Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

multi os support

Browse Source
This commit is contained in:
Gizem Gur 2020-03-26 12:06:05 +03:00
parent 582a062f2f
commit 11fc8bbf89
1 changed files with 395 additions and 247 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

642
openvpn-install.sh
View File

@ -1,161 +1,203 @@
#!/bin/bash #!/bin/bash
# OpenVPN road warrior installer for Debian and Ubuntu
if grep -qs "14.04" /etc/os-release; then
echo "Ubuntu 14.04 is too old and not supported"
exit
fi
if grep -qs "jessie" /etc/os-release; then
echo "Debian 8 is too old and not supported"
exit
fi
if grep -qs "CentOS release 6" /etc/redhat-release; then
echo "CentOS 6 is too old and not supported"
exit
fi
if grep -qs "Ubuntu 16.04" /etc/os-release; then
echo 'Ubuntu 16.04 is no longer supported in the current version of openvpn-install
Use an older version if Ubuntu 16.04 support is needed: https://git.io/vpn1604'
exit
fi
# Detect Debian users running the script with "sh" instead of bash # Detect Debian users running the script with "sh" instead of bash
if readlink /proc/$$/exe | grep -qs "dash"; then if readlink /proc/$$/exe | grep -q "dash"; then
echo "This script needs to be run with bash, not sh" echo "This script needs to be run with bash, not sh"
exit 1 exit
fi fi
if [[ "$EUID" -ne 0 ]]; then if [[ "$EUID" -ne 0 ]]; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit 2 exit
fi fi
if [[ ! -e /dev/net/tun ]]; then if [[ ! -e /dev/net/tun ]]; then
echo "The TUN device is not available echo "The TUN device is not available
You need to enable TUN before running this script" You need to enable TUN before running this script"
exit 3 exit
fi
if ! iptables -t nat -nL &>/dev/null; then
echo "Unable to initialize the iptables/netfilter NAT table, setup can't continue.
Make sure that your system has iptables/netfilter available.
If using OpenVZ, ask your provider to enable full netfilter support."
exit
fi fi
if [[ -e /etc/debian_version ]]; then if [[ -e /etc/debian_version ]]; then
OS=debian os="debian"
GROUPNAME=nogroup group_name="nogroup"
RCLOCAL='/etc/rc.local' elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
os="centos"
group_name="nobody"
elif grep -qs "Amazon Linux" /etc/system-release; then
os="amazon-linux"
group_name="nobody"
else else
echo "Looks like you aren't running this installer on Debian or Ubuntu" echo "Looks like you aren't running this installer on Debian, Ubuntu, CentOS or Amazon Linux"
exit 5 exit
fi fi
newclient () { new_client () {
# Generates the custom client.ovpn # Generates the custom client.ovpn
cp /etc/openvpn/client-common.txt ~/$1.ovpn {
echo "<ca>" >> ~/$1.ovpn cat /etc/openvpn/server/client-common.txt
cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn echo "<ca>"
echo "</ca>" >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/ca.crt
echo "<cert>" >> ~/$1.ovpn echo "</ca>"
cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn echo "<cert>"
echo "</cert>" >> ~/$1.ovpn sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$1".crt
echo "<key>" >> ~/$1.ovpn echo "</cert>"
cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn echo "<key>"
echo "</key>" >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/private/"$1".key
echo "<tls-auth>" >> ~/$1.ovpn echo "</key>"
cat /etc/openvpn/ta.key >> ~/$1.ovpn echo "<tls-crypt>"
echo "</tls-auth>" >> ~/$1.ovpn sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
useradd $1 echo "</tls-crypt>"
google-authenticator -t -d -r3 -R30 -f -l $1-vpn -s /etc/openvpn/google-authenticator/$1 } > ~/"$1".ovpn
chown gauth. /etc/openvpn/google-authenticator/$1 useradd $1
google-authenticator -t -d -r3 -R30 -f -l $1-vpn -s /etc/openvpn/google-authenticator/$1
chown gauth. /etc/openvpn/google-authenticator/$1
} }
# Try to get our IP from the system and fallback to the Internet. if [[ -e /etc/openvpn/server/server.conf ]]; then
# I do this to make the script compatible with NATed servers (lowendspirit.com)
# and to avoid getting an IPv6.
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
if [[ "$IP" = "" ]]; then
IP=$(wget -4qO- "http://whatismyip.akamai.com/")
fi
if [[ -e /etc/openvpn/server.conf ]]; then
while : while :
do do
clear clear
echo "Looks like OpenVPN is already installed" echo "Looks like OpenVPN is already installed."
echo "" echo
echo "What do you want to do?" echo "What do you want to do?"
echo " 1) Add a new user" echo " 1) Add a new user"
echo " 2) Revoke an existing user" echo " 2) Revoke an existing user"
echo " 3) Remove OpenVPN" echo " 3) Remove OpenVPN"
echo " 4) Exit" echo " 4) Exit"
read -p "Select an option [1-4]: " option read -p "Select an option: " option
case $option in until [[ "$option" =~ ^[1-4]$ ]]; do
echo "$option: invalid selection."
read -p "Select an option: " option
done
case "$option" in
1) 1)
echo "" echo
echo "Tell me a name for the client certificate" echo "Tell me a name for the client certificate."
echo "Please, use one word only, no special characters" read -p "Client name: " unsanitized_client
read -p "Client name: " -e -i client CLIENT client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
cd /etc/openvpn/easy-rsa/ while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
./easyrsa build-client-full $CLIENT nopass echo "$client: invalid client name."
read -p "Client name: " unsanitized_client
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
done
cd /etc/openvpn/server/easy-rsa/
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" new_client "$client"
echo "" echo
echo "Client $CLIENT added, configuration is available at" ~/"$CLIENT.ovpn" echo "Client $client added, configuration is available at:" ~/"$client.ovpn"
exit exit
;; ;;
2) 2)
# This option could be documented a bit better and maybe even be simplified # This option could be documented a bit better and maybe even be simplified
# ...but what can I say, I want some sleep too # ...but what can I say, I want some sleep too
NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
if [[ "$NUMBEROFCLIENTS" = '0' ]]; then if [[ "$number_of_clients" = 0 ]]; then
echo "" echo
echo "You have no existing clients!" echo "You have no existing clients!"
exit 6 exit
fi fi
echo "" echo
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke:"
tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
if [[ "$NUMBEROFCLIENTS" = '1' ]]; then read -p "Select one client: " client_number
read -p "Select one client [1]: " CLIENTNUMBER until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
echo "$client_number: invalid selection."
read -p "Select one client: " client_number
done
client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
echo
read -p "Do you really want to revoke access for client $client? [y/N]: " revoke
until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
echo "$revoke: invalid selection."
read -p "Do you really want to revoke access for client $client? [y/N]: " revoke
done
if [[ "$revoke" =~ ^[yY]$ ]]; then
cd /etc/openvpn/server/easy-rsa/
./easyrsa --batch revoke "$client"
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -f pki/reqs/"$client".req
rm -f pki/private/"$client".key
rm -f pki/issued/"$client".crt
rm -f /etc/openvpn/server/crl.pem
cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:"$group_name" /etc/openvpn/server/crl.pem
echo
echo "Certificate for client $client revoked!"
else else
read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER echo
echo "Certificate revocation for client $client aborted!"
fi fi
CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
cd /etc/openvpn/easy-rsa/
./easyrsa --batch revoke $CLIENT
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -rf pki/reqs/$CLIENT.req
rm -rf pki/private/$CLIENT.key
rm -rf pki/issued/$CLIENT.crt
rm -rf /etc/openvpn/crl.pem
userdel $CLIENT
rm -rf /etc/openvpn/google-authenticator/$CLIENT
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem
echo ""
echo "Certificate for client $CLIENT revoked"
exit exit
;; ;;
3) 3)
echo "" echo
read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE read -p "Do you really want to remove OpenVPN? [y/N]: " remove
if [[ "$REMOVE" = 'y' ]]; then until [[ "$remove" =~ ^[yYnN]*$ ]]; do
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) echo "$remove: invalid selection."
PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2) read -p "Do you really want to remove OpenVPN? [y/N]: " remove
done
if [[ "$remove" =~ ^[yY]$ ]]; then
port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
if pgrep firewalld; then if pgrep firewalld; then
IP=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24 -j SNAT --to ' | cut -d " " -f 10) ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24 -j SNAT --to ' | cut -d " " -f 10)
# Using both permanent and not permanent rules to avoid a firewalld reload. # Using both permanent and not permanent rules to avoid a firewalld reload.
firewall-cmd --zone=public --remove-port=$PORT/$PROTOCOL firewall-cmd --remove-port="$port"/"$protocol"
firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
firewall-cmd --permanent --zone=public --remove-port=$PORT/$PROTOCOL firewall-cmd --permanent --remove-port="$port"/"$protocol"
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
else else
IP=$(grep 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to ' $RCLOCAL | cut -d " " -f 14) systemctl disable --now openvpn-iptables.service
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP rm -f /etc/systemd/system/openvpn-iptables.service
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 ! -d 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
if iptables -L -n | grep -qE '^ACCEPT'; then
iptables -D INPUT -p $PROTOCOL --dport $PORT -j ACCEPT
iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
sed -i "/iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT/d" $RCLOCAL
sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
fi
fi fi
if hash sestatus 2>/dev/null; then if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
if sestatus | grep "Current mode" | grep -qs "enforcing"; then semanage port -d -t openvpn_port_t -p "$protocol" "$port"
if [[ "$PORT" != '1194' || "$PROTOCOL" = 'tcp' ]]; then
semanage port -d -t openvpn_port_t -p $PROTOCOL $PORT
fi
fi
fi fi
apt-get remove --purge -y openvpn libpam-google-authenticator systemctl disable --now openvpn-server@server.service
rm -rf /etc/openvpn rm -rf /etc/openvpn/server
echo "" rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
rm -f /etc/sysctl.d/30-openvpn-forward.conf
if [[ "$os" = "debian" ]]; then
apt-get remove --purge -y openvpn
else
yum remove openvpn -y
fi
echo
echo "OpenVPN removed!" echo "OpenVPN removed!"
else else
echo "" echo
echo "Removal aborted!" echo "Removal aborted!"
fi fi
exit exit
@ -165,210 +207,317 @@ if [[ -e /etc/openvpn/server.conf ]]; then
done done
else else
clear clear
echo 'Welcome to this quick OpenVPN "road warrior" installer' echo "Welcome to this OpenVPN "road warrior" installer!"
echo "" echo
# OpenVPN setup and first user creation echo "I need to ask you a few questions before starting setup."
echo "I need to ask you a few questions before starting the setup" echo "You can use the default options and just press enter if you are ok with them."
echo "You can leave the default options and just press enter if you are ok with them" # If system has a single IPv4, it is selected automatically. Else, ask the user
echo "" if [[ $(ip addr | grep inet | grep -v inet6 | grep -vEc '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}') -eq 1 ]]; then
echo "First I need to know the IPv4 address of the network interface you want OpenVPN" ip=$(ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
echo "listening to." else
read -p "IP address: " -e -i $IP IP number_of_ips=$(ip addr | grep inet | grep -v inet6 | grep -vEc '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
echo "" echo
echo "What IPv4 address should the OpenVPN server bind to?"
ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | nl -s ') '
read -p "IPv4 address [1]: " ip_number
until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ips" ]]; do
echo "$ip_number: invalid selection."
read -p "IPv4 address [1]: " ip_number
done
[[ -z "$ip_number" ]] && ip_number="1"
ip=$(ip addr | grep inet | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sed -n "$ip_number"p)
fi
# If $IP is a private IP address, the server must be behind NAT
if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
echo
echo "This server is behind NAT. What is the public IPv4 address or hostname?"
get_public_ip=$(wget -4qO- "http://whatismyip.akamai.com/" || curl -4Ls "http://whatismyip.akamai.com/")
read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
[ -z "$public_ip" ] && public_ip="$get_public_ip"
fi
echo
echo "Which protocol do you want for OpenVPN connections?" echo "Which protocol do you want for OpenVPN connections?"
echo " 1) UDP (recommended)" echo " 1) UDP (recommended)"
echo " 2) TCP" echo " 2) TCP"
read -p "Protocol [1-2]: " -e -i 1 PROTOCOL read -p "Protocol [1]: " protocol
case $PROTOCOL in until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
1) echo "$protocol: invalid selection."
PROTOCOL=udp read -p "Protocol [1]: " protocol
done
case "$protocol" in
1|"")
protocol=udp
;; ;;
2) 2)
PROTOCOL=tcp protocol=tcp
;; ;;
esac esac
echo "" echo
echo "What port do you want OpenVPN listening to?" echo "What port do you want OpenVPN listening to?"
read -p "Port: " -e -i 1194 PORT read -p "Port [1194]: " port
echo "" until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
echo "$port: invalid selection."
read -p "Port [1194]: " port
done
[[ -z "$port" ]] && port="1194"
echo
echo "Which DNS do you want to use with the VPN?" echo "Which DNS do you want to use with the VPN?"
echo " 1) Current system resolvers" echo " 1) Current system resolvers"
echo " 2) 1.1.1.1" echo " 2) 1.1.1.1"
echo " 3) Google" echo " 3) Google"
echo " 4) OpenDNS" echo " 4) OpenDNS"
echo " 5) Verisign" echo " 5) Verisign"
read -p "DNS [1-5]: " -e -i 1 DNS read -p "DNS [1]: " dns
echo "" until [[ -z "$dns" || "$dns" =~ ^[1-5]$ ]]; do
echo "Finally, tell me your name for the client certificate" echo "$dns: invalid selection."
echo "Please, use one word only, no special characters" read -p "DNS [1]: " dns
read -p "Client name: " -e -i client CLIENT done
echo "" echo
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Finally, tell me a name for the client certificate."
read -p "Client name [client]: " unsanitized_client
# Allow a limited set of characters to avoid conflicts
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
[[ -z "$client" ]] && client="client"
echo
echo "Okay, that was all I needed. We are ready to set up your OpenVPN server now."
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."
apt-get update # If running inside a container, disable LimitNPROC to prevent conflicts
apt-get install openvpn iptables openssl ca-certificates -y if systemd-detect-virt -cq; then
apt-get install libqrencode3 libpam-google-authenticator -y mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
# An old version of easy-rsa was available by default in some openvpn packages echo "[Service]
if [[ -d /etc/openvpn/easy-rsa/ ]]; then LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
rm -rf /etc/openvpn/easy-rsa/
fi fi
if [[ "$os" = "debian" ]]; then
apt-get update
apt-get install openvpn iptables openssl ca-certificates -y
apt-get install libqrencode3 libpam-google-authenticator -y
# Google Authenticator configuration
addgroup gauth
useradd -g gauth gauth
elif [[ "$os" == "amazon-linux" ]]; then
amazon-linux-extras install epel -y
yum install openvpn iptables openssl ca-certificates tar -y
yum install google-authenticator -y
groupadd gauth
adduser -g gauth gauth
else
# Else, the distro is CentOS
yum install epel-release -y
yum install openvpn iptables openssl ca-certificates tar -y
yum install google-authenticator -y
groupadd gauth
adduser -g gauth gauth
fi
mkdir /etc/openvpn/google-authenticator
chown gauth:gauth /etc/openvpn/google-authenticator
chmod 0700 /etc/openvpn/google-authenticator
# Get easy-rsa # Get easy-rsa
wget -O ~/EasyRSA-3.0.4.tgz "https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz" easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz'
tar xzf ~/EasyRSA-3.0.4.tgz -C ~/ wget -O ~/easyrsa.tgz "$easy_rsa_url" 2>/dev/null || curl -Lo ~/easyrsa.tgz "$easy_rsa_url"
mv ~/EasyRSA-3.0.4/ /etc/openvpn/ tar xzf ~/easyrsa.tgz -C ~/
mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/ mv ~/EasyRSA-3.0.5/ /etc/openvpn/server/
chown -R root:root /etc/openvpn/easy-rsa/ mv /etc/openvpn/server/EasyRSA-3.0.5/ /etc/openvpn/server/easy-rsa/
rm -rf ~/EasyRSA-3.0.4.tgz chown -R root:root /etc/openvpn/server/easy-rsa/
cd /etc/openvpn/easy-rsa/ rm -f ~/easyrsa.tgz
# Create the PKI, set up the CA, the DH params and the server + client certificates cd /etc/openvpn/server/easy-rsa/
# Create the PKI, set up the CA and the server and client certificates
./easyrsa init-pki ./easyrsa init-pki
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
./easyrsa gen-dh EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
./easyrsa build-server-full server nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
./easyrsa build-client-full $CLIENT nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Move the stuff we need # Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
# CRL is read with each client connection, when OpenVPN is dropped to nobody # CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem chown nobody:"$group_name" /etc/openvpn/server/crl.pem
# Generate key for tls-auth # Generate key for tls-crypt
openvpn --genkey --secret /etc/openvpn/ta.key openvpn --genkey --secret /etc/openvpn/server/tc.key
# Create Google Authenticator # Create the DH parameters file using the predefined ffdhe2048 group
addgroup gauth echo '-----BEGIN DH PARAMETERS-----
useradd -g gauth gauth MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
mkdir /etc/openvpn/google-authenticator +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
chown gauth:gauth /etc/openvpn/google-authenticator 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
chmod 0700 /etc/openvpn/google-authenticator YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
-----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
# Generate server.conf # Generate server.conf
echo "port $PORT echo "local $ip
proto $PROTOCOL port $port
proto $protocol
dev tun dev tun
sndbuf 0
rcvbuf 0
ca ca.crt ca ca.crt
cert server.crt cert server.crt
key server.key key server.key
dh dh.pem dh dh.pem
auth SHA512 auth SHA512
tls-auth ta.key 0 tls-crypt tc.key
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" > /etc/openvpn/server/server.conf
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
# DNS # DNS
case $DNS in case "$dns" in
1) 1|"")
# Locate the proper resolv.conf # Locate the proper resolv.conf
# Needed for systems running systemd-resolved # Needed for systems running systemd-resolved
if grep -q "127.0.0.53" "/etc/resolv.conf"; then if grep -q "127.0.0.53" "/etc/resolv.conf"; then
RESOLVCONF='/run/systemd/resolve/resolv.conf' resolv_conf="/run/systemd/resolve/resolv.conf"
else else
RESOLVCONF='/etc/resolv.conf' resolv_conf="/etc/resolv.conf"
fi fi
# Obtain the resolvers from resolv.conf and use them for OpenVPN # Obtain the resolvers from resolv.conf and use them for OpenVPN
grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do grep -v '#' "$resolv_conf" | grep nameserver | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do
echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf
done done
;; ;;
2) 2)
echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
;; ;;
3) 3)
echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
;; ;;
4) 4)
echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
;; ;;
5) 5)
echo 'push "dhcp-option DNS 64.6.64.6"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 64.6.64.6"' >> /etc/openvpn/server/server.conf
echo 'push "dhcp-option DNS 64.6.65.6"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 64.6.65.6"' >> /etc/openvpn/server/server.conf
;; ;;
esac esac
echo "keepalive 10 120 echo "keepalive 10 120
cipher AES-256-CBC cipher AES-256-CBC
comp-lzo user root
user nobody group root
group $GROUPNAME
persist-key persist-key
persist-tun persist-tun
status openvpn-status.log status openvpn-status.log
verb 3 verb 3
crl-verify crl.pem crl-verify crl.pem" >> /etc/openvpn/server/server.conf
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn" >> /etc/openvpn/server.conf if [[ "$protocol" = "udp" ]]; then
mkdir -p /usr/lib/openvpn/ echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
ln -s /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib/openvpn/openvpn-plugin-auth-pam.so
echo "auth required /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn
# Enable net.ipv4.ip_forward for the system
sed -i '/\<net.ipv4.ip_forward\>/c\net.ipv4.ip_forward=1' /etc/sysctl.conf
if ! grep -q "\<net.ipv4.ip_forward\>" /etc/sysctl.conf; then
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf
fi fi
# Avoid an unneeded reboot # Authenticator config
mkdir -p /usr/lib/openvpn/
if [[ "$os" = "debian" ]]; then
echo "plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so openvpn" >> /etc/openvpn/server/server.conf
ln -s /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib/openvpn/openvpn-plugin-auth-pam.so
echo "auth required /lib/x86_64-linux-gnu/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn
else
# Else, the distro is CentOS or Amazon Linux
yum install perl-Authen-PAM -y
echo "auth-user-pass-verify auth-pam.pl via-file
script-security 2" >> /etc/openvpn/server/server.conf
echo "#!/usr/bin/perl -t
use Authen::PAM;
use POSIX;
sub my_conv_func {
my @res;
while ( @_ ) {
my \$code = shift;
my \$msg = shift;
my \$ans = \"\";
\$ans = \$password if \$msg =~ /[Pp]assword/;
push @res, (PAM_SUCCESS(),\$ans);
}
push @res, PAM_SUCCESS();
return @res;
}
\$service = \"openvpn\";
if (\$ARG = shift @ARGV) {
if (!open (UPFILE, \"<\$ARG\")) {
print \"Could not open username/password file: \$ARG\n\";
exit 1;
}
} else {
print \"No username/password file specified on command line\n\";
exit 1;
}
\$username = <UPFILE>;
\$password = <UPFILE>;
if (!\$username || !\$password) {
print \"Username/password not found in file: \$ARG\n\";
exit 1;
}
chomp \$username;
chomp \$password;
close (UPFILE);
if (!ref(\$pamh = new Authen::PAM(\$service, \$username, \&my_conv_func))) {
print \"Authen::PAM init failed\n\";
exit 1;
}
\$res = \$pamh->pam_authenticate;
if (\$res == PAM_SUCCESS()) {
exit 0;
} else {
print \"Auth '\$username' failed, PAM said: \", \$pamh->pam_strerror($res), \"\n\";
exit 1;
}" > /etc/openvpn/server/auth-pam.pl
chown nobody. /etc/openvpn/server/auth-pam.pl
chmod 755 /etc/openvpn/server/auth-pam.pl
echo "auth required /usr/lib64/security/pam_google_authenticator.so secret=/etc/openvpn/google-authenticator/\${USER} user=gauth forward_pass" > /etc/pam.d/openvpn
fi
# Enable net.ipv4.ip_forward for the system
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf
# Enable without waiting for a reboot or service restart
echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_forward
if pgrep firewalld; then if pgrep firewalld; then
# Using both permanent and not permanent rules to avoid a firewalld # Using both permanent and not permanent rules to avoid a firewalld
# reload. # reload.
# We don't use --add-service=openvpn because that would only work with # We don't use --add-service=openvpn because that would only work with
# the default port and protocol. # the default port and protocol.
firewall-cmd --zone=public --add-port=$PORT/$PROTOCOL firewall-cmd --add-port="$port"/"$protocol"
firewall-cmd --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
firewall-cmd --permanent --zone=public --add-port=$PORT/$PROTOCOL firewall-cmd --permanent --add-port="$port"/"$protocol"
firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
# Set NAT for the VPN subnet # Set NAT for the VPN subnet
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
else else
# Needed to use rc.local with some systemd distros # Create a service to set up persistent iptables rules
if [[ ! -e $RCLOCAL ]]; then echo "[Unit]
echo '#!/bin/sh -e Before=network.target
exit 0' > $RCLOCAL [Service]
fi Type=oneshot
chmod +x $RCLOCAL ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
# Set NAT for the VPN subnet ExecStart=/sbin/iptables -I INPUT -p $protocol --dport $port -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
if iptables -L -n | grep -qE '^(REJECT|DROP)'; then ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
# If iptables has at least one REJECT rule, we asume this is needed. ExecStop=/sbin/iptables -D INPUT -p $protocol --dport $port -j ACCEPT
# Not the best approach but I can't think of other and this shouldn't ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
# cause problems. ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT RemainAfterExit=yes
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT [Install]
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT WantedBy=multi-user.target" > /etc/systemd/system/openvpn-iptables.service
sed -i "1 a\iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT" $RCLOCAL systemctl enable --now openvpn-iptables.service
sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
fi
fi fi
# And finally, restart OpenVPN # If SELinux is enabled and a custom port was selected, we need this
# Little hack to check for systemd if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
if pgrep systemd-journal; then # Install semanage if not already present
systemctl restart openvpn@server.service if ! hash semanage 2>/dev/null; then
else if grep -qs "CentOS Linux release 7" "/etc/centos-release"; then
/etc/init.d/openvpn restart yum install policycoreutils-python -y
fi else
# Try to detect a NATed connection and ask about it to potential LowEndSpirit users yum install policycoreutils-python-utils -y
EXTERNALIP=$(wget -4qO- "http://whatismyip.akamai.com/") fi
if [[ "$IP" != "$EXTERNALIP" ]]; then
echo ""
echo "Looks like your server could be behind a NAT!"
echo ""
echo "If your server is behind a NAT, I need to know the public IP or hostname"
echo "If that's not the case, just ignore this and leave the next field blank"
read -p "Public IP: " -e PUBLICIP
if [[ "$PUBLICIP" != "" ]]; then
IP=$PUBLICIP
fi fi
semanage port -a -t openvpn_port_t -p "$protocol" "$port"
fi
# If the server is behind a NAT, use the correct IP address
if [[ "$public_ip" != "" ]]; then
ip="$public_ip"
fi fi
# client-common.txt is created so we have a template to add further users later # client-common.txt is created so we have a template to add further users later
echo "client echo "client
dev tun dev tun
proto $PROTOCOL proto $protocol
sndbuf 0 remote $ip $port
rcvbuf 0
remote $IP $PORT
resolv-retry infinite resolv-retry infinite
nobind nobind
persist-key persist-key
@ -376,16 +525,15 @@ persist-tun
remote-cert-tls server remote-cert-tls server
auth SHA512 auth SHA512
cipher AES-256-CBC cipher AES-256-CBC
comp-lzo
key-direction 1
verb 3 verb 3
ns-cert-type server auth-user-pass" > /etc/openvpn/server/client-common.txt
auth-user-pass" > /etc/openvpn/client-common.txt # Enable and start the OpenVPN service
systemctl enable --now openvpn-server@server.service
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" new_client "$client"
echo "" echo
echo "Finished!" echo "Finished!"
echo "" echo
echo "Your client configuration is available at" ~/"$CLIENT.ovpn" echo "Your client configuration is available at:" ~/"$client.ovpn"
echo "If you want to add more clients, you simply need to run this script again!" echo "If you want to add more clients, just run this script again!"
fi fi