-
Bob Mottram authoredBob Mottram authored
Code owners
Assign users and groups as approvers for specific file changes. Learn more.
freedombone-app-vpn 26.54 KiB
#!/bin/bash
#
# .---. . .
# | | |
# |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
# | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
# ' ' --' --' -' - -' ' ' -' -' -' ' - --'
#
# Freedom in the Cloud
#
# VPN functions
# https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8
# https://jamielinux.com/blog/force-all-network-traffic-through-openvpn-using-iptables/
# http://www.farrellf.com/projects/software/2016-05-04_Running_a_VPN_Server_with_OpenVPN_and_Stunnel/index_.php
#
# License
# =======
#
# Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <http://www.gnu.org/licenses/>.
VARIANTS='full full-vim'
IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=0
OPENVPN_SERVER_NAME="server"
OPENVPN_KEY_FILENAME='client.ovpn'
VPN_COUNTRY_CODE="US"
VPN_AREA="Apparent Free Speech Zone"
VPN_LOCATION="Freedomville"
VPN_ORGANISATION="Freedombone"
VPN_UNIT="Freedombone Unit"
STUNNEL_PORT=3439
VPN_TLS_PORT=553
VPN_MESH_TLS_PORT=653
vpn_variables=(MY_EMAIL_ADDRESS
DEFAULT_DOMAIN_NAME
MY_USERNAME
VPN_COUNTRY_CODE
VPN_AREA
VPN_LOCATION
VPN_ORGANISATION
VPN_UNIT
VPN_TLS_PORT)
function logging_on_vpn {
sed -i 's|status .*|status /var/log/openvpn.log|g' /etc/openvpn/server.conf
systemctl restart openvpn
}
function logging_off_vpn {
sed -i 's|status .*|status /dev/null|g' /etc/openvpn/server.conf
systemctl restart openvpn
}
function install_interactive_vpn {
read_config_param VPN_TLS_PORT
if [ ! $VPN_TLS_PORT ]; then
VPN_TLS_PORT=553
fi
VPN_DETAILS_COMPLETE=
while [ ! $VPN_DETAILS_COMPLETE ]
do
data=$(tempfile 2>/dev/null)
trap "rm -f $data" 0 1 2 5 15
currtlsport=$(grep 'VPN_TLS_PORT' temp.cfg | awk -F '=' '{print $2}')
if [ $currtlsport ]; then
VPN_TLS_PORT=$currtlsport
fi
dialog --backtitle $"Freedombone Configuration" \
--title $"VPN Configuration" \
--form $"\nPlease enter your VPN details. Changing the port to 443 will help defend against censorship but will prevent other web apps from running." 12 65 1 \
$"TLS port:" 1 1 "$VPN_TLS_PORT" 1 12 5 5 \
2> $data
sel=$?
case $sel in
1) exit 1;;
255) exit 1;;
esac
tlsport=$(cat $data | sed -n 1p)
if [ ${#tlsport} -gt 1 ]; then
if [[ "$tlsport" != *' '* && "$tlsport" != *'.'* ]]; then
VPN_TLS_PORT="$tlsport"
VPN_DETAILS_COMPLETE="yes"
write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
fi
fi
done
clear
APP_INSTALLED=1
}
function vpn_change_tls_port {
if ! grep -q "VPN-TLS" $FIREWALL_CONFIG; then
EXISTING_VPN_TLS_PORT=443
else
EXISTING_VPN_TLS_PORT=$(cat $FIREWALL_CONFIG | grep "VPN-TLS" | awk -F '=' '{print $2}')
fi
data=$(tempfile 2>/dev/null)
trap "rm -f $data" 0 1 2 5 15
dialog --title $"VPN Configuration" \
--backtitle $"Freedombone Control Panel" \
--inputbox $'Change TLS port' 10 50 $EXISTING_VPN_TLS_PORT 2>$data
sel=$?
case $sel in
0)
tlsport=$(<$data)
if [ ${#tlsport} -gt 0 ]; then
if [[ "$tlsport" != "$EXISTING_VPN_TLS_PORT" ]]; then
clear
VPN_TLS_PORT=$tlsport
write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf
sed -i "s|connect =.*|connect = :$VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/stunnel-client.conf ]; then
cp /etc/stunnel/stunnel-client.conf /home/$USERNAME/stunnel-client.conf
chown $USERNAME:$USERNAME /home/$USERNAME/stunnel-client.conf
fi
done
if [ $VPN_TLS_PORT -eq 443 ]; then
if [[ "$PREVIOUS_VPN_TLS_PORT" != "443" ]]; then
firewall_remove VPN-TLS ${EXISTING_VPN_TLS_PORT}
fi
systemctl stop nginx
systemctl disable nginx
else
if [[ "$PREVIOUS_VPN_TLS_PORT" != "$VPN_TLS_PORT" ]]; then
firewall_remove VPN-TLS ${EXISTING_VPN_TLS_PORT}
firewall_add VPN-TLS ${VPN_TLS_PORT} tcp
fi
systemctl enable nginx
systemctl restart nginx
fi
systemctl restart stunnel
if [ $VPN_TLS_PORT -eq 443 ]; then
dialog --title $"VPN Configuration" \
--msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
else
dialog --title $"VPN Configuration" \
--msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
fi
fi
fi
;;
esac
}
function vpn_regenerate_client_keys {
data=$(tempfile 2>/dev/null)
trap "rm -f $data" 0 1 2 5 15
dialog --title $"Regenerate VPN keys for a user" \
--backtitle $"Freedombone Control Panel" \
--inputbox $'username' 10 50 2>$data
sel=$?
case $sel in
0)
USERNAME=$(<$data)
if [ ${#USERNAME} -gt 0 ]; then
if [ -d /home/$USERNAME ]; then
clear
create_user_vpn_key $USERNAME
dialog --title $"Regenerate VPN keys for a user" \
--msgbox $"VPN keys were regenerated for $USERNAME" 6 60
fi
fi
;;
esac
}
function configure_interactive_vpn {
read_config_param VPN_TLS_PORT
while true
do
data=$(tempfile 2>/dev/null)
trap "rm -f $data" 0 1 2 5 15
dialog --backtitle $"Freedombone Control Panel" \
--title $"VPN Configuration" \
--radiolist $"Choose an operation:" 13 70 3 \
1 $"Change TLS port (currently $VPN_TLS_PORT)" off \
2 $"Regenerate keys for a user" off \
3 $"Exit" on 2> $data
sel=$?
case $sel in
1) return;;
255) return;;
esac
case $(cat $data) in
1) vpn_change_tls_port;;
2) vpn_regenerate_client_keys;;
3) break;;
esac
done
}
function reconfigure_vpn {
echo -n ''
}
function upgrade_vpn {
echo -n ''
}
function backup_local_vpn {
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then
cp /home/$USERNAME/$OPENVPN_KEY_FILENAME /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}
fi
done
function_check backup_directory_to_usb
backup_directory_to_usb /etc/openvpn/easy-rsa/keys vpn
backup_directory_to_usb /etc/stunnel vpnstunnel
}
function restore_local_vpn {
temp_restore_dir=/root/tempvpn
restore_directory_from_usb $temp_restore_dir vpn
if [ -d ${temp_restore_dir} ]; then
cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
cp -r ${temp_restore_dir}/dh* /etc/openvpn/
rm -rf ${temp_restore_dir}
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} ]; then
cp /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} /home/$USERNAME/$OPENVPN_KEY_FILENAME
chown $USERNAME:$USERNAME /home/$USERNAME/$OPENVPN_KEY_FILENAME
fi
done
fi
temp_restore_dir=/root/tempvpnstunnel
restore_directory_from_usb $temp_restore_dir vpnstunnel
if [ -d ${temp_restore_dir} ]; then
cp -r ${temp_restore_dir}/* /etc/stunnel
rm -rf ${temp_restore_dir}
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/stunnel.pem ]; then
cp /etc/stunnel/stunnel.pem /home/$USERNAME/stunnel.pem
chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.pem
fi
if [ -f /home/$USERNAME/stunnel.p12 ]; then
cp /etc/stunnel/stunnel.p12 /home/$USERNAME/stunnel.p12
chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.p12
fi
done
fi
}
function backup_remote_vpn {
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then
cp /home/$USERNAME/$OPENVPN_KEY_FILENAME /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}
fi
done
function_check backup_directory_to_friend
backup_directory_to_friend /etc/openvpn/easy-rsa/keys vpn
backup_directory_to_friend /etc/stunnel vpnstunnel
}
function restore_remote_vpn {
temp_restore_dir=/root/tempvpn
restore_directory_from_friend $temp_restore_dir vpn
if [ -d ${temp_restore_dir} ]; then
cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
cp -r ${temp_restore_dir}/dh* /etc/openvpn/
rm -rf ${temp_restore_dir}
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} ]; then
cp /etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME} /home/$USERNAME/$OPENVPN_KEY_FILENAME
chown $USERNAME:$USERNAME /home/$USERNAME/$OPENVPN_KEY_FILENAME
fi
done
fi
temp_restore_dir=/root/tempvpnstunnel
restore_directory_from_friend $temp_restore_dir vpnstunnel
if [ -d ${temp_restore_dir} ]; then
cp -r ${temp_restore_dir}/* /etc/stunnel
rm -rf ${temp_restore_dir}
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/stunnel.pem ]; then
cp /etc/stunnel/stunnel.pem /home/$USERNAME/stunnel.pem
chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.pem
fi
if [ -f /home/$USERNAME/stunnel.p12 ]; then
cp /etc/stunnel/stunnel.p12 /home/$USERNAME/stunnel.p12
chown $USERNAME:$USERNAME /home/$USERNAME/stunnel.p12
fi
done
fi
}
function remove_vpn {
systemctl stop stunnel
systemctl disable stunnel
rm /etc/systemd/system/stunnel.service
systemctl stop openvpn
if [ $VPN_TLS_PORT -ne 443 ]; then
firewall_remove VPN-TLS $VPN_TLS_PORT
else
systemctl enable nginx
systemctl restart nginx
fi
apt-get -yq remove --purge fastd openvpn easy-rsa
apt-get -yq remove stunnel4
if [ -d /etc/openvpn ]; then
rm -rf /etc/openvpn
fi
firewall_disable_vpn
echo 0 > /proc/sys/net/ipv4/ip_forward
sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf
remove_completion_param install_vpn
# remove any client keys
for d in /home/*/ ; do
USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
if [ -f /home/$USERNAME/$OPENVPN_KEY_FILENAME ]; then
shred -zu /home/$USERNAME/$OPENVPN_KEY_FILENAME
fi
rm /home/$USERNAME/stunnel*
done
userdel -f vpn
groupdel -f vpn
if [ -d /etc/stunnel ]; then
rm -rf /etc/stunnel
fi
}
function create_user_vpn_key {
username=$1
if [ ! -d /home/$username ]; then
return
fi
echo $"Creating VPN key for $username"
cd /etc/openvpn/easy-rsa
if [ -f /etc/openvpn/easy-rsa/keys/$username.crt ]; then
rm /etc/openvpn/easy-rsa/keys/$username.crt
fi
if [ -f /etc/openvpn/easy-rsa/keys/$username.key ]; then
rm /etc/openvpn/easy-rsa/keys/$username.key
fi
if [ -f /etc/openvpn/easy-rsa/keys/$username.csr ]; then
rm /etc/openvpn/easy-rsa/keys/$username.csr
fi
sed -i 's| --interact||g' build-key
./build-key "$username"
if [ ! -f /etc/openvpn/easy-rsa/keys/$username.crt ]; then
echo $'VPN user cert not generated'
exit 783528
fi
user_cert=$(cat /etc/openvpn/easy-rsa/keys/$username.crt)
if [ ${#user_cert} -lt 10 ]; then
cat /etc/openvpn/easy-rsa/keys/$username.crt
echo $'User cert generation failed'
exit 634659
fi
if [ ! -f /etc/openvpn/easy-rsa/keys/$username.key ]; then
echo $'VPN user key not generated'
exit 682523
fi
user_key=$(cat /etc/openvpn/easy-rsa/keys/$username.key)
if [ ${#user_key} -lt 10 ]; then
cat /etc/openvpn/easy-rsa/keys/$username.key
echo $'User key generation failed'
exit 285838
fi
user_vpn_cert_file=/home/$username/$OPENVPN_KEY_FILENAME
echo 'client' > $user_vpn_cert_file
echo 'dev tun' >> $user_vpn_cert_file
echo 'proto tcp' >> $user_vpn_cert_file
echo "remote localhost $STUNNEL_PORT" >> $user_vpn_cert_file
echo "route $DEFAULT_DOMAIN_NAME 255.255.255.255 net_gateway" >> $user_vpn_cert_file
echo 'resolv-retry infinite' >> $user_vpn_cert_file
echo 'nobind' >> $user_vpn_cert_file
echo 'tun-mtu 1500' >> $user_vpn_cert_file
echo 'tun-mtu-extra 32' >> $user_vpn_cert_file
echo 'mssfix 1450' >> $user_vpn_cert_file
echo 'persist-key' >> $user_vpn_cert_file
echo 'persist-tun' >> $user_vpn_cert_file
echo 'auth-nocache' >> $user_vpn_cert_file
echo 'remote-cert-tls server' >> $user_vpn_cert_file
echo 'comp-lzo' >> $user_vpn_cert_file
echo 'verb 3' >> $user_vpn_cert_file
echo '' >> $user_vpn_cert_file
echo '<ca>' >> $user_vpn_cert_file
cat /etc/openvpn/ca.crt >> $user_vpn_cert_file
echo '</ca>' >> $user_vpn_cert_file
echo '<cert>' >> $user_vpn_cert_file
cat /etc/openvpn/easy-rsa/keys/$username.crt >> $user_vpn_cert_file
echo '</cert>' >> $user_vpn_cert_file
echo '<key>' >> $user_vpn_cert_file
cat /etc/openvpn/easy-rsa/keys/$username.key >> $user_vpn_cert_file
echo '</key>' >> $user_vpn_cert_file
chown $username:$username $user_vpn_cert_file
# keep a backup
cp $user_vpn_cert_file /etc/openvpn/easy-rsa/keys/$username.ovpn
#rm /etc/openvpn/easy-rsa/keys/$username.crt
#rm /etc/openvpn/easy-rsa/keys/$username.csr
shred -zu /etc/openvpn/easy-rsa/keys/$username.key
echo $"VPN key created at $user_vpn_cert_file"
}
function add_user_vpn {
new_username="$1"
new_user_password="$2"
create_user_vpn_key $new_username
if [ -f /etc/stunnel/stunnel.pem ]; then
cp /etc/stunnel/stunnel.pem /home/$new_username/stunnel.pem
chown $new_username:$new_username /home/$new_username/stunnel.pem
fi
if [ -f /etc/stunnel/stunnel.p12 ]; then
cp /etc/stunnel/stunnel.p12 /home/$new_username/stunnel.p12
chown $new_username:$new_username /home/$new_username/stunnel.p12
fi
cp /etc/stunnel/stunnel-client.conf /home/$new_username/stunnel-client.conf
chown $new_username:$new_username /home/$new_username/stunnel-client.conf
}
function remove_user_vpn {
new_username="$1"
}
function mesh_setup_vpn {
vpn_generate_keys
if [ -d /home/fbone ]; then
cp /etc/stunnel/stunnel-client.conf /home/fbone/stunnel-client.conf
chown fbone:fbone /home/fbone/stunnel*
fi
generate_stunnel_keys
systemctl restart openvpn
}
function generate_stunnel_keys {
openssl req -x509 -nodes -days 3650 -sha256 \
-subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \
-newkey rsa:2048 -keyout /etc/stunnel/key.pem \
-out /etc/stunnel/cert.pem
if [ ! -f /etc/stunnel/key.pem ]; then
echo $'stunnel key not created'
exit 793530
fi
if [ ! -f /etc/stunnel/cert.pem ]; then
echo $'stunnel cert not created'
exit 204587
fi
chmod 400 /etc/stunnel/key.pem
chmod 640 /etc/stunnel/cert.pem
cat /etc/stunnel/key.pem /etc/stunnel/cert.pem >> /etc/stunnel/stunnel.pem
chmod 640 /etc/stunnel/stunnel.pem
openssl pkcs12 -export -out /etc/stunnel/stunnel.p12 -inkey /etc/stunnel/key.pem -in /etc/stunnel/cert.pem -passout pass:
if [ ! -f /etc/stunnel/stunnel.p12 ]; then
echo $'stunnel pkcs12 not created'
exit 639353
fi
chmod 640 /etc/stunnel/stunnel.p12
cp /etc/stunnel/stunnel.pem /home/$MY_USERNAME/stunnel.pem
cp /etc/stunnel/stunnel.p12 /home/$MY_USERNAME/stunnel.p12
chown $MY_USERNAME:$MY_USERNAME $prefix$userhome/stunnel*
}
function install_stunnel {
prefix=
prefixchroot=
if [ $rootdir ]; then
prefix=$rootdir
prefixchroot="chroot $rootdir"
VPN_TLS_PORT=$VPN_MESH_TLS_PORT
fi
$prefixchroot apt-get -yq install stunnel4
if [ ! $prefix ]; then
cd /etc/stunnel
generate_stunnel_keys
fi
echo 'chroot = /var/lib/stunnel4' > $prefix/etc/stunnel/stunnel.conf
echo 'pid = /stunnel4.pid' >> $prefix/etc/stunnel/stunnel.conf
echo 'setuid = stunnel4' >> $prefix/etc/stunnel/stunnel.conf
echo 'setgid = stunnel4' >> $prefix/etc/stunnel/stunnel.conf
echo 'socket = l:TCP_NODELAY=1' >> $prefix/etc/stunnel/stunnel.conf
echo 'socket = r:TCP_NODELAY=1' >> $prefix/etc/stunnel/stunnel.conf
echo 'cert = /etc/stunnel/stunnel.pem' >> $prefix/etc/stunnel/stunnel.conf
echo '[openvpn]' >> $prefix/etc/stunnel/stunnel.conf
echo "accept = $VPN_TLS_PORT" >> $prefix/etc/stunnel/stunnel.conf
echo 'connect = localhost:1194' >> $prefix/etc/stunnel/stunnel.conf
echo 'cert = /etc/stunnel/stunnel.pem' >> $prefix/etc/stunnel/stunnel.conf
echo 'protocol = socks' >> $prefix/etc/stunnel/stunnel.conf
sed -i 's|ENABLED=.*|ENABLED=1|g' $prefix/etc/default/stunnel4
echo '[openvpn]' > $prefix/etc/stunnel/stunnel-client.conf
echo 'client = yes' >> $prefix/etc/stunnel/stunnel-client.conf
echo "accept = $STUNNEL_PORT" >> $prefix/etc/stunnel/stunnel-client.conf
echo "connect = $DEFAULT_DOMAIN_NAME:$VPN_TLS_PORT" >> $prefix/etc/stunnel/stunnel-client.conf
echo 'cert = stunnel.pem' >> $prefix/etc/stunnel/stunnel-client.conf
echo 'protocol = socks' >> $prefix/etc/stunnel/stunnel-client.conf
echo '[Unit]' > $prefix/etc/systemd/system/stunnel.service
echo 'Description=SSL tunnel for network daemons' >> $prefix/etc/systemd/system/stunnel.service
echo 'Documentation=man:stunnel https://www.stunnel.org/docs.html' >> $prefix/etc/systemd/system/stunnel.service
echo 'DefaultDependencies=no' >> $prefix/etc/systemd/system/stunnel.service
echo 'After=network.target' >> $prefix/etc/systemd/system/stunnel.service
echo 'After=syslog.target' >> $prefix/etc/systemd/system/stunnel.service
echo '' >> $prefix/etc/systemd/system/stunnel.service
echo '[Install]' >> $prefix/etc/systemd/system/stunnel.service
echo 'WantedBy=multi-user.target' >> $prefix/etc/systemd/system/stunnel.service
echo 'Alias=stunnel.target' >> $prefix/etc/systemd/system/stunnel.service
echo '' >> $prefix/etc/systemd/system/stunnel.service
echo '[Service]' >> $prefix/etc/systemd/system/stunnel.service
echo 'Type=forking' >> $prefix/etc/systemd/system/stunnel.service
echo 'RuntimeDirectory=stunnel' >> $prefix/etc/systemd/system/stunnel.service
echo 'EnvironmentFile=-/etc/stunnel/stunnel.conf' >> $prefix/etc/systemd/system/stunnel.service
echo 'ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf' >> $prefix/etc/systemd/system/stunnel.service
echo 'ExecStop=/usr/bin/killall -9 stunnel' >> $prefix/etc/systemd/system/stunnel.service
echo 'RemainAfterExit=yes' >> $prefix/etc/systemd/system/stunnel.service
if [ ! $prefix ]; then
if [ $VPN_TLS_PORT -eq 443 ]; then
systemctl stop nginx
systemctl disable nginx
else
systemctl enable nginx
systemctl restart nginx
fi
systemctl enable stunnel
systemctl daemon-reload
systemctl start stunnel
cp /etc/stunnel/stunnel-client.conf /home/$MY_USERNAME/stunnel-client.conf
chown $MY_USERNAME:$MY_USERNAME /home/$MY_USERNAME/stunnel*
fi
}
function vpn_generate_keys {
# generate host keys
if [ ! -f /etc/openvpn/dh2048.pem ]; then
${PROJECT_NAME}-dhparam -o /etc/openvpn/dh2048.pem
fi
if [ ! -f /etc/openvpn/dh2048.pem ]; then
echo $'vpn dhparams were not generated'
exit 73724523
fi
cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem
cd /etc/openvpn/easy-rsa
. ./vars
./clean-all
vpn_openssl_version='1.0.0'
if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then
echo $"openssl-${vpn_openssl_version}.cnf was not found"
exit 7392353
fi
cp openssl-${vpn_openssl_version}.cnf openssl.cnf
if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
fi
if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key
fi
if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then
rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr
fi
sed -i 's| --interact||g' build-key-server
sed -i 's| --interact||g' build-ca
./build-ca
./build-key-server ${OPENVPN_SERVER_NAME}
if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
echo $'OpenVPN crt not found'
exit 7823352
fi
server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt)
if [ ${#server_cert} -lt 10 ]; then
cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
echo $'Server cert generation failed'
exit 3284682
fi
if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
echo $'OpenVPN key not found'
exit 6839436
fi
if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then
echo $'OpenVPN ca not found'
exit 7935203
fi
cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn
create_user_vpn_key ${MY_USERNAME}
}
function install_vpn {
prefix=
prefixchroot=
if [ $rootdir ]; then
prefix=$rootdir
prefixchroot="chroot $rootdir"
VPN_TLS_PORT=$VPN_MESH_TLS_PORT
fi
$prefixchroot apt-get -yq install fastd openvpn easy-rsa
$prefixchroot groupadd vpn
$prefixchroot useradd -r -s /bin/false -g vpn vpn
# server configuration
echo 'port 1194' > $prefix/etc/openvpn/server.conf
echo 'proto tcp' >> $prefix/etc/openvpn/server.conf
echo 'dev tun' >> $prefix/etc/openvpn/server.conf
echo 'tun-mtu 1500' >> $prefix/etc/openvpn/server.conf
echo 'tun-mtu-extra 32' >> $prefix/etc/openvpn/server.conf
echo 'mssfix 1450' >> $prefix/etc/openvpn/server.conf
echo 'ca /etc/openvpn/ca.crt' >> $prefix/etc/openvpn/server.conf
echo 'cert /etc/openvpn/server.crt' >> $prefix/etc/openvpn/server.conf
echo 'key /etc/openvpn/server.key' >> $prefix/etc/openvpn/server.conf
echo 'dh /etc/openvpn/dh2048.pem' >> $prefix/etc/openvpn/server.conf
echo 'server 10.8.0.0 255.255.255.0' >> $prefix/etc/openvpn/server.conf
echo 'push "redirect-gateway def1 bypass-dhcp"' >> $prefix/etc/openvpn/server.conf
echo "push \"dhcp-option DNS 85.214.73.63\"" >> $prefix/etc/openvpn/server.conf
echo "push \"dhcp-option DNS 213.73.91.35\"" >> $prefix/etc/openvpn/server.conf
echo 'keepalive 5 30' >> $prefix/etc/openvpn/server.conf
echo 'comp-lzo' >> $prefix/etc/openvpn/server.conf
echo 'persist-key' >> $prefix/etc/openvpn/server.conf
echo 'persist-tun' >> $prefix/etc/openvpn/server.conf
echo 'status /dev/null' >> $prefix/etc/openvpn/server.conf
echo 'verb 3' >> $prefix/etc/openvpn/server.conf
echo '' >> $prefix/etc/openvpn/server.conf
if [ ! $prefix ]; then
echo 1 > /proc/sys/net/ipv4/ip_forward
fi
sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' $prefix/etc/sysctl.conf
sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' $prefix/etc/sysctl.conf
sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' $prefix/etc/sysctl.conf
cp -r $prefix/usr/share/easy-rsa/ $prefix/etc/openvpn
if [ ! -d $prefix/etc/openvpn/easy-rsa/keys ]; then
mkdir $prefix/etc/openvpn/easy-rsa/keys
fi
# keys configuration
sed -i "s|export KEY_COUNTRY.*|export KEY_COUNTRY=\"US\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_PROVINCE.*|export KEY_PROVINCE=\"TX\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_CITY.*|export KEY_CITY=\"Dallas\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_ORG.*|export KEY_ORG=\"$PROJECT_NAME\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_EMAIL.*|export KEY_EMAIL=\"$MY_EMAIL_ADDRESS\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_OU=.*|export KEY_OU=\"MoonUnit\"|g" $prefix/etc/openvpn/easy-rsa/vars
sed -i "s|export KEY_NAME.*|export KEY_NAME=\"$OPENVPN_SERVER_NAME\"|g" $prefix/etc/openvpn/easy-rsa/vars
if [ ! $prefix ]; then
vpn_generate_keys
firewall_enable_vpn
if [ ${VPN_TLS_PORT} -ne 443 ]; then
firewall_add VPN-TLS ${VPN_TLS_PORT} tcp
fi
systemctl start openvpn
fi
install_stunnel
if [ ! $prefix ]; then
systemctl restart openvpn
fi
APP_INSTALLED=1
}
# NOTE: deliberately there is no "exit 0"