From 101d1188b1de26b09b252086fe6519c09cb788b1 Mon Sep 17 00:00:00 2001 From: Hoang Huynh Date: Thu, 27 Feb 2014 23:20:53 +0700 Subject: [PATCH 1/3] add ca$IP.crt to client conf file --- openvpn-install.sh | 29 ++++++++++++++++++----------- 1 file changed, 18 insertions(+), 11 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 5c87f16..211af81 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -1,17 +1,18 @@ #!/bin/bash # OpenVPN road warrior installer for Debian-based distros -# This script will only work on Debian-based systems. It isn't bulletproof but -# it will probably work if you simply want to setup a VPN on your Debian/Ubuntu -# VPS. It has been designed to be as unobtrusive and universal as possible. + +# TODO check for Debian-based distros +# Check for root if [ $USER != 'root' ]; then echo "Sorry, you need to run this as root" exit fi +# check for tun/tap if [ ! -e /dev/net/tun ]; then echo "TUN/TAP is not available, please enable it first (contact your provider if you don't know how)" exit @@ -45,7 +46,7 @@ if [ -e /etc/openvpn/server.conf ]; then echo "" echo "Tell me a name for the client cert" echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT + read -p "Client name: " -e CLIENT cd /etc/openvpn/easy-rsa/2.0/ source ./vars # build-key for the client @@ -54,26 +55,28 @@ if [ -e /etc/openvpn/server.conf ]; then "$EASY_RSA/pkitool" $CLIENT # Let's generate the client config mkdir ~/ovpn-$CLIENT + # add server IP to the file names to prevent duplication on client configs cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT@$IP.conf cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT/ca@$IP.crt cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT/$CLIENT@$IP.crt cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT/$CLIENT@$IP.key cd ~/ovpn-$CLIENT + sed -i "s|ca ca.crt|ca ca@$IP.crt|" $CLIENT@$IP.conf sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf - # this is the conf file for client's openvpn gui tool + # add an .ovpn file which is essentially the .conf file for client's openvpn gui tool cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key cd ~/ rm -rf ovpn-$CLIENT echo "" - echo "Client $CLIENT added, certs available at ~/ovpn-$CLIENT.tar.gz" + echo "Client $CLIENT added, certs available at `pwd`/ovpn-$CLIENT.tar.gz" exit ;; 2) echo "" echo "Tell me the existing client name" - read -p "Client name: " -e -i client CLIENT + read -p "Client name: " -e CLIENT cd /etc/openvpn/easy-rsa/2.0/ . /etc/openvpn/easy-rsa/2.0/vars . /etc/openvpn/easy-rsa/2.0/revoke-full $CLIENT @@ -93,7 +96,7 @@ if [ -e /etc/openvpn/server.conf ]; then apt-get remove --purge -y openvpn openvpn-blacklist rm -rf /etc/openvpn rm -rf /usr/share/doc/openvpn - sed -i '/--dport 53 -j REDIRECT --to-port 1194/d' /etc/rc.local + sed -i '/--dport 53 -j REDIRECT --to-port/d' /etc/rc.local sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0/d' /etc/rc.local echo "" echo "OpenVPN removed!" @@ -105,6 +108,10 @@ if [ -e /etc/openvpn/server.conf ]; then else echo 'Welcome to this quick OpenVPN "road warrior" installer' echo "" + echo "This script will only work on Debian-based systems. It isn't bulletproof but" + echo "it will probably work if you simply want to setup a VPN on your Debian/Ubuntu" + echo "VPS. It has been designed to be as unobtrusive and universal as possible." + echo "" # OpenVPN setup and first user creation echo "I need to ask you a few questions before starting the setup" echo "You can leave the default options and just press enter if you are ok with them" @@ -122,7 +129,7 @@ else echo "" echo "Finally, tell me your name for the client cert" echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT + read -p "Client name: " -e CLIENT echo "" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" read -n1 -r -p "Press any key to continue..." @@ -175,8 +182,8 @@ else sed -i "s|port 1194|port $PORT|" server.conf # Listen at port 53 too if user wants that if [ $ALTPORT = 'y' ]; then - iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194 - sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194" /etc/rc.local + iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT + sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT" /etc/rc.local fi # Enable net.ipv4.ip_forward for the system sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /etc/sysctl.conf From d5342a9e1dec46cfe41c934a003225e6b668ed64 Mon Sep 17 00:00:00 2001 From: Hoang Huynh Date: Thu, 27 Feb 2014 23:34:27 +0700 Subject: [PATCH 2/3] add IP to first client conf and cert filenames --- openvpn-install.sh | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 211af81..8c279e3 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -177,7 +177,7 @@ else # Set the server configuration sed -i 's|dh dh1024.pem|dh dh2048.pem|' server.conf sed -i 's|;push "redirect-gateway def1 bypass-dhcp"|push "redirect-gateway def1 bypass-dhcp"|' server.conf - sed -i 's|;push "dhcp-option DNS 208.67.222.222"|push "dhcp-option DNS 129.250.35.250"|' server.conf + sed -i 's|;push "dhcp-option DNS 208.67.222.222"|push "dhcp-option DNS 8.8.8.8"|' server.conf sed -i 's|;push "dhcp-option DNS 208.67.220.220"|push "dhcp-option DNS 74.82.42.42"|' server.conf sed -i "s|port 1194|port $PORT|" server.conf # Listen at port 53 too if user wants that @@ -213,14 +213,16 @@ else # IP/port set on the default client.conf so we can add further users # without asking for them sed -i "s|remote my-server-1 1194|remote $IP $PORT|" /usr/share/doc/openvpn/examples/sample-config-files/client.conf - cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT.conf - cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT - cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT - cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT + cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT@$IP.conf + cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT/ca@$IP.crt + cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT/$CLIENT@$IP.crt + cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT/$CLIENT@$IP.key cd ~/ovpn-$CLIENT - sed -i "s|cert client.crt|cert $CLIENT.crt|" $CLIENT.conf - sed -i "s|key client.key|key $CLIENT.key|" $CLIENT.conf - tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT.conf ca.crt $CLIENT.crt $CLIENT.key + sed -i "s|ca ca.crt|ca ca@$IP.crt|" $CLIENT@$IP.conf + sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf + sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf + cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn + tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key cd ~/ rm -rf ovpn-$CLIENT echo "" From 54341eaa50c96e7aae1b8bbe2b63edc64d866976 Mon Sep 17 00:00:00 2001 From: Hoang Huynh Date: Fri, 28 Feb 2014 01:03:04 +0700 Subject: [PATCH 3/3] typo --- openvpn-install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 8c279e3..c17a043 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -64,7 +64,7 @@ if [ -e /etc/openvpn/server.conf ]; then sed -i "s|ca ca.crt|ca ca@$IP.crt|" $CLIENT@$IP.conf sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf - # add an .ovpn file which is essentially the .conf file for client's openvpn gui tool + # add an .ovpn file which is essentially the .conf file for client-side openvpn GUI tool on Windows cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key cd ~/