API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Sep 21st, 2019
117
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 37.73 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. function isRoot () {
  4. if [ "$EUID" -ne 0 ]; then
  5. return 1
  6. fi
  7. }
  8.  
  9. function tunAvailable () {
  10. if [ ! -e /dev/net/tun ]; then
  11. return 1
  12. fi
  13. }
  14.  
  15. function checkOS () {
  16. if [[ -e /etc/debian_version ]]; then
  17. OS="debian"
  18. source /etc/os-release
  19.  
  20. if [[ "$ID" == "debian" || "$ID" == "raspbian" ]]; then
  21. if [[ ! $VERSION_ID =~ (8|9|10) ]]; then
  22. echo "⚠️ Your version of Debian is not supported."
  23. echo ""
  24. echo "However, if you're using Debian >= 9 or unstable/testing then you can continue."
  25. echo "Keep in mind they are not supported, though."
  26. echo ""
  27. until [[ $CONTINUE =~ (y|n) ]]; do
  28. read -rp "Continue? [y/n]: " -e CONTINUE
  29. done
  30. if [[ "$CONTINUE" = "n" ]]; then
  31. exit 1
  32. fi
  33. fi
  34. elif [[ "$ID" == "ubuntu" ]];then
  35. OS="ubuntu"
  36. if [[ ! $VERSION_ID =~ (16.04|18.04|19.04) ]]; then
  37. echo "⚠️ Your version of Ubuntu is not supported."
  38. echo ""
  39. echo "However, if you're using Ubuntu > 17 or beta, then you can continue."
  40. echo "Keep in mind they are not supported, though."
  41. echo ""
  42. until [[ $CONTINUE =~ (y|n) ]]; do
  43. read -rp "Continue? [y/n]: " -e CONTINUE
  44. done
  45. if [[ "$CONTINUE" = "n" ]]; then
  46. exit 1
  47. fi
  48. fi
  49. fi
  50. elif [[ -e /etc/system-release ]]; then
  51. source /etc/os-release
  52. if [[ "$ID" = "centos" ]]; then
  53. OS="centos"
  54. if [[ ! $VERSION_ID == "7" ]]; then
  55. echo "⚠️ Your version of CentOS is not supported."
  56. echo ""
  57. echo "The script only support CentOS 7."
  58. echo ""
  59. exit 1
  60. fi
  61. fi
  62. if [[ "$ID" = "amzn" ]]; then
  63. OS="amzn"
  64. if [[ ! $VERSION_ID == "2" ]]; then
  65. echo "⚠️ Your version of Amazon Linux is not supported."
  66. echo ""
  67. echo "The script only support Amazon Linux 2."
  68. echo ""
  69. exit 1
  70. fi
  71. fi
  72. elif [[ -e /etc/fedora-release ]]; then
  73. OS=fedora
  74. elif [[ -e /etc/arch-release ]]; then
  75. OS=arch
  76. else
  77. echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora, CentOS, Amazon Linux 2 or Arch Linux system"
  78. exit 1
  79. fi
  80. }
  81.  
  82. function initialCheck () {
  83. if ! isRoot; then
  84. echo "Sorry, you need to run this as root"
  85. exit 1
  86. fi
  87. if ! tunAvailable; then
  88. echo "TUN is not available"
  89. exit 1
  90. fi
  91. checkOS
  92. }
  93.  
  94. function installUnbound () {
  95. if [[ ! -e /etc/unbound/unbound.conf ]]; then
  96.  
  97. if [[ "$OS" =~ (debian|ubuntu) ]]; then
  98. apt-get install -y unbound
  99.  
  100. # Configuration
  101. echo 'interface: 10.8.0.1
  102. access-control: 10.8.0.1/24 allow
  103. hide-identity: yes
  104. hide-version: yes
  105. use-caps-for-id: yes
  106. prefetch: yes' >> /etc/unbound/unbound.conf
  107.  
  108. elif [[ "$OS" =~ (centos|amzn) ]]; then
  109. yum install -y unbound
  110.  
  111. # Configuration
  112. sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
  113. sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
  114. sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
  115. sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
  116. sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
  117.  
  118. elif [[ "$OS" = "fedora" ]]; then
  119. dnf install -y unbound
  120.  
  121. # Configuration
  122. sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
  123. sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
  124. sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
  125. sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
  126. sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
  127.  
  128. elif [[ "$OS" = "arch" ]]; then
  129. pacman -Syu --noconfirm unbound
  130.  
  131. # Get root servers list
  132. curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
  133.  
  134. mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old
  135.  
  136. echo 'server:
  137. use-syslog: yes
  138. do-daemonize: no
  139. username: "unbound"
  140. directory: "/etc/unbound"
  141. trust-anchor-file: trusted-key.key
  142. root-hints: root.hints
  143. interface: 10.8.0.1
  144. access-control: 10.8.0.1/24 allow
  145. port: 53
  146. num-threads: 2
  147. use-caps-for-id: yes
  148. harden-glue: yes
  149. hide-identity: yes
  150. hide-version: yes
  151. qname-minimisation: yes
  152. prefetch: yes' > /etc/unbound/unbound.conf
  153. fi
  154.  
  155. if [[ ! "$OS" =~ (fedora|centos|amzn) ]];then
  156. # DNS Rebinding fix
  157. echo "private-address: 10.0.0.0/8
  158. private-address: 172.16.0.0/12
  159. private-address: 192.168.0.0/16
  160. private-address: 169.254.0.0/16
  161. private-address: fd00::/8
  162. private-address: fe80::/10
  163. private-address: 127.0.0.0/8
  164. private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf
  165. fi
  166. else # Unbound is already installed
  167. echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf
  168.  
  169. # Add Unbound 'server' for the OpenVPN subnet
  170. echo 'server:
  171. interface: 10.8.0.1
  172. access-control: 10.8.0.1/24 allow
  173. hide-identity: yes
  174. hide-version: yes
  175. use-caps-for-id: yes
  176. prefetch: yes
  177. private-address: 10.0.0.0/8
  178. private-address: 172.16.0.0/12
  179. private-address: 192.168.0.0/16
  180. private-address: 169.254.0.0/16
  181. private-address: fd00::/8
  182. private-address: fe80::/10
  183. private-address: 127.0.0.0/8
  184. private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf
  185. fi
  186.  
  187. systemctl enable unbound
  188. systemctl restart unbound
  189. }
  190.  
  191. function installQuestions () {
  192. echo "Welcome to the OpenVPN installer!"
  193. echo "The git repository is available at: https://github.com/angristan/openvpn-install"
  194. echo ""
  195.  
  196. echo "I need to ask you a few questions before starting the setup."
  197. echo "You can leave the default options and just press enter if you are ok with them."
  198. echo ""
  199. echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to."
  200. echo "Unless your server is behind NAT, it should be your public IPv4 address."
  201.  
  202. # Detect public IPv4 address and pre-fill for the user
  203. IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
  204. APPROVE_IP=${APPROVE_IP:-n}
  205. if [[ $APPROVE_IP =~ n ]]; then
  206. read -rp "IP address: " -e -i "$IP" IP
  207. fi
  208. # If $IP is a private IP address, the server must be behind NAT
  209. if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
  210. echo ""
  211. echo "It seems this server is behind NAT. What is its public IPv4 address or hostname?"
  212. echo "We need it for the clients to connect to the server."
  213. until [[ "$ENDPOINT" != "" ]]; do
  214. read -rp "Public IPv4 address or hostname: " -e ENDPOINT
  215. done
  216. fi
  217.  
  218. echo ""
  219. echo "Checking for IPv6 connectivity..."
  220. echo ""
  221. # "ping6" and "ping -6" availability varies depending on the distribution
  222. if type ping6 > /dev/null 2>&1; then
  223. PING6="ping6 -c3 ipv6.google.com > /dev/null 2>&1"
  224. else
  225. PING6="ping -6 -c3 ipv6.google.com > /dev/null 2>&1"
  226. fi
  227. if eval "$PING6"; then
  228. echo "Your host appears to have IPv6 connectivity."
  229. SUGGESTION="y"
  230. else
  231. echo "Your host does not appear to have IPv6 connectivity."
  232. SUGGESTION="n"
  233. fi
  234. echo ""
  235. # Ask the user if they want to enable IPv6 regardless its availability.
  236. until [[ $IPV6_SUPPORT =~ (y|n) ]]; do
  237. read -rp "Do you want to enable IPv6 support (NAT)? [y/n]: " -e -i $SUGGESTION IPV6_SUPPORT
  238. done
  239. echo ""
  240. echo "What port do you want OpenVPN to listen to?"
  241. echo " 1) Default: 1194"
  242. echo " 2) Custom"
  243. echo " 3) Random [49152-65535]"
  244. until [[ "$PORT_CHOICE" =~ ^[1-3]$ ]]; do
  245. read -rp "Port choice [1-3]: " -e -i 1 PORT_CHOICE
  246. done
  247. case $PORT_CHOICE in
  248. 1)
  249. PORT="1194"
  250. ;;
  251. 2)
  252. until [[ "$PORT" =~ ^[0-9]+$ ]] && [ "$PORT" -ge 1 ] && [ "$PORT" -le 65535 ]; do
  253. read -rp "Custom port [1-65535]: " -e -i 1194 PORT
  254. done
  255. ;;
  256. 3)
  257. # Generate random number within private ports range
  258. PORT=$(shuf -i49152-65535 -n1)
  259. echo "Random Port: $PORT"
  260. ;;
  261. esac
  262. echo ""
  263. echo "What protocol do you want OpenVPN to use?"
  264. echo "UDP is faster. Unless it is not available, you shouldn't use TCP."
  265. echo " 1) UDP"
  266. echo " 2) TCP"
  267. until [[ "$PROTOCOL_CHOICE" =~ ^[1-2]$ ]]; do
  268. read -rp "Protocol [1-2]: " -e -i 1 PROTOCOL_CHOICE
  269. done
  270. case $PROTOCOL_CHOICE in
  271. 1)
  272. PROTOCOL="udp"
  273. ;;
  274. 2)
  275. PROTOCOL="tcp"
  276. ;;
  277. esac
  278. echo ""
  279. echo "What DNS resolvers do you want to use with the VPN?"
  280. echo " 1) Current system resolvers (from /etc/resolv.conf)"
  281. echo " 2) Self-hosted DNS Resolver (Unbound)"
  282. echo " 3) Cloudflare (Anycast: worldwide)"
  283. echo " 4) Quad9 (Anycast: worldwide)"
  284. echo " 5) Quad9 uncensored (Anycast: worldwide)"
  285. echo " 6) FDN (France)"
  286. echo " 7) DNS.WATCH (Germany)"
  287. echo " 8) OpenDNS (Anycast: worldwide)"
  288. echo " 9) Google (Anycast: worldwide)"
  289. echo " 10) Yandex Basic (Russia)"
  290. echo " 11) AdGuard DNS (Russia)"
  291. echo " 12) Custom"
  292. until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 ] && [ "$DNS" -le 12 ]; do
  293. read -rp "DNS [1-12]: " -e -i 3 DNS
  294. if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then
  295. echo ""
  296. echo "Unbound is already installed."
  297. echo "You can allow the script to configure it in order to use it from your OpenVPN clients"
  298. echo "We will simply add a second server to /etc/unbound/unbound.conf for the OpenVPN subnet."
  299. echo "No changes are made to the current configuration."
  300. echo ""
  301.  
  302. until [[ $CONTINUE =~ (y|n) ]]; do
  303. read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE
  304. done
  305. if [[ $CONTINUE = "n" ]];then
  306. # Break the loop and cleanup
  307. unset DNS
  308. unset CONTINUE
  309. fi
  310. elif [[ $DNS == "12" ]]; then
  311. until [[ "$DNS1" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
  312. read -rp "Primary DNS: " -e DNS1
  313. done
  314. until [[ "$DNS2" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
  315. read -rp "Secondary DNS (optional): " -e DNS2
  316. if [[ "$DNS2" == "" ]]; then
  317. break
  318. fi
  319. done
  320. fi
  321. done
  322. echo ""
  323. echo "Do you want to use compression? It is not recommended since the VORACLE attack make use of it."
  324. until [[ $COMPRESSION_ENABLED =~ (y|n) ]]; do
  325. read -rp"Enable compression? [y/n]: " -e -i n COMPRESSION_ENABLED
  326. done
  327. if [[ $COMPRESSION_ENABLED == "y" ]];then
  328. echo "Choose which compression algorithm you want to use: (they are ordered by efficiency)"
  329. echo " 1) LZ4-v2"
  330. echo " 2) LZ4"
  331. echo " 3) LZ0"
  332. until [[ $COMPRESSION_CHOICE =~ ^[1-3]$ ]]; do
  333. read -rp"Compression algorithm [1-3]: " -e -i 1 COMPRESSION_CHOICE
  334. done
  335. case $COMPRESSION_CHOICE in
  336. 1)
  337. COMPRESSION_ALG="lz4-v2"
  338. ;;
  339. 2)
  340. COMPRESSION_ALG="lz4"
  341. ;;
  342. 3)
  343. COMPRESSION_ALG="lzo"
  344. ;;
  345. esac
  346. fi
  347. echo ""
  348. echo "Do you want to customize encryption settings?"
  349. echo "Unless you know what you're doing, you should stick with the default parameters provided by the script."
  350. echo "Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)"
  351. echo "See https://github.com/angristan/openvpn-install#security-and-encryption to learn more."
  352. echo ""
  353. until [[ $CUSTOMIZE_ENC =~ (y|n) ]]; do
  354. read -rp "Customize encryption settings? [y/n]: " -e -i n CUSTOMIZE_ENC
  355. done
  356. if [[ $CUSTOMIZE_ENC == "n" ]];then
  357. # Use default, sane and fast parameters
  358. CIPHER="AES-128-GCM"
  359. CERT_TYPE="1" # ECDSA
  360. CERT_CURVE="prime256v1"
  361. CC_CIPHER="TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256"
  362. DH_TYPE="1" # ECDH
  363. DH_CURVE="prime256v1"
  364. HMAC_ALG="SHA256"
  365. TLS_SIG="1" # tls-crypt
  366. else
  367. echo ""
  368. echo "Choose which cipher you want to use for the data channel:"
  369. echo " 1) AES-128-GCM (recommended)"
  370. echo " 2) AES-192-GCM"
  371. echo " 3) AES-256-GCM"
  372. echo " 4) AES-128-CBC"
  373. echo " 5) AES-192-CBC"
  374. echo " 6) AES-256-CBC"
  375. until [[ "$CIPHER_CHOICE" =~ ^[1-6]$ ]]; do
  376. read -rp "Cipher [1-6]: " -e -i 1 CIPHER_CHOICE
  377. done
  378. case $CIPHER_CHOICE in
  379. 1)
  380. CIPHER="AES-128-GCM"
  381. ;;
  382. 2)
  383. CIPHER="AES-192-GCM"
  384. ;;
  385. 3)
  386. CIPHER="AES-256-GCM"
  387. ;;
  388. 4)
  389. CIPHER="AES-128-CBC"
  390. ;;
  391. 5)
  392. CIPHER="AES-192-CBC"
  393. ;;
  394. 6)
  395. CIPHER="AES-256-CBC"
  396. ;;
  397. esac
  398. echo ""
  399. echo "Choose what kind of certificate you want to use:"
  400. echo " 1) ECDSA (recommended)"
  401. echo " 2) RSA"
  402. until [[ $CERT_TYPE =~ ^[1-2]$ ]]; do
  403. read -rp"Certificate key type [1-2]: " -e -i 1 CERT_TYPE
  404. done
  405. case $CERT_TYPE in
  406. 1)
  407. echo ""
  408. echo "Choose which curve you want to use for the certificate's key:"
  409. echo " 1) prime256v1 (recommended)"
  410. echo " 2) secp384r1"
  411. echo " 3) secp521r1"
  412. until [[ $CERT_CURVE_CHOICE =~ ^[1-3]$ ]]; do
  413. read -rp"Curve [1-3]: " -e -i 1 CERT_CURVE_CHOICE
  414. done
  415. case $CERT_CURVE_CHOICE in
  416. 1)
  417. CERT_CURVE="prime256v1"
  418. ;;
  419. 2)
  420. CERT_CURVE="secp384r1"
  421. ;;
  422. 3)
  423. CERT_CURVE="secp521r1"
  424. ;;
  425. esac
  426. ;;
  427. 2)
  428. echo ""
  429. echo "Choose which size you want to use for the certificate's RSA key:"
  430. echo " 1) 2048 bits (recommended)"
  431. echo " 2) 3072 bits"
  432. echo " 3) 4096 bits"
  433. until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[1-3]$ ]]; do
  434. read -rp "RSA key size [1-3]: " -e -i 1 RSA_KEY_SIZE_CHOICE
  435. done
  436. case $RSA_KEY_SIZE_CHOICE in
  437. 1)
  438. RSA_KEY_SIZE="2048"
  439. ;;
  440. 2)
  441. RSA_KEY_SIZE="3072"
  442. ;;
  443. 3)
  444. RSA_KEY_SIZE="4096"
  445. ;;
  446. esac
  447. ;;
  448. esac
  449. echo ""
  450. echo "Choose which cipher you want to use for the control channel:"
  451. case $CERT_TYPE in
  452. 1)
  453. echo " 1) ECDHE-ECDSA-AES-128-GCM-SHA256 (recommended)"
  454. echo " 2) ECDHE-ECDSA-AES-256-GCM-SHA384"
  455. until [[ $CC_CIPHER_CHOICE =~ ^[1-2]$ ]]; do
  456. read -rp"Control channel cipher [1-2]: " -e -i 1 CC_CIPHER_CHOICE
  457. done
  458. case $CC_CIPHER_CHOICE in
  459. 1)
  460. CC_CIPHER="TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256"
  461. ;;
  462. 2)
  463. CC_CIPHER="TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"
  464. ;;
  465. esac
  466. ;;
  467. 2)
  468. echo " 1) ECDHE-RSA-AES-128-GCM-SHA256 (recommended)"
  469. echo " 2) ECDHE-RSA-AES-256-GCM-SHA384"
  470. until [[ $CC_CIPHER_CHOICE =~ ^[1-2]$ ]]; do
  471. read -rp"Control channel cipher [1-2]: " -e -i 1 CC_CIPHER_CHOICE
  472. done
  473. case $CC_CIPHER_CHOICE in
  474. 1)
  475. CC_CIPHER="TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256"
  476. ;;
  477. 2)
  478. CC_CIPHER="TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384"
  479. ;;
  480. esac
  481. ;;
  482. esac
  483. echo ""
  484. echo "Choose what kind of Diffie-Hellman key you want to use:"
  485. echo " 1) ECDH (recommended)"
  486. echo " 2) DH"
  487. until [[ $DH_TYPE =~ [1-2] ]]; do
  488. read -rp"DH key type [1-2]: " -e -i 1 DH_TYPE
  489. done
  490. case $DH_TYPE in
  491. 1)
  492. echo ""
  493. echo "Choose which curve you want to use for the ECDH key:"
  494. echo " 1) prime256v1 (recommended)"
  495. echo " 2) secp384r1"
  496. echo " 3) secp521r1"
  497. while [[ $DH_CURVE_CHOICE != "1" && $DH_CURVE_CHOICE != "2" && $DH_CURVE_CHOICE != "3" ]]; do
  498. read -rp"Curve [1-3]: " -e -i 1 DH_CURVE_CHOICE
  499. done
  500. case $DH_CURVE_CHOICE in
  501. 1)
  502. DH_CURVE="prime256v1"
  503. ;;
  504. 2)
  505. DH_CURVE="secp384r1"
  506. ;;
  507. 3)
  508. DH_CURVE="secp521r1"
  509. ;;
  510. esac
  511. ;;
  512. 2)
  513. echo ""
  514. echo "Choose what size of Diffie-Hellman key you want to use:"
  515. echo " 1) 2048 bits (recommended)"
  516. echo " 2) 3072 bits"
  517. echo " 3) 4096 bits"
  518. until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[1-3]$ ]]; do
  519. read -rp "DH key size [1-3]: " -e -i 1 DH_KEY_SIZE_CHOICE
  520. done
  521. case $DH_KEY_SIZE_CHOICE in
  522. 1)
  523. DH_KEY_SIZE="2048"
  524. ;;
  525. 2)
  526. DH_KEY_SIZE="3072"
  527. ;;
  528. 3)
  529. DH_KEY_SIZE="4096"
  530. ;;
  531. esac
  532. ;;
  533. esac
  534. echo ""
  535. # The "auth" options behaves differently with AEAD ciphers
  536. if [[ "$CIPHER" =~ CBC$ ]]; then
  537. echo "The digest algorithm authenticates data channel packets and tls-auth packets from the control channel."
  538. elif [[ "$CIPHER" =~ GCM$ ]]; then
  539. echo "The digest algorithm authenticates tls-auth packets from the control channel."
  540. fi
  541. echo "Which digest algorithm do you want to use for HMAC?"
  542. echo " 1) SHA-256 (recommended)"
  543. echo " 2) SHA-384"
  544. echo " 3) SHA-512"
  545. until [[ $HMAC_ALG_CHOICE =~ ^[1-3]$ ]]; do
  546. read -rp "Digest algorithm [1-3]: " -e -i 1 HMAC_ALG_CHOICE
  547. done
  548. case $HMAC_ALG_CHOICE in
  549. 1)
  550. HMAC_ALG="SHA256"
  551. ;;
  552. 2)
  553. HMAC_ALG="SHA384"
  554. ;;
  555. 3)
  556. HMAC_ALG="SHA512"
  557. ;;
  558. esac
  559. echo ""
  560. echo "You can add an additional layer of security to the control channel with tls-auth and tls-crypt"
  561. echo "tls-auth authenticates the packets, while tls-crypt authenticate and encrypt them."
  562. echo " 1) tls-crypt (recommended)"
  563. echo " 2) tls-auth"
  564. until [[ $TLS_SIG =~ [1-2] ]]; do
  565. read -rp "Control channel additional security mechanism [1-2]: " -e -i 1 TLS_SIG
  566. done
  567. fi
  568. echo ""
  569. echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now."
  570. echo "You will be able to generate a client at the end of the installation."
  571. APPROVE_INSTALL=${APPROVE_INSTALL:-n}
  572. if [[ $APPROVE_INSTALL =~ n ]]; then
  573. read -n1 -r -p "Press any key to continue..."
  574. fi
  575. }
  576. function installOpenVPN () {
  577. if [[ $AUTO_INSTALL == "y" ]]; then
  578. # Set default choices so that no questions will be asked.
  579. APPROVE_INSTALL=${APPROVE_INSTALL:-y}
  580. APPROVE_IP=${APPROVE_IP:-y}
  581. IPV6_SUPPORT=${IPV6_SUPPORT:-n}
  582. PORT_CHOICE=${PORT_CHOICE:-1}
  583. PROTOCOL_CHOICE=${PROTOCOL_CHOICE:-1}
  584. DNS=${DNS:-1}
  585. COMPRESSION_ENABLED=${COMPRESSION_ENABLED:-n}
  586. CUSTOMIZE_ENC=${CUSTOMIZE_ENC:-n}
  587. CLIENT=${CLIENT:-client}
  588. PASS=${PASS:-1}
  589. CONTINUE=${CONTINUE:-y}
  590. # Behind NAT, we'll default to the publicly reachable IPv4.
  591. PUBLIC_IPV4=$(curl ifconfig.co)
  592. ENDPOINT=${ENDPOINT:-$PUBLIC_IPV4}
  593. fi
  594. # Run setup questions first, and set other variales if auto-install
  595. installQuestions
  596. # Get the "public" interface from the default route
  597. NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)
  598. if [[ "$OS" =~ (debian|ubuntu) ]]; then
  599. apt-get update
  600. apt-get -y install ca-certificates gnupg
  601. # We add the OpenVPN repo to get the latest version.
  602. if [[ "$VERSION_ID" = "8" ]]; then
  603. echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list
  604. wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  605. apt-get update
  606. fi
  607. if [[ "$VERSION_ID" = "16.04" ]]; then
  608. echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn.list
  609. wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  610. apt-get update
  611. fi
  612. # Ubuntu > 16.04 and Debian > 8 have OpenVPN >= 2.4 without the need of a third party repository.
  613. apt-get install -y openvpn iptables openssl wget ca-certificates curl
  614. elif [[ "$OS" = 'centos' ]]; then
  615. yum install -y epel-release
  616. yum install -y openvpn iptables openssl wget ca-certificates curl
  617. elif [[ "$OS" = 'amzn' ]]; then
  618. amazon-linux-extras install -y epel
  619. yum install -y openvpn iptables openssl wget ca-certificates curl
  620. elif [[ "$OS" = 'fedora' ]]; then
  621. dnf install -y openvpn iptables openssl wget ca-certificates curl
  622. elif [[ "$OS" = 'arch' ]]; then
  623. # Install required dependencies and upgrade the system
  624. pacman --needed --noconfirm -Syu openvpn iptables openssl wget ca-certificates curl
  625. fi
  626. # Find out if the machine uses nogroup or nobody for the permissionless group
  627. if grep -qs "^nogroup:" /etc/group; then
  628. NOGROUP=nogroup
  629. else
  630. NOGROUP=nobody
  631. fi
  632. # An old version of easy-rsa was available by default in some openvpn packages
  633. if [[ -d /etc/openvpn/easy-rsa/ ]]; then
  634. rm -rf /etc/openvpn/easy-rsa/
  635. fi
  636. # Install the latest version of easy-rsa from source
  637. local version="3.0.6"
  638. wget -O ~/EasyRSA-unix-v${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-unix-v${version}.tgz
  639. tar xzf ~/EasyRSA-unix-v${version}.tgz -C ~/
  640. mv ~/EasyRSA-v${version} /etc/openvpn/easy-rsa
  641. chown -R root:root /etc/openvpn/easy-rsa/
  642. rm -f ~/EasyRSA-unix-v${version}.tgz
  643. cd /etc/openvpn/easy-rsa/
  644. case $CERT_TYPE in
  645. 1)
  646. echo "set_var EASYRSA_ALGO ec" > vars
  647. echo "set_var EASYRSA_CURVE $CERT_CURVE" >> vars
  648. ;;
  649. 2)
  650. echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
  651. ;;
  652. esac
  653. # Generate a random, alphanumeric identifier of 16 characters for CN and one for server name
  654. SERVER_CN="cn_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
  655. SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
  656. echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars
  657. # Workaround to remove unharmful error until easy-rsa 3.0.7
  658. # https://github.com/OpenVPN/easy-rsa/issues/261
  659. sed -i 's/^RANDFILE/#RANDFILE/g' pki/openssl-easyrsa.cnf
  660. # Create the PKI, set up the CA, the DH params and the server certificate
  661. ./easyrsa init-pki
  662. ./easyrsa --batch build-ca nopass
  663. if [[ $DH_TYPE == "2" ]]; then
  664. # ECDH keys are generated on-the-fly so we don't need to generate them beforehand
  665. openssl dhparam -out dh.pem $DH_KEY_SIZE
  666. fi
  667. ./easyrsa build-server-full "$SERVER_NAME" nopass
  668. EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
  669. case $TLS_SIG in
  670. 1)
  671. # Generate tls-crypt key
  672. openvpn --genkey --secret /etc/openvpn/tls-crypt.key
  673. ;;
  674. 2)
  675. # Generate tls-auth key
  676. openvpn --genkey --secret /etc/openvpn/tls-auth.key
  677. ;;
  678. esac
  679. # Move all the generated files
  680. cp pki/ca.crt pki/private/ca.key "pki/issued/$SERVER_NAME.crt" "pki/private/$SERVER_NAME.key" /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
  681. if [[ $DH_TYPE == "2" ]]; then
  682. cp dh.pem /etc/openvpn
  683. fi
  684. # Make cert revocation list readable for non-root
  685. chmod 644 /etc/openvpn/crl.pem
  686. # Generate server.conf
  687. echo "port $PORT" > /etc/openvpn/server.conf
  688. if [[ "$IPV6_SUPPORT" = 'n' ]]; then
  689. echo "proto $PROTOCOL" >> /etc/openvpn/server.conf
  690. elif [[ "$IPV6_SUPPORT" = 'y' ]]; then
  691. echo "proto ${PROTOCOL}6" >> /etc/openvpn/server.conf
  692. fi
  693. echo "dev tun
  694. user nobody
  695. group $NOGROUP
  696. persist-key
  697. persist-tun
  698. keepalive 10 120
  699. topology subnet
  700. server 10.8.0.0 255.255.255.0
  701. ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
  702. # DNS resolvers
  703. case $DNS in
  704. 1)
  705. # Locate the proper resolv.conf
  706. # Needed for systems running systemd-resolved
  707. if grep -q "127.0.0.53" "/etc/resolv.conf"; then
  708. RESOLVCONF='/run/systemd/resolve/resolv.conf'
  709. else
  710. RESOLVCONF='/etc/resolv.conf'
  711. fi
  712. # Obtain the resolvers from resolv.conf and use them for OpenVPN
  713. grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read -r line; do
  714. echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf
  715. done
  716. ;;
  717. 2)
  718. echo 'push "dhcp-option DNS 10.8.0.1"' >> /etc/openvpn/server.conf
  719. ;;
  720. 3) # Cloudflare
  721. echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf
  722. echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server.conf
  723. ;;
  724. 4) # Quad9
  725. echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf
  726. echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server.conf
  727. ;;
  728. 5) # Quad9 uncensored
  729. echo 'push "dhcp-option DNS 9.9.9.10"' >> /etc/openvpn/server.conf
  730. echo 'push "dhcp-option DNS 149.112.112.10"' >> /etc/openvpn/server.conf
  731. ;;
  732. 6) # FDN
  733. echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf
  734. echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf
  735. ;;
  736. 7) # DNS.WATCH
  737. echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf
  738. echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf
  739. ;;
  740. 8) # OpenDNS
  741. echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf
  742. echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf
  743. ;;
  744. 9) # Google
  745. echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf
  746. echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf
  747. ;;
  748. 10) # Yandex Basic
  749. echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf
  750. echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf
  751. ;;
  752. 11) # AdGuard DNS
  753. echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf
  754. echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf
  755. ;;
  756. 12) # Custom DNS
  757. echo "push \"dhcp-option DNS $DNS1\"" >> /etc/openvpn/server.conf
  758. if [[ "$DNS2" != "" ]]; then
  759. echo "push \"dhcp-option DNS $DNS2\"" >> /etc/openvpn/server.conf
  760. fi
  761. ;;
  762. esac
  763. echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf
  764. # IPv6 network settings if needed
  765. if [[ "$IPV6_SUPPORT" = 'y' ]]; then
  766. echo 'server-ipv6 fd42:42:42:42::/112
  767. tun-ipv6
  768. push tun-ipv6
  769. push "route-ipv6 2000::/3"
  770. push "redirect-gateway ipv6"' >> /etc/openvpn/server.conf
  771. fi
  772. if [[ $COMPRESSION_ENABLED == "y" ]]; then
  773. echo "compress $COMPRESSION_ALG" >> /etc/openvpn/server.conf
  774. fi
  775. if [[ $DH_TYPE == "1" ]]; then
  776. echo "dh none" >> /etc/openvpn/server.conf
  777. echo "ecdh-curve $DH_CURVE" >> /etc/openvpn/server.conf
  778. elif [[ $DH_TYPE == "2" ]]; then
  779. echo "dh dh.pem" >> /etc/openvpn/server.conf
  780. fi
  781. case $TLS_SIG in
  782. 1)
  783. echo "tls-crypt tls-crypt.key 0" >> /etc/openvpn/server.conf
  784. ;;
  785. 2)
  786. echo "tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf
  787. ;;
  788. esac
  789. echo "crl-verify crl.pem
  790. ca ca.crt
  791. cert $SERVER_NAME.crt
  792. key $SERVER_NAME.key
  793. auth $HMAC_ALG
  794. cipher $CIPHER
  795. ncp-ciphers $CIPHER
  796. tls-server
  797. tls-version-min 1.2
  798. tls-cipher $CC_CIPHER
  799. status /var/log/openvpn/status.log
  800. verb 3" >> /etc/openvpn/server.conf
  801. # Create log dir
  802. mkdir -p /var/log/openvpn
  803. # Enable routing
  804. echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf
  805. if [[ "$IPV6_SUPPORT" = 'y' ]]; then
  806. echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf
  807. fi
  808. # Apply sysctl rules
  809. sysctl --system
  810. # If SELinux is enabled and a custom port was selected, we need this
  811. if hash sestatus 2>/dev/null; then
  812. if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  813. if [[ "$PORT" != '1194' ]]; then
  814. semanage port -a -t openvpn_port_t -p "$PROTOCOL" "$PORT"
  815. fi
  816. fi
  817. fi
  818. # Finally, restart and enable OpenVPN
  819. if [[ "$OS" = 'arch' || "$OS" = 'fedora' ]]; then
  820. # Don't modify package-provided service
  821. cp /usr/lib/systemd/system/openvpn-server@.service /etc/systemd/system/openvpn-server@.service
  822. # Workaround to fix OpenVPN service on OpenVZ
  823. sed -i 's|LimitNPROC|#LimitNPROC|' /etc/systemd/system/openvpn-server@.service
  824. # Another workaround to keep using /etc/openvpn/
  825. sed -i 's|/etc/openvpn/server|/etc/openvpn|' /etc/systemd/system/openvpn-server@.service
  826. # On fedora, the service hardcodes the ciphers. We want to manage the cipher ourselves, so we remove it from the service
  827. if [[ "$OS" == "fedora" ]];then
  828. sed -i 's|--cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC||' /etc/systemd/system/openvpn-server@.service
  829. fi
  830. systemctl daemon-reload
  831. systemctl restart openvpn-server@server
  832. systemctl enable openvpn-server@server
  833. elif [[ "$OS" == "ubuntu" ]] && [[ "$VERSION_ID" == "16.04" ]]; then
  834. # On Ubuntu 16.04, we use the package from the OpenVPN repo
  835. # This package uses a sysvinit service
  836. systemctl enable openvpn
  837. systemctl start openvpn
  838. else
  839. # Don't modify package-provided service
  840. cp /lib/systemd/system/openvpn\@.service /etc/systemd/system/openvpn\@.service
  841. # Workaround to fix OpenVPN service on OpenVZ
  842. sed -i 's|LimitNPROC|#LimitNPROC|' /etc/systemd/system/openvpn\@.service
  843. # Another workaround to keep using /etc/openvpn/
  844. sed -i 's|/etc/openvpn/server|/etc/openvpn|' /etc/systemd/system/openvpn\@.service
  845. systemctl daemon-reload
  846. systemctl restart openvpn@server
  847. systemctl enable openvpn@server
  848. fi
  849. if [[ $DNS == 2 ]];then
  850. installUnbound
  851. fi
  852. # Add iptables rules in two scripts
  853. mkdir /etc/iptables
  854. # Script to add rules
  855. echo "#!/bin/sh
  856. iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE
  857. iptables -I INPUT 1 -i tun0 -j ACCEPT
  858. iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
  859. iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
  860. iptables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh
  861. if [[ "$IPV6_SUPPORT" = 'y' ]]; then
  862. echo "ip6tables -t nat -I POSTROUTING 1 -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
  863. ip6tables -I INPUT 1 -i tun0 -j ACCEPT
  864. ip6tables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
  865. ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh
  866. fi
  867. # Script to remove rules
  868. echo "#!/bin/sh
  869. iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
  870. iptables -D INPUT -i tun0 -j ACCEPT
  871. iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
  872. iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
  873. iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh
  874. if [[ "$IPV6_SUPPORT" = 'y' ]]; then
  875. echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
  876. ip6tables -D INPUT -i tun0 -j ACCEPT
  877. ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT
  878. ip6tables -D FORWARD -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh
  879. fi
  880. chmod +x /etc/iptables/add-openvpn-rules.sh
  881. chmod +x /etc/iptables/rm-openvpn-rules.sh
  882. # Handle the rules via a systemd script
  883. echo "[Unit]
  884. Description=iptables rules for OpenVPN
  885. Before=network-online.target
  886. Wants=network-online.target
  887. [Service]
  888. Type=oneshot
  889. ExecStart=/etc/iptables/add-openvpn-rules.sh
  890. ExecStop=/etc/iptables/rm-openvpn-rules.sh
  891. RemainAfterExit=yes
  892. [Install]
  893. WantedBy=multi-user.target" > /etc/systemd/system/iptables-openvpn.service
  894. # Enable service and apply rules
  895. systemctl daemon-reload
  896. systemctl enable iptables-openvpn
  897. systemctl start iptables-openvpn
  898. # If the server is behind a NAT, use the correct IP address for the clients to connect to
  899. if [[ "$ENDPOINT" != "" ]]; then
  900. IP=$ENDPOINT
  901. fi
  902. # client-template.txt is created so we have a template to add further users later
  903. echo "client" > /etc/openvpn/client-template.txt
  904. if [[ "$PROTOCOL" = 'udp' ]]; then
  905. echo "proto udp" >> /etc/openvpn/client-template.txt
  906. elif [[ "$PROTOCOL" = 'tcp' ]]; then
  907. echo "proto tcp-client" >> /etc/openvpn/client-template.txt
  908. fi
  909. echo "remote $IP $PORT
  910. dev tun
  911. resolv-retry infinite
  912. nobind
  913. persist-key
  914. persist-tun
  915. remote-cert-tls server
  916. verify-x509-name $SERVER_NAME name
  917. auth $HMAC_ALG
  918. auth-nocache
  919. cipher $CIPHER
  920. tls-client
  921. tls-version-min 1.2
  922. tls-cipher $CC_CIPHER
  923. setenv opt block-outside-dns # Prevent Windows 10 DNS leak
  924. verb 3" >> /etc/openvpn/client-template.txt
  925. if [[ $COMPRESSION_ENABLED == "y" ]]; then
  926. echo "compress $COMPRESSION_ALG" >> /etc/openvpn/client-template.txt
  927. fi
  928. # Generate the custom client.ovpn
  929. newClient
  930. echo "If you want to add more clients, you simply need to run this script another time!"
  931. }
  932. function newClient () {
  933. echo ""
  934. echo "Tell me a name for the client."
  935. echo "Use one word only, no special characters."
  936. until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
  937. read -rp "Client name: " -e CLIENT
  938. done
  939. echo ""
  940. echo "Do you want to protect the configuration file with a password?"
  941. echo "(e.g. encrypt the private key with a password)"
  942. echo " 1) Add a passwordless client"
  943. echo " 2) Use a password for the client"
  944. until [[ "$PASS" =~ ^[1-2]$ ]]; do
  945. read -rp "Select an option [1-2]: " -e -i 1 PASS
  946. done
  947. cd /etc/openvpn/easy-rsa/ || return
  948. case $PASS in
  949. 1)
  950. ./easyrsa build-client-full "$CLIENT" nopass
  951. ;;
  952. 2)
  953. echo "⚠️ You will be asked for the client password below ⚠️"
  954. ./easyrsa build-client-full "$CLIENT"
  955. ;;
  956. esac
  957. # Home directory of the user, where the client configuration (.ovpn) will be written
  958. if [ -e "/home/$CLIENT" ]; then # if $1 is a user name
  959. homeDir="/home/$CLIENT"
  960. elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER
  961. homeDir="/home/${SUDO_USER}"
  962. else # if not SUDO_USER, use /root
  963. homeDir="/root"
  964. fi
  965. # Determine if we use tls-auth or tls-crypt
  966. if grep -qs "^tls-crypt" /etc/openvpn/server.conf; then
  967. TLS_SIG="1"
  968. elif grep -qs "^tls-auth" /etc/openvpn/server.conf; then
  969. TLS_SIG="2"
  970. fi
  971. # Generates the custom client.ovpn
  972. cp /etc/openvpn/client-template.txt "$homeDir/$CLIENT.ovpn"
  973. {
  974. echo "<ca>"
  975. cat "/etc/openvpn/easy-rsa/pki/ca.crt"
  976. echo "</ca>"
  977. echo "<cert>"
  978. awk '/BEGIN/,/END/' "/etc/openvpn/easy-rsa/pki/issued/$CLIENT.crt"
  979. echo "</cert>"
  980. echo "<key>"
  981. cat "/etc/openvpn/easy-rsa/pki/private/$CLIENT.key"
  982. echo "</key>"
  983. case $TLS_SIG in
  984. 1)
  985. echo "<tls-crypt>"
  986. cat /etc/openvpn/tls-crypt.key
  987. echo "</tls-crypt>"
  988. ;;
  989. 2)
  990. echo "key-direction 1"
  991. echo "<tls-auth>"
  992. cat /etc/openvpn/tls-auth.key
  993. echo "</tls-auth>"
  994. ;;
  995. esac
  996. } >> "$homeDir/$CLIENT.ovpn"
  997. echo ""
  998. echo "Client $CLIENT added, the configuration file is available at $homeDir/$CLIENT.ovpn."
  999. echo "Download the .ovpn file and import it in your OpenVPN client."
  1000. exit 0
  1001. }
  1002. function revokeClient () {
  1003. NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V")
  1004. if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
  1005. echo ""
  1006. echo "You have no existing clients!"
  1007. exit 1
  1008. fi
  1009. echo ""
  1010. echo "Select the existing client certificate you want to revoke"
  1011. tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
  1012. if [[ "$NUMBEROFCLIENTS" = '1' ]]; then
  1013. read -rp "Select one client [1]: " CLIENTNUMBER
  1014. else
  1015. read -rp "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
  1016. fi
  1017. CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
  1018. cd /etc/openvpn/easy-rsa/
  1019. ./easyrsa --batch revoke "$CLIENT"
  1020. EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
  1021. # Cleanup
  1022. rm -f "pki/reqs/$CLIENT.req"
  1023. rm -f "pki/private/$CLIENT.key"
  1024. rm -f "pki/issued/$CLIENT.crt"
  1025. rm -f /etc/openvpn/crl.pem
  1026. cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
  1027. chmod 644 /etc/openvpn/crl.pem
  1028. find /home/ -maxdepth 2 -name "$CLIENT.ovpn" -delete
  1029. rm -f "/root/$CLIENT.ovpn"
  1030. sed -i "s|^$CLIENT,.*||" /etc/openvpn/ipp.txt
  1031. echo ""
  1032. echo "Certificate for client $CLIENT revoked."
  1033. }
  1034. function removeUnbound () {
  1035. # Remove OpenVPN-related config
  1036. sed -i 's|include: \/etc\/unbound\/openvpn.conf||' /etc/unbound/unbound.conf
  1037. rm /etc/unbound/openvpn.conf
  1038. systemctl restart unbound
  1039. until [[ $REMOVE_UNBOUND =~ (y|n) ]]; do
  1040. echo ""
  1041. echo "If you were already using Unbound before installing OpenVPN, I removed the configuration related to OpenVPN."
  1042. read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND
  1043. done
  1044. if [[ "$REMOVE_UNBOUND" = 'y' ]]; then
  1045. # Stop Unbound
  1046. systemctl stop unbound
  1047. if [[ "$OS" =~ (debian|ubuntu) ]]; then
  1048. apt-get autoremove --purge -y unbound
  1049. elif [[ "$OS" = 'arch' ]]; then
  1050. pacman --noconfirm -R unbound
  1051. elif [[ "$OS" =~ (centos|amzn) ]]; then
  1052. yum remove -y unbound
  1053. elif [[ "$OS" = 'fedora' ]]; then
  1054. dnf remove -y unbound
  1055. fi
  1056. rm -rf /etc/unbound/
  1057. echo ""
  1058. echo "Unbound removed!"
  1059. else
  1060. echo ""
  1061. echo "Unbound wasn't removed."
  1062. fi
  1063. }
  1064. function removeOpenVPN () {
  1065. echo ""
  1066. read -rp "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE
  1067. if [[ "$REMOVE" = 'y' ]]; then
  1068. # Get OpenVPN port from the configuration
  1069. PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
  1070. # Stop OpenVPN
  1071. if [[ "$OS" =~ (fedora|arch) ]]; then
  1072. systemctl disable openvpn-server@server
  1073. systemctl stop openvpn-server@server
  1074. # Remove customised service
  1075. rm /etc/systemd/system/openvpn-server@.service
  1076. elif [[ "$OS" == "ubuntu" ]] && [[ "$VERSION_ID" == "16.04" ]]; then
  1077. systemctl disable openvpn
  1078. systemctl stop openvpn
  1079. else
  1080. systemctl disable openvpn@server
  1081. systemctl stop openvpn@server
  1082. # Remove customised service
  1083. rm /etc/systemd/system/openvpn\@.service
  1084. fi
  1085. # Remove the iptables rules related to the script
  1086. systemctl stop iptables-openvpn
  1087. # Cleanup
  1088. systemctl disable iptables-openvpn
  1089. rm /etc/systemd/system/iptables-openvpn.service
  1090. systemctl daemon-reload
  1091. rm /etc/iptables/add-openvpn-rules.sh
  1092. rm /etc/iptables/rm-openvpn-rules.sh
  1093. # SELinux
  1094. if hash sestatus 2>/dev/null; then
  1095. if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  1096. if [[ "$PORT" != '1194' ]]; then
  1097. semanage port -d -t openvpn_port_t -p udp "$PORT"
  1098. fi
  1099. fi
  1100. fi
  1101. if [[ "$OS" =~ (debian|ubuntu) ]]; then
  1102. apt-get autoremove --purge -y openvpn
  1103. if [[ -e /etc/apt/sources.list.d/openvpn.list ]];then
  1104. rm /etc/apt/sources.list.d/openvpn.list
  1105. apt-get update
  1106. fi
  1107. elif [[ "$OS" = 'arch' ]]; then
  1108. pacman --noconfirm -R openvpn
  1109. elif [[ "$OS" =~ (centos|amzn) ]]; then
  1110. yum remove -y openvpn
  1111. elif [[ "$OS" = 'fedora' ]]; then
  1112. dnf remove -y openvpn
  1113. fi
  1114. # Cleanup
  1115. find /home/ -maxdepth 2 -name "*.ovpn" -delete
  1116. find /root/ -maxdepth 1 -name "*.ovpn" -delete
  1117. rm -rf /etc/openvpn
  1118. rm -rf /usr/share/doc/openvpn*
  1119. rm -f /etc/sysctl.d/20-openvpn.conf
  1120. rm -rf /var/log/openvpn
  1121. # Unbound
  1122. if [[ -e /etc/unbound/openvpn.conf ]]; then
  1123. removeUnbound
  1124. fi
  1125. echo ""
  1126. echo "OpenVPN removed!"
  1127. else
  1128. echo ""
  1129. echo "Removal aborted!"
  1130. fi
  1131. }
  1132. function manageMenu () {
  1133. clear
  1134. echo "Welcome to OpenVPN-install!"
  1135. echo ""
  1136. echo "It looks like OpenVPN is already installed."
  1137. echo ""
  1138. echo "What do you want to do?"
  1139. echo " 1) Add a new user"
  1140. echo " 2) Revoke existing user"
  1141. echo " 3) Remove OpenVPN"
  1142. echo " 4) Exit"
  1143. until [[ "$MENU_OPTION" =~ ^[1-4]$ ]]; do
  1144. read -rp "Select an option [1-4]: " MENU_OPTION
  1145. done
  1146. case $MENU_OPTION in
  1147. 1)
  1148. newClient
  1149. ;;
  1150. 2)
  1151. revokeClient
  1152. ;;
  1153. 3)
  1154. removeOpenVPN
  1155. ;;
  1156. 4)
  1157. exit 0
  1158. ;;
  1159. esac
  1160. }
  1161. # Check for root, TUN, OS...
  1162. initialCheck
  1163. # Check if OpenVPN is already installed
  1164. if [[ -e /etc/openvpn/server.conf ]]; then
  1165. manageMenu
  1166. else
  1167. installOpenVPN
  1168. fi
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!