Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add ca$IP.crt to client conf file

Browse Source
This commit is contained in:
Hoang Huynh 2014-02-27 23:20:53 +07:00
parent c3189eacb4
commit 101d1188b1
1 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
openvpn-install.sh
View File

@ -1,17 +1,18 @@
#!/bin/bash #!/bin/bash
# OpenVPN road warrior installer for Debian-based distros # OpenVPN road warrior installer for Debian-based distros
# This script will only work on Debian-based systems. It isn't bulletproof but
# it will probably work if you simply want to setup a VPN on your Debian/Ubuntu # TODO check for Debian-based distros
# VPS. It has been designed to be as unobtrusive and universal as possible.
# Check for root
if [ $USER != 'root' ]; then if [ $USER != 'root' ]; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit exit
fi fi
# check for tun/tap
if [ ! -e /dev/net/tun ]; then if [ ! -e /dev/net/tun ]; then
echo "TUN/TAP is not available, please enable it first (contact your provider if you don't know how)" echo "TUN/TAP is not available, please enable it first (contact your provider if you don't know how)"
exit exit
@ -45,7 +46,7 @@ if [ -e /etc/openvpn/server.conf ]; then
echo "" echo ""
echo "Tell me a name for the client cert" echo "Tell me a name for the client cert"
echo "Please, use one word only, no special characters" echo "Please, use one word only, no special characters"
read -p "Client name: " -e -i client CLIENT read -p "Client name: " -e CLIENT
cd /etc/openvpn/easy-rsa/2.0/ cd /etc/openvpn/easy-rsa/2.0/
source ./vars source ./vars
# build-key for the client # build-key for the client
@ -54,26 +55,28 @@ if [ -e /etc/openvpn/server.conf ]; then
"$EASY_RSA/pkitool" $CLIENT "$EASY_RSA/pkitool" $CLIENT
# Let's generate the client config # Let's generate the client config
mkdir ~/ovpn-$CLIENT mkdir ~/ovpn-$CLIENT
# add server IP to the file names to prevent duplication on client configs
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT@$IP.conf cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT@$IP.conf
cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT/ca@$IP.crt cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT/ca@$IP.crt
cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT/$CLIENT@$IP.crt cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT/$CLIENT@$IP.crt
cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT/$CLIENT@$IP.key cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT/$CLIENT@$IP.key
cd ~/ovpn-$CLIENT cd ~/ovpn-$CLIENT
sed -i "s|ca ca.crt|ca ca@$IP.crt|" $CLIENT@$IP.conf
sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf
sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf
# this is the conf file for client's openvpn gui tool # add an .ovpn file which is essentially the .conf file for client's openvpn gui tool
cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn
tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key
cd ~/ cd ~/
rm -rf ovpn-$CLIENT rm -rf ovpn-$CLIENT
echo "" echo ""
echo "Client $CLIENT added, certs available at ~/ovpn-$CLIENT.tar.gz" echo "Client $CLIENT added, certs available at `pwd`/ovpn-$CLIENT.tar.gz"
exit exit
;; ;;
2) 2)
echo "" echo ""
echo "Tell me the existing client name" echo "Tell me the existing client name"
read -p "Client name: " -e -i client CLIENT read -p "Client name: " -e CLIENT
cd /etc/openvpn/easy-rsa/2.0/ cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/vars . /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/revoke-full $CLIENT . /etc/openvpn/easy-rsa/2.0/revoke-full $CLIENT
@ -93,7 +96,7 @@ if [ -e /etc/openvpn/server.conf ]; then
apt-get remove --purge -y openvpn openvpn-blacklist apt-get remove --purge -y openvpn openvpn-blacklist
rm -rf /etc/openvpn rm -rf /etc/openvpn
rm -rf /usr/share/doc/openvpn rm -rf /usr/share/doc/openvpn
sed -i '/--dport 53 -j REDIRECT --to-port 1194/d' /etc/rc.local sed -i '/--dport 53 -j REDIRECT --to-port/d' /etc/rc.local
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0/d' /etc/rc.local sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0/d' /etc/rc.local
echo "" echo ""
echo "OpenVPN removed!" echo "OpenVPN removed!"
@ -105,6 +108,10 @@ if [ -e /etc/openvpn/server.conf ]; then
else else
echo 'Welcome to this quick OpenVPN "road warrior" installer' echo 'Welcome to this quick OpenVPN "road warrior" installer'
echo "" echo ""
echo "This script will only work on Debian-based systems. It isn't bulletproof but"
echo "it will probably work if you simply want to setup a VPN on your Debian/Ubuntu"
echo "VPS. It has been designed to be as unobtrusive and universal as possible."
echo ""
# OpenVPN setup and first user creation # OpenVPN setup and first user creation
echo "I need to ask you a few questions before starting the setup" echo "I need to ask you a few questions before starting the setup"
echo "You can leave the default options and just press enter if you are ok with them" echo "You can leave the default options and just press enter if you are ok with them"
@ -122,7 +129,7 @@ else
echo "" echo ""
echo "Finally, tell me your name for the client cert" echo "Finally, tell me your name for the client cert"
echo "Please, use one word only, no special characters" echo "Please, use one word only, no special characters"
read -p "Client name: " -e -i client CLIENT read -p "Client name: " -e CLIENT
echo "" echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."
@ -175,8 +182,8 @@ else
sed -i "s|port 1194|port $PORT|" server.conf sed -i "s|port 1194|port $PORT|" server.conf
# Listen at port 53 too if user wants that # Listen at port 53 too if user wants that
if [ $ALTPORT = 'y' ]; then if [ $ALTPORT = 'y' ]; then
iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194 iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT
sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194" /etc/rc.local sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT" /etc/rc.local
fi fi
# Enable net.ipv4.ip_forward for the system # Enable net.ipv4.ip_forward for the system
sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /etc/sysctl.conf sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /etc/sysctl.conf