diff --git a/openvpn-install.sh b/openvpn-install.sh index 2710fbb..c5a8cab 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -33,7 +33,7 @@ function checkOS () { done if [[ "$CONTINUE" = "n" ]]; then echo "Ok, bye!" - exit 4 + exit 1 fi fi elif [[ -e /etc/fedora-release ]]; then @@ -49,13 +49,13 @@ function checkOS () { done if [[ "$CONTINUE" = "n" ]]; then echo "Ok, bye!" - exit 5 + exit 1 fi fi OS=centos else echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora or CentOS system" - exit 4 + exit 1 fi } @@ -66,7 +66,7 @@ function initialCheck () { fi if ! tunAvailable; then echo "TUN is not available" - exit 2 + exit 1 fi checkOS } @@ -77,6 +77,7 @@ function installLocalDNS () { if [[ "$OS" = "debian" ]]; then apt-get install -y unbound + # Configuration echo 'interface: 10.8.0.1 access-control: 10.8.0.1/24 allow hide-identity: yes @@ -116,11 +117,10 @@ prefetch: yes' >> /etc/unbound/unbound.conf private-address: 127.0.0.0/8 private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf fi - else - # Unbound is already installed + else # Unbound is already installed echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf - # Add OpenVPN integration + # Add Unbound 'server' for the OpenVPN subnet echo 'server: interface: 10.8.0.1 access-control: 10.8.0.1/24 allow @@ -138,19 +138,15 @@ private-address: 127.0.0.0/8 private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf fi - if pgrep systemd-journal; then systemctl enable unbound systemctl start unbound - else - service unbound restart - fi } function installOpenVPN () { - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" + echo "Welcome to the OpenVPN installer!" + echo "The git repository is available at: https://github.com/angristan/openvpn-install" echo "" - # OpenVPN setup and first user creation echo "I need to ask you a few questions before starting the setup" echo "You can leave the default options and just press enter if you are ok with them" echo "" @@ -158,7 +154,7 @@ function installOpenVPN () { echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" echo "Otherwise, it should be your public IPv4 address." - # Autodetect IP address and pre-fill for the user + # Detect public IPv4 address and pre-fill for the user IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) read -rp "IP address: " -e -i $IP IP # If $IP is a private IP address, the server must be behind NAT @@ -167,21 +163,25 @@ function installOpenVPN () { echo "This server is behind NAT. What is the public IPv4 address or hostname?" read -rp "Public IP address / hostname: " -e PUBLICIP fi + echo "" echo "Checking for IPv6 connectivity..." ping6 -c4 ipv6.google.com > /dev/null 2>&1; echo "" if [[ $? == 0 ]]; then echo "Your host appears to have IPv6 connectivity." + SUGGESTION="y" else echo "Your host does not appear to have IPv6 connectivity." + SUGGESTION="n" fi echo "" - while [[ $IPV6 != "y" && $IPV6 != "n" ]]; do - read -rp "Do you want to enable IPv6 support? [y/n]: " -e IPV6 + # Ask the user if they want to enable IPv6 regardless its availability. + while [[ $IPV6_SUPPORT != "y" && $IPV6_SUPPORT != "n" ]]; do + read -rp "Do you want to enable IPv6 support? [y/n]: " -e -i $SUGGESTION IPV6_SUPPORT done echo "" - echo "What port do you want for OpenVPN?" + echo "What port do you want OpenVPN to listen to?" echo " 1) Default: 1194" echo " 2) Custom" echo " 3) Random [49152-65535]" @@ -204,13 +204,23 @@ function installOpenVPN () { ;; esac echo "" - echo "What protocol do you want for OpenVPN?" - echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - until [[ "$PROTOCOL" == "UDP" || "$PROTOCOL" == "TCP" ]]; do - read -rp "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + echo "What protocol do you want OpenVPN to use?" + echo "UDP is faster. Unless it is not available, you shoudn't use TCP." + echo " 1) UDP" + echo " 2) TCP" + until [[ "$PROTOCOL_CHOICE" =~ ^[1-2] ]]; do + read -rp "Protocol [1-2]: " -e -i 1 PROTOCOL_CHOICE done + case $PROTOCOL_CHOICE in + 1) + PROTOCOL="udp" + ;; + 2) + PROTOCOL="tcp" + ;; + esac echo "" - echo "What DNS do you want to use with the VPN?" + echo "What DNS resolvers do you want to use with the VPN?" echo " 1) Current system resolvers (from /etc/resolv.conf)" echo " 2) Self-hosted DNS Resolver (Unbound)" echo " 3) Cloudflare (Anycast: worldwide)" @@ -222,7 +232,7 @@ function installOpenVPN () { echo " 9) Yandex Basic (Russia)" echo " 10) AdGuard DNS (Russia)" until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 -a "$DNS" -le 10 ]; do - read -rp "DNS [1-10]: " -e -i 1 DNS + read -rp "DNS [1-10]: " -e -i 3 DNS if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then echo "" echo "Unbound is already installed." @@ -235,6 +245,7 @@ function installOpenVPN () { read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE done if [[ $CONTINUE = "n" ]];then + # Break the loop and cleanup unset DNS unset CONTINUE fi @@ -245,21 +256,15 @@ function installOpenVPN () { echo "the encryption in OpenVPN and the choices I made in this script." echo "Please note that all the choices proposed are secure (to a different degree)" echo "and are still viable to date, unlike some default OpenVPN options" - echo '' + echo "" echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" + echo " 1) AES-128-CBC (recommended)" echo " 2) AES-192-CBC" echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - until [[ "$CIPHER" =~ ^[0-9]+$ ]] && [ "$CIPHER" -ge 1 -a "$CIPHER" -le 7 ]; do - read -rp "Cipher [1-7]: " -e -i 1 CIPHER + until [[ "$CIPHER_CHOICE" =~ ^[0-9]+$ ]] && [ "$CIPHER_CHOICE" -ge 1 -a "$CIPHER_CHOICE" -le 3 ]; do + read -rp "CIPHER_CHOICE [1-7]: " -e -i 1 CIPHER_CHOICE done - case $CIPHER in + case $CIPHER_CHOICE in 1) CIPHER="cipher AES-128-CBC" ;; @@ -269,28 +274,16 @@ function installOpenVPN () { 3) CIPHER="cipher AES-256-CBC" ;; - 4) - CIPHER="cipher CAMELLIA-128-CBC" - ;; - 5) - CIPHER="cipher CAMELLIA-192-CBC" - ;; - 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" - ;; esac echo "" echo "Choose what size of Diffie-Hellman key you want to use:" echo " 1) 2048 bits (fastest)" echo " 2) 3072 bits (recommended, best compromise)" echo " 3) 4096 bits (most secure)" - until [[ "$DH_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE" -ge 1 -a "$DH_KEY_SIZE" -le 3 ]; do - read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE + until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE_CHOICE" -ge 1 -a "$DH_KEY_SIZE_CHOICE" -le 3 ]; do + read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE_CHOICE done - case $DH_KEY_SIZE in + case $DH_KEY_SIZE_CHOICE in 1) DH_KEY_SIZE="2048" ;; @@ -302,14 +295,14 @@ function installOpenVPN () { ;; esac echo "" - echo "Choose what size of RSA key you want to use:" + echo "Choose what size of RSA key you want to use for the certificate:" echo " 1) 2048 bits (fastest)" echo " 2) 3072 bits (recommended, best compromise)" echo " 3) 4096 bits (most secure)" - until [[ "$RSA_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE" -ge 1 -a "$RSA_KEY_SIZE" -le 3 ]; do - read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE + until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE_CHOICE" -ge 1 -a "$RSA_KEY_SIZE_CHOICE" -le 3 ]; do + read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE_CHOICE done - case $RSA_KEY_SIZE in + case $RSA_KEY_SIZE_CHOICE in 1) RSA_KEY_SIZE="2048" ;; @@ -321,43 +314,28 @@ function installOpenVPN () { ;; esac echo "" - echo "Do you want to protect the configuration file with a password?" - echo "(e.g. encrypt the private key with a password)" - echo " 1) Add a passwordless client" - echo " 2) Use a password for the client" - until [[ "$pass" =~ ^[1-2]$ ]]; do - read -rp "Select an option [1-2]: " -e -i 1 pass - done - echo "" - echo "Finally, tell me a name for the client certificate and configuration" - echo "Use one word only, no special characters" - until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do - read -rp "Client name: " -e -i client CLIENT - done - echo "" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" + echo "You will be able to generate a client at the end of the installtion." read -n1 -r -p "Press any key to continue..." + # Get the "public" interface from the default route NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) if [[ "$OS" = 'debian' ]]; then apt-get update apt-get install ca-certificates gnupg -y # We add the OpenVPN repo to get the latest version. - # Debian 8 if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update fi # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y - elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then - if [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - fi - yum install openvpn iptables openssl wget ca-certificates curl -y + elif [[ "$OS" = 'centos' ]]; then + yum install epel-release openvpn iptables openssl wget ca-certificates curl -y + elif [[ "$OS" = 'fedora' ]]; then + dnf install openvpn iptables openssl wget ca-certificates curl -y fi # Find out if the machine uses nogroup or nobody for the permissionless group @@ -372,6 +350,7 @@ function installOpenVPN () { rm -rf /etc/openvpn/easy-rsa/ fi + # Install the latest version of easy-rsa from source local version="3.0.4" wget -O ~/EasyRSA-${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-${version}.tgz tar xzf ~/EasyRSA-${version}.tgz -C ~/ @@ -386,22 +365,13 @@ function installOpenVPN () { SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars - # Create the PKI, set up the CA, the DH params and the server + client certificates + # Create the PKI, set up the CA, the DH params and the server certificate ./easyrsa init-pki ./easyrsa --batch build-ca nopass openssl dhparam -out dh.pem $DH_KEY_SIZE ./easyrsa build-server-full $SERVER_NAME nopass - case $pass in - 1) - ./easyrsa build-client-full $CLIENT nopass - ;; - 2) - echo "⚠️ You will be asked for the client password below ⚠️" - ./easyrsa build-client-full $CLIENT - ;; - esac EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key + # Generate tls-auth key openvpn --genkey --secret /etc/openvpn/tls-auth.key # Move all the generated files cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/$SERVER_NAME.crt pki/private/$SERVER_NAME.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn @@ -410,19 +380,12 @@ function installOpenVPN () { # Generate server.conf echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$IPV6" = 'n' ]]; then - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - elif [[ "$IPV6" = 'y' ]]; then - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp6" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp6" >> /etc/openvpn/server.conf - fi + if [[ "$IPV6_SUPPORT" = 'n' ]]; then + echo "proto $PROTOCOL" >> /etc/openvpn/server.conf + elif [[ "$IPV6_SUPPORT" = 'y' ]]; then + echo "proto ${PROTOCOL}6" >> /etc/openvpn/server.conf fi + echo "dev tun user nobody group $NOGROUP @@ -432,6 +395,7 @@ keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf + # DNS resolvers case $DNS in 1) @@ -487,7 +451,8 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf esac echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf - if [[ "$IPV6" = 'y' ]]; then + # IPv6 network settings if needed + if [[ "$IPV6_SUPPORT" = 'y' ]]; then echo 'server-ipv6 fd42:42:42:42::/112 tun-ipv6 push tun-ipv6 @@ -514,10 +479,9 @@ verb 3" >> /etc/openvpn/server.conf # Enable routing echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf - if [[ "$IPV6" = 'y' ]]; then + if [[ "$IPV6_SUPPORT" = 'y' ]]; then echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf fi - # Avoid an unneeded reboot sysctl --system @@ -525,15 +489,7 @@ verb 3" >> /etc/openvpn/server.conf if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi + semanage port -a -t openvpn_port_t -p $PROTOCOL $PORT fi fi fi @@ -557,7 +513,7 @@ verb 3" >> /etc/openvpn/server.conf systemctl enable openvpn@server fi - # Install iptables service + # Add iptables rules in two scripts mkdir /etc/iptables # Script to add rules @@ -565,15 +521,10 @@ verb 3" >> /etc/openvpn/server.conf iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -A INPUT -i tun0 -j ACCEPT iptables -A FORWARD -i $NIC -o tun0 -j ACCEPT -iptables -A FORWARD -i tun0 -o $NIC -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh +iptables -A FORWARD -i tun0 -o $NIC -j ACCEPT +iptables -A INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "iptables -A INPUT -i $NIC -p udp --dport $PORT -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "iptables -A INPUT -i $NIC -p tcp --dport $PORT -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh - fi - - if [[ "$IPV6" = 'y' ]]; then + if [[ "$IPV6_SUPPORT" = 'y' ]]; then echo "ip6tables -t nat -A POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE ip6tables -A INPUT -i tun0 -j ACCEPT ip6tables -A FORWARD -i $NIC -o tun0 -j ACCEPT @@ -585,15 +536,10 @@ ip6tables -A FORWARD -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-rul iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT -iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh +iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT +iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "iptables -D INPUT -i $NIC -p udp --dport $PORT -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "iptables -D INPUT -i $NIC -p tcp --dport $PORT -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh - fi - - if [[ "$IPV6" = 'y' ]]; then + if [[ "$IPV6_SUPPORT" = 'y' ]]; then echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE ip6tables -D INPUT -i tun0 -j ACCEPT ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT @@ -623,16 +569,16 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables-openvpn.service systemctl enable iptables-openvpn systemctl start iptables-openvpn - # If the server is behind a NAT, use the correct IP address + # If the server is behind a NAT, use the correct IP address for the clients to connect to if [[ "$PUBLICIP" != "" ]]; then IP=$PUBLICIP fi # client-template.txt is created so we have a template to add further users later echo "client" > /etc/openvpn/client-template.txt - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = 'udp' ]]; then echo "proto udp" >> /etc/openvpn/client-template.txt - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = 'tcp' ]]; then echo "proto tcp-client" >> /etc/openvpn/client-template.txt fi echo "remote $IP $PORT @@ -653,76 +599,73 @@ setenv opt block-outside-dns verb 3" >> /etc/openvpn/client-template.txt # Generate the custom client.ovpn - newclient + newClient echo "If you want to add more clients, you simply need to run this script another time!" } function newClient () { + echo "" + echo "Tell me a name for the client." + echo "Use one word only, no special characters." + + until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do + read -rp "Client name: " -e CLIENT + done + echo "" echo "Do you want to protect the configuration file with a password?" echo "(e.g. encrypt the private key with a password)" echo " 1) Add a passwordless client" echo " 2) Use a password for the client" - until [[ "$pass" =~ ^[1-2]$ ]]; do - read -rp "Select an option [1-2]: " -e -i 1 local pass - done - - echo "" - echo "Tell me a name for the client cert" - echo "Use one word only, no special characters" - - until [[ "$client" =~ ^[a-zA-Z0-9_]+$ ]]; do - read -rp "Client name: " -e local client + until [[ "$PASS" =~ ^[1-2]$ ]]; do + read -rp "Select an option [1-2]: " -e -i 1 PASS done - generateClient -} - -function generateClient () { cd /etc/openvpn/easy-rsa/ || return - case $pass in + case $PASS in 1) - ./easyrsa build-client-full $client nopass + ./easyrsa build-client-full $CLIENT nopass ;; 2) echo "⚠️ You will be asked for the client password below ⚠️" - ./easyrsa build-client-full $client + ./easyrsa build-client-full $CLIENT ;; esac - # Where to write the custom client.ovpn? - if [ -e "/home/$client" ]; then # if $1 is a user name - homeDir="/home/$client" + # Home directory of the user, where the client configuration (.ovpn) will be written + if [ -e "/home/$CLIENT" ]; then # if $1 is a user name + homeDir="/home/$CLIENT" elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root homeDir="/root" fi + # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt "$homeDir/$client.ovpn" + cp /etc/openvpn/client-template.txt "$homeDir/$CLIENT.ovpn" { echo "" cat "/etc/openvpn/easy-rsa/pki/ca.crt" echo "" echo "" - cat "/etc/openvpn/easy-rsa/pki/issued/$client.crt" + cat "/etc/openvpn/easy-rsa/pki/issued/$CLIENT.crt" echo "" echo "" - cat "/etc/openvpn/easy-rsa/pki/private/$client.key" + cat "/etc/openvpn/easy-rsa/pki/private/$CLIENT.key" echo "" echo "key-direction 1" echo "" cat "/etc/openvpn/tls-auth.key" echo "" - } >> "$homeDir/$client.ovpn" + } >> "$homeDir/$CLIENT.ovpn" echo "" - echo "Client $client added, certs available at $homeDir/$client.ovpn" - exit + echo "Client $CLIENT added, the configuration file is available at $homeDir/$CLIENT.ovpn." + echo "Download the .ovpn file and import it in your OpenVPN client." } function revokeClient () { @@ -730,7 +673,7 @@ function revokeClient () { if [[ "$NUMBEROFCLIENTS" = '0' ]]; then echo "" echo "You have no existing clients!" - exit 5 + exit 1 fi echo "" @@ -746,6 +689,7 @@ function revokeClient () { cd /etc/openvpn/easy-rsa/ ./easyrsa --batch revoke $CLIENT EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + # Cleanup rm -f pki/reqs/$CLIENT.req rm -f pki/private/$CLIENT.key rm -f pki/issued/$CLIENT.crt @@ -756,9 +700,7 @@ function revokeClient () { rm -f /root/$CLIENT.ovpn 2>/dev/null echo "" - echo "Certificate for client $CLIENT revoked" - echo "Exiting..." - exit + echo "Certificate for client $CLIENT revoked." } function removeOpenVPN () { @@ -767,7 +709,7 @@ function removeOpenVPN () { if [[ "$REMOVE" = 'y' ]]; then PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) - # Remove ipatbles rules related to the script + # Remove the iptables rules related to the script systemctl stop iptables-openvpn # Cleanup systemctl disable iptables-openvpn @@ -776,6 +718,7 @@ function removeOpenVPN () { rm /etc/iptables/add-openvpn-rules.sh rm /etc/iptables/rm-openvpn-rules.sh + # SELinux if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -783,11 +726,16 @@ function removeOpenVPN () { fi fi fi + if [[ "$OS" = 'debian' ]]; then apt-get autoremove --purge -y openvpn - else + elif [[ "$OS" = 'centos' ]]; then yum remove openvpn -y + elif [[ "$OS" = 'fedora' ]]; then + dnf remove openvpn -y fi + + # Cleanup OVPNS=$(ls /etc/openvpn/easy-rsa/pki/issued | awk -F "." {'print $1'}) for i in $OVPNS;do rm $(find /home -maxdepth 2 | grep $i.ovpn) 2>/dev/null @@ -797,8 +745,8 @@ function removeOpenVPN () { rm -rf /usr/share/doc/openvpn* rm -f /etc/sysctl.d/20-openvpn.conf + # Unbound if [[ -e /etc/unbound/openvpn.conf ]]; then - # Remove OpenVPN-related config sed -i 's|include: \/etc\/unbound\/openvpn.conf||' /etc/unbound/unbound.conf rm /etc/unbound/openvpn.conf @@ -807,22 +755,25 @@ function removeOpenVPN () { until [[ $REMOVE_UNBOUND == "y" || $REMOVE_UNBOUND == "n" ]]; do echo "" echo "If you were already using Unbound before installing OpenVPN, I removed the configuration related to OpenVPN." - echo "You can keep using Unbound as before." read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND done if [[ "$REMOVE_UNBOUND" = 'y' ]]; then if [[ "$OS" = 'debian' ]]; then apt-get autoremove --purge -y unbound - else + elif [[ "$OS" = 'centos' ]]; then yum remove unbound -y + elif [[ "$OS" = 'fedora' ]]; then + dnf remove unbound -y fi + rm -rf /etc/unbound/ + echo "" echo "Unbound removed!" else echo "" - echo "Unbound not removed!" + echo "Unbound wasn't removed." fi fi echo "" @@ -831,27 +782,25 @@ function removeOpenVPN () { echo "" echo "Removal aborted!" fi - exit } function manageMenu () { clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" + echo "Welcome to OpenVPN-install!" + echo "The git repository is available at: https://github.com/angristan/openvpn-install" echo "" - echo "Looks like OpenVPN is already installed" + echo "It looks like OpenVPN is already installed." echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" + echo " 1) Add a new user" + echo " 2) Revoke existing user" echo " 3) Remove OpenVPN" echo " 4) Exit" read -rp "Select an option [1-4]: " option case $option in 1) - # Generates the custom client.ovpn - newclient + newClient ;; 2) revokeClient @@ -860,19 +809,19 @@ function manageMenu () { removeOpenVPN ;; 4) - exit + exit 0 ;; esac } # Main +# Check for root, TUN, OS... initialCheck +# Check if OpenVPN is already installed if [[ -e /etc/openvpn/server.conf ]]; then manageMenu else installOpenVPN fi - -exit 0