diff --git a/extras/vpnupgrade_Libreswan.sh b/extras/vpnupgrade_Libreswan.sh index f36f7ab..d8263e9 100644 --- a/extras/vpnupgrade_Libreswan.sh +++ b/extras/vpnupgrade_Libreswan.sh @@ -11,7 +11,7 @@ # know how you have improved it! # Check https://libreswan.org and update version number if necessary -SWAN_VER=3.17 +swan_ver=3.17 ### Do not edit below this line @@ -39,9 +39,9 @@ if [ "$?" != "0" ]; then exit 1 fi -/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "Libreswan $SWAN_VER" +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "Libreswan $swan_ver" if [ "$?" = "0" ]; then - echo "You already have Libreswan version $SWAN_VER installed! " + echo "You already have Libreswan version $swan_ver installed! " echo printf "Do you wish to continue anyway? [y/N] " read -r response @@ -59,7 +59,7 @@ fi clear cat < Makefile.inc.local </dev/null | grep -qs "$SWAN_VER" -[ "$?" != "0" ] && { echo; echo "Libreswan $SWAN_VER failed to build. Aborting."; exit 1; } +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "$swan_ver" +[ "$?" != "0" ] && { echo; echo "Libreswan $swan_ver failed to build. Aborting."; exit 1; } echo -echo "Libreswan $SWAN_VER was installed successfully! " +echo "Libreswan $swan_ver was installed successfully! " echo exit 0 diff --git a/extras/vpnupgrade_Libreswan_centos.sh b/extras/vpnupgrade_Libreswan_centos.sh index 2991aba..5d4ecf0 100644 --- a/extras/vpnupgrade_Libreswan_centos.sh +++ b/extras/vpnupgrade_Libreswan_centos.sh @@ -11,7 +11,7 @@ # know how you have improved it! # Check https://libreswan.org and update version number if necessary -SWAN_VER=3.17 +swan_ver=3.17 ### Do not edit below this line @@ -48,9 +48,9 @@ if [ "$?" != "0" ]; then exit 1 fi -/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "Libreswan $SWAN_VER" +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "Libreswan $swan_ver" if [ "$?" = "0" ]; then - echo "You already have Libreswan version $SWAN_VER installed! " + echo "You already have Libreswan version $swan_ver installed! " echo printf "Do you wish to continue anyway? [y/N] " read -r response @@ -68,7 +68,7 @@ fi clear cat < Makefile.inc.local </dev/null service ipsec restart # Verify the install -/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "$SWAN_VER" -[ "$?" != "0" ] && { echo; echo "Libreswan $SWAN_VER failed to build. Aborting."; exit 1; } +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "$swan_ver" +[ "$?" != "0" ] && { echo; echo "Libreswan $swan_ver failed to build. Aborting."; exit 1; } echo -echo "Libreswan $SWAN_VER was installed successfully! " +echo "Libreswan $swan_ver was installed successfully! " echo exit 0 diff --git a/vpnsetup.sh b/vpnsetup.sh index 018d67e..309daea 100644 --- a/vpnsetup.sh +++ b/vpnsetup.sh @@ -150,14 +150,14 @@ apt-get -yq install xl2tpd apt-get -yq install fail2ban # Compile and install Libreswan -SWAN_VER=3.17 -SWAN_FILE="libreswan-${SWAN_VER}.tar.gz" -SWAN_URL="https://download.libreswan.org/$SWAN_FILE" -wget -t 3 -T 30 -nv -O "$SWAN_FILE" "$SWAN_URL" +swan_ver=3.17 +swan_file="libreswan-${swan_ver}.tar.gz" +swan_url="https://download.libreswan.org/$swan_file" +wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url" [ "$?" != "0" ] && { echo "Cannot download Libreswan source. Aborting."; exit 1; } -/bin/rm -rf "/opt/src/libreswan-$SWAN_VER" -tar xzf "$SWAN_FILE" && /bin/rm -f "$SWAN_FILE" -cd "libreswan-$SWAN_VER" || { echo "Cannot enter Libreswan source dir. Aborting."; exit 1; } +/bin/rm -rf "/opt/src/libreswan-$swan_ver" +tar xzf "$swan_file" && /bin/rm -f "$swan_file" +cd "libreswan-$swan_ver" || { echo "Cannot enter Libreswan source dir. Aborting."; exit 1; } # Workaround for Libreswan compile issues cat > Makefile.inc.local </dev/null | grep -qs "$SWAN_VER" -[ "$?" != "0" ] && { echo; echo "Libreswan $SWAN_VER failed to build. Aborting."; exit 1; } +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "$swan_ver" +[ "$?" != "0" ] && { echo; echo "Libreswan $swan_ver failed to build. Aborting."; exit 1; } # Create IPsec (Libreswan) config -SYS_DT="$(date +%Y-%m-%d-%H:%M:%S)" -/bin/cp -f /etc/ipsec.conf "/etc/ipsec.conf.old-$SYS_DT" 2>/dev/null +sys_dt="$(date +%Y-%m-%d-%H:%M:%S)" +/bin/cp -f /etc/ipsec.conf "/etc/ipsec.conf.old-$sys_dt" 2>/dev/null cat > /etc/ipsec.conf </dev/null +/bin/cp -f /etc/ipsec.secrets "/etc/ipsec.secrets.old-$sys_dt" 2>/dev/null cat > /etc/ipsec.secrets </dev/null +/bin/cp -f /etc/xl2tpd/xl2tpd.conf "/etc/xl2tpd/xl2tpd.conf.old-$sys_dt" 2>/dev/null cat > /etc/xl2tpd/xl2tpd.conf </dev/null +/bin/cp -f /etc/ppp/options.xl2tpd "/etc/ppp/options.xl2tpd.old-$sys_dt" 2>/dev/null cat > /etc/ppp/options.xl2tpd </dev/null +/bin/cp -f /etc/ppp/chap-secrets "/etc/ppp/chap-secrets.old-$sys_dt" 2>/dev/null cat > /etc/ppp/chap-secrets </dev/null +/bin/cp -f /etc/ipsec.d/passwd "/etc/ipsec.d/passwd.old-$sys_dt" 2>/dev/null VPN_PASSWORD_ENC=$(openssl passwd -1 "$VPN_PASSWORD") echo "${VPN_USER}:${VPN_PASSWORD_ENC}:xauth-psk" > /etc/ipsec.d/passwd # Update sysctl settings if ! grep -qs "hwdsl2 VPN script" /etc/sysctl.conf; then -/bin/cp -f /etc/sysctl.conf "/etc/sysctl.conf.old-$SYS_DT" 2>/dev/null +/bin/cp -f /etc/sysctl.conf "/etc/sysctl.conf.old-$sys_dt" 2>/dev/null cat >> /etc/sysctl.conf </dev/null +/bin/cp -f /etc/iptables.rules "/etc/iptables.rules.old-$sys_dt" 2>/dev/null service fail2ban stop >/dev/null 2>&1 if [ "$(iptables-save | grep -c '^\-')" = "0" ]; then cat > /etc/iptables.rules <> /etc/iptables.rules fi # Update rules for iptables-persistent if [ -f /etc/iptables/rules.v4 ]; then -/bin/cp -f /etc/iptables/rules.v4 "/etc/iptables/rules.v4.old-$SYS_DT" +/bin/cp -f /etc/iptables/rules.v4 "/etc/iptables/rules.v4.old-$sys_dt" /bin/cp -f /etc/iptables.rules /etc/iptables/rules.v4 fi fi # Create basic IPv6 rules if ! grep -qs "hwdsl2 VPN script" /etc/ip6tables.rules; then -/bin/cp -f /etc/ip6tables.rules "/etc/ip6tables.rules.old-$SYS_DT" 2>/dev/null +/bin/cp -f /etc/ip6tables.rules "/etc/ip6tables.rules.old-$sys_dt" 2>/dev/null cat > /etc/ip6tables.rules < /etc/ip6tables.rules </dev/null +/bin/cp -f /etc/rc.local "/etc/rc.local.old-$sys_dt" 2>/dev/null sed --follow-symlinks -i -e '/^exit 0/d' /etc/rc.local cat >> /etc/rc.local < Makefile.inc.local </dev/null | grep -qs "$SWAN_VER" -[ "$?" != "0" ] && { echo; echo "Libreswan $SWAN_VER failed to build. Aborting."; exit 1; } +/usr/local/sbin/ipsec --version 2>/dev/null | grep -qs "$swan_ver" +[ "$?" != "0" ] && { echo; echo "Libreswan $swan_ver failed to build. Aborting."; exit 1; } # Create IPsec (Libreswan) config -SYS_DT="$(date +%Y-%m-%d-%H:%M:%S)" -/bin/cp -f /etc/ipsec.conf "/etc/ipsec.conf.old-$SYS_DT" 2>/dev/null +sys_dt="$(date +%Y-%m-%d-%H:%M:%S)" +/bin/cp -f /etc/ipsec.conf "/etc/ipsec.conf.old-$sys_dt" 2>/dev/null cat > /etc/ipsec.conf </dev/null +/bin/cp -f /etc/ipsec.secrets "/etc/ipsec.secrets.old-$sys_dt" 2>/dev/null cat > /etc/ipsec.secrets </dev/null +/bin/cp -f /etc/xl2tpd/xl2tpd.conf "/etc/xl2tpd/xl2tpd.conf.old-$sys_dt" 2>/dev/null cat > /etc/xl2tpd/xl2tpd.conf </dev/null +/bin/cp -f /etc/ppp/options.xl2tpd "/etc/ppp/options.xl2tpd.old-$sys_dt" 2>/dev/null cat > /etc/ppp/options.xl2tpd </dev/null +/bin/cp -f /etc/ppp/chap-secrets "/etc/ppp/chap-secrets.old-$sys_dt" 2>/dev/null cat > /etc/ppp/chap-secrets </dev/null +/bin/cp -f /etc/ipsec.d/passwd "/etc/ipsec.d/passwd.old-$sys_dt" 2>/dev/null VPN_PASSWORD_ENC=$(openssl passwd -1 "$VPN_PASSWORD") echo "${VPN_USER}:${VPN_PASSWORD_ENC}:xauth-psk" > /etc/ipsec.d/passwd # Update sysctl settings if ! grep -qs "hwdsl2 VPN script" /etc/sysctl.conf; then -/bin/cp -f /etc/sysctl.conf "/etc/sysctl.conf.old-$SYS_DT" 2>/dev/null +/bin/cp -f /etc/sysctl.conf "/etc/sysctl.conf.old-$sys_dt" 2>/dev/null cat >> /etc/sysctl.conf </dev/null +/bin/cp -f /etc/sysconfig/iptables "/etc/sysconfig/iptables.old-$sys_dt" 2>/dev/null service fail2ban stop >/dev/null 2>&1 if [ "$(iptables-save | grep -c '^\-')" = "0" ]; then cat > /etc/sysconfig/iptables </dev/null +/bin/cp -f /etc/sysconfig/ip6tables "/etc/sysconfig/ip6tables.old-$sys_dt" 2>/dev/null cat > /etc/sysconfig/ip6tables </dev/null +/bin/cp -f /etc/rc.local "/etc/rc.local.old-$sys_dt" 2>/dev/null cat >> /etc/rc.local <