diff --git a/openvpn-install.sh b/openvpn-install.sh index 121a782..ab5f8f9 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -3,96 +3,166 @@ # Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux # https://github.com/Angristan/OpenVPN-install +######################################### +############ FUNCTIONS ############ +######################################### -# Verify root -if [[ "$EUID" -ne 0 ]]; then - echo "Sorry, you need to run this as root" - exit 1 -fi - -# Verify tun -if [[ ! -e /dev/net/tun ]]; then - echo "TUN is not available" - exit 2 -fi - -# Check if CentOS 5 -if grep -qs "CentOS release 5" "/etc/redhat-release"; then - echo "CentOS 5 is too old and not supported" - exit 3 -fi - -if [[ -e /etc/debian_version ]]; then - OS="debian" - # Getting the version number, to verify that a recent version of OpenVPN is available - VERSION_ID=$(grep "VERSION_ID" /etc/os-release) - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="18.04"' ]]; then - echo "Your version of Debian/Ubuntu is not supported." - echo "I can't install a recent version of OpenVPN on your system." - echo "" - echo "However, if you're using Debian unstable/testing, or Ubuntu beta," - echo "then you can continue, a recent version of OpenVPN is available on these." - echo "Keep in mind they are not supported, though." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -rp "Continue ? [y/n]: " -e CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi +function isRoot () { + if [ "$EUID" -ne 0 ]; then + return 1 fi -elif [[ -e /etc/fedora-release ]]; then - OS=fedora - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.d/openvpn.conf' -elif [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then - OS=centos - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' -elif [[ -e /etc/arch-release ]]; then - OS=arch - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.d/openvpn.conf' -else - echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" - exit 4 -fi +} + +function tunAvailable () { + if [ ! -e /dev/net/tun ]; then + return 1 + fi +} + +function checkOS () { + # Check if CentOS 5 + if grep -qs "CentOS release 5" "/etc/redhat-release"; then + echo "CentOS 5 is too old and not supported" + exit 1 + fi + + if [[ -e /etc/debian_version ]]; then + OS="debian" + # Getting the version number, to verify that a recent version of OpenVPN is available + VERSION_ID=$(grep "VERSION_ID" /etc/os-release) + IPTABLES='/etc/iptables/iptables.rules' + SYSCTL='/etc/sysctl.conf' + if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="18.04"' ]]; then + echo "Your version of Debian/Ubuntu is not supported." + echo "I can't install a recent version of OpenVPN on your system." + echo "" + echo "However, if you're using Debian unstable/testing, or Ubuntu beta," + echo "then you can continue, a recent version of OpenVPN is available on these." + echo "Keep in mind they are not supported, though." + while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + read -rp "Continue ? [y/n]: " -e local CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 1 + fi + fi + elif [[ -e /etc/fedora-release ]]; then + OS=fedora + IPTABLES='/etc/iptables/iptables.rules' + SYSCTL='/etc/sysctl.d/openvpn.conf' + elif [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then + OS=centos + IPTABLES='/etc/iptables/iptables.rules' + SYSCTL='/etc/sysctl.conf' + elif [[ -e /etc/arch-release ]]; then + OS=arch + IPTABLES='/etc/iptables/iptables.rules' + SYSCTL='/etc/sysctl.d/openvpn.conf' + else + echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" + exit 1 + fi +} + +function initialCheck () { + if ! isRoot; then + echo "Sorry, you need to run this as root" + exit 1 + fi + if ! tunAvailable; then + echo "TUN is not available" + exit 1 + fi + + checkOS +} + +function getNIC () { + return $(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) +} + +function installEasyRsa () { + wget -O ~/EasyRSA-3.0.4.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz + tar xzf ~/EasyRSA-3.0.4.tgz -C ~/ + mv ~/EasyRSA-3.0.4/ /etc/openvpn/ + mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/ + chown -R root:root /etc/openvpn/easy-rsa/ + rm -f ~/EasyRSA-3.0.4.tgz +} + +function newclient () { + echo "" + echo "Do you want to protect the configuration file with a password?" + echo "(e.g. encrypt the private key with a password)" + echo " 1) Add a passwordless client" + echo " 2) Use a password for the client" + + until [[ "$pass" =~ ^[1-2]$ ]]; do + read -rp "Select an option [1-2]: " -e -i 1 local pass + done + + echo "" + echo "Tell me a name for the client cert" + echo "Use one word only, no special characters" + + until [[ "$client" =~ ^[a-zA-Z0-9_]+$ ]]; do + read -rp "Client name: " -e local client + done + + cd /etc/openvpn/easy-rsa/ || return + case $pass in + 1) + ./easyrsa build-client-full $client nopass + ;; + 2) + echo "⚠️ You will be asked for the client password below ⚠️" + ./easyrsa build-client-full $client + ;; + esac -newclient () { # Where to write the custom client.ovpn? - if [ -e "/home/$1" ]; then # if $1 is a user name - homeDir="/home/$1" + if [ -e "/home/$client" ]; then # if $1 is a user name + homeDir="/home/$client" elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root homeDir="/root" fi # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt "$homeDir/$1.ovpn" + cp /etc/openvpn/client-template.txt "$homeDir/$client.ovpn" { echo "" cat "/etc/openvpn/easy-rsa/pki/ca.crt" echo "" echo "" - cat "/etc/openvpn/easy-rsa/pki/issued/$1.crt" + cat "/etc/openvpn/easy-rsa/pki/issued/$client.crt" echo "" echo "" - cat "/etc/openvpn/easy-rsa/pki/private/$1.key" + cat "/etc/openvpn/easy-rsa/pki/private/$client.key" echo "" echo "key-direction 1" echo "" cat "/etc/openvpn/tls-auth.key" echo "" - } >> "$homeDir/$1.ovpn" + } >> "$homeDir/$client.ovpn" + + echo "" + echo "Client $client added, certs available at $homeDir/$client.ovpn" + exit } +########################################## +############### MAIN ############### +########################################## + +initialCheck + # Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) +NIC=$(getNIC) if [[ -e /etc/openvpn/server.conf ]]; then while : @@ -112,38 +182,9 @@ if [[ -e /etc/openvpn/server.conf ]]; then case $option in 1) - echo "" - echo "Do you want to protect the configuration file with a password?" - echo "(e.g. encrypt the private key with a password)" - echo " 1) Add a passwordless client" - echo " 2) Use a password for the client" - until [[ "$pass" =~ ^[1-2]$ ]]; do - read -rp "Select an option [1-2]: " -e -i 1 pass - done - echo "" - echo "Tell me a name for the client cert" - echo "Use one word only, no special characters" - until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do - read -rp "Client name: " -e CLIENT - done - - cd /etc/openvpn/easy-rsa/ || return - case $pass in - 1) - ./easyrsa build-client-full $CLIENT nopass - ;; - 2) - echo "⚠️ You will be asked for the client password below ⚠️" - ./easyrsa build-client-full $CLIENT - ;; - esac - # Generates the custom client.ovpn - newclient "$CLIENT" + newclient - echo "" - echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - exit ;; 2) NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") @@ -530,13 +571,9 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service if [[ -d /etc/openvpn/easy-rsa/ ]]; then rm -rf /etc/openvpn/easy-rsa/ fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.4.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz - tar xzf ~/EasyRSA-3.0.4.tgz -C ~/ - mv ~/EasyRSA-3.0.4/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -f ~/EasyRSA-3.0.4.tgz + # Install easy-rsa + installEasyRsa + cd /etc/openvpn/easy-rsa/ || return # Generate a random, alphanumeric identifier of 16 characters for CN and one for server name SERVER_CN="cn_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" @@ -773,11 +810,7 @@ setenv opt block-outside-dns verb 3" >> /etc/openvpn/client-template.txt # Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" + newclient echo "If you want to add more clients, you simply need to run this script another time!" fi exit 0;