mirror/openvpn-install
1
0
Fork 0
mirror of https://github.com/Nyr/openvpn-install.git synced 2024-11-24 05:56:08 +03:00
Code Issues Projects Releases Wiki Activity

Fix indentation

Browse Source
This commit is contained in:
Julien Reichardt 2015-12-13 11:58:31 +01:00
parent 2cd35e883e
commit 6e6f5c3f7b
1 changed files with 36 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
openvpn-install.sh
View File

@ -12,19 +12,20 @@
if [ "$(id -u)" != "0" ] if [ "$(id -u)" != "0" ]
then then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit 1 exit 1
fi fi
if [ ! -e /dev/net/tun ] if [ ! -e /dev/net/tun ]
then then
echo "TUN/TAP is not available" echo "TUN/TAP is not available"
exit 2 exit 2
fi fi
if grep -qs "CentOS release 5" "/etc/redhat-release" if grep -qs "CentOS release 5" "/etc/redhat-release"
then echo "CentOS 5 is too old and not supported" then
echo "CentOS 5 is too old and not supported"
exit 3 exit 3
fi fi
@ -49,8 +50,9 @@ pidof /sbin/init && INITSYS=sysvinit
# Return the PID of systemd if running # Return the PID of systemd if running
pidof systemd && INITSYS=systemd pidof systemd && INITSYS=systemd
if [ "$INITSYS" = "" ] if [ "$INITSYS" = "" ]
then echo "Your init system isn't supported" then
exit 5 echo "Your init system isn't supported"
exit 5
fi fi
newclient() { newclient() {
@ -72,7 +74,7 @@ newclient() {
# and to avoid getting an IPv6. # and to avoid getting an IPv6.
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
if [ "$IP" = "" ] if [ "$IP" = "" ]
then IP=$(wget -qO- ipv4.icanhazip.com) then IP=$(wget -qO- ipv4.icanhazip.com)
fi fi
if [ -e /etc/openvpn/server.conf ] if [ -e /etc/openvpn/server.conf ]
@ -93,8 +95,8 @@ then
echo "" echo ""
echo "Tell me a name for the client cert" echo "Tell me a name for the client cert"
echo "Please, use one word only, no special characters" echo "Please, use one word only, no special characters"
read -p "Client name: client " CLIENT read -p "Client name: client " CLIENT
CLIENT=${CLIENT:-client} CLIENT=${CLIENT:-client}
cd /etc/openvpn/easy-rsa/ cd /etc/openvpn/easy-rsa/
./easyrsa build-client-full $CLIENT nopass ./easyrsa build-client-full $CLIENT nopass
# Generates the custom client.ovpn # Generates the custom client.ovpn
@ -107,7 +109,7 @@ then
# ...but what can I say, I want some sleep too # ...but what can I say, I want some sleep too
NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V")
if [ "$NUMBEROFCLIENTS" = 0 ] if [ "$NUMBEROFCLIENTS" = 0 ]
then then
echo "" echo ""
echo "You have no existing clients!" echo "You have no existing clients!"
exit 5 exit 5
@ -116,7 +118,7 @@ then
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke"
tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
if [ "$NUMBEROFCLIENTS" = 1 ] if [ "$NUMBEROFCLIENTS" = 1 ]
then read -p "Select one client [1]: " CLIENTNUMBER then read -p "Select one client [1]: " CLIENTNUMBER
else else
read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
fi fi
@ -126,18 +128,18 @@ then
./easyrsa gen-crl ./easyrsa gen-crl
# And restart # And restart
if [ $INITSYS = systemd ] if [ $INITSYS = systemd ]
then systemctl restart openvpn@server.service then systemctl restart openvpn@server.service
else else
service openvpn restart service openvpn restart
fi fi
echo "" echo ""
echo "Certificate for client $CLIENT revoked" echo "Certificate for client $CLIENT revoked"
exit;; exit;;
3) 3)
echo "" echo ""
read -p "Do you really want to remove OpenVPN? [N/y]: " REMOVE read -p "Do you really want to remove OpenVPN? [N/y]: " REMOVE
if [ $REMOVE = y ] if [ $REMOVE = y ]
then PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) then PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
if pgrep firewalld if pgrep firewalld
then # Using both permanent and not permanent rules to avoid a firewalld reload. then # Using both permanent and not permanent rules to avoid a firewalld reload.
firewall-cmd --zone=public --remove-port=$PORT/udp firewall-cmd --zone=public --remove-port=$PORT/udp
@ -153,7 +155,7 @@ then
fi fi
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
if [ $OS = debian ] if [ $OS = debian ]
then apt-get remove --purge -y openvpn openvpn-blacklist then apt-get remove --purge -y openvpn openvpn-blacklist
else else
yum remove openvpn -y yum remove openvpn -y
fi fi
@ -179,12 +181,12 @@ else
echo "" echo ""
echo "First I need to know the IPv4 address of the network interface you want OpenVPN" echo "First I need to know the IPv4 address of the network interface you want OpenVPN"
echo "listening to." echo "listening to."
read -p "IP address: $IP " IP read -p "IP address: $IP " IP
IP=${IP:-$IP} IP=${IP:-$IP}
echo "" echo ""
echo "What port do you want for OpenVPN?" echo "What port do you want for OpenVPN?"
read -p "Port: 1194 " PORT read -p "Port: 1194 " PORT
PORT=${PORT:-1194} PORT=${PORT:-1194}
echo "" echo ""
echo "What DNS do you want to use with the VPN?" echo "What DNS do you want to use with the VPN?"
echo " 1) Current system resolvers" echo " 1) Current system resolvers"
@ -194,18 +196,18 @@ else
echo " 5) Hurricane Electric" echo " 5) Hurricane Electric"
echo " 6) Google" echo " 6) Google"
read -p "DNS [1-6]: 1 " DNS read -p "DNS [1-6]: 1 " DNS
DNS=${DNS:-1} DNS=${DNS:-1}
echo "" echo ""
echo "Finally, tell me your name for the client cert" echo "Finally, tell me your name for the client cert"
echo "Please, use one word only, no special characters" echo "Please, use one word only, no special characters"
read -p "Client name: client " CLIENT read -p "Client name: client " CLIENT
CLIENT=${CLIENT:-client} CLIENT=${CLIENT:-client}
echo "" echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
echo "Press [ENTER] to continue... \c" echo "Press [ENTER] to continue... \c "
read read
if [ $OS = debian ] if [ $OS = debian ]
then then
apt-get update apt-get update
apt-get install openvpn iptables openssl ca-certificates -y apt-get install openvpn iptables openssl ca-certificates -y
else else
@ -215,7 +217,7 @@ else
fi fi
# An old version of easy-rsa was available by default in some openvpn packages # An old version of easy-rsa was available by default in some openvpn packages
if [ -d /etc/openvpn/easy-rsa/ ] if [ -d /etc/openvpn/easy-rsa/ ]
then rm -rf /etc/openvpn/easy-rsa/ then rm -rf /etc/openvpn/easy-rsa/
fi fi
# Get easy-rsa # Get easy-rsa
wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz
@ -318,12 +320,12 @@ crl-verify /etc/openvpn/easy-rsa/pki/crl.pem" >> /etc/openvpn/server.conf
fi fi
# And finally, restart OpenVPN # And finally, restart OpenVPN
if [ $INITSYS = systemd ] if [ $INITSYS = systemd ]
then # Little hack to check for systemd then
systemctl restart openvpn@server.service systemctl restart openvpn@server.service
systemctl enable openvpn@server.service systemctl enable openvpn@server.service
else else
service openvpn restart service openvpn restart
chkconfig openvpn on chkconfig openvpn on
fi fi
# Try to detect a NATed connection and ask about it to potential LowEndSpirit users # Try to detect a NATed connection and ask about it to potential LowEndSpirit users
EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) EXTERNALIP=$(wget -qO- ipv4.icanhazip.com)
@ -336,7 +338,7 @@ crl-verify /etc/openvpn/easy-rsa/pki/crl.pem" >> /etc/openvpn/server.conf
echo "If that's not the case, just ignore this and leave the next field blank" echo "If that's not the case, just ignore this and leave the next field blank"
read -p "External IP: " USEREXTERNALIP read -p "External IP: " USEREXTERNALIP
if [ "$USEREXTERNALIP" != "" ] if [ "$USEREXTERNALIP" != "" ]
then echo IP=$USEREXTERNALIP then echo IP=$USEREXTERNALIP
fi fi
fi fi
# client-common.txt is created so we have a template to add further users later # client-common.txt is created so we have a template to add further users later