Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Support for client names with non-alphanumeric characters

Browse Source
This commit is contained in:
Ben Gadbois 2018-08-26 19:03:16 +02:00 committed by Ben Gadbois
parent 43ef4f920d
commit 189f492169
1 changed files with 19 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
openvpn-install.sh
View File

@ -41,19 +41,19 @@ fi
newclient () { newclient () {
# Generates the custom client.ovpn # Generates the custom client.ovpn
cp /etc/openvpn/server/client-common.txt ~/$1.ovpn cp /etc/openvpn/server/client-common.txt ~/"$1.ovpn"
echo "<ca>" >> ~/$1.ovpn echo "<ca>" >> ~/"$1.ovpn"
cat /etc/openvpn/server/easy-rsa/pki/ca.crt >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/ca.crt >> ~/"$1.ovpn"
echo "</ca>" >> ~/$1.ovpn echo "</ca>" >> ~/"$1.ovpn"
echo "<cert>" >> ~/$1.ovpn echo "<cert>" >> ~/"$1.ovpn"
sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$1.crt" >> ~/"$1.ovpn"
echo "</cert>" >> ~/$1.ovpn echo "</cert>" >> ~/"$1.ovpn"
echo "<key>" >> ~/$1.ovpn echo "<key>" >> ~/"$1.ovpn"
cat /etc/openvpn/server/easy-rsa/pki/private/$1.key >> ~/$1.ovpn cat /etc/openvpn/server/easy-rsa/pki/private/$1.key >> ~/"$1.ovpn"
echo "</key>" >> ~/$1.ovpn echo "</key>" >> ~/"$1.ovpn"
echo "<tls-auth>" >> ~/$1.ovpn echo "<tls-auth>" >> ~/"$1.ovpn"
sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/ta.key >> ~/$1.ovpn sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/ta.key >> ~/"$1.ovpn"
echo "</tls-auth>" >> ~/$1.ovpn echo "</tls-auth>" >> ~/"$1.ovpn"
} }
if [[ -e /etc/openvpn/server/server.conf ]]; then if [[ -e /etc/openvpn/server/server.conf ]]; then
@ -72,10 +72,9 @@ if [[ -e /etc/openvpn/server/server.conf ]]; then
1) 1)
echo echo
echo "Tell me a name for the client certificate." echo "Tell me a name for the client certificate."
echo "Please, use one word only, no special characters."
read -p "Client name: " -e CLIENT read -p "Client name: " -e CLIENT
cd /etc/openvpn/server/easy-rsa/ cd /etc/openvpn/server/easy-rsa/
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full $CLIENT nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$CLIENT" nopass
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" newclient "$CLIENT"
echo echo
@ -104,11 +103,11 @@ if [[ -e /etc/openvpn/server/server.conf ]]; then
read -p "Do you really want to revoke access for client $CLIENT? [y/N]: " -e REVOKE read -p "Do you really want to revoke access for client $CLIENT? [y/N]: " -e REVOKE
if [[ "$REVOKE" = 'y' || "$REVOKE" = 'Y' ]]; then if [[ "$REVOKE" = 'y' || "$REVOKE" = 'Y' ]]; then
cd /etc/openvpn/server/easy-rsa/ cd /etc/openvpn/server/easy-rsa/
./easyrsa --batch revoke $CLIENT ./easyrsa --batch revoke "$CLIENT"
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -f pki/reqs/$CLIENT.req rm -f "pki/reqs/$CLIENT.req"
rm -f pki/private/$CLIENT.key rm -f "pki/private/$CLIENT.key"
rm -f pki/issued/$CLIENT.crt rm -f "pki/issued/$CLIENT.crt"
rm -f /etc/openvpn/server/crl.pem rm -f /etc/openvpn/server/crl.pem
cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody # CRL is read with each client connection, when OpenVPN is dropped to nobody
@ -207,7 +206,6 @@ else
read -p "DNS [1-5]: " -e -i 1 DNS read -p "DNS [1-5]: " -e -i 1 DNS
echo echo
echo "Finally, tell me your name for the client certificate." echo "Finally, tell me your name for the client certificate."
echo "Please, use one word only, no special characters."
read -p "Client name: " -e -i client CLIENT read -p "Client name: " -e -i client CLIENT
echo echo
echo "Okay, that was all I needed. We are ready to set up your OpenVPN server now." echo "Okay, that was all I needed. We are ready to set up your OpenVPN server now."
@ -233,7 +231,7 @@ else
./easyrsa init-pki ./easyrsa init-pki
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full $CLIENT nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$CLIENT" nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Move the stuff we need # Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server