Merge 19a2e838a3 into 41860dd960
This commit is contained in:
Angristan
GitHub
commit
8da7a94a6b
2 changed files with 341 additions and 108 deletions
35
README.md
35
README.md
|
|
@ -13,7 +13,7 @@ Here is a preview of the installer :
|
|||
|
||||
**You have to enable the TUN module otherwise OpenVPN won't work.** Ask your host if you don't know how to do it. If the TUN module is not enabled, the script will warn you and exit.
|
||||
|
||||
You can get a cheap VPS to run this script for $2.50/month worldwide at [Vultr](https://goo.gl/Xyd1Sc) or 3€/month for unlimited bandwidth in France at [PulseHeberg](https://goo.gl/76yqW5).
|
||||
You can get a cheap VPS to run this script at [Vultr](https://goo.gl/Xyd1Sc), [Digital Ocean](https://goo.gl/qXrNLK) or [PulseHeberg](https://goo.gl/76yqW5).
|
||||
|
||||
First, get the script and make it executable :
|
||||
|
||||
|
|
@ -54,20 +54,27 @@ On the client-side, it's less problematic, but if you want to use an OpenVPN ser
|
|||
|
||||
## Compatibility
|
||||
|
||||
The script is made to work on these OS and architectures :
|
||||
| | i386 | amd64 | armhf | arm64 |
|
||||
| ------------ | ------ | ------ | ------- | ------|
|
||||
| Debian 8 | ✔️ | ✔️ | ❌ | ❌ |
|
||||
| Debian 9 | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| Ubuntu 14.04 | ✔️ | ✔️ | ❌ | ❌ |
|
||||
| Ubuntu 16.04 | ✔️ | ✔️ | ❌ | ❌ |
|
||||
| Ubuntu 17.04 | ✔️ | ✔️ | ✔️ | ✔️ |
|
||||
| [Ubuntu 17.10](https://github.com/Angristan/OpenVPN-install/issues/125) | ❌ | ❌ | ❌ | ❌ |
|
||||
| CentOS 6 | ✔️ | ✔️ | ❔ | ❔ |
|
||||
| CentOS 7 | ✔️ | ✔️ | ✔️ | ❔ |
|
||||
| Fedora 25 | ❔ | ✔️ | ❔ | ❔ |
|
||||
| Fedora 26 | ❔ | ✔️ | ❔ | ❔ |
|
||||
| Fedora 27 | ❔ | ✔️ | ❔ | ❔ |
|
||||
| Arch Linux | ✔️ | ✔️ | ❌[(❔)](https://github.com/Angristan/OpenVPN-install/issues/99) | ✔️ |
|
||||
|
||||
- ✔️ = tested and compatible
|
||||
|
||||
- ❔ = untested
|
||||
|
||||
- ❌ = tested and not compatible
|
||||
|
||||
- **Debian 7** (i386, amd64)
|
||||
- **Debian 8** (i386, amd64)
|
||||
- **Debian 9** (i386, amd64, armhf, arm64)
|
||||
- **Ubuntu 14.04 LTS** (i386, amd64)
|
||||
- **Ubuntu 16.04 LTS** (i386, amd64)
|
||||
- **Ubuntu 17.10** (i386, amd64, armhf, arm64)
|
||||
- **Fedora 25** (amd64)
|
||||
- **Fedora 26** (amd64)
|
||||
- **Fedora 27** (amd64)
|
||||
- **CentOS 6** (i386, amd64)
|
||||
- **CentOS 7** (i386, amd64, arm64)
|
||||
- **Arch Linux** (i686, amd64, arm64)
|
||||
|
||||
(It should also work on Debian unstable/testing and Ubuntu beta).
|
||||
|
||||
|
|
|
|||
|
|
@ -22,10 +22,10 @@ fi
|
|||
if [[ -e /etc/debian_version ]]; then
|
||||
OS="debian"
|
||||
# Getting the version number, to verify that a recent version of OpenVPN is available
|
||||
VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID")
|
||||
VERSION_ID=$(grep "VERSION_ID" /etc/os-release)
|
||||
IPTABLES='/etc/iptables/iptables.rules'
|
||||
SYSCTL='/etc/sysctl.conf'
|
||||
if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.10"' ]]; then
|
||||
if [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.10"' ]]; then
|
||||
echo "Your version of Debian/Ubuntu is not supported."
|
||||
echo "I can't install a recent version of OpenVPN on your system."
|
||||
echo ""
|
||||
|
|
@ -59,9 +59,7 @@ fi
|
|||
|
||||
newclient () {
|
||||
# Where to write the custom client.ovpn?
|
||||
if [ -e /home/$1 ]; then # if $1 is a user name
|
||||
homeDir="/home/$1"
|
||||
elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER
|
||||
if [ ${SUDO_USER} ]; then # if not, use SUDO_USER
|
||||
homeDir="/home/${SUDO_USER}"
|
||||
else # if not SUDO_USER, use /root
|
||||
homeDir="/root"
|
||||
|
|
@ -77,10 +75,18 @@ newclient () {
|
|||
echo "<key>" >> $homeDir/$1.ovpn
|
||||
cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn
|
||||
echo "</key>" >> $homeDir/$1.ovpn
|
||||
#We verify if we used tls-crypt or tls-auth during the installation
|
||||
TLS_SIG=$(cat /etc/openvpn/TLS_SIG)
|
||||
if [[ $TLS_SIG == "1" ]]; then
|
||||
echo "<tls-crypt>" >> $homeDir/$1.ovpn
|
||||
cat /etc/openvpn/tls-crypt.key >> $homeDir/$1.ovpn
|
||||
echo "</tls-crypt>" >> $homeDir/$1.ovpn
|
||||
elif [[ $TLS_SIG == "2" ]]; then
|
||||
echo "key-direction 1" >> $homeDir/$1.ovpn
|
||||
echo "<tls-auth>" >> $homeDir/$1.ovpn
|
||||
cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn
|
||||
echo "</tls-auth>" >> $homeDir/$1.ovpn
|
||||
fi
|
||||
}
|
||||
|
||||
# Try to get our IP from the system and fallback to the Internet.
|
||||
|
|
@ -190,6 +196,13 @@ if [[ -e /etc/openvpn/server.conf ]]; then
|
|||
fi
|
||||
rm -rf /etc/openvpn
|
||||
rm -rf /usr/share/doc/openvpn*
|
||||
# Where are the client files?
|
||||
if [ ${SUDO_USER} ]; then # if not, use SUDO_USER
|
||||
homeDir="/home/${SUDO_USER}"
|
||||
else # if not SUDO_USER, use /root
|
||||
homeDir="/root"
|
||||
fi
|
||||
rm $homeDir/*.ovpn
|
||||
echo ""
|
||||
echo "OpenVPN removed!"
|
||||
else
|
||||
|
|
@ -219,8 +232,10 @@ else
|
|||
echo ""
|
||||
echo "What protocol do you want for OpenVPN?"
|
||||
echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)"
|
||||
while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do
|
||||
read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
|
||||
echo " 1) UDP (recommended)"
|
||||
echo " 2) TCP"
|
||||
while [[ $PROTOCOL != "1" && $PROTOCOL != "2" ]]; do
|
||||
read -p "Protocol [1-2]: " -e -i 1 PROTOCOL
|
||||
done
|
||||
echo ""
|
||||
echo "What DNS do you want to use with the VPN?"
|
||||
|
|
@ -236,83 +251,250 @@ else
|
|||
read -p "DNS [1-8]: " -e -i 1 DNS
|
||||
done
|
||||
echo ""
|
||||
echo "Choose which compression algorithm you want to use:"
|
||||
echo " 1) LZ4 (faster)"
|
||||
echo " 2) LZ0 (use for OpenVPN 2.3 compatibility)"
|
||||
echo " 3) No compression"
|
||||
while [[ $COMPRESSION != "1" && $COMPRESSION != "2" && $COMPRESSION != "3" ]]; do
|
||||
read -p "Compression algorithm [1-3]: " -e -i 1 COMPRESSION
|
||||
done
|
||||
case $COMPRESSION in
|
||||
1)
|
||||
COMPRESSION="lz4"
|
||||
;;
|
||||
2)
|
||||
COMPRESSION="lzo"
|
||||
;;
|
||||
3)
|
||||
# We don't do anything
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about "
|
||||
echo "the encryption in OpenVPN and the choices I made in this script."
|
||||
echo "Please note that all the choices proposed are secure (to a different degree)"
|
||||
echo "and are still viable to date, unlike some default OpenVPN options"
|
||||
echo ''
|
||||
echo "the encryption in OpenVPN and the choices proposed in this script."
|
||||
echo "Please note that all the choices proposed are secure enough considering today's strandards, unlike some default OpenVPN options"
|
||||
echo "You can just type "enter" if you don't know what to choose."
|
||||
echo "Note that if you want to use an OpenVPN 2.3 client, You'll have to choose OpenVPN 2.3-compatible options."
|
||||
echo "All OpenVPN 2.3-compatible choices are specified for each following option."
|
||||
echo ""
|
||||
echo "Choose which cipher you want to use for the data channel:"
|
||||
echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)"
|
||||
echo " 2) AES-192-CBC"
|
||||
echo " 3) AES-256-CBC"
|
||||
echo "Alternatives to AES, use them only if you know what you're doing."
|
||||
echo "They are relatively slower but as secure as AES."
|
||||
echo " 4) CAMELLIA-128-CBC"
|
||||
echo " 5) CAMELLIA-192-CBC"
|
||||
echo " 6) CAMELLIA-256-CBC"
|
||||
echo " 7) SEED-CBC"
|
||||
while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do
|
||||
read -p "Cipher [1-7]: " -e -i 1 CIPHER
|
||||
echo " 1) AES-128-GCM (recommended)"
|
||||
echo " 2) AES-192-GCM"
|
||||
echo " 3) AES-256-GCM"
|
||||
echo "Only use AES-CBC for OpenVPN 2.3 compatibilty"
|
||||
echo " 4) AES-128-CBC"
|
||||
echo " 5) AES-192-CBC"
|
||||
echo " 6) AES-256-CBC"
|
||||
while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" ]]; do
|
||||
read -p "Data channel cipher [1-6]: " -e -i 1 CIPHER
|
||||
done
|
||||
case $CIPHER in
|
||||
1)
|
||||
CIPHER="cipher AES-128-CBC"
|
||||
CIPHER="cipher AES-128-GCM"
|
||||
;;
|
||||
2)
|
||||
CIPHER="cipher AES-192-CBC"
|
||||
CIPHER="cipher AES-192-GCM"
|
||||
;;
|
||||
3)
|
||||
CIPHER="cipher AES-256-CBC"
|
||||
CIPHER="cipher AES-256-GCM"
|
||||
;;
|
||||
4)
|
||||
CIPHER="cipher CAMELLIA-128-CBC"
|
||||
CIPHER="cipher AES-128-CBC"
|
||||
;;
|
||||
5)
|
||||
CIPHER="cipher CAMELLIA-192-CBC"
|
||||
CIPHER="cipher AES-192-CBC"
|
||||
;;
|
||||
6)
|
||||
CIPHER="cipher CAMELLIA-256-CBC"
|
||||
;;
|
||||
7)
|
||||
CIPHER="cipher SEED-CBC"
|
||||
CIPHER="cipher AES-256-CBC"
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "Choose what size of Diffie-Hellman key you want to use:"
|
||||
echo " 1) 2048 bits (fastest)"
|
||||
echo " 2) 3072 bits (recommended, best compromise)"
|
||||
echo " 3) 4096 bits (most secure)"
|
||||
while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do
|
||||
read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE
|
||||
echo "Choose what kind of certificate you want to use:"
|
||||
echo "Elleptic Curves keys (EC) are recommended, they're faster, lighter and more secure."
|
||||
echo "Use RSA for OpenVPN 2.3 compatibilty"
|
||||
echo " 1) ECDSA (recommended)"
|
||||
echo " 2) RSA"
|
||||
while [[ $CERT_TYPE != "1" && $CERT_TYPE != "2" ]]; do
|
||||
read -p "Certificate type [1-2]: " -e -i 1 CERT_TYPE
|
||||
done
|
||||
case $DH_KEY_SIZE in
|
||||
case $CERT_TYPE in
|
||||
1)
|
||||
DH_KEY_SIZE="2048"
|
||||
echo ""
|
||||
echo "Choose which curve you want to use for the EC key:"
|
||||
echo " 1) secp256r1"
|
||||
echo " 2) secp384r1 (recommended)"
|
||||
echo " 3) secp521r1"
|
||||
while [[ $CERT_CURVE != "1" && $CERT_CURVE != "2" && $CERT_CURVE != "3" ]]; do
|
||||
read -p "Curve [1-3]: " -e -i 2 CERT_CURVE
|
||||
done
|
||||
case $CERT_CURVE in
|
||||
1)
|
||||
CERT_CURVE="secp256r1"
|
||||
;;
|
||||
2)
|
||||
DH_KEY_SIZE="3072"
|
||||
CERT_CURVE="secp384r1"
|
||||
;;
|
||||
3)
|
||||
DH_KEY_SIZE="4096"
|
||||
CERT_CURVE="secp521r1"
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
2)
|
||||
echo ""
|
||||
echo "Choose which RSA key size you want to use:"
|
||||
echo " 1) 2048 bits"
|
||||
echo " 2) 3072 bits (recommended)"
|
||||
echo " 3) 4096 bits"
|
||||
while [[ $RSA_SIZE != "1" && $RSA_SIZE != "2" && $RSA_SIZE != "3" ]]; do
|
||||
read -p "DH key size [1-3]: " -e -i 2 RSA_SIZE
|
||||
done
|
||||
case $RSA_SIZE in
|
||||
1)
|
||||
RSA_SIZE="2048"
|
||||
;;
|
||||
2)
|
||||
RSA_SIZE="3072"
|
||||
;;
|
||||
3)
|
||||
RSA_SIZE="4096"
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "Choose what size of RSA key you want to use:"
|
||||
echo " 1) 2048 bits (fastest)"
|
||||
echo " 2) 3072 bits (recommended, best compromise)"
|
||||
echo " 3) 4096 bits (most secure)"
|
||||
while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do
|
||||
read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE
|
||||
echo "Choose which hash algorithm you want to use for the certificate:"
|
||||
echo " 1) SHA-256"
|
||||
echo " 2) SHA-384 (recommended)"
|
||||
echo " 3) SHA-512"
|
||||
while [[ $CERT_HASH != "1" && $CERT_HASH != "2" && $CERT_HASH != "3" ]]; do
|
||||
read -p "Hash algorithm [1-3]: " -e -i 2 CERT_HASH
|
||||
done
|
||||
case $RSA_KEY_SIZE in
|
||||
case $CERT_HASH in
|
||||
1)
|
||||
RSA_KEY_SIZE="2048"
|
||||
CERT_HASH="sha256"
|
||||
;;
|
||||
2)
|
||||
RSA_KEY_SIZE="3072"
|
||||
CERT_HASH="sha384"
|
||||
;;
|
||||
3)
|
||||
RSA_KEY_SIZE="4096"
|
||||
CERT_HASH="sha512"
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "Choose what kind of Diffie-Hellman key you want to use."
|
||||
echo "Elleptic Curves (EC) are recommended, they're faster, lighter and more secure."
|
||||
echo "Use DH for OpenVPN 2.3 compatibilty"
|
||||
echo " 1) ECDH (recommended)"
|
||||
echo " 2) DH"
|
||||
while [[ $DH_TYPE != "1" && $DH_TYPE != "2" ]]; do
|
||||
read -p "DH key type [1-2]: " -e -i 1 DH_TYPE
|
||||
done
|
||||
case $DH_TYPE in
|
||||
1)
|
||||
echo ""
|
||||
echo "Choose which curve you want to use for the ECDH key"
|
||||
echo " 1) secp256r1"
|
||||
echo " 2) secp384r1 (recommended)"
|
||||
echo " 3) secp521r1"
|
||||
while [[ $DH_CURVE != "1" && $DH_CURVE != "2" && $DH_CURVE != "3" ]]; do
|
||||
read -p "Curve [1-3]: " -e -i 2 DH_CURVE
|
||||
done
|
||||
case $DH_CURVE in
|
||||
1)
|
||||
DH_CURVE="secp256r1"
|
||||
;;
|
||||
2)
|
||||
DH_CURVE="secp384r1"
|
||||
;;
|
||||
3)
|
||||
DH_CURVE="secp521r1"
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
2)
|
||||
echo""
|
||||
echo "Choose which DH key size you want to use"
|
||||
echo " 1) 2048 bits"
|
||||
echo " 2) 3072 bits (recommended)"
|
||||
echo " 3) 4096 bits"
|
||||
while [[ $DH_SIZE != "1" && $DH_SIZE != "2" && $DH_SIZE != "3" ]]; do
|
||||
read -p "DH key size [1-3]: " -e -i 2 DH_SIZE
|
||||
done
|
||||
case $DH_SIZE in
|
||||
1)
|
||||
DH_SIZE="2048"
|
||||
;;
|
||||
2)
|
||||
DH_SIZE="3072"
|
||||
;;
|
||||
3)
|
||||
DH_SIZE="4096"
|
||||
;;
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "Choose which cipher you want to use for the control channel:"
|
||||
if [[ "$CERT_TYPE" = '1' ]]; then
|
||||
echo " 1) ECDHE-ECDSA-AES-256-GCM-SHA384 (recommended)"
|
||||
echo " 2) ECDHE-ECDSA-AES-128-GCM-SHA256"
|
||||
while [[ $CC_ENC != "1" && $CC_ENC != "2" ]]; do
|
||||
read -p "Control channel cipher [1-2]: " -e -i 1 CC_ENC
|
||||
done
|
||||
case $CC_ENC in
|
||||
1)
|
||||
CC_ENC="TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"
|
||||
;;
|
||||
2)
|
||||
CC_ENC="TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256"
|
||||
;;
|
||||
esac
|
||||
elif [[ "$CERT_TYPE" = '2' ]]; then
|
||||
echo " 1) ECDHE-RSA-AES-256-GCM-SHA384 (recommended)"
|
||||
echo " 2) ECDHE-RSA-AES-128-GCM-SHA256"
|
||||
while [[ $CC_ENC != "1" && $CC_ENC != "2" ]]; do
|
||||
read -p "Control channel cipher [1-2]: " -e -i 1 CC_ENC
|
||||
done
|
||||
case $CC_ENC in
|
||||
1)
|
||||
CC_ENC="TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384"
|
||||
;;
|
||||
2)
|
||||
CC_ENC="TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256"
|
||||
;;
|
||||
esac
|
||||
fi
|
||||
echo ""
|
||||
echo "Do you want to use tls-crypt or tls-auth?"
|
||||
echo "They both encrypt and authenticate all control channel packets with a key."
|
||||
echo "tls-crypt is more advanced and secure than tls-auth, but it's an OpenVPN 2.4 feature."
|
||||
echo " 1) tls-crypt (recommended)"
|
||||
echo " 2) tls-auth (use only for OpenVPN 2.3 client compatibility)"
|
||||
while [[ $TLS_SIG != "1" && $TLS_SIG != "2" ]]; do
|
||||
read -p "Crontrol channel additional security layer [1-2]: " -e -i 1 TLS_SIG
|
||||
done
|
||||
echo""
|
||||
if [[ $CIPHER = "cipher AES-256-GCM" ]] || [[ $CIPHER = "cipher AES-192-GCM" ]] || [[ $CIPHER = "cipher AES-128-GCM" ]]; then
|
||||
echo "Choose which message digest algorithm you want to use for the tls-auth/tls-crypt control channel packets:"
|
||||
elif [[ $CIPHER = "cipher AES-256-CBC" ]] || [[ $CIPHER = "cipher AES-192-CBC" ]] || [[ $CIPHER = "cipher AES-128-CBC" ]]; then
|
||||
echo "Choose which message digest algorithm you want to use for the data channel packets"
|
||||
echo "and the tls-auth/tls-crypt control channel packets:"
|
||||
fi
|
||||
echo " 1) SHA-256"
|
||||
echo " 2) SHA-384 (recommended)"
|
||||
echo " 3) SHA-512"
|
||||
while [[ $HMAC_AUTH != "1" && $HMAC_AUTH != "2" && $HMAC_AUTH != "3" ]]; do
|
||||
read -p "HMAC authentication algorithm [1-3]: " -e -i 2 HMAC_AUTH
|
||||
done
|
||||
case $HMAC_AUTH in
|
||||
1)
|
||||
HMAC_AUTH="SHA256"
|
||||
;;
|
||||
2)
|
||||
HMAC_AUTH="SHA384"
|
||||
;;
|
||||
3)
|
||||
HMAC_AUTH="SHA512"
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
|
|
@ -328,26 +510,25 @@ else
|
|||
if [[ "$OS" = 'debian' ]]; then
|
||||
apt-get install ca-certificates gpg -y
|
||||
# We add the OpenVPN repo to get the latest version.
|
||||
# Debian 7
|
||||
if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then
|
||||
echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list
|
||||
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
|
||||
apt-get update
|
||||
fi
|
||||
# Debian 8
|
||||
if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then
|
||||
echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list
|
||||
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
|
||||
apt update
|
||||
fi
|
||||
elif [[ "$VERSION_ID" = 'VERSION_ID="9"' ]]; then
|
||||
echo "deb http://build.openvpn.net/debian/openvpn/stable stretch main" > /etc/apt/sources.list.d/openvpn.list
|
||||
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
|
||||
# Ubuntu 14.04
|
||||
if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then
|
||||
elif [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then
|
||||
echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list
|
||||
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
|
||||
apt-get update
|
||||
# Ubuntu 16.04
|
||||
elif [[ "$VERSION_ID" = 'VERSION_ID="16.04"' ]]; then
|
||||
echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn.list
|
||||
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
|
||||
fi
|
||||
# Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository.
|
||||
# Ubuntu >= 17.04 and Debian > 9 have OpenVPN 2.4 without the need of a third party repository.
|
||||
# The we install OpenVPN
|
||||
apt-get update
|
||||
apt-get install openvpn iptables openssl wget ca-certificates curl -y
|
||||
# Install iptables service
|
||||
if [[ ! -e /etc/systemd/system/iptables.service ]]; then
|
||||
|
|
@ -444,6 +625,10 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
|
|||
systemctl start iptables
|
||||
fi
|
||||
fi
|
||||
|
||||
#To remember if we use tls-crypt or tls-auth when generating a new client conf
|
||||
echo $TLS_SIG > /etc/openvpn/TLS_SIG
|
||||
|
||||
# Find out if the machine uses nogroup or nobody for the permissionless group
|
||||
if grep -qs "^nogroup:" /etc/group; then
|
||||
NOGROUP=nogroup
|
||||
|
|
@ -463,30 +648,46 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
|
|||
chown -R root:root /etc/openvpn/easy-rsa/
|
||||
rm -rf ~/EasyRSA-3.0.4.tgz
|
||||
cd /etc/openvpn/easy-rsa/
|
||||
if [[ $CERT_TYPE == "1" ]]; then
|
||||
echo "set_var EASYRSA_ALGO ec
|
||||
set_var EASYRSA_CURVE $CERT_CURVE" > vars
|
||||
elif [[ $CERT_TYPE == "2" ]]; then
|
||||
echo "set_var EASYRSA_KEY_SIZE $RSA_SIZE" > vars
|
||||
fi
|
||||
# Generate a random, alphanumeric identifier of 16 characters for CN and one for server name
|
||||
SERVER_CN="cn_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
|
||||
SERVER_NAME="server_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
|
||||
echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
|
||||
echo 'set_var EASYRSA_DIGEST "'$CERT_HASH'"' >> vars
|
||||
echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars
|
||||
# Create the PKI, set up the CA, the DH params and the server + client certificates
|
||||
./easyrsa init-pki
|
||||
./easyrsa --batch build-ca nopass
|
||||
openssl dhparam -out dh.pem $DH_KEY_SIZE
|
||||
if [[ $DH_TYPE == "2" ]]; then
|
||||
openssl dhparam -out dh.pem $DH_SIZE
|
||||
fi
|
||||
./easyrsa build-server-full $SERVER_NAME nopass
|
||||
./easyrsa build-client-full $CLIENT nopass
|
||||
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
|
||||
# generate tls-auth key
|
||||
if [[ $TLS_SIG == "1" ]]; then
|
||||
# Generate tls-crypt key
|
||||
openvpn --genkey --secret /etc/openvpn/tls-crypt.key
|
||||
elif [[ $TLS_SIG == "2" ]]; then
|
||||
# Generate tls-auth key
|
||||
openvpn --genkey --secret /etc/openvpn/tls-auth.key
|
||||
fi
|
||||
# Move all the generated files
|
||||
cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/$SERVER_NAME.crt pki/private/$SERVER_NAME.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
|
||||
cp pki/ca.crt pki/private/ca.key pki/issued/$SERVER_NAME.crt pki/private/$SERVER_NAME.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
|
||||
if [[ $DH_TYPE == "2" ]]; then
|
||||
cp dh.pem /etc/openvpn
|
||||
fi
|
||||
# Make cert revocation list readable for non-root
|
||||
chmod 644 /etc/openvpn/crl.pem
|
||||
|
||||
# Generate server.conf
|
||||
echo "port $PORT" > /etc/openvpn/server.conf
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
echo "proto udp" >> /etc/openvpn/server.conf
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
echo "proto tcp" >> /etc/openvpn/server.conf
|
||||
fi
|
||||
echo "dev tun
|
||||
|
|
@ -538,15 +739,30 @@ echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf
|
|||
echo "crl-verify crl.pem
|
||||
ca ca.crt
|
||||
cert $SERVER_NAME.crt
|
||||
key $SERVER_NAME.key
|
||||
tls-auth tls-auth.key 0
|
||||
dh dh.pem
|
||||
auth SHA256
|
||||
key $SERVER_NAME.key" >> /etc/openvpn/server.conf
|
||||
if [[ $TLS_SIG == "1" ]]; then
|
||||
echo "tls-crypt tls-crypt.key 0" >> /etc/openvpn/server.conf
|
||||
elif [[ $TLS_SIG == "2" ]]; then
|
||||
echo "tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf
|
||||
fi
|
||||
if [[ $DH_TYPE == "1" ]]; then
|
||||
echo "dh none
|
||||
ecdh-curve $DH_CURVE" >> /etc/openvpn/server.conf
|
||||
elif [[ $DH_TYPE == "2" ]]; then
|
||||
echo "dh dh.pem" >> /etc/openvpn/server.conf
|
||||
fi
|
||||
echo "auth $HMAC_AUTH
|
||||
$CIPHER
|
||||
ncp-disable
|
||||
tls-server
|
||||
tls-version-min 1.2
|
||||
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
|
||||
status openvpn.log
|
||||
tls-cipher $CC_ENC" >> /etc/openvpn/server.conf
|
||||
|
||||
if [[ $COMPRESSION == "lz4" || $COMPRESSION == "lzo" ]]; then
|
||||
echo "compress $COMPRESSION" >> /etc/openvpn/server.conf
|
||||
fi
|
||||
|
||||
echo "status openvpn.log
|
||||
verb 3" >> /etc/openvpn/server.conf
|
||||
|
||||
# Create the sysctl configuration file if needed (mainly for Arch Linux)
|
||||
|
|
@ -569,10 +785,10 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
# We don't use --add-service=openvpn because that would only work with
|
||||
# the default port. Using both permanent and not permanent rules to
|
||||
# avoid a firewalld reload.
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
firewall-cmd --zone=public --add-port=$PORT/udp
|
||||
firewall-cmd --permanent --zone=public --add-port=$PORT/udp
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
firewall-cmd --zone=public --add-port=$PORT/tcp
|
||||
firewall-cmd --permanent --zone=public --add-port=$PORT/tcp
|
||||
fi
|
||||
|
|
@ -583,15 +799,20 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
# If iptables has at least one REJECT rule, we asume this is needed.
|
||||
# Not the best approach but I can't think of other and this shouldn't
|
||||
# cause problems.
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
iptables -I INPUT -p udp --dport $PORT -j ACCEPT
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
iptables -I INPUT -p tcp --dport $PORT -j ACCEPT
|
||||
fi
|
||||
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
# Save persitent OpenVPN rules
|
||||
iptables-save > $IPTABLES
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL
|
||||
fi
|
||||
sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
|
||||
sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
|
||||
fi
|
||||
# If SELinux is enabled and a custom port was selected, we need this
|
||||
if hash sestatus 2>/dev/null; then
|
||||
|
|
@ -601,9 +822,9 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
if ! hash semanage 2>/dev/null; then
|
||||
yum install policycoreutils-python -y
|
||||
fi
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
semanage port -a -t openvpn_port_t -p udp $PORT
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
semanage port -a -t openvpn_port_t -p tcp $PORT
|
||||
fi
|
||||
fi
|
||||
|
|
@ -657,9 +878,9 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
fi
|
||||
# client-template.txt is created so we have a template to add further users later
|
||||
echo "client" > /etc/openvpn/client-template.txt
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
if [[ "$PROTOCOL" = '1' ]]; then
|
||||
echo "proto udp" >> /etc/openvpn/client-template.txt
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
elif [[ "$PROTOCOL" = '2' ]]; then
|
||||
echo "proto tcp-client" >> /etc/openvpn/client-template.txt
|
||||
fi
|
||||
echo "remote $IP $PORT
|
||||
|
|
@ -670,13 +891,18 @@ persist-key
|
|||
persist-tun
|
||||
remote-cert-tls server
|
||||
verify-x509-name $SERVER_NAME name
|
||||
auth SHA256
|
||||
auth $HMAC_AUTH
|
||||
auth-nocache
|
||||
$CIPHER
|
||||
tls-client
|
||||
tls-version-min 1.2
|
||||
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
|
||||
setenv opt block-outside-dns
|
||||
tls-cipher $CC_ENC" >> /etc/openvpn/client-template.txt
|
||||
|
||||
if [[ $COMPRESSION == "lz4" || $COMPRESSION == "lzo" ]]; then
|
||||
echo "compress $COMPRESSION" >> /etc/openvpn/client-template.txt
|
||||
fi
|
||||
|
||||
echo "setenv opt block-outside-dns
|
||||
verb 3" >> /etc/openvpn/client-template.txt
|
||||
|
||||
# Generate the custom client.ovpn
|
||||
|
|
|
|||
Loading…
Reference in a new issue