Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

multi os support

Browse Source
This commit is contained in:
Gizem Gur 2020-03-26 12:06:05 +03:00
parent 582a062f2f
commit 11fc8bbf89
1 changed files with 395 additions and 247 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

620
openvpn-install.sh
View File

@ -1,161 +1,203 @@
#!/bin/bash #!/bin/bash
# OpenVPN road warrior installer for Debian and Ubuntu
if grep -qs "14.04" /etc/os-release; then
echo "Ubuntu 14.04 is too old and not supported"
exit
fi
if grep -qs "jessie" /etc/os-release; then
echo "Debian 8 is too old and not supported"
exit
fi
if grep -qs "CentOS release 6" /etc/redhat-release; then
echo "CentOS 6 is too old and not supported"
exit
fi
if grep -qs "Ubuntu 16.04" /etc/os-release; then
echo 'Ubuntu 16.04 is no longer supported in the current version of openvpn-install
Use an older version if Ubuntu 16.04 support is needed: https://git.io/vpn1604'
exit
fi
# Detect Debian users running the script with "sh" instead of bash # Detect Debian users running the script with "sh" instead of bash
if readlink /proc/$$/exe | grep -qs "dash"; then if readlink /proc/$$/exe | grep -q "dash"; then
echo "This script needs to be run with bash, not sh" echo "This script needs to be run with bash, not sh"
exit 1 exit
fi fi
if [[ "$EUID" -ne 0 ]]; then if [[ "$EUID" -ne 0 ]]; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit 2 exit
fi fi
if [[ ! -e /dev/net/tun ]]; then if [[ ! -e /dev/net/tun ]]; then
echo "The TUN device is not available echo "The TUN device is not available
You need to enable TUN before running this script" You need to enable TUN before running this script"
exit 3 exit
fi
if ! iptables -t nat -nL &>/dev/null; then
echo "Unable to initialize the iptables/netfilter NAT table, setup can't continue.
Make sure that your system has iptables/netfilter available.
If using OpenVZ, ask your provider to enable full netfilter support."
exit
fi fi
if [[ -e /etc/debian_version ]]; then if [[ -e /etc/debian_version ]]; then
OS=debian os="debian"
GROUPNAME=nogroup group_name="nogroup"
RCLOCAL='/etc/rc.local' elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
os="centos"
group_name="nobody"
elif grep -qs "Amazon Linux" /etc/system-release; then
os="amazon-linux"
group_name="nobody"
else else
echo "Looks like you aren't running this installer on Debian or Ubuntu" echo "Looks like you aren't running this installer on Debian, Ubuntu, CentOS or Amazon Linux"
exit 5 exit
fi fi
newclient () { new_client () {
# Generates the custom client.ovpn # Generates the custom client.ovpn
cp /etc/openvpn/client-common.txt ~/$1.ovpn {
echo "<ca>" >> ~/$1.ovpn cat /etc/openvpn/server/client-common.txt
cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn echo "<ca>"
echo "</ca>" >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/ca.crt
echo "<cert>" >> ~/$1.ovpn echo "</ca>"
cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn echo "<cert>"
echo "</cert>" >> ~/$1.ovpn sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$1".crt
echo "<key>" >> ~/$1.ovpn echo "</cert>"
cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn echo "<key>"
echo "</key>" >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/private/"$1".key
echo "<tls-auth>" >> ~/$1.ovpn echo "</key>"
cat /etc/openvpn/ta.key >> ~/$1.ovpn echo "<tls-crypt>"
echo "</tls-auth>" >> ~/$1.ovpn sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
echo "</tls-crypt>"
} > ~/"$1".ovpn
useradd $1 useradd $1
google-authenticator -t -d -r3 -R30 -f -l $1-vpn -s /etc/openvpn/google-authenticator/$1 google-authenticator -t -d -r3 -R30 -f -l $1-vpn -s /etc/openvpn/google-authenticator/$1
chown gauth. /etc/openvpn/google-authenticator/$1 chown gauth. /etc/openvpn/google-authenticator/$1
} }
# Try to get our IP from the system and fallback to the Internet. if [[ -e /etc/openvpn/server/server.conf ]]; then
# I do this to make the script compatible with NATed servers (lowendspirit.com)
# and to avoid getting an IPv6.
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
if [[ "$IP" = "" ]]; then
IP=$(wget -4qO- "http://whatismyip.akamai.com/")
fi
if [[ -e /etc/openvpn/server.conf ]]; then
while : while :
do do
clear clear
echo "Looks like OpenVPN is already installed" echo "Looks like OpenVPN is already installed."
echo "" echo
echo "What do you want to do?" echo "What do you want to do?"
echo " 1) Add a new user" echo " 1) Add a new user"
echo " 2) Revoke an existing user" echo " 2) Revoke an existing user"
echo " 3) Remove OpenVPN" echo " 3) Remove OpenVPN"
echo " 4) Exit" echo " 4) Exit"
read -p "Select an option [1-4]: " option read -p "Select an option: " option
case $option in until [[ "$option" =~ ^[1-4]$ ]]; do
echo "$option: invalid selection."
read -p "Select an option: " option
done
case "$option" in
1) 1)
echo "" echo
echo "Tell me a name for the client certificate" echo "Tell me a name for the client certificate."
echo "Please, use one word only, no special characters" read -p "Client name: " unsanitized_client
read -p "Client name: " -e -i client CLIENT client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
cd /etc/openvpn/easy-rsa/ while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
./easyrsa build-client-full $CLIENT nopass echo "$client: invalid client name."
read -p "Client name: " unsanitized_client
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
done
cd /etc/openvpn/server/easy-rsa/
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" new_client "$client"
echo "" echo
echo "Client $CLIENT added, configuration is available at" ~/"$CLIENT.ovpn" echo "Client $client added, configuration is available at:" ~/"$client.ovpn"
exit exit
;; ;;
2) 2)
# This option could be documented a bit better and maybe even be simplified # This option could be documented a bit better and maybe even be simplified
# ...but what can I say, I want some sleep too # ...but what can I say, I want some sleep too
NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
if [[ "$NUMBEROFCLIENTS" = '0' ]]; then if [[ "$number_of_clients" = 0 ]]; then
echo "" echo
echo "You have no existing clients!" echo "You have no existing clients!"
exit 6 exit
fi fi
echo "" echo
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke:"
tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
if [[ "$NUMBEROFCLIENTS" = '1' ]]; then read -p "Select one client: " client_number
read -p "Select one client [1]: " CLIENTNUMBER until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
else echo "$client_number: invalid selection."
read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER read -p "Select one client: " client_number
fi done
CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
cd /etc/openvpn/easy-rsa/ echo
./easyrsa --batch revoke $CLIENT read -p "Do you really want to revoke access for client $client? [y/N]: " revoke
until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
echo "$revoke: invalid selection."
read -p "Do you really want to revoke access for client $client? [y/N]: " revoke
done
if [[ "$revoke" =~ ^[yY]$ ]]; then
cd /etc/openvpn/server/easy-rsa/
./easyrsa --batch revoke "$client"
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -rf pki/reqs/$CLIENT.req rm -f pki/reqs/"$client".req
rm -rf pki/private/$CLIENT.key rm -f pki/private/"$client".key
rm -rf pki/issued/$CLIENT.crt rm -f pki/issued/"$client".crt
rm -rf /etc/openvpn/crl.pem rm -f /etc/openvpn/server/crl.pem
userdel $CLIENT cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
rm -rf /etc/openvpn/google-authenticator/$CLIENT
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody # CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem chown nobody:"$group_name" /etc/openvpn/server/crl.pem
echo "" echo
echo "Certificate for client $CLIENT revoked" echo "Certificate for client $client revoked!"
else
echo
echo "Certificate revocation for client $client aborted!"
fi
exit exit
;; ;;
3) 3)
echo "" echo
read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE read -p "Do you really want to remove OpenVPN? [y/N]: " remove
if [[ "$REMOVE" = 'y' ]]; then until [[ "$remove" =~ ^[yYnN]*$ ]]; do
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) echo "$remove: invalid selection."
PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2) read -p "Do you really want to remove OpenVPN? [y/N]: " remove
done
if [[ "$remove" =~ ^[yY]$ ]]; then
port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
if pgrep firewalld; then if pgrep firewalld; then
IP=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24 -j SNAT --to ' | cut -d " " -f 10) ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24 -j SNAT --to ' | cut -d " " -f 10)
# Using both permanent and not permanent rules to avoid a firewalld reload. # Using both permanent and not permanent rules to avoid a firewalld reload.
firewall-cmd --zone=public --remove-port=$PORT/$PROTOCOL firewall-cmd --remove-port="$port"/"$protocol"
firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
firewall-cmd --permanent --zone=public --remove-port=$PORT/$PROTOCOL firewall-cmd --permanent --remove-port="$port"/"$protocol"
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
else else
IP=$(grep 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to ' $RCLOCAL | cut -d " " -f 14) systemctl disable --now openvpn-iptables.service
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP rm -f /etc/systemd/system/openvpn-iptables.service
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 ! -d 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
if iptables -L -n | grep -qE '^ACCEPT'; then
iptables -D INPUT -p $PROTOCOL --dport $PORT -j ACCEPT
iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
sed -i "/iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT/d" $RCLOCAL
sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
fi fi
if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
semanage port -d -t openvpn_port_t -p "$protocol" "$port"
fi fi
if hash sestatus 2>/dev/null; then systemctl disable --now openvpn-server@server.service
if sestatus | grep "Current mode" | grep -qs "enforcing"; then rm -rf /etc/openvpn/server
if [[ "$PORT" != '1194' || "$PROTOCOL" = 'tcp' ]]; then rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
semanage port -d -t openvpn_port_t -p $PROTOCOL $PORT rm -f /etc/sysctl.d/30-openvpn-forward.conf
if [[ "$os" = "debian" ]]; then
apt-get remove --purge -y openvpn
else
yum remove openvpn -y
fi fi
fi echo
fi
apt-get remove --purge -y openvpn libpam-google-authenticator
rm -rf /etc/openvpn
echo ""
echo "OpenVPN removed!" echo "OpenVPN removed!"
else else
echo "" echo
echo "Removal aborted!" echo "Removal aborted!"
fi fi
exit exit
@ -165,210 +207,317 @@ if [[ -e /etc/openvpn/server.conf ]]; then
done done
else else
clear clear
echo 'Welcome to this quick OpenVPN "road warrior" installer' echo "Welcome to this OpenVPN "road warrior" installer!"
echo "" echo
# OpenVPN setup and first user creation echo "I need to ask you a few questions before starting setup."
echo "I need to ask you a few questions before starting the setup" echo "You can use the default options and just press enter if you are ok with them."
echo "You can leave the default options and just press enter if you are ok with them" # If system has a single IPv4, it is selected automatically. Else, ask the user
echo "" if [[ $(ip addr | grep inet | grep -v inet6 | grep -vEc '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}') -eq 1 ]]; then
echo "First I need to know the IPv4 address of the network interface you want OpenVPN" ip=$(ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
echo "listening to." else
read -p "IP address: " -e -i $IP IP number_of_ips=$(ip addr | grep inet | grep -v inet6 | grep -vEc '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
echo "" echo
echo "What IPv4 address should the OpenVPN server bind to?"
ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | nl -s ') '
read -p "IPv4 address [1]: " ip_number
until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ips" ]]; do
echo "$ip_number: invalid selection."
read -p "IPv4 address [1]: " ip_number
done
[[ -z "$ip_number" ]] && ip_number="1"
ip=$(ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed -n "$ip_number"p)
fi
# If $IP is a private IP address, the server must be behind NAT
if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
echo
echo "This server is behind NAT. What is the public IPv4 address or hostname?"
get_public_ip=$(wget -4qO- "http://whatismyip.akamai.com/" || curl -4Ls "http://whatismyip.akamai.com/")
read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
[ -z "$public_ip" ] && public_ip="$get_public_ip"
fi
echo
echo "Which protocol do you want for OpenVPN connections?" echo "Which protocol do you want for OpenVPN connections?"
echo " 1) UDP (recommended)" echo " 1) UDP (recommended)"
echo " 2) TCP" echo " 2) TCP"
read -p "Protocol [1-2]: " -e -i 1 PROTOCOL read -p "Protocol [1]: " protocol
case $PROTOCOL in until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
1) echo "$protocol: invalid selection."
PROTOCOL=udp read -p "Protocol [1]: " protocol
done
case "$protocol" in
1|"")
protocol=udp
;; ;;
2) 2)
PROTOCOL=tcp protocol=tcp
;; ;;
esac esac
echo "" echo
echo "What port do you want OpenVPN listening to?" echo "What port do you want OpenVPN listening to?"
read -p "Port: " -e -i 1194 PORT read -p "Port [1194]: " port
echo "" until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
echo "$port: invalid selection."
read -p "Port [1194]: " port
done
[[ -z "$port" ]] && port="1194"
echo
echo "Which DNS do you want to use with the VPN?" echo "Which DNS do you want to use with the VPN?"
echo " 1) Current system resolvers" echo " 1) Current system resolvers"
echo " 2) 1.1.1.1" echo " 2) 1.1.1.1"
echo " 3) Google" echo " 3) Google"
echo " 4) OpenDNS" echo " 4) OpenDNS"
echo " 5) Verisign" echo " 5) Verisign"
read -p "DNS [1-5]: " -e -i 1 DNS read -p "DNS [1]: " dns
echo "" until [[ -z "$dns" || "$dns" =~ ^[1-5]$ ]]; do
echo "Finally, tell me your name for the client certificate" echo "$dns: invalid selection."
echo "Please, use one word only, no special characters" read -p "DNS [1]: " dns
read -p "Client name: " -e -i client CLIENT done
echo "" echo
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Finally, tell me a name for the client certificate."
read -p "Client name [client]: " unsanitized_client
# Allow a limited set of characters to avoid conflicts
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
[[ -z "$client" ]] && client="client"
echo
echo "Okay, that was all I needed. We are ready to set up your OpenVPN server now."
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."
# If running inside a container, disable LimitNPROC to prevent conflicts
if systemd-detect-virt -cq; then
mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
echo "[Service]
LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
fi
if [[ "$os" = "debian" ]]; then
apt-get update apt-get update
apt-get install openvpn iptables openssl ca-certificates -y apt-get install openvpn iptables openssl ca-certificates -y
apt-get install libqrencode3 libpam-google-authenticator -y apt-get install libqrencode3 libpam-google-authenticator -y
# An old version of easy-rsa was available by default in some openvpn packages # Google Authenticator configuration
if [[ -d /etc/openvpn/easy-rsa/ ]]; then
rm -rf /etc/openvpn/easy-rsa/
fi
# Get easy-rsa
wget -O ~/EasyRSA-3.0.4.tgz "https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz"
tar xzf ~/EasyRSA-3.0.4.tgz -C ~/
mv ~/EasyRSA-3.0.4/ /etc/openvpn/
mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/
chown -R root:root /etc/openvpn/easy-rsa/
rm -rf ~/EasyRSA-3.0.4.tgz
cd /etc/openvpn/easy-rsa/
# Create the PKI, set up the CA, the DH params and the server + client certificates
./easyrsa init-pki
./easyrsa --batch build-ca nopass
./easyrsa gen-dh
./easyrsa build-server-full server nopass
./easyrsa build-client-full $CLIENT nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem
# Generate key for tls-auth
openvpn --genkey --secret /etc/openvpn/ta.key
# Create Google Authenticator
addgroup gauth addgroup gauth
useradd -g gauth gauth useradd -g gauth gauth
elif [[ "$os" == "amazon-linux" ]]; then
amazon-linux-extras install epel -y
yum install openvpn iptables openssl ca-certificates tar -y
yum install google-authenticator -y
groupadd gauth
adduser -g gauth gauth
else
# Else, the distro is CentOS
yum install epel-release -y
yum install openvpn iptables openssl ca-certificates tar -y
yum install google-authenticator -y
groupadd gauth
adduser -g gauth gauth
fi
mkdir /etc/openvpn/google-authenticator mkdir /etc/openvpn/google-authenticator
chown gauth:gauth /etc/openvpn/google-authenticator chown gauth:gauth /etc/openvpn/google-authenticator
chmod 0700 /etc/openvpn/google-authenticator chmod 0700 /etc/openvpn/google-authenticator
# Get easy-rsa
easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz'
wget -O ~/easyrsa.tgz "$easy_rsa_url" 2>/dev/null || curl -Lo ~/easyrsa.tgz "$easy_rsa_url"
tar xzf ~/easyrsa.tgz -C ~/
mv ~/EasyRSA-3.0.5/ /etc/openvpn/server/
mv /etc/openvpn/server/EasyRSA-3.0.5/ /etc/openvpn/server/easy-rsa/
chown -R root:root /etc/openvpn/server/easy-rsa/
rm -f ~/easyrsa.tgz
cd /etc/openvpn/server/easy-rsa/
# Create the PKI, set up the CA and the server and client certificates
./easyrsa init-pki
./easyrsa --batch build-ca nopass
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:"$group_name" /etc/openvpn/server/crl.pem
# Generate key for tls-crypt
openvpn --genkey --secret /etc/openvpn/server/tc.key
# Create the DH parameters file using the predefined ffdhe2048 group
echo '-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
-----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
# Generate server.conf # Generate server.conf
echo "port $PORT echo "local $ip
proto $PROTOCOL port $port
proto $protocol
dev tun dev tun
sndbuf 0
rcvbuf 0
ca ca.crt ca ca.crt
cert server.crt cert server.crt
key server.key key server.key
dh dh.pem dh dh.pem
auth SHA512 auth SHA512
tls-auth ta.key 0 tls-crypt tc.key
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" > /etc/openvpn/server/server.conf
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
# DNS # DNS
case $DNS in case "$dns" in
1) 1|"")
# Locate the proper resolv.conf # Locate the proper resolv.conf
# Needed for systems running systemd-resolved # Needed for systems running systemd-resolved
if grep -q "127.0.0.53" "/etc/resolv.conf"; then if grep -q "127.0.0.53" "/etc/resolv.conf"; then
RESOLVCONF='/run/systemd/resolve/resolv.conf' resolv_conf="/run/systemd/resolve/resolv.conf"
else else
RESOLVCONF='/etc/resolv.conf' resolv_conf="/etc/resolv.conf"
fi fi
# Obtain the resolvers from resolv.conf and use them for OpenVPN # Obtain the resolvers from resolv.conf and use them for OpenVPN
grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do grep -v '#' "$resolv_conf" | grep nameserver | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do
echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf
done done
;; ;;
2) 2)
echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
;; ;;
3) 3)
echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
;; ;;
4) 4)
echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
;; ;;
5) 5)
echo 'push "dhcp-option DNS 64.6.64.6"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 64.6.64.6"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 64.6.65.6"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 64.6.65.6"' >> /etc/openvpn/server/server.conf
;; ;;
esac esac
echo "keepalive 10 120 echo "keepalive 10 120
cipher AES-256-CBC cipher AES-256-CBC
comp-lzo user root
user nobody group root
group $GROUPNAME
persist-key persist-key
persist-tun persist-tun
status openvpn-status.log status openvpn-status.log
verb 3 verb 3
crl-verify crl.pem crl-verify crl.pem" >> /etc/openvpn/server/server.conf
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn" >> /etc/openvpn/server.conf if [[ "$protocol" = "udp" ]]; then
echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
fi
# Authenticator config
mkdir -p /usr/lib/openvpn/ mkdir -p /usr/lib/openvpn/
if [[ "$os" = "debian" ]]; then
echo "plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn" >> /etc/openvpn/server/server.conf
ln -s /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib/openvpn/openvpn-plugin-auth-pam.so ln -s /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib/openvpn/openvpn-plugin-auth-pam.so
echo "auth required /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn echo "auth required /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn
# Enable net.ipv4.ip_forward for the system else
sed -i '/\<net.ipv4.ip_forward\>/c\net.ipv4.ip_forward=1' /etc/sysctl.conf # Else, the distro is CentOS or Amazon Linux
if ! grep -q "\<net.ipv4.ip_forward\>" /etc/sysctl.conf; then yum install perl-Authen-PAM -y
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf echo "auth-user-pass-verify auth-pam.pl via-file
script-security 2" >> /etc/openvpn/server/server.conf
echo "#!/usr/bin/perl -t
use Authen::PAM;
use POSIX;
sub my_conv_func {
my @res;
while ( @_ ) {
my \$code = shift;
my \$msg = shift;
my \$ans = \"\";
\$ans = \$password if \$msg =~ /[Pp]assword/;
push @res, (PAM_SUCCESS(),\$ans);
}
push @res, PAM_SUCCESS();
return @res;
}
\$service = \"openvpn\";
if (\$ARG = shift @ARGV) {
if (!open (UPFILE, \"<\$ARG\")) {
print \"Could not open username/password file: \$ARG\n\";
exit 1;
}
} else {
print \"No username/password file specified on command line\n\";
exit 1;
}
\$username = <UPFILE>;
\$password = <UPFILE>;
if (!\$username || !\$password) {
print \"Username/password not found in file: \$ARG\n\";
exit 1;
}
chomp \$username;
chomp \$password;
close (UPFILE);
if (!ref(\$pamh = new Authen::PAM(\$service, \$username, \&my_conv_func))) {
print \"Authen::PAM init failed\n\";
exit 1;
}
\$res = \$pamh->pam_authenticate;
if (\$res == PAM_SUCCESS()) {
exit 0;
} else {
print \"Auth '\$username' failed, PAM said: \", \$pamh->pam_strerror($res), \"\n\";
exit 1;
}" > /etc/openvpn/server/auth-pam.pl
chown nobody. /etc/openvpn/server/auth-pam.pl
chmod 755 /etc/openvpn/server/auth-pam.pl
echo "auth required /usr/lib64/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn
fi fi
# Avoid an unneeded reboot # Enable net.ipv4.ip_forward for the system
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf
# Enable without waiting for a reboot or service restart
echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_forward
if pgrep firewalld; then if pgrep firewalld; then
# Using both permanent and not permanent rules to avoid a firewalld # Using both permanent and not permanent rules to avoid a firewalld
# reload. # reload.
# We don't use --add-service=openvpn because that would only work with # We don't use --add-service=openvpn because that would only work with
# the default port and protocol. # the default port and protocol.
firewall-cmd --zone=public --add-port=$PORT/$PROTOCOL firewall-cmd --add-port="$port"/"$protocol"
firewall-cmd --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
firewall-cmd --permanent --zone=public --add-port=$PORT/$PROTOCOL firewall-cmd --permanent --add-port="$port"/"$protocol"
firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
# Set NAT for the VPN subnet # Set NAT for the VPN subnet
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
else else
# Needed to use rc.local with some systemd distros # Create a service to set up persistent iptables rules
if [[ ! -e $RCLOCAL ]]; then echo "[Unit]
echo '#!/bin/sh -e Before=network.target
exit 0' > $RCLOCAL [Service]
Type=oneshot
ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
ExecStart=/sbin/iptables -I INPUT -p $protocol --dport $port -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
ExecStop=/sbin/iptables -D INPUT -p $protocol --dport $port -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target" > /etc/systemd/system/openvpn-iptables.service
systemctl enable --now openvpn-iptables.service
fi fi
chmod +x $RCLOCAL # If SELinux is enabled and a custom port was selected, we need this
# Set NAT for the VPN subnet if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP # Install semanage if not already present
sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL if ! hash semanage 2>/dev/null; then
if iptables -L -n | grep -qE '^(REJECT|DROP)'; then if grep -qs "CentOS Linux release 7" "/etc/centos-release"; then
# If iptables has at least one REJECT rule, we asume this is needed. yum install policycoreutils-python -y
# Not the best approach but I can't think of other and this shouldn't
# cause problems.
iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
sed -i "1 a\iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT" $RCLOCAL
sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
fi
fi
# And finally, restart OpenVPN
# Little hack to check for systemd
if pgrep systemd-journal; then
systemctl restart openvpn@server.service
else else
/etc/init.d/openvpn restart yum install policycoreutils-python-utils -y
fi fi
# Try to detect a NATed connection and ask about it to potential LowEndSpirit users
EXTERNALIP=$(wget -4qO- "http://whatismyip.akamai.com/")
if [[ "$IP" != "$EXTERNALIP" ]]; then
echo ""
echo "Looks like your server could be behind a NAT!"
echo ""
echo "If your server is behind a NAT, I need to know the public IP or hostname"
echo "If that's not the case, just ignore this and leave the next field blank"
read -p "Public IP: " -e PUBLICIP
if [[ "$PUBLICIP" != "" ]]; then
IP=$PUBLICIP
fi fi
semanage port -a -t openvpn_port_t -p "$protocol" "$port"
fi
# If the server is behind a NAT, use the correct IP address
if [[ "$public_ip" != "" ]]; then
ip="$public_ip"
fi fi
# client-common.txt is created so we have a template to add further users later # client-common.txt is created so we have a template to add further users later
echo "client echo "client
dev tun dev tun
proto $PROTOCOL proto $protocol
sndbuf 0 remote $ip $port
rcvbuf 0
remote $IP $PORT
resolv-retry infinite resolv-retry infinite
nobind nobind
persist-key persist-key
@ -376,16 +525,15 @@ persist-tun
remote-cert-tls server remote-cert-tls server
auth SHA512 auth SHA512
cipher AES-256-CBC cipher AES-256-CBC
comp-lzo
key-direction 1
verb 3 verb 3
ns-cert-type server auth-user-pass" > /etc/openvpn/server/client-common.txt
auth-user-pass" > /etc/openvpn/client-common.txt # Enable and start the OpenVPN service
systemctl enable --now openvpn-server@server.service
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" new_client "$client"
echo "" echo
echo "Finished!" echo "Finished!"
echo "" echo
echo "Your client configuration is available at" ~/"$CLIENT.ovpn" echo "Your client configuration is available at:" ~/"$client.ovpn"
echo "If you want to add more clients, you simply need to run this script again!" echo "If you want to add more clients, just run this script again!"
fi fi