${dir_easy} +chown -R root:root ${dir_easy}/ +rm -rf ~/${file_easy} +} + ## function: install iptables for debian install_ipt_service(){ @@ -344,11 +346,11 @@ elif [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then if [[ "$OS" = 'centos7' ]]; then yum install epel-release -y fi - yum install openvpn iptables openssl wget ca-certificates curl -y + yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y # install_ipt_service ## call function elif [[ "$OS" = 'centos6' ]]; then yum install epel-release -y - yum install openvpn iptables openssl wget ca-certificates curl -y + yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y # install_ipt_service ## call function else # Else, the distro is ArchLinux @@ -412,7 +414,9 @@ persist-tun keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt" >> ${file_openvpn_conf} +ifconfig-pool-persist ipp.txt +#client-config-dir ccd +#route 10.8.0.0 255.255.255.252" >> ${file_openvpn_conf} # DNS resolvers case $DNS in 1) @@ -450,7 +454,8 @@ case $DNS in ;; esac >> ${file_openvpn_conf} echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${file_openvpn_conf} -echo "crl-verify crl.pem +echo "client-to-client +crl-verify crl.pem ca ca.crt cert server.crt key server.key @@ -462,6 +467,8 @@ tls-server tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn.log +log openvpn.log +log-append openvpn.log verb 3" >> ${file_openvpn_conf} set_firewall ## call function @@ -546,6 +553,49 @@ echo "Your client config is available at $homeDir/$CLIENT.ovpn" echo "If you want to add more clients, you simply need to run this script again!" } +remove_openvpn(){ + +echo "" +read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE +if [[ 'y' = "$REMOVE" ]]; then + PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${file_openvpn_conf} | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $file_iptables + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $file_iptables + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" +else + echo "" + echo "Removal aborted!" +fi +} config_openvpn(){ @@ -610,46 +660,7 @@ EOF exit ;; 3) - echo "" - read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ 'y' = "$REMOVE" ]]; then - PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) - PROTOCOL=$(grep '^proto ' ${file_openvpn_conf} | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $file_iptables - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $file_iptables - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf ${dir_openvpn} /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi + remove_openvpn ## call function exit ;; 4) exit;; From 3d95333ec522812394cc137e37da1d7d69831692 Mon Sep 17 00:00:00 2001 From: xiagw Date: Sat, 6 Jan 2018 16:34:15 +0800 Subject: [PATCH 14/23] change debian the third party repository --- openvpn-install.sh | 36 +++++++++++++++++------------------- 1 file changed, 17 insertions(+), 19 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 99e62d4..1968eb3 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -28,7 +28,7 @@ file_client_tpl="${dir_openvpn}/client-template.txt" file_openvpn_conf="${dir_openvpn}/server.conf" file_iptables='/etc/sysconfig/iptables.rules' - +## function: config the firewall set_firewall(){ # Create the sysctl configuration file if needed (mainly for Arch Linux) @@ -80,6 +80,7 @@ if hash sestatus 2>/dev/null; then fi } +## function: generate the new client??.ovpn generate_newclient() { # Where to write the custom client.ovpn? @@ -108,6 +109,7 @@ cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} } +## function: install easyrsa 3.0.3 install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages @@ -170,8 +172,7 @@ WantedBy=multi-user.target" > ${file_ipt_svc} fi } - -## function for install openvpn server +## function: install openvpn server install_openvpn(){ clear @@ -311,33 +312,27 @@ read -n1 -r -p "Press any key to continue..." if [[ "$OS" = 'debian' ]]; then apt-get install ca-certificates -y # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then + case $VERSION_ID in + '7') # Debian 7 echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update - fi - # Debian 8 - if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - os_vername=jessie + ;; + '8') # Debian 8 echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - os_vername=precise + ;; + '12.04') # Ubuntu 12.04 echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update - fi - # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - os_vername=trusty + ;; + '14.04') # Ubuntu 14.04 echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update - fi + esac # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y @@ -348,10 +343,12 @@ elif [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then fi yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y # install_ipt_service ## call function + read -p "Please manually set the firewall,press anykey continue" elif [[ "$OS" = 'centos6' ]]; then yum install epel-release -y yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y # install_ipt_service ## call function + read -p "Please manually set the firewall,press anykey continue" else # Else, the distro is ArchLinux echo "" @@ -553,6 +550,7 @@ echo "Your client config is available at $homeDir/$CLIENT.ovpn" echo "If you want to add more clients, you simply need to run this script again!" } +## function: remove openvpn server and config dir remove_openvpn(){ echo "" @@ -597,6 +595,7 @@ else fi } + config_openvpn(){ while : @@ -745,4 +744,3 @@ fi } main $@ -# exit 0; From 25755b2a434e58632360b946fb553d814a250f4e Mon Sep 17 00:00:00 2001 From: xiagw Date: Sat, 6 Jan 2018 16:59:20 +0800 Subject: [PATCH 15/23] fix easyrsa problem --- openvpn-install.sh | 21 +++++++++++---------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 1968eb3..28078f5 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -95,13 +95,13 @@ fi file_client="$homeDir/$1.ovpn" cp ${file_client_tpl} ${file_client} echo "" >> ${file_client} -cat ${dir_easy}/pki/ca.crt >> ${file_client} +cat ${dir_pki}/ca.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_easy}/pki/issued/$1.crt >> ${file_client} +cat ${dir_pki}/issued/$1.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_easy}/pki/private/$1.key >> ${file_client} +cat ${dir_pki}/private/$1.key >> ${file_client} echo "" >> ${file_client} echo "key-direction 1" >> ${file_client} echo "" >> ${file_client} @@ -115,15 +115,16 @@ install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages if [[ -d ${dir_easy}/ ]]; then rm -rf ${dir_easy}/ + mkdir -p ${dir_easy} else mkdir -p ${dir_easy} fi # Get easy-rsa url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' file_easy=${url_easy##*/} -wget -O ~/${file_easy} ${url_easy} +wget -c -O ~/${file_easy} ${url_easy} tar xzf ~/${file_easy} -C ~/ -mv ~/${file_easy%.tgz} ${dir_easy} +mv ~/${file_easy%.tgz}/* ${dir_easy}/ chown -R root:root ${dir_easy}/ rm -rf ~/${file_easy} } @@ -387,11 +388,11 @@ install_easyrsa ## call function cd ${dir_easy}/ echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars # Create the PKI, set up the CA, the DH params and the server + client certificates -./easyrsa init-pki -./easyrsa --batch build-ca nopass +${dir_easy}/easyrsa init-pki +${dir_easy}/easyrsa --batch build-ca nopass openssl dhparam -out dh.pem $DH_KEY_SIZE -./easyrsa build-server-full server nopass -./easyrsa build-client-full $CLIENT nopass +${dir_easy}/easyrsa build-server-full server nopass +${dir_easy}/easyrsa build-client-full $CLIENT nopass EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl ## generate tls-auth key openvpn --genkey --secret ${dir_openvpn}/tls-auth.key @@ -463,7 +464,7 @@ $CIPHER tls-server tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn.log +status openvpn-status.log log openvpn.log log-append openvpn.log verb 3" >> ${file_openvpn_conf} From 331e0c1d17b9ce3d07c0a4d7c191bff75881afd6 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 16:56:35 +0800 Subject: [PATCH 16/23] merged from master --- edit-in-master.sh | 769 +++++++++++++++++++++++++++++++++++++++++++++ openvpn-install.sh | 192 ++++++----- origin-upstream.sh | 693 ++++++++++++++++++++++++++++++++++++++++ 3 files changed, 1569 insertions(+), 85 deletions(-) create mode 100644 edit-in-master.sh create mode 100644 origin-upstream.sh diff --git a/edit-in-master.sh b/edit-in-master.sh new file mode 100644 index 0000000..ab0c534 --- /dev/null +++ b/edit-in-master.sh @@ -0,0 +1,769 @@ +#!/bin/bash + +# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux +# https://github.com/Angristan/OpenVPN-install + + +if [[ "$EUID" -ne 0 ]]; then + echo "Sorry, you need to run this as root" + exit 1 +fi + +if [[ ! -e /dev/net/tun ]]; then + echo "TUN is not available" + exit 2 +fi + +if grep -qs "CentOS release 5" "/etc/redhat-release"; then + echo "CentOS 5 is too old and not supported" + exit 3 +fi + +## Global variables +dir_openvpn='/etc/openvpn' +dir_easy="${dir_openvpn}/easy-rsa" +dir_pki="${dir_easy}/pki" +bin_easy="${dir_easy}/easyrsa" +conf_client_tpl="${dir_openvpn}/client-template.txt" +conf_server="${dir_openvpn}/server.conf" +conf_iptables='/etc/sysconfig/iptables.rules' + +## function: config the firewall +set_firewall(){ + +# Create the sysctl configuration file if needed (mainly for Arch Linux) +if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL +fi + +# Enable net.ipv4.ip_forward for the system +sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL +if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL +fi +# Avoid an unneeded reboot +echo 1 > /proc/sys/net/ipv4/ip_forward +# Set NAT for the VPN subnet +iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE +# Save persitent iptables rules +iptables-save > $conf_iptables +if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 +fi +if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules + iptables-save > $conf_iptables +fi +# If SELinux is enabled and a custom port was selected, we need this +if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi +fi +} + +## function: generate the new client??.ovpn +generate_newclient() { + +echo "" +echo "Tell me a name for the client cert" +echo "Please, use one word only, no special characters" +echo "Here are the files that already exist,do not repeat that" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +read -p "Client name: " -e -i client CLIENT +cd ${dir_easy} +${bin_easy} build-client-full $CLIENT nopass + +# Generates the custom client.ovpn +# Where to write the custom client.ovpn? +if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name + homeDir="/home/$CLIENT" +elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" +else # if not SUDO_USER, use /root + homeDir="${dir_openvpn}" +fi +# Generates the custom client.ovpn +file_client="$homeDir/$CLIENT.ovpn" +cp ${conf_client_tpl} ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/ca.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/private/$CLIENT.key >> ${file_client} +echo "" >> ${file_client} +echo "key-direction 1" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_openvpn}/tls-auth.key >> ${file_client} +echo "" >> ${file_client} + +echo "" +echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + +} + +## function: revoke a exist client??.ovpn +revoke_openvpn_client(){ + +NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") +if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 +fi +echo "" +echo "Select the existing client certificate you want to revoke" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER +else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER +fi +CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) +cd ${dir_easy} +${bin_easy} --batch revoke $CLIENT +EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl +rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt +#rm -f ${dir_openvpn}/crl.pem +/bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem +chmod 644 ${dir_openvpn}/crl.pem +echo "" +echo "Certificate for client $CLIENT revoked" +echo "Exiting..." +} + +## function: install easyrsa 3.0.3 +install_easyrsa(){ + +# An old version of easy-rsa was available by default in some openvpn packages +rm -rf ${dir_easy} +mkdir -p ${dir_easy} +# Get easy-rsa +url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' +file_easy=${url_easy##*/} +wget -c -O ~/${file_easy} ${url_easy} +tar xzf ~/${file_easy} -C ~/ +mv ~/${file_easy%.tgz}/* ${dir_easy}/ +chown -R root:root ${dir_easy}/ +rm -rf ~/${file_easy} +} + +## function: install iptables for debian +systemd_ipt_service(){ + +dir_ipt='/etc/iptables' +file_ipt_svc='/etc/systemd/system/iptables.service' +file_ipt_sh="${dir_ipt}/flush-iptables.sh" +# Install iptables service +if [[ ! -e ${file_ipt_svc} ]]; then + mkdir ${dir_ipt} + iptables-save > ${conf_iptables} + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > ${file_ipt_sh} + chmod +x ${file_ipt_sh} + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore ${conf_iptables} +ExecReload=/sbin/iptables-restore ${conf_iptables} +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > ${file_ipt_svc} + systemctl daemon-reload + systemctl enable iptables.service + if [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi +fi +} + +## +config_iptables(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + +## +config_firewalld(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + + +## function: install openvpn server +install_openvpn(){ + +clear +cat < /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + ;; + '8') # Debian 8 + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update + ;; + '12.04') # Ubuntu 12.04 + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + ;; + '14.04') # Ubuntu 14.04 + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + esac + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + ## The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + systemd_ipt_service ## call function +elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + if [[ "$OS" != 'fedora' ]]; then + yum install epel-release -y + fi + yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y + if [[ "$OS" = 'centos6' ]]; then + config_iptables ## call function + else + config_firewalld ## call function + fi +else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != [yn] ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + + if [[ "$OS" = 'arch' ]]; then + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > ${conf_iptables} # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi +fi + + +# Find out if the machine uses nogroup or nobody for the permissionless group +if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup +else + NOGROUP=nobody +fi + +install_easyrsa ## call function + +cd ${dir_easy}/ +echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars +# Create the PKI, set up the CA, the DH params and the server + client certificates +${dir_easy}/easyrsa init-pki +${dir_easy}/easyrsa --batch build-ca nopass +openssl dhparam -out dh.pem $DH_KEY_SIZE +${dir_easy}/easyrsa build-server-full server nopass +${dir_easy}/easyrsa build-client-full $CLIENT nopass +EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl +## generate tls-auth key +openvpn --genkey --secret ${dir_openvpn}/tls-auth.key +## Move all the generated files +cp ${dir_pki}/ca.crt ${dir_pki}/private/ca.key dh.pem ${dir_pki}/issued/server.crt ${dir_pki}/private/server.key ${dir_pki}/crl.pem ${dir_openvpn}/ +## Make cert revocation list readable for non-root +chmod 644 ${dir_openvpn}/crl.pem + +## Generate server.conf +echo "port $PORT +proto ${PROTOCOL} +dev tun +user nobody +group $NOGROUP +persist-key +persist-tun +keepalive 10 120 +topology subnet +server 10.8.0.0 255.255.255.0 +ifconfig-pool-persist ipp.txt +#client-config-dir ccd +#route 10.8.0.0 255.255.255.252" >> ${conf_server} +# DNS resolvers +case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" + done + ;; + 2) #Quad9 + echo 'push "dhcp-option DNS 9.9.9.9"' + ;; + 3) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' + echo 'push "dhcp-option DNS 80.67.169.40"' + ;; + 4) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' + echo 'push "dhcp-option DNS 84.200.70.40"' + ;; + 5) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' + echo 'push "dhcp-option DNS 208.67.220.220"' + ;; + 6) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' + echo 'push "dhcp-option DNS 8.8.4.4"' + ;; + 7) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' + echo 'push "dhcp-option DNS 77.88.8.1"' + ;; + 8) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' + echo 'push "dhcp-option DNS 176.103.130.131"' + ;; +esac >> ${conf_server} +echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} +echo "client-to-client +crl-verify crl.pem +ca ca.crt +cert server.crt +key server.key +tls-auth tls-auth.key 0 +dh dh.pem +auth SHA256 +$CIPHER +tls-server +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +status openvpn-status.log +log openvpn.log +log-append openvpn.log +verb 3" >> ${conf_server} + +set_firewall ## call function + +# And finally, restart OpenVPN +if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + #Workaround to fix OpenVPN service on OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service + systemctl daemon-reload + systemctl restart openvpn + systemctl enable openvpn + else + /etc/init.d/openvpn restart + fi +else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then + #Workaround to avoid rewriting the entire script for Arch & Fedora + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service + fi + else + service openvpn restart + chkconfig openvpn on + fi +fi + +# Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users +EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) +if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP + fi +fi + +# client-template.txt is created so we have a template to add further users later +echo "client" > ${conf_client_tpl} +if [[ "$PROTOCOL" = 'udp' ]]; then + echo "proto ${PROTOCOL}" >> ${conf_client_tpl} +elif [[ "$PROTOCOL" = 'tcp' ]]; then + echo "proto ${PROTOCOL}-client" >> ${conf_client_tpl} +fi +echo "remote $IP $PORT +dev tun +resolv-retry infinite +nobind +persist-key +persist-tun +remote-cert-tls server +auth SHA256 +auth-nocache +$CIPHER +tls-client +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +setenv opt block-outside-dns +verb 3" >> ${conf_client_tpl} + +# call function Generate the custom client.ovpn +generate_newclient "$CLIENT" +echo "" +echo "Finished!" +echo "" +echo "Your client config is available at $homeDir/$CLIENT.ovpn" +echo "If you want to add more clients, you simply need to run this script again!" +} + +## function: remove openvpn server and config dir +remove_openvpn(){ + +echo "" +read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE +if [[ 'y' = "$REMOVE" ]]; then + PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $conf_iptables + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $conf_iptables + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" +else + echo "" + echo "Removal aborted!" +fi +} + +config_openvpn_server(){ +: +} + +config_openvpn_client(){ +: +} + +config_openvpn(){ + +while : +do + clear + cat < /proc/sys/net/ipv4/ip_forward # Set NAT for the VPN subnet iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE # Save persitent iptables rules -iptables-save > $file_iptables +iptables-save > $conf_iptables if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to @@ -64,7 +64,7 @@ if iptables -L -n | grep -qE 'REJECT|DROP'; then iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # Save persitent OpenVPN rules - iptables-save > $file_iptables + iptables-save > $conf_iptables fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then @@ -83,42 +83,82 @@ fi ## function: generate the new client??.ovpn generate_newclient() { +echo "" +echo "Tell me a name for the client cert" +echo "Please, use one word only, no special characters" +echo "Here are the files that already exist,do not repeat that" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +read -p "Client name: " -e -i client CLIENT +cd ${dir_easy} +${bin_easy} build-client-full $CLIENT nopass + +# Generates the custom client.ovpn # Where to write the custom client.ovpn? -if [ -e /home/$1 ]; then # if $1 is a user name - homeDir="/home/$1" +if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name + homeDir="/home/$CLIENT" elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root homeDir="${dir_openvpn}" fi # Generates the custom client.ovpn -file_client="$homeDir/$1.ovpn" -cp ${file_client_tpl} ${file_client} +file_client="$homeDir/$CLIENT.ovpn" +cp ${conf_client_tpl} ${file_client} echo "" >> ${file_client} cat ${dir_pki}/ca.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_pki}/issued/$1.crt >> ${file_client} +cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_pki}/private/$1.key >> ${file_client} +cat ${dir_pki}/private/$CLIENT.key >> ${file_client} echo "" >> ${file_client} echo "key-direction 1" >> ${file_client} echo "" >> ${file_client} cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} + +echo "" +echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + +} + +## function: revoke a exist client??.ovpn +revoke_openvpn_client(){ + +NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") +if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 +fi +echo "" +echo "Select the existing client certificate you want to revoke" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER +else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER +fi +CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) +cd ${dir_easy} +${bin_easy} --batch revoke $CLIENT +EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl +rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt +#rm -f ${dir_openvpn}/crl.pem +/bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem +chmod 644 ${dir_openvpn}/crl.pem +echo "" +echo "Certificate for client $CLIENT revoked" +echo "Exiting..." } ## function: install easyrsa 3.0.3 install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages -if [[ -d ${dir_easy}/ ]]; then - rm -rf ${dir_easy}/ - mkdir -p ${dir_easy} -else - mkdir -p ${dir_easy} -fi +rm -rf ${dir_easy} +mkdir -p ${dir_easy} # Get easy-rsa url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' file_easy=${url_easy##*/} @@ -130,7 +170,7 @@ rm -rf ~/${file_easy} } ## function: install iptables for debian -install_ipt_service(){ +systemd_ipt_service(){ dir_ipt='/etc/iptables' file_ipt_svc='/etc/systemd/system/iptables.service' @@ -138,7 +178,7 @@ file_ipt_sh="${dir_ipt}/flush-iptables.sh" # Install iptables service if [[ ! -e ${file_ipt_svc} ]]; then mkdir ${dir_ipt} - iptables-save > ${file_iptables} + iptables-save > ${conf_iptables} echo "#!/bin/sh iptables -F iptables -X @@ -157,8 +197,8 @@ Before=network-pre.target Wants=network-pre.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore ${file_iptables} -ExecReload=/sbin/iptables-restore ${file_iptables} +ExecStart=/sbin/iptables-restore ${conf_iptables} +ExecReload=/sbin/iptables-restore ${conf_iptables} ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] @@ -173,6 +213,19 @@ WantedBy=multi-user.target" > ${file_ipt_svc} fi } +## +config_iptables(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + +## +config_firewalld(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + + ## function: install openvpn server install_openvpn(){ @@ -337,19 +390,17 @@ if [[ "$OS" = 'debian' ]]; then # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y - install_ipt_service ## call function -elif [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos7' ]]; then + systemd_ipt_service ## call function +elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + if [[ "$OS" != 'fedora' ]]; then yum install epel-release -y fi yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y - # install_ipt_service ## call function - read -p "Please manually set the firewall,press anykey continue" -elif [[ "$OS" = 'centos6' ]]; then - yum install epel-release -y - yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y - # install_ipt_service ## call function - read -p "Please manually set the firewall,press anykey continue" + if [[ "$OS" = 'centos6' ]]; then + config_iptables ## call function + else + config_firewalld ## call function + fi else # Else, the distro is ArchLinux echo "" @@ -369,13 +420,14 @@ else if [[ "$OS" = 'arch' ]]; then # Install dependencies pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > ${file_iptables} # iptables won't start if this file does not exist + iptables-save > ${conf_iptables} # iptables won't start if this file does not exist systemctl daemon-reload systemctl enable iptables systemctl start iptables fi fi + # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then NOGROUP=nogroup @@ -414,7 +466,7 @@ topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt #client-config-dir ccd -#route 10.8.0.0 255.255.255.252" >> ${file_openvpn_conf} +#route 10.8.0.0 255.255.255.252" >> ${conf_server} # DNS resolvers case $DNS in 1) @@ -450,8 +502,8 @@ case $DNS in echo 'push "dhcp-option DNS 176.103.130.130"' echo 'push "dhcp-option DNS 176.103.130.131"' ;; -esac >> ${file_openvpn_conf} -echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${file_openvpn_conf} +esac >> ${conf_server} +echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} echo "client-to-client crl-verify crl.pem ca ca.crt @@ -467,7 +519,7 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn-status.log log openvpn.log log-append openvpn.log -verb 3" >> ${file_openvpn_conf} +verb 3" >> ${conf_server} set_firewall ## call function @@ -520,11 +572,11 @@ if [[ "$IP" != "$EXTERNALIP" ]]; then fi # client-template.txt is created so we have a template to add further users later -echo "client" > ${file_client_tpl} +echo "client" > ${conf_client_tpl} if [[ "$PROTOCOL" = 'udp' ]]; then - echo "proto ${PROTOCOL}" >> ${file_client_tpl} + echo "proto ${PROTOCOL}" >> ${conf_client_tpl} elif [[ "$PROTOCOL" = 'tcp' ]]; then - echo "proto ${PROTOCOL}-client" >> ${file_client_tpl} + echo "proto ${PROTOCOL}-client" >> ${conf_client_tpl} fi echo "remote $IP $PORT dev tun @@ -540,7 +592,7 @@ tls-client tls-version-min 1.2 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 setenv opt block-outside-dns -verb 3" >> ${file_client_tpl} +verb 3" >> ${conf_client_tpl} # call function Generate the custom client.ovpn generate_newclient "$CLIENT" @@ -557,8 +609,8 @@ remove_openvpn(){ echo "" read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE if [[ 'y' = "$REMOVE" ]]; then - PORT=$(grep '^port ' ${file_openvpn_conf} | cut -d " " -f 2) - PROTOCOL=$(grep '^proto ' ${file_openvpn_conf} | cut -d " " -f 2) + PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) if pgrep firewalld; then # Using both permanent and not permanent rules to avoid a firewalld reload. firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} @@ -569,10 +621,10 @@ if [[ 'y' = "$REMOVE" ]]; then if iptables -L -n | grep -qE 'REJECT|DROP'; then iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $file_iptables + iptables-save > $conf_iptables fi iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $file_iptables + iptables-save > $conf_iptables if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -596,6 +648,13 @@ else fi } +config_openvpn_server(){ +: +} + +config_openvpn_client(){ +: +} config_openvpn(){ @@ -603,7 +662,7 @@ while : do clear cat <" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} + echo "" >> ${file_client} + echo "key-direction 1" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/tls-auth.key >> ${file_client} + echo "" >> ${file_client} +} + +# Try to get our IP from the system and fallback to the Internet. +# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) +# and to avoid getting an IPv6. +IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) +if [[ "$IP" = "" ]]; then + IP=$(wget -qO- ipv4.icanhazip.com) +fi +# Get Internet network interface with default route +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) + +if [[ -e /etc/openvpn/server.conf ]]; then + while : + do + clear + echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" + echo "" + echo "Looks like OpenVPN is already installed" + echo "" + echo "What do you want to do?" + echo " 1) Add a cert for a new user" + echo " 2) Revoke existing user cert" + echo " 3) Remove OpenVPN" + echo " 4) Exit" + read -p "Select an option [1-4]: " option + case $option in + 1) + echo "" + echo "Tell me a name for the client cert" + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + cd /etc/openvpn/easy-rsa/ + ./easyrsa build-client-full $CLIENT nopass + # Generates the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + exit + ;; + 2) + NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") + if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 + fi + echo "" + echo "Select the existing client certificate you want to revoke" + tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER + else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER + fi + CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) + cd /etc/openvpn/easy-rsa/ + ./easyrsa --batch revoke $CLIENT + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + rm -rf pki/reqs/$CLIENT.req + rm -rf pki/private/$CLIENT.key + rm -rf pki/issued/$CLIENT.crt + rm -rf /etc/openvpn/crl.pem + cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem + chmod 644 /etc/openvpn/crl.pem + echo "" + echo "Certificate for client $CLIENT revoked" + echo "Exiting..." + exit + ;; + 3) + echo "" + read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE + if [[ "$REMOVE" = 'y' ]]; then + PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/udp + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/udp + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + if [[ "$PROTOCOL" = 'udp' ]]; then + iptables -D INPUT -p udp --dport $PORT -j ACCEPT + else + iptables -D INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $IPTABLES + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $IPTABLES + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p udp $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf /etc/openvpn + rm -rf /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" + else + echo "" + echo "Removal aborted!" + fi + exit + ;; + 4) exit;; + esac + done +else + clear + echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" + echo "" + # OpenVPN setup and first user creation + echo "I need to ask you a few questions before starting the setup" + echo "You can leave the default options and just press enter if you are ok with them" + echo "" + echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." + echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" + echo "Otherwise, it should be your public IPv4 address." + read -p "IP address: " -e -i $IP IP + echo "" + echo "What port do you want for OpenVPN?" + read -p "Port: " -e -i 1194 PORT + echo "" + echo "What protocol do you want for OpenVPN?" + echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" + while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do + read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + done + echo "" + echo "What DNS do you want to use with the VPN?" + echo " 1) Current system resolvers (from /etc/resolv.conf)" + echo " 2) Quad9 (Anycast: worldwide)" + echo " 3) FDN (France)" + echo " 4) DNS.WATCH (Germany)" + echo " 5) OpenDNS (Anycast: worldwide)" + echo " 6) Google (Anycast: worldwide)" + echo " 7) Yandex Basic (Russia)" + echo " 8) AdGuard DNS (Russia)" + while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" && $DNS != "8" ]]; do + read -p "DNS [1-8]: " -e -i 1 DNS + done + echo "" + echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " + echo "the encryption in OpenVPN and the choices I made in this script." + echo "Please note that all the choices proposed are secure (to a different degree)" + echo "and are still viable to date, unlike some default OpenVPN options" + echo '' + echo "Choose which cipher you want to use for the data channel:" + echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" + echo " 2) AES-192-CBC" + echo " 3) AES-256-CBC" + echo "Alternatives to AES, use them only if you know what you're doing." + echo "They are relatively slower but as secure as AES." + echo " 4) CAMELLIA-128-CBC" + echo " 5) CAMELLIA-192-CBC" + echo " 6) CAMELLIA-256-CBC" + echo " 7) SEED-CBC" + while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do + read -p "Cipher [1-7]: " -e -i 1 CIPHER + done + case $CIPHER in + 1) + CIPHER="cipher AES-128-CBC" + ;; + 2) + CIPHER="cipher AES-192-CBC" + ;; + 3) + CIPHER="cipher AES-256-CBC" + ;; + 4) + CIPHER="cipher CAMELLIA-128-CBC" + ;; + 5) + CIPHER="cipher CAMELLIA-192-CBC" + ;; + 6) + CIPHER="cipher CAMELLIA-256-CBC" + ;; + 7) + CIPHER="cipher SEED-CBC" + ;; + esac + echo "" + echo "Choose what size of Diffie-Hellman key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do + read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE + done + case $DH_KEY_SIZE in + 1) + DH_KEY_SIZE="2048" + ;; + 2) + DH_KEY_SIZE="3072" + ;; + 3) + DH_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Choose what size of RSA key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE + done + case $RSA_KEY_SIZE in + 1) + RSA_KEY_SIZE="2048" + ;; + 2) + RSA_KEY_SIZE="3072" + ;; + 3) + RSA_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Finally, tell me a name for the client certificate and configuration" + while [[ $CLIENT = "" ]]; do + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + done + echo "" + echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" + read -n1 -r -p "Press any key to continue..." + + if [[ "$OS" = 'debian' ]]; then + apt-get install ca-certificates -y + # We add the OpenVPN repo to get the latest version. + # Debian 7 + if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Debian 8 + if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update + fi + # Ubuntu 12.04 + if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu 14.04 + if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + # The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi + elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then + if [[ "$OS" = 'centos' ]]; then + yum install epel-release -y + fi + yum install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi + else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + + if [[ "$OS" = 'arch' ]]; then + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi + fi + # Find out if the machine uses nogroup or nobody for the permissionless group + if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup + else + NOGROUP=nobody + fi + + # An old version of easy-rsa was available by default in some openvpn packages + if [[ -d /etc/openvpn/easy-rsa/ ]]; then + rm -rf /etc/openvpn/easy-rsa/ + fi + # Get easy-rsa + wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz + tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ + mv ~/EasyRSA-3.0.3/ /etc/openvpn/ + mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ + chown -R root:root /etc/openvpn/easy-rsa/ + rm -rf ~/EasyRSA-3.0.3.tgz + cd /etc/openvpn/easy-rsa/ + echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars + # Create the PKI, set up the CA, the DH params and the server + client certificates + ./easyrsa init-pki + ./easyrsa --batch build-ca nopass + openssl dhparam -out dh.pem $DH_KEY_SIZE + ./easyrsa build-server-full server nopass + ./easyrsa build-client-full $CLIENT nopass + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + # generate tls-auth key + openvpn --genkey --secret /etc/openvpn/tls-auth.key + # Move all the generated files + cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + # Make cert revocation list readable for non-root + chmod 644 /etc/openvpn/crl.pem + + # Generate server.conf + echo "port $PORT" > /etc/openvpn/server.conf + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> /etc/openvpn/server.conf + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp" >> /etc/openvpn/server.conf + fi + echo "dev tun +user nobody +group $NOGROUP +persist-key +persist-tun +keepalive 10 120 +topology subnet +server 10.8.0.0 255.255.255.0 +ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf + # DNS resolvers + case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf + done + ;; + 2) #Quad9 + echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf + ;; + 3) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf + ;; + 4) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf + ;; + 5) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf + ;; + 6) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf + ;; + 7) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf + ;; + 8) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + ;; + esac +echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf +echo "crl-verify crl.pem +ca ca.crt +cert server.crt +key server.key +tls-auth tls-auth.key 0 +dh dh.pem +auth SHA256 +$CIPHER +tls-server +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +status openvpn.log +verb 3" >> /etc/openvpn/server.conf + + # Create the sysctl configuration file if needed (mainly for Arch Linux) + if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL + fi + + # Enable net.ipv4.ip_forward for the system + sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL + if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL + fi + # Avoid an unneeded reboot + echo 1 > /proc/sys/net/ipv4/ip_forward + # Set NAT for the VPN subnet + iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + # Save persitent iptables rules + iptables-save > $IPTABLES + if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + if [[ "$PROTOCOL" = 'UDP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/udp + firewall-cmd --permanent --zone=public --add-port=$PORT/udp + elif [[ "$PROTOCOL" = 'TCP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/tcp + firewall-cmd --permanent --zone=public --add-port=$PORT/tcp + fi + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + if [[ "$PROTOCOL" = 'UDP' ]]; then + iptables -I INPUT -p udp --dport $PORT -j ACCEPT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + iptables -I INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules + iptables-save > $IPTABLES + fi + # If SELinux is enabled and a custom port was selected, we need this + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + if [[ "$PROTOCOL" = 'UDP' ]]; then + semanage port -a -t openvpn_port_t -p udp $PORT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + semanage port -a -t openvpn_port_t -p tcp $PORT + fi + fi + fi + fi + # And finally, restart OpenVPN + if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + #Workaround to fix OpenVPN service on OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service + systemctl daemon-reload + systemctl restart openvpn + systemctl enable openvpn + else + /etc/init.d/openvpn restart + fi + else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then + #Workaround to avoid rewriting the entire script for Arch & Fedora + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service + fi + else + service openvpn restart + chkconfig openvpn on + fi + fi + # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users + EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) + if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP + fi + fi + # client-template.txt is created so we have a template to add further users later + file_client_tpl=/etc/openvpn/client-template.txt + echo "client" > ${file_client_tpl} + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> ${file_client_tpl} + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp-client" >> ${file_client_tpl} + fi + echo "remote $IP $PORT +dev tun +resolv-retry infinite +nobind +persist-key +persist-tun +remote-cert-tls server +auth SHA256 +auth-nocache +$CIPHER +tls-client +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +setenv opt block-outside-dns +verb 3" >> /etc/openvpn/client-template.txt + + # Generate the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Finished!" + echo "" + echo "Your client config is available at $homeDir/$CLIENT.ovpn" + echo "If you want to add more clients, you simply need to run this script another time!" +fi +exit 0; From e223619808defc28548a819f822bc4c3c1876407 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 18:25:04 +0800 Subject: [PATCH 17/23] delete two files. --- edit-in-master.sh | 769 --------------------------------------------- origin-upstream.sh | 693 ---------------------------------------- 2 files changed, 1462 deletions(-) delete mode 100644 edit-in-master.sh delete mode 100644 origin-upstream.sh diff --git a/edit-in-master.sh b/edit-in-master.sh deleted file mode 100644 index ab0c534..0000000 --- a/edit-in-master.sh +++ /dev/null @@ -1,769 +0,0 @@ -#!/bin/bash - -# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux -# https://github.com/Angristan/OpenVPN-install - - -if [[ "$EUID" -ne 0 ]]; then - echo "Sorry, you need to run this as root" - exit 1 -fi - -if [[ ! -e /dev/net/tun ]]; then - echo "TUN is not available" - exit 2 -fi - -if grep -qs "CentOS release 5" "/etc/redhat-release"; then - echo "CentOS 5 is too old and not supported" - exit 3 -fi - -## Global variables -dir_openvpn='/etc/openvpn' -dir_easy="${dir_openvpn}/easy-rsa" -dir_pki="${dir_easy}/pki" -bin_easy="${dir_easy}/easyrsa" -conf_client_tpl="${dir_openvpn}/client-template.txt" -conf_server="${dir_openvpn}/server.conf" -conf_iptables='/etc/sysconfig/iptables.rules' - -## function: config the firewall -set_firewall(){ - -# Create the sysctl configuration file if needed (mainly for Arch Linux) -if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL -fi - -# Enable net.ipv4.ip_forward for the system -sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL -if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL -fi -# Avoid an unneeded reboot -echo 1 > /proc/sys/net/ipv4/ip_forward -# Set NAT for the VPN subnet -iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE -# Save persitent iptables rules -iptables-save > $conf_iptables -if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 -fi -if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $conf_iptables -fi -# If SELinux is enabled and a custom port was selected, we need this -if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi -fi -} - -## function: generate the new client??.ovpn -generate_newclient() { - -echo "" -echo "Tell me a name for the client cert" -echo "Please, use one word only, no special characters" -echo "Here are the files that already exist,do not repeat that" -tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' -read -p "Client name: " -e -i client CLIENT -cd ${dir_easy} -${bin_easy} build-client-full $CLIENT nopass - -# Generates the custom client.ovpn -# Where to write the custom client.ovpn? -if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name - homeDir="/home/$CLIENT" -elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER - homeDir="/home/${SUDO_USER}" -else # if not SUDO_USER, use /root - homeDir="${dir_openvpn}" -fi -# Generates the custom client.ovpn -file_client="$homeDir/$CLIENT.ovpn" -cp ${conf_client_tpl} ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/ca.crt >> ${file_client} -echo "" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} -echo "" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/private/$CLIENT.key >> ${file_client} -echo "" >> ${file_client} -echo "key-direction 1" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_openvpn}/tls-auth.key >> ${file_client} -echo "" >> ${file_client} - -echo "" -echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - -} - -## function: revoke a exist client??.ovpn -revoke_openvpn_client(){ - -NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") -if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 -fi -echo "" -echo "Select the existing client certificate you want to revoke" -tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' -if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER -else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER -fi -CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) -cd ${dir_easy} -${bin_easy} --batch revoke $CLIENT -EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl -rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt -#rm -f ${dir_openvpn}/crl.pem -/bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem -chmod 644 ${dir_openvpn}/crl.pem -echo "" -echo "Certificate for client $CLIENT revoked" -echo "Exiting..." -} - -## function: install easyrsa 3.0.3 -install_easyrsa(){ - -# An old version of easy-rsa was available by default in some openvpn packages -rm -rf ${dir_easy} -mkdir -p ${dir_easy} -# Get easy-rsa -url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' -file_easy=${url_easy##*/} -wget -c -O ~/${file_easy} ${url_easy} -tar xzf ~/${file_easy} -C ~/ -mv ~/${file_easy%.tgz}/* ${dir_easy}/ -chown -R root:root ${dir_easy}/ -rm -rf ~/${file_easy} -} - -## function: install iptables for debian -systemd_ipt_service(){ - -dir_ipt='/etc/iptables' -file_ipt_svc='/etc/systemd/system/iptables.service' -file_ipt_sh="${dir_ipt}/flush-iptables.sh" -# Install iptables service -if [[ ! -e ${file_ipt_svc} ]]; then - mkdir ${dir_ipt} - iptables-save > ${conf_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > ${file_ipt_sh} - chmod +x ${file_ipt_sh} - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${conf_iptables} -ExecReload=/sbin/iptables-restore ${conf_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > ${file_ipt_svc} - systemctl daemon-reload - systemctl enable iptables.service - if [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi -fi -} - -## -config_iptables(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - -## -config_firewalld(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - - -## function: install openvpn server -install_openvpn(){ - -clear -cat < /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - ;; - '8') # Debian 8 - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - ;; - '12.04') # Ubuntu 12.04 - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - ;; - '14.04') # Ubuntu 14.04 - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - esac - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - ## The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - systemd_ipt_service ## call function -elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - if [[ "$OS" != 'fedora' ]]; then - yum install epel-release -y - fi - yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y - if [[ "$OS" = 'centos6' ]]; then - config_iptables ## call function - else - config_firewalld ## call function - fi -else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != [yn] ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > ${conf_iptables} # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi -fi - - -# Find out if the machine uses nogroup or nobody for the permissionless group -if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup -else - NOGROUP=nobody -fi - -install_easyrsa ## call function - -cd ${dir_easy}/ -echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars -# Create the PKI, set up the CA, the DH params and the server + client certificates -${dir_easy}/easyrsa init-pki -${dir_easy}/easyrsa --batch build-ca nopass -openssl dhparam -out dh.pem $DH_KEY_SIZE -${dir_easy}/easyrsa build-server-full server nopass -${dir_easy}/easyrsa build-client-full $CLIENT nopass -EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl -## generate tls-auth key -openvpn --genkey --secret ${dir_openvpn}/tls-auth.key -## Move all the generated files -cp ${dir_pki}/ca.crt ${dir_pki}/private/ca.key dh.pem ${dir_pki}/issued/server.crt ${dir_pki}/private/server.key ${dir_pki}/crl.pem ${dir_openvpn}/ -## Make cert revocation list readable for non-root -chmod 644 ${dir_openvpn}/crl.pem - -## Generate server.conf -echo "port $PORT -proto ${PROTOCOL} -dev tun -user nobody -group $NOGROUP -persist-key -persist-tun -keepalive 10 120 -topology subnet -server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt -#client-config-dir ccd -#route 10.8.0.0 255.255.255.252" >> ${conf_server} -# DNS resolvers -case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" - done - ;; - 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' - ;; - 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' - echo 'push "dhcp-option DNS 80.67.169.40"' - ;; - 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' - echo 'push "dhcp-option DNS 84.200.70.40"' - ;; - 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' - echo 'push "dhcp-option DNS 208.67.220.220"' - ;; - 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' - echo 'push "dhcp-option DNS 8.8.4.4"' - ;; - 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' - echo 'push "dhcp-option DNS 77.88.8.1"' - ;; - 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' - echo 'push "dhcp-option DNS 176.103.130.131"' - ;; -esac >> ${conf_server} -echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} -echo "client-to-client -crl-verify crl.pem -ca ca.crt -cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 -$CIPHER -tls-server -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn-status.log -log openvpn.log -log-append openvpn.log -verb 3" >> ${conf_server} - -set_firewall ## call function - -# And finally, restart OpenVPN -if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - #Workaround to fix OpenVPN service on OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service - systemctl daemon-reload - systemctl restart openvpn - systemctl enable openvpn - else - /etc/init.d/openvpn restart - fi -else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then - #Workaround to avoid rewriting the entire script for Arch & Fedora - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi -fi - -# Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users -EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) -if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi -fi - -# client-template.txt is created so we have a template to add further users later -echo "client" > ${conf_client_tpl} -if [[ "$PROTOCOL" = 'udp' ]]; then - echo "proto ${PROTOCOL}" >> ${conf_client_tpl} -elif [[ "$PROTOCOL" = 'tcp' ]]; then - echo "proto ${PROTOCOL}-client" >> ${conf_client_tpl} -fi -echo "remote $IP $PORT -dev tun -resolv-retry infinite -nobind -persist-key -persist-tun -remote-cert-tls server -auth SHA256 -auth-nocache -$CIPHER -tls-client -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -setenv opt block-outside-dns -verb 3" >> ${conf_client_tpl} - -# call function Generate the custom client.ovpn -generate_newclient "$CLIENT" -echo "" -echo "Finished!" -echo "" -echo "Your client config is available at $homeDir/$CLIENT.ovpn" -echo "If you want to add more clients, you simply need to run this script again!" -} - -## function: remove openvpn server and config dir -remove_openvpn(){ - -echo "" -read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE -if [[ 'y' = "$REMOVE" ]]; then - PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) - PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $conf_iptables - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $conf_iptables - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf ${dir_openvpn} /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" -else - echo "" - echo "Removal aborted!" -fi -} - -config_openvpn_server(){ -: -} - -config_openvpn_client(){ -: -} - -config_openvpn(){ - -while : -do - clear - cat <" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} - echo "" >> ${file_client} - echo "key-direction 1" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/tls-auth.key >> ${file_client} - echo "" >> ${file_client} -} - -# Try to get our IP from the system and fallback to the Internet. -# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) -# and to avoid getting an IPv6. -IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) -if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) -fi -# Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) - -if [[ -e /etc/openvpn/server.conf ]]; then - while : - do - clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" - echo "" - echo "Looks like OpenVPN is already installed" - echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" - echo " 3) Remove OpenVPN" - echo " 4) Exit" - read -p "Select an option [1-4]: " option - case $option in - 1) - echo "" - echo "Tell me a name for the client cert" - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - cd /etc/openvpn/easy-rsa/ - ./easyrsa build-client-full $CLIENT nopass - # Generates the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - exit - ;; - 2) - NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") - if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 - fi - echo "" - echo "Select the existing client certificate you want to revoke" - tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' - if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER - else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER - fi - CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) - cd /etc/openvpn/easy-rsa/ - ./easyrsa --batch revoke $CLIENT - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - rm -rf pki/reqs/$CLIENT.req - rm -rf pki/private/$CLIENT.key - rm -rf pki/issued/$CLIENT.crt - rm -rf /etc/openvpn/crl.pem - cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem - chmod 644 /etc/openvpn/crl.pem - echo "" - echo "Certificate for client $CLIENT revoked" - echo "Exiting..." - exit - ;; - 3) - echo "" - read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ "$REMOVE" = 'y' ]]; then - PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/udp - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/udp - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - if [[ "$PROTOCOL" = 'udp' ]]; then - iptables -D INPUT -p udp --dport $PORT -j ACCEPT - else - iptables -D INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p udp $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf /etc/openvpn - rm -rf /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi - exit - ;; - 4) exit;; - esac - done -else - clear - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" - echo "" - # OpenVPN setup and first user creation - echo "I need to ask you a few questions before starting the setup" - echo "You can leave the default options and just press enter if you are ok with them" - echo "" - echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." - echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" - echo "Otherwise, it should be your public IPv4 address." - read -p "IP address: " -e -i $IP IP - echo "" - echo "What port do you want for OpenVPN?" - read -p "Port: " -e -i 1194 PORT - echo "" - echo "What protocol do you want for OpenVPN?" - echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL - done - echo "" - echo "What DNS do you want to use with the VPN?" - echo " 1) Current system resolvers (from /etc/resolv.conf)" - echo " 2) Quad9 (Anycast: worldwide)" - echo " 3) FDN (France)" - echo " 4) DNS.WATCH (Germany)" - echo " 5) OpenDNS (Anycast: worldwide)" - echo " 6) Google (Anycast: worldwide)" - echo " 7) Yandex Basic (Russia)" - echo " 8) AdGuard DNS (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" && $DNS != "8" ]]; do - read -p "DNS [1-8]: " -e -i 1 DNS - done - echo "" - echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " - echo "the encryption in OpenVPN and the choices I made in this script." - echo "Please note that all the choices proposed are secure (to a different degree)" - echo "and are still viable to date, unlike some default OpenVPN options" - echo '' - echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" - echo " 2) AES-192-CBC" - echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do - read -p "Cipher [1-7]: " -e -i 1 CIPHER - done - case $CIPHER in - 1) - CIPHER="cipher AES-128-CBC" - ;; - 2) - CIPHER="cipher AES-192-CBC" - ;; - 3) - CIPHER="cipher AES-256-CBC" - ;; - 4) - CIPHER="cipher CAMELLIA-128-CBC" - ;; - 5) - CIPHER="cipher CAMELLIA-192-CBC" - ;; - 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" - ;; - esac - echo "" - echo "Choose what size of Diffie-Hellman key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE - done - case $DH_KEY_SIZE in - 1) - DH_KEY_SIZE="2048" - ;; - 2) - DH_KEY_SIZE="3072" - ;; - 3) - DH_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Choose what size of RSA key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE - done - case $RSA_KEY_SIZE in - 1) - RSA_KEY_SIZE="2048" - ;; - 2) - RSA_KEY_SIZE="3072" - ;; - 3) - RSA_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Finally, tell me a name for the client certificate and configuration" - while [[ $CLIENT = "" ]]; do - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - done - echo "" - echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" - read -n1 -r -p "Press any key to continue..." - - if [[ "$OS" = 'debian' ]]; then - apt-get install ca-certificates -y - # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Debian 8 - if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi - elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - fi - yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi - else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi - fi - # Find out if the machine uses nogroup or nobody for the permissionless group - if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup - else - NOGROUP=nobody - fi - - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ - fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz - cd /etc/openvpn/easy-rsa/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars - # Create the PKI, set up the CA, the DH params and the server + client certificates - ./easyrsa init-pki - ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE - ./easyrsa build-server-full server nopass - ./easyrsa build-client-full $CLIENT nopass - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key - # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn - # Make cert revocation list readable for non-root - chmod 644 /etc/openvpn/crl.pem - - # Generate server.conf - echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - echo "dev tun -user nobody -group $NOGROUP -persist-key -persist-tun -keepalive 10 120 -topology subnet -server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf - # DNS resolvers - case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf - done - ;; - 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf - ;; - 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf - ;; - 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf - ;; - 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf - ;; - 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf - ;; - 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf - ;; - 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf - ;; - esac -echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf -echo "crl-verify crl.pem -ca ca.crt -cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 -$CIPHER -tls-server -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn.log -verb 3" >> /etc/openvpn/server.conf - - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi - - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/udp - firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/tcp - firewall-cmd --permanent --zone=public --add-port=$PORT/tcp - fi - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then - iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - iptables -I INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi - fi - fi - fi - # And finally, restart OpenVPN - if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - #Workaround to fix OpenVPN service on OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service - systemctl daemon-reload - systemctl restart openvpn - systemctl enable openvpn - else - /etc/init.d/openvpn restart - fi - else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then - #Workaround to avoid rewriting the entire script for Arch & Fedora - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi - fi - # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users - EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) - if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi - fi - # client-template.txt is created so we have a template to add further users later - file_client_tpl=/etc/openvpn/client-template.txt - echo "client" > ${file_client_tpl} - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> ${file_client_tpl} - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> ${file_client_tpl} - fi - echo "remote $IP $PORT -dev tun -resolv-retry infinite -nobind -persist-key -persist-tun -remote-cert-tls server -auth SHA256 -auth-nocache -$CIPHER -tls-client -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -setenv opt block-outside-dns -verb 3" >> /etc/openvpn/client-template.txt - - # Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" - echo "If you want to add more clients, you simply need to run this script another time!" -fi -exit 0; From d7a3cecaaa8566d8dbd43e72f51b62e55a3845f6 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 18:43:54 +0800 Subject: [PATCH 18/23] a line --- openvpn-install.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index ab0c534..dcfbd6a 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -471,7 +471,8 @@ ifconfig-pool-persist ipp.txt case $DNS in 1) # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | \ + while read line; do echo "push \"dhcp-option DNS $line\"" done ;; From c6a9012d6f7dde7c5b2c82063620f39fc7eb0b23 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 18:45:34 +0800 Subject: [PATCH 19/23] Revert "delete two files." This reverts commit e223619808defc28548a819f822bc4c3c1876407. --- edit-in-master.sh | 769 +++++++++++++++++++++++++++++++++++++++++++++ origin-upstream.sh | 693 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1462 insertions(+) create mode 100644 edit-in-master.sh create mode 100644 origin-upstream.sh diff --git a/edit-in-master.sh b/edit-in-master.sh new file mode 100644 index 0000000..ab0c534 --- /dev/null +++ b/edit-in-master.sh @@ -0,0 +1,769 @@ +#!/bin/bash + +# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux +# https://github.com/Angristan/OpenVPN-install + + +if [[ "$EUID" -ne 0 ]]; then + echo "Sorry, you need to run this as root" + exit 1 +fi + +if [[ ! -e /dev/net/tun ]]; then + echo "TUN is not available" + exit 2 +fi + +if grep -qs "CentOS release 5" "/etc/redhat-release"; then + echo "CentOS 5 is too old and not supported" + exit 3 +fi + +## Global variables +dir_openvpn='/etc/openvpn' +dir_easy="${dir_openvpn}/easy-rsa" +dir_pki="${dir_easy}/pki" +bin_easy="${dir_easy}/easyrsa" +conf_client_tpl="${dir_openvpn}/client-template.txt" +conf_server="${dir_openvpn}/server.conf" +conf_iptables='/etc/sysconfig/iptables.rules' + +## function: config the firewall +set_firewall(){ + +# Create the sysctl configuration file if needed (mainly for Arch Linux) +if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL +fi + +# Enable net.ipv4.ip_forward for the system +sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL +if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL +fi +# Avoid an unneeded reboot +echo 1 > /proc/sys/net/ipv4/ip_forward +# Set NAT for the VPN subnet +iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE +# Save persitent iptables rules +iptables-save > $conf_iptables +if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 +fi +if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules + iptables-save > $conf_iptables +fi +# If SELinux is enabled and a custom port was selected, we need this +if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi +fi +} + +## function: generate the new client??.ovpn +generate_newclient() { + +echo "" +echo "Tell me a name for the client cert" +echo "Please, use one word only, no special characters" +echo "Here are the files that already exist,do not repeat that" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +read -p "Client name: " -e -i client CLIENT +cd ${dir_easy} +${bin_easy} build-client-full $CLIENT nopass + +# Generates the custom client.ovpn +# Where to write the custom client.ovpn? +if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name + homeDir="/home/$CLIENT" +elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" +else # if not SUDO_USER, use /root + homeDir="${dir_openvpn}" +fi +# Generates the custom client.ovpn +file_client="$homeDir/$CLIENT.ovpn" +cp ${conf_client_tpl} ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/ca.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} +echo "" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_pki}/private/$CLIENT.key >> ${file_client} +echo "" >> ${file_client} +echo "key-direction 1" >> ${file_client} +echo "" >> ${file_client} +cat ${dir_openvpn}/tls-auth.key >> ${file_client} +echo "" >> ${file_client} + +echo "" +echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + +} + +## function: revoke a exist client??.ovpn +revoke_openvpn_client(){ + +NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") +if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 +fi +echo "" +echo "Select the existing client certificate you want to revoke" +tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' +if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER +else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER +fi +CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) +cd ${dir_easy} +${bin_easy} --batch revoke $CLIENT +EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl +rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt +#rm -f ${dir_openvpn}/crl.pem +/bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem +chmod 644 ${dir_openvpn}/crl.pem +echo "" +echo "Certificate for client $CLIENT revoked" +echo "Exiting..." +} + +## function: install easyrsa 3.0.3 +install_easyrsa(){ + +# An old version of easy-rsa was available by default in some openvpn packages +rm -rf ${dir_easy} +mkdir -p ${dir_easy} +# Get easy-rsa +url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' +file_easy=${url_easy##*/} +wget -c -O ~/${file_easy} ${url_easy} +tar xzf ~/${file_easy} -C ~/ +mv ~/${file_easy%.tgz}/* ${dir_easy}/ +chown -R root:root ${dir_easy}/ +rm -rf ~/${file_easy} +} + +## function: install iptables for debian +systemd_ipt_service(){ + +dir_ipt='/etc/iptables' +file_ipt_svc='/etc/systemd/system/iptables.service' +file_ipt_sh="${dir_ipt}/flush-iptables.sh" +# Install iptables service +if [[ ! -e ${file_ipt_svc} ]]; then + mkdir ${dir_ipt} + iptables-save > ${conf_iptables} + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > ${file_ipt_sh} + chmod +x ${file_ipt_sh} + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore ${conf_iptables} +ExecReload=/sbin/iptables-restore ${conf_iptables} +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > ${file_ipt_svc} + systemctl daemon-reload + systemctl enable iptables.service + if [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi +fi +} + +## +config_iptables(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + +## +config_firewalld(){ + echo "Please manually set the firewall" + read -p "press any key continue..." +} + + +## function: install openvpn server +install_openvpn(){ + +clear +cat < /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + ;; + '8') # Debian 8 + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update + ;; + '12.04') # Ubuntu 12.04 + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + ;; + '14.04') # Ubuntu 14.04 + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + esac + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + ## The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + systemd_ipt_service ## call function +elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + if [[ "$OS" != 'fedora' ]]; then + yum install epel-release -y + fi + yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y + if [[ "$OS" = 'centos6' ]]; then + config_iptables ## call function + else + config_firewalld ## call function + fi +else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != [yn] ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + + if [[ "$OS" = 'arch' ]]; then + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > ${conf_iptables} # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi +fi + + +# Find out if the machine uses nogroup or nobody for the permissionless group +if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup +else + NOGROUP=nobody +fi + +install_easyrsa ## call function + +cd ${dir_easy}/ +echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars +# Create the PKI, set up the CA, the DH params and the server + client certificates +${dir_easy}/easyrsa init-pki +${dir_easy}/easyrsa --batch build-ca nopass +openssl dhparam -out dh.pem $DH_KEY_SIZE +${dir_easy}/easyrsa build-server-full server nopass +${dir_easy}/easyrsa build-client-full $CLIENT nopass +EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl +## generate tls-auth key +openvpn --genkey --secret ${dir_openvpn}/tls-auth.key +## Move all the generated files +cp ${dir_pki}/ca.crt ${dir_pki}/private/ca.key dh.pem ${dir_pki}/issued/server.crt ${dir_pki}/private/server.key ${dir_pki}/crl.pem ${dir_openvpn}/ +## Make cert revocation list readable for non-root +chmod 644 ${dir_openvpn}/crl.pem + +## Generate server.conf +echo "port $PORT +proto ${PROTOCOL} +dev tun +user nobody +group $NOGROUP +persist-key +persist-tun +keepalive 10 120 +topology subnet +server 10.8.0.0 255.255.255.0 +ifconfig-pool-persist ipp.txt +#client-config-dir ccd +#route 10.8.0.0 255.255.255.252" >> ${conf_server} +# DNS resolvers +case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" + done + ;; + 2) #Quad9 + echo 'push "dhcp-option DNS 9.9.9.9"' + ;; + 3) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' + echo 'push "dhcp-option DNS 80.67.169.40"' + ;; + 4) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' + echo 'push "dhcp-option DNS 84.200.70.40"' + ;; + 5) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' + echo 'push "dhcp-option DNS 208.67.220.220"' + ;; + 6) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' + echo 'push "dhcp-option DNS 8.8.4.4"' + ;; + 7) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' + echo 'push "dhcp-option DNS 77.88.8.1"' + ;; + 8) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' + echo 'push "dhcp-option DNS 176.103.130.131"' + ;; +esac >> ${conf_server} +echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} +echo "client-to-client +crl-verify crl.pem +ca ca.crt +cert server.crt +key server.key +tls-auth tls-auth.key 0 +dh dh.pem +auth SHA256 +$CIPHER +tls-server +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +status openvpn-status.log +log openvpn.log +log-append openvpn.log +verb 3" >> ${conf_server} + +set_firewall ## call function + +# And finally, restart OpenVPN +if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + #Workaround to fix OpenVPN service on OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service + systemctl daemon-reload + systemctl restart openvpn + systemctl enable openvpn + else + /etc/init.d/openvpn restart + fi +else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then + #Workaround to avoid rewriting the entire script for Arch & Fedora + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service + fi + else + service openvpn restart + chkconfig openvpn on + fi +fi + +# Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users +EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) +if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP + fi +fi + +# client-template.txt is created so we have a template to add further users later +echo "client" > ${conf_client_tpl} +if [[ "$PROTOCOL" = 'udp' ]]; then + echo "proto ${PROTOCOL}" >> ${conf_client_tpl} +elif [[ "$PROTOCOL" = 'tcp' ]]; then + echo "proto ${PROTOCOL}-client" >> ${conf_client_tpl} +fi +echo "remote $IP $PORT +dev tun +resolv-retry infinite +nobind +persist-key +persist-tun +remote-cert-tls server +auth SHA256 +auth-nocache +$CIPHER +tls-client +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +setenv opt block-outside-dns +verb 3" >> ${conf_client_tpl} + +# call function Generate the custom client.ovpn +generate_newclient "$CLIENT" +echo "" +echo "Finished!" +echo "" +echo "Your client config is available at $homeDir/$CLIENT.ovpn" +echo "If you want to add more clients, you simply need to run this script again!" +} + +## function: remove openvpn server and config dir +remove_openvpn(){ + +echo "" +read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE +if [[ 'y' = "$REMOVE" ]]; then + PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $conf_iptables + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $conf_iptables + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf ${dir_openvpn} /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" +else + echo "" + echo "Removal aborted!" +fi +} + +config_openvpn_server(){ +: +} + +config_openvpn_client(){ +: +} + +config_openvpn(){ + +while : +do + clear + cat <" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} + echo "" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} + echo "" >> ${file_client} + echo "key-direction 1" >> ${file_client} + echo "" >> ${file_client} + cat /etc/openvpn/tls-auth.key >> ${file_client} + echo "" >> ${file_client} +} + +# Try to get our IP from the system and fallback to the Internet. +# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) +# and to avoid getting an IPv6. +IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) +if [[ "$IP" = "" ]]; then + IP=$(wget -qO- ipv4.icanhazip.com) +fi +# Get Internet network interface with default route +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) + +if [[ -e /etc/openvpn/server.conf ]]; then + while : + do + clear + echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" + echo "" + echo "Looks like OpenVPN is already installed" + echo "" + echo "What do you want to do?" + echo " 1) Add a cert for a new user" + echo " 2) Revoke existing user cert" + echo " 3) Remove OpenVPN" + echo " 4) Exit" + read -p "Select an option [1-4]: " option + case $option in + 1) + echo "" + echo "Tell me a name for the client cert" + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + cd /etc/openvpn/easy-rsa/ + ./easyrsa build-client-full $CLIENT nopass + # Generates the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + exit + ;; + 2) + NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") + if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 + fi + echo "" + echo "Select the existing client certificate you want to revoke" + tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER + else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER + fi + CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) + cd /etc/openvpn/easy-rsa/ + ./easyrsa --batch revoke $CLIENT + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + rm -rf pki/reqs/$CLIENT.req + rm -rf pki/private/$CLIENT.key + rm -rf pki/issued/$CLIENT.crt + rm -rf /etc/openvpn/crl.pem + cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem + chmod 644 /etc/openvpn/crl.pem + echo "" + echo "Certificate for client $CLIENT revoked" + echo "Exiting..." + exit + ;; + 3) + echo "" + read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE + if [[ "$REMOVE" = 'y' ]]; then + PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/udp + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/udp + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + if [[ "$PROTOCOL" = 'udp' ]]; then + iptables -D INPUT -p udp --dport $PORT -j ACCEPT + else + iptables -D INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $IPTABLES + fi + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $IPTABLES + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p udp $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf /etc/openvpn + rm -rf /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" + else + echo "" + echo "Removal aborted!" + fi + exit + ;; + 4) exit;; + esac + done +else + clear + echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" + echo "" + # OpenVPN setup and first user creation + echo "I need to ask you a few questions before starting the setup" + echo "You can leave the default options and just press enter if you are ok with them" + echo "" + echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." + echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" + echo "Otherwise, it should be your public IPv4 address." + read -p "IP address: " -e -i $IP IP + echo "" + echo "What port do you want for OpenVPN?" + read -p "Port: " -e -i 1194 PORT + echo "" + echo "What protocol do you want for OpenVPN?" + echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" + while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do + read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + done + echo "" + echo "What DNS do you want to use with the VPN?" + echo " 1) Current system resolvers (from /etc/resolv.conf)" + echo " 2) Quad9 (Anycast: worldwide)" + echo " 3) FDN (France)" + echo " 4) DNS.WATCH (Germany)" + echo " 5) OpenDNS (Anycast: worldwide)" + echo " 6) Google (Anycast: worldwide)" + echo " 7) Yandex Basic (Russia)" + echo " 8) AdGuard DNS (Russia)" + while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" && $DNS != "8" ]]; do + read -p "DNS [1-8]: " -e -i 1 DNS + done + echo "" + echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " + echo "the encryption in OpenVPN and the choices I made in this script." + echo "Please note that all the choices proposed are secure (to a different degree)" + echo "and are still viable to date, unlike some default OpenVPN options" + echo '' + echo "Choose which cipher you want to use for the data channel:" + echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" + echo " 2) AES-192-CBC" + echo " 3) AES-256-CBC" + echo "Alternatives to AES, use them only if you know what you're doing." + echo "They are relatively slower but as secure as AES." + echo " 4) CAMELLIA-128-CBC" + echo " 5) CAMELLIA-192-CBC" + echo " 6) CAMELLIA-256-CBC" + echo " 7) SEED-CBC" + while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do + read -p "Cipher [1-7]: " -e -i 1 CIPHER + done + case $CIPHER in + 1) + CIPHER="cipher AES-128-CBC" + ;; + 2) + CIPHER="cipher AES-192-CBC" + ;; + 3) + CIPHER="cipher AES-256-CBC" + ;; + 4) + CIPHER="cipher CAMELLIA-128-CBC" + ;; + 5) + CIPHER="cipher CAMELLIA-192-CBC" + ;; + 6) + CIPHER="cipher CAMELLIA-256-CBC" + ;; + 7) + CIPHER="cipher SEED-CBC" + ;; + esac + echo "" + echo "Choose what size of Diffie-Hellman key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do + read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE + done + case $DH_KEY_SIZE in + 1) + DH_KEY_SIZE="2048" + ;; + 2) + DH_KEY_SIZE="3072" + ;; + 3) + DH_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Choose what size of RSA key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE + done + case $RSA_KEY_SIZE in + 1) + RSA_KEY_SIZE="2048" + ;; + 2) + RSA_KEY_SIZE="3072" + ;; + 3) + RSA_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Finally, tell me a name for the client certificate and configuration" + while [[ $CLIENT = "" ]]; do + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + done + echo "" + echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" + read -n1 -r -p "Press any key to continue..." + + if [[ "$OS" = 'debian' ]]; then + apt-get install ca-certificates -y + # We add the OpenVPN repo to get the latest version. + # Debian 7 + if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Debian 8 + if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update + fi + # Ubuntu 12.04 + if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu 14.04 + if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + # The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi + elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then + if [[ "$OS" = 'centos' ]]; then + yum install epel-release -y + fi + yum install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + systemctl mask firewalld + fi + else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + + if [[ "$OS" = 'arch' ]]; then + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi + fi + # Find out if the machine uses nogroup or nobody for the permissionless group + if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup + else + NOGROUP=nobody + fi + + # An old version of easy-rsa was available by default in some openvpn packages + if [[ -d /etc/openvpn/easy-rsa/ ]]; then + rm -rf /etc/openvpn/easy-rsa/ + fi + # Get easy-rsa + wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz + tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ + mv ~/EasyRSA-3.0.3/ /etc/openvpn/ + mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ + chown -R root:root /etc/openvpn/easy-rsa/ + rm -rf ~/EasyRSA-3.0.3.tgz + cd /etc/openvpn/easy-rsa/ + echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars + # Create the PKI, set up the CA, the DH params and the server + client certificates + ./easyrsa init-pki + ./easyrsa --batch build-ca nopass + openssl dhparam -out dh.pem $DH_KEY_SIZE + ./easyrsa build-server-full server nopass + ./easyrsa build-client-full $CLIENT nopass + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + # generate tls-auth key + openvpn --genkey --secret /etc/openvpn/tls-auth.key + # Move all the generated files + cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + # Make cert revocation list readable for non-root + chmod 644 /etc/openvpn/crl.pem + + # Generate server.conf + echo "port $PORT" > /etc/openvpn/server.conf + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> /etc/openvpn/server.conf + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp" >> /etc/openvpn/server.conf + fi + echo "dev tun +user nobody +group $NOGROUP +persist-key +persist-tun +keepalive 10 120 +topology subnet +server 10.8.0.0 255.255.255.0 +ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf + # DNS resolvers + case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf + done + ;; + 2) #Quad9 + echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf + ;; + 3) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf + ;; + 4) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf + ;; + 5) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf + ;; + 6) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf + ;; + 7) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf + ;; + 8) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + ;; + esac +echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf +echo "crl-verify crl.pem +ca ca.crt +cert server.crt +key server.key +tls-auth tls-auth.key 0 +dh dh.pem +auth SHA256 +$CIPHER +tls-server +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +status openvpn.log +verb 3" >> /etc/openvpn/server.conf + + # Create the sysctl configuration file if needed (mainly for Arch Linux) + if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL + fi + + # Enable net.ipv4.ip_forward for the system + sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL + if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL + fi + # Avoid an unneeded reboot + echo 1 > /proc/sys/net/ipv4/ip_forward + # Set NAT for the VPN subnet + iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + # Save persitent iptables rules + iptables-save > $IPTABLES + if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + if [[ "$PROTOCOL" = 'UDP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/udp + firewall-cmd --permanent --zone=public --add-port=$PORT/udp + elif [[ "$PROTOCOL" = 'TCP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/tcp + firewall-cmd --permanent --zone=public --add-port=$PORT/tcp + fi + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + if [[ "$PROTOCOL" = 'UDP' ]]; then + iptables -I INPUT -p udp --dport $PORT -j ACCEPT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + iptables -I INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + # Save persitent OpenVPN rules + iptables-save > $IPTABLES + fi + # If SELinux is enabled and a custom port was selected, we need this + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + if [[ "$PROTOCOL" = 'UDP' ]]; then + semanage port -a -t openvpn_port_t -p udp $PORT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + semanage port -a -t openvpn_port_t -p tcp $PORT + fi + fi + fi + fi + # And finally, restart OpenVPN + if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + #Workaround to fix OpenVPN service on OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service + systemctl daemon-reload + systemctl restart openvpn + systemctl enable openvpn + else + /etc/init.d/openvpn restart + fi + else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then + #Workaround to avoid rewriting the entire script for Arch & Fedora + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service + fi + else + service openvpn restart + chkconfig openvpn on + fi + fi + # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users + EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) + if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP + fi + fi + # client-template.txt is created so we have a template to add further users later + file_client_tpl=/etc/openvpn/client-template.txt + echo "client" > ${file_client_tpl} + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> ${file_client_tpl} + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp-client" >> ${file_client_tpl} + fi + echo "remote $IP $PORT +dev tun +resolv-retry infinite +nobind +persist-key +persist-tun +remote-cert-tls server +auth SHA256 +auth-nocache +$CIPHER +tls-client +tls-version-min 1.2 +tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +setenv opt block-outside-dns +verb 3" >> /etc/openvpn/client-template.txt + + # Generate the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Finished!" + echo "" + echo "Your client config is available at $homeDir/$CLIENT.ovpn" + echo "If you want to add more clients, you simply need to run this script another time!" +fi +exit 0; From 2e0e816fcc6acddf7bdeb5a98ac8d35454aa4e5c Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 18:47:08 +0800 Subject: [PATCH 20/23] del two files. --- edit-in-master.sh | 769 --------------------------------------------- origin-upstream.sh | 693 ---------------------------------------- 2 files changed, 1462 deletions(-) delete mode 100644 edit-in-master.sh delete mode 100644 origin-upstream.sh diff --git a/edit-in-master.sh b/edit-in-master.sh deleted file mode 100644 index ab0c534..0000000 --- a/edit-in-master.sh +++ /dev/null @@ -1,769 +0,0 @@ -#!/bin/bash - -# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux -# https://github.com/Angristan/OpenVPN-install - - -if [[ "$EUID" -ne 0 ]]; then - echo "Sorry, you need to run this as root" - exit 1 -fi - -if [[ ! -e /dev/net/tun ]]; then - echo "TUN is not available" - exit 2 -fi - -if grep -qs "CentOS release 5" "/etc/redhat-release"; then - echo "CentOS 5 is too old and not supported" - exit 3 -fi - -## Global variables -dir_openvpn='/etc/openvpn' -dir_easy="${dir_openvpn}/easy-rsa" -dir_pki="${dir_easy}/pki" -bin_easy="${dir_easy}/easyrsa" -conf_client_tpl="${dir_openvpn}/client-template.txt" -conf_server="${dir_openvpn}/server.conf" -conf_iptables='/etc/sysconfig/iptables.rules' - -## function: config the firewall -set_firewall(){ - -# Create the sysctl configuration file if needed (mainly for Arch Linux) -if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL -fi - -# Enable net.ipv4.ip_forward for the system -sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL -if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL -fi -# Avoid an unneeded reboot -echo 1 > /proc/sys/net/ipv4/ip_forward -# Set NAT for the VPN subnet -iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE -# Save persitent iptables rules -iptables-save > $conf_iptables -if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - firewall-cmd --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=public --add-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 -fi -if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - iptables -I INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $conf_iptables -fi -# If SELinux is enabled and a custom port was selected, we need this -if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - semanage port -a -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi -fi -} - -## function: generate the new client??.ovpn -generate_newclient() { - -echo "" -echo "Tell me a name for the client cert" -echo "Please, use one word only, no special characters" -echo "Here are the files that already exist,do not repeat that" -tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' -read -p "Client name: " -e -i client CLIENT -cd ${dir_easy} -${bin_easy} build-client-full $CLIENT nopass - -# Generates the custom client.ovpn -# Where to write the custom client.ovpn? -if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name - homeDir="/home/$CLIENT" -elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER - homeDir="/home/${SUDO_USER}" -else # if not SUDO_USER, use /root - homeDir="${dir_openvpn}" -fi -# Generates the custom client.ovpn -file_client="$homeDir/$CLIENT.ovpn" -cp ${conf_client_tpl} ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/ca.crt >> ${file_client} -echo "" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} -echo "" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_pki}/private/$CLIENT.key >> ${file_client} -echo "" >> ${file_client} -echo "key-direction 1" >> ${file_client} -echo "" >> ${file_client} -cat ${dir_openvpn}/tls-auth.key >> ${file_client} -echo "" >> ${file_client} - -echo "" -echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - -} - -## function: revoke a exist client??.ovpn -revoke_openvpn_client(){ - -NUMBEROFCLIENTS=$(tail -n +2 ${file_index} | grep -c "^V") -if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 -fi -echo "" -echo "Select the existing client certificate you want to revoke" -tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' -if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER -else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER -fi -CLIENT=$(tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | sed -n "${CLIENTNUMBER:?empty-var}"p) -cd ${dir_easy} -${bin_easy} --batch revoke $CLIENT -EASYRSA_CRL_DAYS=3650 ${bin_easy} gen-crl -rm -f ${dir_pki}/reqs/$CLIENT.req ${dir_pki}/private/$CLIENT.key ${dir_pki}/issued/$CLIENT.crt -#rm -f ${dir_openvpn}/crl.pem -/bin/cp -f ${dir_pki}/crl.pem ${dir_openvpn}/crl.pem -chmod 644 ${dir_openvpn}/crl.pem -echo "" -echo "Certificate for client $CLIENT revoked" -echo "Exiting..." -} - -## function: install easyrsa 3.0.3 -install_easyrsa(){ - -# An old version of easy-rsa was available by default in some openvpn packages -rm -rf ${dir_easy} -mkdir -p ${dir_easy} -# Get easy-rsa -url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' -file_easy=${url_easy##*/} -wget -c -O ~/${file_easy} ${url_easy} -tar xzf ~/${file_easy} -C ~/ -mv ~/${file_easy%.tgz}/* ${dir_easy}/ -chown -R root:root ${dir_easy}/ -rm -rf ~/${file_easy} -} - -## function: install iptables for debian -systemd_ipt_service(){ - -dir_ipt='/etc/iptables' -file_ipt_svc='/etc/systemd/system/iptables.service' -file_ipt_sh="${dir_ipt}/flush-iptables.sh" -# Install iptables service -if [[ ! -e ${file_ipt_svc} ]]; then - mkdir ${dir_ipt} - iptables-save > ${conf_iptables} - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > ${file_ipt_sh} - chmod +x ${file_ipt_sh} - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore ${conf_iptables} -ExecReload=/sbin/iptables-restore ${conf_iptables} -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > ${file_ipt_svc} - systemctl daemon-reload - systemctl enable iptables.service - if [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi -fi -} - -## -config_iptables(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - -## -config_firewalld(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - - -## function: install openvpn server -install_openvpn(){ - -clear -cat < /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - ;; - '8') # Debian 8 - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - ;; - '12.04') # Ubuntu 12.04 - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - ;; - '14.04') # Ubuntu 14.04 - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - esac - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - ## The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - systemd_ipt_service ## call function -elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - if [[ "$OS" != 'fedora' ]]; then - yum install epel-release -y - fi - yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y - if [[ "$OS" = 'centos6' ]]; then - config_iptables ## call function - else - config_firewalld ## call function - fi -else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != [yn] ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > ${conf_iptables} # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi -fi - - -# Find out if the machine uses nogroup or nobody for the permissionless group -if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup -else - NOGROUP=nobody -fi - -install_easyrsa ## call function - -cd ${dir_easy}/ -echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars -# Create the PKI, set up the CA, the DH params and the server + client certificates -${dir_easy}/easyrsa init-pki -${dir_easy}/easyrsa --batch build-ca nopass -openssl dhparam -out dh.pem $DH_KEY_SIZE -${dir_easy}/easyrsa build-server-full server nopass -${dir_easy}/easyrsa build-client-full $CLIENT nopass -EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl -## generate tls-auth key -openvpn --genkey --secret ${dir_openvpn}/tls-auth.key -## Move all the generated files -cp ${dir_pki}/ca.crt ${dir_pki}/private/ca.key dh.pem ${dir_pki}/issued/server.crt ${dir_pki}/private/server.key ${dir_pki}/crl.pem ${dir_openvpn}/ -## Make cert revocation list readable for non-root -chmod 644 ${dir_openvpn}/crl.pem - -## Generate server.conf -echo "port $PORT -proto ${PROTOCOL} -dev tun -user nobody -group $NOGROUP -persist-key -persist-tun -keepalive 10 120 -topology subnet -server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt -#client-config-dir ccd -#route 10.8.0.0 255.255.255.252" >> ${conf_server} -# DNS resolvers -case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" - done - ;; - 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' - ;; - 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' - echo 'push "dhcp-option DNS 80.67.169.40"' - ;; - 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' - echo 'push "dhcp-option DNS 84.200.70.40"' - ;; - 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' - echo 'push "dhcp-option DNS 208.67.220.220"' - ;; - 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' - echo 'push "dhcp-option DNS 8.8.4.4"' - ;; - 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' - echo 'push "dhcp-option DNS 77.88.8.1"' - ;; - 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' - echo 'push "dhcp-option DNS 176.103.130.131"' - ;; -esac >> ${conf_server} -echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} -echo "client-to-client -crl-verify crl.pem -ca ca.crt -cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 -$CIPHER -tls-server -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn-status.log -log openvpn.log -log-append openvpn.log -verb 3" >> ${conf_server} - -set_firewall ## call function - -# And finally, restart OpenVPN -if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - #Workaround to fix OpenVPN service on OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service - systemctl daemon-reload - systemctl restart openvpn - systemctl enable openvpn - else - /etc/init.d/openvpn restart - fi -else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then - #Workaround to avoid rewriting the entire script for Arch & Fedora - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi -fi - -# Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users -EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) -if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi -fi - -# client-template.txt is created so we have a template to add further users later -echo "client" > ${conf_client_tpl} -if [[ "$PROTOCOL" = 'udp' ]]; then - echo "proto ${PROTOCOL}" >> ${conf_client_tpl} -elif [[ "$PROTOCOL" = 'tcp' ]]; then - echo "proto ${PROTOCOL}-client" >> ${conf_client_tpl} -fi -echo "remote $IP $PORT -dev tun -resolv-retry infinite -nobind -persist-key -persist-tun -remote-cert-tls server -auth SHA256 -auth-nocache -$CIPHER -tls-client -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -setenv opt block-outside-dns -verb 3" >> ${conf_client_tpl} - -# call function Generate the custom client.ovpn -generate_newclient "$CLIENT" -echo "" -echo "Finished!" -echo "" -echo "Your client config is available at $homeDir/$CLIENT.ovpn" -echo "If you want to add more clients, you simply need to run this script again!" -} - -## function: remove openvpn server and config dir -remove_openvpn(){ - -echo "" -read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE -if [[ 'y' = "$REMOVE" ]]; then - PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) - PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/${PROTOCOL} - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - iptables -D INPUT -p ${PROTOCOL} --dport $PORT -j ACCEPT - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $conf_iptables - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $conf_iptables - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p ${PROTOCOL} $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf ${dir_openvpn} /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" -else - echo "" - echo "Removal aborted!" -fi -} - -config_openvpn_server(){ -: -} - -config_openvpn_client(){ -: -} - -config_openvpn(){ - -while : -do - clear - cat <" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/ca.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ${file_client} - echo "" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ${file_client} - echo "" >> ${file_client} - echo "key-direction 1" >> ${file_client} - echo "" >> ${file_client} - cat /etc/openvpn/tls-auth.key >> ${file_client} - echo "" >> ${file_client} -} - -# Try to get our IP from the system and fallback to the Internet. -# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) -# and to avoid getting an IPv6. -IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) -if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) -fi -# Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) - -if [[ -e /etc/openvpn/server.conf ]]; then - while : - do - clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" - echo "" - echo "Looks like OpenVPN is already installed" - echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" - echo " 3) Remove OpenVPN" - echo " 4) Exit" - read -p "Select an option [1-4]: " option - case $option in - 1) - echo "" - echo "Tell me a name for the client cert" - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - cd /etc/openvpn/easy-rsa/ - ./easyrsa build-client-full $CLIENT nopass - # Generates the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - exit - ;; - 2) - NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") - if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 - fi - echo "" - echo "Select the existing client certificate you want to revoke" - tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' - if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER - else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER - fi - CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) - cd /etc/openvpn/easy-rsa/ - ./easyrsa --batch revoke $CLIENT - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - rm -rf pki/reqs/$CLIENT.req - rm -rf pki/private/$CLIENT.key - rm -rf pki/issued/$CLIENT.crt - rm -rf /etc/openvpn/crl.pem - cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem - chmod 644 /etc/openvpn/crl.pem - echo "" - echo "Certificate for client $CLIENT revoked" - echo "Exiting..." - exit - ;; - 3) - echo "" - read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ "$REMOVE" = 'y' ]]; then - PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/udp - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/udp - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - if [[ "$PROTOCOL" = 'udp' ]]; then - iptables -D INPUT -p udp --dport $PORT -j ACCEPT - else - iptables -D INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p udp $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf /etc/openvpn - rm -rf /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi - exit - ;; - 4) exit;; - esac - done -else - clear - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" - echo "" - # OpenVPN setup and first user creation - echo "I need to ask you a few questions before starting the setup" - echo "You can leave the default options and just press enter if you are ok with them" - echo "" - echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." - echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" - echo "Otherwise, it should be your public IPv4 address." - read -p "IP address: " -e -i $IP IP - echo "" - echo "What port do you want for OpenVPN?" - read -p "Port: " -e -i 1194 PORT - echo "" - echo "What protocol do you want for OpenVPN?" - echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL - done - echo "" - echo "What DNS do you want to use with the VPN?" - echo " 1) Current system resolvers (from /etc/resolv.conf)" - echo " 2) Quad9 (Anycast: worldwide)" - echo " 3) FDN (France)" - echo " 4) DNS.WATCH (Germany)" - echo " 5) OpenDNS (Anycast: worldwide)" - echo " 6) Google (Anycast: worldwide)" - echo " 7) Yandex Basic (Russia)" - echo " 8) AdGuard DNS (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" && $DNS != "8" ]]; do - read -p "DNS [1-8]: " -e -i 1 DNS - done - echo "" - echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " - echo "the encryption in OpenVPN and the choices I made in this script." - echo "Please note that all the choices proposed are secure (to a different degree)" - echo "and are still viable to date, unlike some default OpenVPN options" - echo '' - echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" - echo " 2) AES-192-CBC" - echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do - read -p "Cipher [1-7]: " -e -i 1 CIPHER - done - case $CIPHER in - 1) - CIPHER="cipher AES-128-CBC" - ;; - 2) - CIPHER="cipher AES-192-CBC" - ;; - 3) - CIPHER="cipher AES-256-CBC" - ;; - 4) - CIPHER="cipher CAMELLIA-128-CBC" - ;; - 5) - CIPHER="cipher CAMELLIA-192-CBC" - ;; - 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" - ;; - esac - echo "" - echo "Choose what size of Diffie-Hellman key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE - done - case $DH_KEY_SIZE in - 1) - DH_KEY_SIZE="2048" - ;; - 2) - DH_KEY_SIZE="3072" - ;; - 3) - DH_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Choose what size of RSA key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE - done - case $RSA_KEY_SIZE in - 1) - RSA_KEY_SIZE="2048" - ;; - 2) - RSA_KEY_SIZE="3072" - ;; - 3) - RSA_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Finally, tell me a name for the client certificate and configuration" - while [[ $CLIENT = "" ]]; do - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - done - echo "" - echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" - read -n1 -r -p "Press any key to continue..." - - if [[ "$OS" = 'debian' ]]; then - apt-get install ca-certificates -y - # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Debian 8 - if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi - elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - fi - yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - systemctl mask firewalld - fi - else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi - fi - # Find out if the machine uses nogroup or nobody for the permissionless group - if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup - else - NOGROUP=nobody - fi - - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ - fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz - cd /etc/openvpn/easy-rsa/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars - # Create the PKI, set up the CA, the DH params and the server + client certificates - ./easyrsa init-pki - ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE - ./easyrsa build-server-full server nopass - ./easyrsa build-client-full $CLIENT nopass - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key - # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn - # Make cert revocation list readable for non-root - chmod 644 /etc/openvpn/crl.pem - - # Generate server.conf - echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - echo "dev tun -user nobody -group $NOGROUP -persist-key -persist-tun -keepalive 10 120 -topology subnet -server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf - # DNS resolvers - case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf - done - ;; - 2) #Quad9 - echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf - ;; - 3) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf - ;; - 4) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf - ;; - 5) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf - ;; - 6) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf - ;; - 7) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf - ;; - 8) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf - ;; - esac -echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf -echo "crl-verify crl.pem -ca ca.crt -cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 -$CIPHER -tls-server -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn.log -verb 3" >> /etc/openvpn/server.conf - - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi - - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/udp - firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/tcp - firewall-cmd --permanent --zone=public --add-port=$PORT/tcp - fi - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then - iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - iptables -I INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi - fi - fi - fi - # And finally, restart OpenVPN - if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - #Workaround to fix OpenVPN service on OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn\@.service - systemctl daemon-reload - systemctl restart openvpn - systemctl enable openvpn - else - /etc/init.d/openvpn restart - fi - else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then - #Workaround to avoid rewriting the entire script for Arch & Fedora - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi - fi - # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users - EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) - if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi - fi - # client-template.txt is created so we have a template to add further users later - file_client_tpl=/etc/openvpn/client-template.txt - echo "client" > ${file_client_tpl} - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> ${file_client_tpl} - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> ${file_client_tpl} - fi - echo "remote $IP $PORT -dev tun -resolv-retry infinite -nobind -persist-key -persist-tun -remote-cert-tls server -auth SHA256 -auth-nocache -$CIPHER -tls-client -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -setenv opt block-outside-dns -verb 3" >> /etc/openvpn/client-template.txt - - # Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" - echo "If you want to add more clients, you simply need to run this script another time!" -fi -exit 0; From 390df65aa60e42dab093e32d38d7630c7d76b5cd Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 20:40:29 +0800 Subject: [PATCH 21/23] fix bug:add client error --- openvpn-install.sh | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index dcfbd6a..9128cdd 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -23,11 +23,13 @@ fi dir_openvpn='/etc/openvpn' dir_easy="${dir_openvpn}/easy-rsa" dir_pki="${dir_easy}/pki" +file_index="${dir_pki}/index.txt" bin_easy="${dir_easy}/easyrsa" conf_client_tpl="${dir_openvpn}/client-template.txt" conf_server="${dir_openvpn}/server.conf" conf_iptables='/etc/sysconfig/iptables.rules' + ## function: config the firewall set_firewall(){ @@ -83,15 +85,6 @@ fi ## function: generate the new client??.ovpn generate_newclient() { -echo "" -echo "Tell me a name for the client cert" -echo "Please, use one word only, no special characters" -echo "Here are the files that already exist,do not repeat that" -tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' -read -p "Client name: " -e -i client CLIENT -cd ${dir_easy} -${bin_easy} build-client-full $CLIENT nopass - # Generates the custom client.ovpn # Where to write the custom client.ovpn? if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name @@ -634,9 +627,16 @@ if [[ 'y' = "$REMOVE" ]]; then fi fi if [[ "$OS" = 'debian' ]]; then + systemctl stop openvpn@server apt-get autoremove --purge -y openvpn elif [[ "$OS" = 'arch' ]]; then pacman -R openvpn --noconfirm + elif [[ "$OS" = 'centos7' ]]; then + systemctl stop openvpn@server + yum remove openvpn -y + elif [[ "$OS" = 'centos6' ]]; then + /etc/init.d/openvpn stop + yum remove openvpn -y else yum remove openvpn -y fi @@ -673,10 +673,18 @@ What do you want to do? 3) Remove OpenVPN 4) Exit EOF - file_index="${dir_pki}/index.txt" + read -p 'Select an option [1-4]: ' option case $option in 1) + echo "" + echo "Tell me a name for the client cert" + echo "Please, use one word only, no special characters" + echo "Here are the files that already exist,do not repeat that" + tail -n +2 ${file_index} | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + read -p "Client name: " -e -i client CLIENT + cd ${dir_easy} + ${bin_easy} build-client-full $CLIENT nopass generate_newclient exit ;; From 29eed9e7409c45201926bf528081d041e56c13ca Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 22:00:37 +0800 Subject: [PATCH 22/23] fix bug: generate client twice. --- openvpn-install.sh | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 9128cdd..bc01091 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -87,24 +87,24 @@ generate_newclient() { # Generates the custom client.ovpn # Where to write the custom client.ovpn? -if [ -e /home/$CLIENT ]; then # if $CLIENT is a user name - homeDir="/home/$CLIENT" +if [ -e /home/$1 ]; then # if $1 is a user name + homeDir="/home/$1" elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root homeDir="${dir_openvpn}" fi # Generates the custom client.ovpn -file_client="$homeDir/$CLIENT.ovpn" +file_client="$homeDir/$1.ovpn" cp ${conf_client_tpl} ${file_client} echo "" >> ${file_client} cat ${dir_pki}/ca.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_pki}/issued/$CLIENT.crt >> ${file_client} +cat ${dir_pki}/issued/$1.crt >> ${file_client} echo "" >> ${file_client} echo "" >> ${file_client} -cat ${dir_pki}/private/$CLIENT.key >> ${file_client} +cat ${dir_pki}/private/$1.key >> ${file_client} echo "" >> ${file_client} echo "key-direction 1" >> ${file_client} echo "" >> ${file_client} @@ -112,7 +112,7 @@ cat ${dir_openvpn}/tls-auth.key >> ${file_client} echo "" >> ${file_client} echo "" -echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" +echo "Client $1 added, certs available at $homeDir/$1.ovpn" } @@ -685,7 +685,7 @@ EOF read -p "Client name: " -e -i client CLIENT cd ${dir_easy} ${bin_easy} build-client-full $CLIENT nopass - generate_newclient + generate_newclient $CLIENT exit ;; 2) From feb04d1104936ad1aa5c63b2a30e7a42405d7ea1 Mon Sep 17 00:00:00 2001 From: xiagw Date: Mon, 8 Jan 2018 22:26:02 +0800 Subject: [PATCH 23/23] dev again --- openvpn-install.sh | 69 +++++++++++++++++++--------------------------- 1 file changed, 28 insertions(+), 41 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index bc01091..4d7eff3 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -26,7 +26,7 @@ dir_pki="${dir_easy}/pki" file_index="${dir_pki}/index.txt" bin_easy="${dir_easy}/easyrsa" conf_client_tpl="${dir_openvpn}/client-template.txt" -conf_server="${dir_openvpn}/server.conf" +conf_openvpn="${dir_openvpn}/server.conf" conf_iptables='/etc/sysconfig/iptables.rules' @@ -150,8 +150,12 @@ echo "Exiting..." install_easyrsa(){ # An old version of easy-rsa was available by default in some openvpn packages -rm -rf ${dir_easy} -mkdir -p ${dir_easy} +if [[ -d ${dir_easy}/ ]]; then + rm -rf ${dir_easy}/ + mkdir -p ${dir_easy} +else + mkdir -p ${dir_easy} +fi # Get easy-rsa url_easy='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz' file_easy=${url_easy##*/} @@ -206,19 +210,6 @@ WantedBy=multi-user.target" > ${file_ipt_svc} fi } -## -config_iptables(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - -## -config_firewalld(){ - echo "Please manually set the firewall" - read -p "press any key continue..." -} - - ## function: install openvpn server install_openvpn(){ @@ -384,16 +375,18 @@ if [[ "$OS" = 'debian' ]]; then ## The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y systemd_ipt_service ## call function -elif [[ "$OS" = 'centos6' || "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then - if [[ "$OS" != 'fedora' ]]; then +elif [[ "$OS" = 'centos7' || "$OS" = 'fedora' ]]; then + if [[ "$OS" = 'centos7' ]]; then yum install epel-release -y fi yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y - if [[ "$OS" = 'centos6' ]]; then - config_iptables ## call function - else - config_firewalld ## call function - fi + # systemd_ipt_service ## call function + read -p "Please manually set the firewall,press anykey continue" +elif [[ "$OS" = 'centos6' ]]; then + yum install epel-release -y + yum --enablerepo=epel install openvpn iptables openssl wget ca-certificates curl -y + # systemd_ipt_service ## call function + read -p "Please manually set the firewall,press anykey continue" else # Else, the distro is ArchLinux echo "" @@ -420,7 +413,6 @@ else fi fi - # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then NOGROUP=nogroup @@ -459,7 +451,7 @@ topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt #client-config-dir ccd -#route 10.8.0.0 255.255.255.252" >> ${conf_server} +#route 10.8.0.0 255.255.255.252" >> ${conf_openvpn} # DNS resolvers case $DNS in 1) @@ -496,8 +488,8 @@ case $DNS in echo 'push "dhcp-option DNS 176.103.130.130"' echo 'push "dhcp-option DNS 176.103.130.131"' ;; -esac >> ${conf_server} -echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_server} +esac >> ${conf_openvpn} +echo 'push "redirect-gateway def1 bypass-dhcp" '>> ${conf_openvpn} echo "client-to-client crl-verify crl.pem ca ca.crt @@ -513,7 +505,7 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn-status.log log openvpn.log log-append openvpn.log -verb 3" >> ${conf_server} +verb 3" >> ${conf_openvpn} set_firewall ## call function @@ -603,8 +595,8 @@ remove_openvpn(){ echo "" read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE if [[ 'y' = "$REMOVE" ]]; then - PORT=$(grep '^port ' ${conf_server} | cut -d " " -f 2) - PROTOCOL=$(grep '^proto ' ${conf_server} | cut -d " " -f 2) + PORT=$(grep '^port ' ${conf_openvpn} | cut -d " " -f 2) + PROTOCOL=$(grep '^proto ' ${conf_openvpn} | cut -d " " -f 2) if pgrep firewalld; then # Using both permanent and not permanent rules to avoid a firewalld reload. firewall-cmd --zone=public --remove-port=$PORT/${PROTOCOL} @@ -649,13 +641,6 @@ else fi } -config_openvpn_server(){ -: -} - -config_openvpn_client(){ -: -} config_openvpn(){ @@ -663,7 +648,7 @@ while : do clear cat <