mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2025-01-31 20:41:42 +03:00
Code Issues Projects Releases Wiki Activity

Cleanup

Browse Source 
- Improve display of Libreswan versions in upgrade scripts
- Clean up notes
This commit is contained in:
hwdsl2 2018-09-16 21:36:49 -05:00
parent dfc5fce92c
commit 329a5ecf50
2 changed files with 72 additions and 56 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
extras/vpnupgrade.sh
View File

@ -58,6 +58,7 @@ if [ "$swan_ver_is_supported" != "1" ]; then
fi fi
ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)" ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)"
ipsec_ver_short="$(printf '%s' "$ipsec_ver" | sed -e 's/Linux Libreswan/Libreswan/' -e 's/ (netkey) on .*//')"
if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then
exiterr "This script requires Libreswan already installed." exiterr "This script requires Libreswan already installed."
fi fi
@ -105,8 +106,8 @@ Additional packages required for compilation will also be installed.
It is intended for upgrading servers to a newer Libreswan version. It is intended for upgrading servers to a newer Libreswan version.
Current version: $ipsec_ver Current version: $ipsec_ver_short
Version to be installed: Libreswan $SWAN_VER Version to install: Libreswan $SWAN_VER
EOF EOF
@ -114,8 +115,8 @@ case "$SWAN_VER" in
3.2[35]) 3.2[35])
cat <<'EOF' cat <<'EOF'
WARNING: Libreswan 3.23 and 3.25 have an issue with connecting multiple WARNING: Libreswan 3.23 and 3.25 have an issue with connecting multiple
IPsec/XAuth VPN clients from behind the same NAT (e.g. home router). IPsec/XAuth VPN clients from behind the same NAT (e.g. home router).
DO NOT upgrade to 3.23/3.25 if your use cases include the above. DO NOT upgrade to 3.23/3.25 if your use cases include the above.
EOF EOF
;; ;;
@ -123,15 +124,15 @@ esac
cat <<'EOF' cat <<'EOF'
NOTE: Libreswan versions 3.19 and newer require some configuration changes. NOTE: Libreswan versions 3.19 and newer require some configuration changes.
This script will make the following updates to your /etc/ipsec.conf: This script will make the following updates to your /etc/ipsec.conf:
1. Replace "auth=esp" with "phase2=esp" 1. Replace "auth=esp" with "phase2=esp"
2. Replace "forceencaps=yes" with "encapsulation=yes" 2. Replace "forceencaps=yes" with "encapsulation=yes"
3. Consolidate VPN ciphers for "ike=" and "phase2alg=", 3. Consolidate VPN ciphers for "ike=" and "phase2alg=",
re-add "MODP1024" to the list of allowed "ike=" ciphers, re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from the defaults in Libreswan 3.19. which was removed from the defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
EOF EOF
@ -211,40 +212,47 @@ sed -i".old-$(date +%F-%T)" \
mkdir -p /run/pluto mkdir -p /run/pluto
service ipsec restart service ipsec restart
echo cat <<EOF
echo "Libreswan $SWAN_VER was installed successfully! "
echo
===================================================
Libreswan $SWAN_VER has been successfully installed!
===================================================
EOF
if [ "$is_upgrade_to_323_or_newer" = "1" ]; then if [ "$is_upgrade_to_323_or_newer" = "1" ]; then
cat <<'EOF' cat <<'EOF'
IMPORTANT: Users upgrading to Libreswan 3.23 or newer must edit IMPORTANT: Users upgrading to Libreswan 3.23 or newer must edit /etc/ipsec.conf
/etc/ipsec.conf and replace these two lines: and replace these two lines:
modecfgdns1=DNS_SERVER_1 modecfgdns1=DNS_SERVER_1
modecfgdns2=DNS_SERVER_2 modecfgdns2=DNS_SERVER_2
with a single line like this: with a single line like this:
modecfgdns="DNS_SERVER_1, DNS_SERVER_2" modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
Then run "service ipsec restart". Then run "service ipsec restart".
EOF EOF
fi fi
if [ "$is_downgrade_to_322_or_older" = "1" ]; then if [ "$is_downgrade_to_322_or_older" = "1" ]; then
cat <<'EOF' cat <<'EOF'
IMPORTANT: Users downgrading to Libreswan 3.22 or older must edit IMPORTANT: Users downgrading to Libreswan 3.22 or older must edit /etc/ipsec.conf
/etc/ipsec.conf and replace this line: and replace this line:
modecfgdns="DNS_SERVER_1, DNS_SERVER_2" modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
with two lines like this: with two lines like this:
modecfgdns1=DNS_SERVER_1 modecfgdns1=DNS_SERVER_1
modecfgdns2=DNS_SERVER_2 modecfgdns2=DNS_SERVER_2
Then run "service ipsec restart". Then run "service ipsec restart".
EOF EOF
fi fi

64
extras/vpnupgrade_centos.sh
View File

@ -49,6 +49,7 @@ if [ "$swan_ver_is_supported" != "1" ]; then
fi fi
ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)" ipsec_ver="$(/usr/local/sbin/ipsec --version 2>/dev/null)"
ipsec_ver_short="$(printf '%s' "$ipsec_ver" | sed -e 's/Linux Libreswan/Libreswan/' -e 's/ (netkey) on .*//')"
if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then if ! printf '%s' "$ipsec_ver" | grep -q "Libreswan"; then
exiterr "This script requires Libreswan already installed." exiterr "This script requires Libreswan already installed."
fi fi
@ -96,8 +97,8 @@ Additional packages required for compilation will also be installed.
It is intended for upgrading servers to a newer Libreswan version. It is intended for upgrading servers to a newer Libreswan version.
Current version: $ipsec_ver Current version: $ipsec_ver_short
Version to be installed: Libreswan $SWAN_VER Version to install: Libreswan $SWAN_VER
EOF EOF
@ -105,8 +106,8 @@ case "$SWAN_VER" in
3.2[35]) 3.2[35])
cat <<'EOF' cat <<'EOF'
WARNING: Libreswan 3.23 and 3.25 have an issue with connecting multiple WARNING: Libreswan 3.23 and 3.25 have an issue with connecting multiple
IPsec/XAuth VPN clients from behind the same NAT (e.g. home router). IPsec/XAuth VPN clients from behind the same NAT (e.g. home router).
DO NOT upgrade to 3.23/3.25 if your use cases include the above. DO NOT upgrade to 3.23/3.25 if your use cases include the above.
EOF EOF
;; ;;
@ -114,15 +115,15 @@ esac
cat <<'EOF' cat <<'EOF'
NOTE: Libreswan versions 3.19 and newer require some configuration changes. NOTE: Libreswan versions 3.19 and newer require some configuration changes.
This script will make the following updates to your /etc/ipsec.conf: This script will make the following updates to your /etc/ipsec.conf:
1. Replace "auth=esp" with "phase2=esp" 1. Replace "auth=esp" with "phase2=esp"
2. Replace "forceencaps=yes" with "encapsulation=yes" 2. Replace "forceencaps=yes" with "encapsulation=yes"
3. Consolidate VPN ciphers for "ike=" and "phase2alg=", 3. Consolidate VPN ciphers for "ike=" and "phase2alg=",
re-add "MODP1024" to the list of allowed "ike=" ciphers, re-add "MODP1024" to the list of allowed "ike=" ciphers,
which was removed from the defaults in Libreswan 3.19. which was removed from the defaults in Libreswan 3.19.
Your other VPN configuration files will not be modified. Your other VPN configuration files will not be modified.
EOF EOF
@ -212,40 +213,47 @@ sed -i".old-$(date +%F-%T)" \
mkdir -p /run/pluto mkdir -p /run/pluto
service ipsec restart service ipsec restart
echo cat <<EOF
echo "Libreswan $SWAN_VER was installed successfully! "
echo
===================================================
Libreswan $SWAN_VER has been successfully installed!
===================================================
EOF
if [ "$is_upgrade_to_323_or_newer" = "1" ]; then if [ "$is_upgrade_to_323_or_newer" = "1" ]; then
cat <<'EOF' cat <<'EOF'
IMPORTANT: Users upgrading to Libreswan 3.23 or newer must edit IMPORTANT: Users upgrading to Libreswan 3.23 or newer must edit /etc/ipsec.conf
/etc/ipsec.conf and replace these two lines: and replace these two lines:
modecfgdns1=DNS_SERVER_1 modecfgdns1=DNS_SERVER_1
modecfgdns2=DNS_SERVER_2 modecfgdns2=DNS_SERVER_2
with a single line like this: with a single line like this:
modecfgdns="DNS_SERVER_1, DNS_SERVER_2" modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
Then run "service ipsec restart". Then run "service ipsec restart".
EOF EOF
fi fi
if [ "$is_downgrade_to_322_or_older" = "1" ]; then if [ "$is_downgrade_to_322_or_older" = "1" ]; then
cat <<'EOF' cat <<'EOF'
IMPORTANT: Users downgrading to Libreswan 3.22 or older must edit IMPORTANT: Users downgrading to Libreswan 3.22 or older must edit /etc/ipsec.conf
/etc/ipsec.conf and replace this line: and replace this line:
modecfgdns="DNS_SERVER_1, DNS_SERVER_2" modecfgdns="DNS_SERVER_1, DNS_SERVER_2"
with two lines like this: with two lines like this:
modecfgdns1=DNS_SERVER_1 modecfgdns1=DNS_SERVER_1
modecfgdns2=DNS_SERVER_2 modecfgdns2=DNS_SERVER_2
Then run "service ipsec restart". Then run "service ipsec restart".
EOF EOF
fi fi