mirror/openvpn-install
1
0
Fork 0
mirror of https://github.com/Nyr/openvpn-install.git synced 2024-11-23 21:46:08 +03:00
Code Issues Projects Releases Wiki Activity

Drop privileges after initialization

Browse Source
This commit is contained in:
Nyr 2016-05-15 20:50:37 +02:00
parent c5b4907fd6
commit ae5b5ce2be
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
openvpn-install.sh
View File

@ -30,9 +30,11 @@ if grep -qs "CentOS release 5" "/etc/redhat-release"; then
fi fi
if [[ -e /etc/debian_version ]]; then if [[ -e /etc/debian_version ]]; then
OS=debian OS=debian
GROUPNAME=nogroup
RCLOCAL='/etc/rc.local' RCLOCAL='/etc/rc.local'
elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
OS=centos OS=centos
GROUPNAME=nobody
RCLOCAL='/etc/rc.d/rc.local' RCLOCAL='/etc/rc.d/rc.local'
# Needed for CentOS 7 # Needed for CentOS 7
chmod +x /etc/rc.d/rc.local chmod +x /etc/rc.d/rc.local
@ -118,6 +120,8 @@ if [[ -e /etc/openvpn/server.conf ]]; then
rm -rf pki/issued/$CLIENT.crt rm -rf pki/issued/$CLIENT.crt
rm -rf /etc/openvpn/crl.pem rm -rf /etc/openvpn/crl.pem
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem
echo "" echo ""
echo "Certificate for client $CLIENT revoked" echo "Certificate for client $CLIENT revoked"
exit exit
@ -224,6 +228,8 @@ else
./easyrsa gen-crl ./easyrsa gen-crl
# Move the stuff we need # Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
# CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:$GROUPNAME /etc/openvpn/crl.pem
# Generate key for tls-auth # Generate key for tls-auth
openvpn --genkey --secret /etc/openvpn/ta.key openvpn --genkey --secret /etc/openvpn/ta.key
# Generate server.conf # Generate server.conf
@ -271,6 +277,8 @@ ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf
esac esac
echo "keepalive 10 120 echo "keepalive 10 120
comp-lzo comp-lzo
user nobody
group $GROUPNAME
persist-key persist-key
persist-tun persist-tun
status openvpn-status.log status openvpn-status.log