diff --git a/build_key-pass.sh b/build_key-pass.sh
index 1e9e226..1dab6fe 100755
--- a/build_key-pass.sh
+++ b/build_key-pass.sh
@@ -1,17 +1,39 @@
#!/usr/bin/env bash
script_dir="$(dirname $(realpath $0))"
-conf_file=${script_dir}/conf/install_openvpn.conf
log_file="$(mktemp)"
_date="$(date +%Y-%m-%d-%H%M)"
+key_names_reserverd="ta ca server"
+
#---------------------------------------
#-----------------------------
-# Base Function(s)
+# Some functions
#-----------------------------
#---------------------------------------
+clean_up() {
+
+ # Perform program exit housekeeping
+ rm $log_file
+ exit $1
+}
+
+is_number() {
+
+ return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);
+
+ # - also possible
+ # -
+ #[[ ! -z "${1##*[!0-9]*}" ]] && return 0 || return 1
+ #return $([[ ! -z "${1##*[!0-9]*}" ]])
+}
+
+is_int() {
+ return $(test "$@" -eq "$@" > /dev/null 2>&1);
+}
+
echononl(){
echo X\\c > /tmp/shprompt$$
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
@@ -22,19 +44,19 @@ echononl(){
rm /tmp/shprompt$$
}
+error(){
+ echo ""
+ echo -e "\t[ \033[31m\033[1mError\033[m ]: $*"
+ echo ""
+}
+
fatal(){
echo ""
echo -e "\t[ \033[31m\033[1mFatal\033[m ]: $*"
echo ""
echo -e "\t\033[37m\033[1mInstalllation will be interrupted\033[m\033[m"
echo ""
- exit 1
-}
-
-error(){
- echo ""
- echo -e "\t[ \033[31m\033[1mError\033[m ]: $*"
- echo ""
+ clean_up 1
}
warn (){
@@ -48,7 +70,6 @@ info (){
echo -e "\t[ \033[32m\033[1mInfo\033[m ]: $*"
echo ""
}
-
echo_done() {
echo -e "\033[80G[ \033[32mdone\033[m ]"
}
@@ -65,7 +86,98 @@ echo_skipped() {
echo -e "\033[80G[ \033[37mskipped\033[m ]"
}
+trap clean_up SIGHUP SIGINT SIGTERM
+
+
clear
+echo ""
+echo -e "\033[21G\033[32mCreate OpenVPN user certificate/key.. \033[m"
+echo ""
+echo ""
+
+declare -a conf_file_arr=()
+declare -a conf_name_arr=()
+for _conf_file in `ls ${script_dir}/conf/server-*.conf 2>/dev/null` ; do
+ conf_file_arr+=("${_conf_file}")
+ _basename=$(basename $_conf_file)
+ _tmp_name=${_basename%%.*}
+ _tmp_name=${_tmp_name#*-}
+ conf_name_arr+=("$_tmp_name")
+done
+
+if [[ ${#conf_file_arr[@]} -lt 1 ]] ; then
+ fatal "NO Configuration found!"
+fi
+
+
+echo ""
+
+declare -i i=0
+
+if [[ ${#conf_file_arr[@]} -gt 1 ]] ; then
+ echo ""
+ echo "Which Configuration should be loaded?"
+ echo ""
+ for _conf_file in ${conf_file_arr[@]} ; do
+ echo " [${i}] ${conf_name_arr[${i}]}"
+ (( i++ ))
+ done
+ _OK=false
+ echo
+ echononl "Eingabe: "
+ while ! $_OK ; do
+ read _IN
+ if is_number "$_IN" && [[ -n ${conf_file_arr[$_IN]} ]]; then
+ conf_file=${conf_file_arr[$_IN]}
+ _OK=true
+ else
+ echo ""
+ echo -e "\tFalsche Eingabe !"
+ echo ""
+ echononl "Eingabe: "
+ fi
+ done
+
+else
+ conf_file=${conf_file_arr[0]}
+fi
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+
+#---------------------------------------
+#-----------------------------
+# Read Configurations from $conf_file
+#-----------------------------
+#---------------------------------------
+
+echononl " Load Configuration File $(basename ${conf_file}).."
+if [[ ! -f "$conf_file" ]]; then
+ echo_failed
+ fatal "Configuration file \033[37m\033[1m$(basename ${conf_file})\033[m not found!"
+else
+ source "${conf_file}" > $log_file 2>&1
+ if [[ $? -eq 0 ]]; then
+ echo_ok
+ else
+ echo_failed
+ fatal "$(cat $log_file)"
+ fi
+fi
+
+
+[[ -n "$OPENVPN_SERVER" ]] || fatal "OpenVPN Server (parameter OPENVPN_SERVER ) not present!"
+[[ -n "$SERVER_PORT" ]] || fatal "Server Port (parameter SERVER_PORT ) not present!"
+
+EASY_RSA_DIR="${OPENVPN_BASE_DIR}/easy-rsa"
+OPENVPN_CCD_DIR="${OPENVPN_BASE_DIR}/ccd/server-${OPENVPN_NAME}"
+
+EMAIL_PREFIX="$(echo $KEY_EMAIL | cut -d '\' -f1)"
+EMAIL_DOMAIN="$(echo $KEY_EMAIL | cut -d '@' -f2)"
+
+
echo ""
echo -e "\033[32m--\033[m"
echo ""
@@ -83,6 +195,10 @@ if [ -z "$NEW_KEY_NAME" ]; then
done
fi
+for _name in $key_names_reserverd ; do
+ [[ "$_name" = "$NEW_KEY_NAME" ]] && fatal "Name '$NEW_KEY_NAME' cannot be used - its a reserved name!"
+done
+
echo ""
echo -e "\033[32m--\033[m"
echo ""
@@ -109,6 +225,19 @@ do
fi
done
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+echo "OpenVPN name............: $OPENVPN_NAME"
+echo ""
+echo "OpenVPN Server..........: $OPENVPN_SERVER"
+echo ""
+echo "OpenVPN Base directory..: $OPENVPN_BASE_DIR"
+echo ""
+echo ""
+echo "Key Name................: $NEW_KEY_NAME"
+echo "Key Password............: $KEY_PW"
+
info "Going to create key \033[37m\033[1m${NEW_KEY_NAME}.key\033[m.."
echo -n "To continue type uppercase 'YES': "
read OK
@@ -119,26 +248,6 @@ fi
-#---------------------------------------
-#-----------------------------
-# Read Configurations from $conf_file
-#-----------------------------
-#---------------------------------------
-
-echononl " Load configuration file.."
-if [[ ! -f "$conf_file" ]]; then
- echo_failed
- fatal "Configuration file \033[37m\033[1m$(basename ${conf_file})\033[m not found!"
-else
- source "${conf_file}"
- if [[ $? -eq 0 ]]; then
- echo_ok
- else
- echo_failed
- fatal "$(cat $log_file)"
- fi
-fi
-
#---------------------------------------
#-----------------------------
@@ -208,6 +317,199 @@ else
error "$(cat $log_file)"
fi
+_client_conf_file="${OPENVPN_BASE_DIR}/${NEW_KEY_NAME}.conf.sample"
+echononl " Create sample client configuration ${_client_conf_file}.."
+cat << EOF > "$_client_conf_file" 2> $log_file
+##############################################
+# Sample client-side OpenVPN 2.0 config file #
+# for connecting to multi-client server. #
+# #
+# This configuration can be used by multiple #
+# clients, however each client should have #
+# its own cert and key files. #
+# #
+# On Windows, you might want to rename this #
+# file so it has a .ovpn extension #
+##############################################
+
+# Specify that we are a client and that we
+# will be pulling certain config file directives
+# from the server.
+client
+
+# Use the same setting as you are using on
+# the server.
+# On most systems, the VPN will not function
+# unless you partially or fully disable
+# the firewall for the TUN/TAP interface.
+;dev tap
+dev tun
+
+# Are we connecting to a TCP or
+# UDP server? Use the same setting as
+# on the server
+proto udp
+
+# The hostname/IP and port of the server.
+# You can have multiple remote entries
+# to load balance between the servers.
+remote $OPENVPN_SERVER $SERVER_PORT
+
+topology subnet
+
+# Keep trying indefinitely to resolve the
+# host name of the OpenVPN server. Very useful
+# on machines which are not permanently connected
+# to the internet such as laptops.
+resolv-retry infinite
+
+# Most clients don't need to bind to
+# a specific local port number.
+nobind
+
+# Try to preserve some state across restarts.
+persist-key
+persist-tun
+
+# Server CA
+
+EOF
+
+_file="${OPENVPN_BASE_DIR}/keys/ca.crt"
+_found=false
+while IFS='' read -r line || [[ -n $line ]]; do
+ if [[ "$line" =~ "-----BEGIN" ]] ; then
+ _found=true
+ fi
+ if $_found ; then
+ echo "$line" >> "$_client_conf_file"
+ fi
+ if [[ "$line" =~ "-----END" ]]; then
+ _found=false
+ fi
+done < $_file
+
+cat << EOF >> "$_client_conf_file" 2> $log_file
+
+
+# Client Certificate
+
+EOF
+
+_file="${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.crt"
+_found=false
+while IFS='' read -r line || [[ -n $line ]]; do
+ if [[ "$line" =~ "-----BEGIN" ]] ; then
+ _found=true
+ fi
+ if $_found ; then
+ echo "$line" >> "$_client_conf_file"
+ fi
+ if [[ "$line" =~ "-----END" ]]; then
+ _found=false
+ fi
+done < $_file
+
+cat << EOF >> "$_client_conf_file" 2> $log_file
+
+
+# Client Key
+
+EOF
+
+_file="${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.key"
+_found=false
+while IFS='' read -r line || [[ -n $line ]]; do
+ if [[ "$line" =~ "-----BEGIN" ]] ; then
+ _found=true
+ fi
+ if $_found ; then
+ echo "$line" >> "$_client_conf_file"
+ fi
+ if [[ "$line" =~ "-----END" ]]; then
+ _found=false
+ fi
+done < $_file
+
+cat << EOF >> "$_client_conf_file" 2> $log_file
+
+
+# Verify server certificate by checking
+# that the certicate has the nsCertType
+# field set to "server". This is an
+# important precaution to protect against
+# a potential attack discussed here:
+# http://openvpn.net/howto.html#mitm
+#
+# To use this feature, you will need to generate
+# your server certificates with the nsCertType
+# field set to "server". The build-key-serve
+ns-cert-type server
+
+# If a tls-auth key is used on the server
+# then every client must also have the key.
+#
+# Don't forget to set the 'key-direction' Parameter if using
+# Inline Key. Usualy , sever has key direction '0', while client
+# has ke direction '1'.
+#
+key-direction 1
+
+EOF
+
+_file="${OPENVPN_BASE_DIR}/keys/ta.key"
+_found=false
+while IFS='' read -r line || [[ -n $line ]]; do
+ if [[ "$line" =~ "-----BEGIN" ]] ; then
+ _found=true
+ fi
+ if $_found ; then
+ echo "$line" >> "$_client_conf_file"
+ fi
+ if [[ "$line" =~ "-----END" ]]; then
+ _found=false
+ fi
+done < $_file
+
+cat << EOF >> "$_client_conf_file" 2> $log_file
+
+
+# Select a cryptographic cipher.
+# If the cipher option is used on the server
+# then you must also specify it here.
+EOF
+
+if [[ -n "$SERVER_CIPHER" ]]; then
+ cat <> "$_client_conf_file" 2>> "$log_file"
+cipher AES-256-CBC
+EOF
+fi
+
+cat <> "$_client_conf_file" 2>> "$log_file"
+
+# Enable compression on the VPN link.
+# Don't enable this unless it is also
+# enabled in the server config file.
+comp-lzo
+
+# Verbosity level.
+# 0 -- quiet except for fatal errors.
+# 1 -- mostly quiet, but display non-fatal network errors.
+# 3 -- medium output, good for normal operation.
+# 9 -- verbose, good for troubleshooting
+verb 1
+
+# Setting 'pull' on the client takes care to get the 'push' durectives
+# from the server
+pull
+EOF
+if [[ $? -eq 0 ]] ; then
+ echo_ok
+else
+ echo_failed
+ #error "$(cat $log_file)"
+fi
+
echo ""
@@ -260,19 +562,23 @@ if $_copy_to_user_home_dir ; then
if [[ $? -ne 0 ]] ; then
_failed=true
fi
- cp -a ${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.key "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
+ cp -a "${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.key" "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
if [[ $? -ne 0 ]] ; then
_failed=true
fi
- cp -a -a ${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.crt "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
+ cp -a "$_client_conf_file" "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}/client-$(basename $_client_conf_file)"
if [[ $? -ne 0 ]] ; then
_failed=true
fi
- cp -a -a ${OPENVPN_BASE_DIR}/keys/ca.crt "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
+ cp -a "${OPENVPN_BASE_DIR}/keys/${NEW_KEY_NAME}.crt" "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
if [[ $? -ne 0 ]] ; then
_failed=true
fi
- cp -a -a ${OPENVPN_BASE_DIR}/keys/ta.key "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
+ cp -a "${OPENVPN_BASE_DIR}/keys/ca.crt" "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
+ if [[ $? -ne 0 ]] ; then
+ _failed=true
+ fi
+ cp -a "${OPENVPN_BASE_DIR}/keys/ta.key" "${_home_dir}/VPN/${KEY_CN}-${NEW_KEY_NAME}" >> $log_file 2>&1
if [[ $? -ne 0 ]] ; then
_failed=true
fi
@@ -297,7 +603,5 @@ EOF
fi
-
-rm -f $log_file
echo ""
-exit 0
+clean_up 0
diff --git a/conf/install_openvpn.conf.sample b/conf/install_openvpn.conf.sample
index 0a37f01..5a8d05a 100644
--- a/conf/install_openvpn.conf.sample
+++ b/conf/install_openvpn.conf.sample
@@ -1,50 +1,16 @@
-## - Configuration/Initialization OpenVPN
-## -
+DEFAULT_SERVER=""
+DEFAULT_SERVER_PORT=1194
-# ====================
-# - Some Parameter Settings for using this installation howto
-# ====================
+DEFAULT_CA_EXPIRE=11688
+DEFAULT_KEY_EXPIRE=7305
-# ---
-# - Parameters OpenVPN Configuration / KEY Creation
-# ---
+DEFAULT_KEY_SIZE=4096
-OPENVPN_BASE_DIR=/etc/openvpn
-EASY_RSA_DIR=${OPENVPN_BASE_DIR}/easy-rsa
+DEFAULT_KEY_COUNTRY="DE"
+DEFAULT_KEY_PROVINCE="Berlin"
+DEFAULT_KEY_CITY="Berlin"
+DEFAULT_KEY_EMAIL='support@oopen.de'
+DEFAULT_KEY_OU="Network Services"
+DEFAULT_KEY_ORG="O.OPEN"
-# - (3*365+366)*8 = 11688 = 32 Jahre
-CA_EXPIRE=11688
-# - (3*365+366)*5 = 7305 = 20 Jahre
-KEY_EXPIRE=7305
-
-KEY_SIZE=4096
-
-KEY_COUNTRY="DE"
-KEY_PROVINCE="Berlin"
-KEY_CITY="Berlin"
-KEY_ORG="O.OPEN"
-KEY_EMAIL="ckubu-adm\@oopen.de"
-KEY_OU="Network Services"
-
-KEY_NAME="VPN B3"
-KEY_CN="VPN-B3"
-
-KEY_ALTNAMES="VPN B3"
-
-
-# ---
-# - Parameters for Server Configurations ( server-home.conf / server-gw-ckubu.conf)
-# ---
-
-SERVER_PORT_HOME=1194
-OPENVPN_NETWORK_HOME="10.0.42.0"
-CCD_HOME="/etc/openvpn/ccd/server-home"
-
-SERVER_PORT_GW_CKUBU=1195
-OPENVPN_NETWORK_GW_CKUBU="10.1.42.0"
-IPV4_OPENVPN_GW_CKUBU="10.1.42.1"
-CCD_GW_CKUBU="/etc/openvpn/ccd/server-gw-ckubu"
-
-MAIN_NETWORK=192.168.42.0
-DNS_SERVER=192.168.42.1
-DOMAIN=b3-bornim.netz
+DEFAULT_SERVER_CIPHER="AES-256-CBC"
diff --git a/conf/server-gw-ckubu.conf.sample b/conf/server-gw-ckubu.conf.sample
deleted file mode 100644
index 3b06bd9..0000000
--- a/conf/server-gw-ckubu.conf.sample
+++ /dev/null
@@ -1,316 +0,0 @@
-#################################################
-# Sample OpenVPN 2.0 config file for #
-# multi-client server. #
-# #
-# This file is for the server side #
-# of a many-clients <-> one-server #
-# OpenVPN configuration. #
-# #
-# OpenVPN also supports #
-# single-machine <-> single-machine #
-# configurations (See the Examples page #
-# on the web site for more info). #
-# #
-# This config should work on Windows #
-# or Linux/BSD systems. Remember on #
-# Windows to quote pathnames and use #
-# double backslashes, e.g.: #
-# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
-# #
-# Comments are preceded with '#' or ';' #
-#################################################
-
-# Which local IP address should OpenVPN
-# listen on? (optional)
-;local a.b.c.d
-
-# Which TCP/UDP port should OpenVPN listen on?
-# If you want to run multiple OpenVPN instances
-# on the same machine, use a different port
-# number for each one. You will need to
-# open up this port on your firewall.
-port
-
-# TCP or UDP server?
-;proto tcp
-proto udp
-
-
-topology subnet
-route 192.168.63.0 255.255.255.0 >
-route 192.168.64.0 255.255.255.0
-
-# "dev tun" will create a routed IP tunnel,
-# "dev tap" will create an ethernet tunnel.
-# Use "dev tap" if you are ethernet bridging.
-# If you want to control access policies
-# over the VPN, you must create firewall
-# rules for the the TUN/TAP interface.
-# On non-Windows systems, you can give
-# an explicit unit number, such as tun0.
-# On Windows, use "dev-node" for this.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-;dev tap
-dev tun
-
-# Windows needs the TAP-Win32 adapter name
-# from the Network Connections panel if you
-# have more than one. On XP SP2 or higher,
-# you may need to selectively disable the
-# Windows firewall for the TAP adapter.
-# Non-Windows systems usually don't need this.
-;dev-node MyTap
-
-# SSL/TLS root certificate (ca), certificate
-# (cert), and private key (key). Each client
-# and the server must have their own cert and
-# key file. The server and all clients will
-# use the same ca file.
-#
-# See the "easy-rsa" directory for a series
-# of scripts for generating RSA certificates
-# and private keys. Remember to use
-# a unique Common Name for the server
-# and each of the client certificates.
-#
-# Any X509 key management system can be used.
-# OpenVPN can also use a PKCS #12 formatted key file
-# (see "pkcs12" directive in man page).
-ca keys/ca.crt
-cert keys/server.crt
-key keys/server.key # This file should be kept secret
-
-# Diffie hellman parameters.
-# Generate your own with:
-# openssl dhparam -out dh1024.pem 1024
-# Substitute 2048 for 1024 if you are using
-# 2048 bit keys.
-dh keys/dh2048.pem
-
-# Configure server mode and supply a VPN subnet
-# for OpenVPN to draw client addresses from.
-# The server will take 10.8.0.1 for itself,
-# the rest will be made available to clients.
-# Each client will be able to reach the server
-# on 10.8.0.1. Comment this line out if you are
-# ethernet bridging. See the man page for more info.
-server 255.255.255.0
-
-# Maintain a record of client <-> virtual IP address
-# associations in this file. If OpenVPN goes down or
-# is restarted, reconnecting clients can be assigned
-# the same virtual IP address from the pool that was
-# previously assigned.
-ifconfig-pool-persist /etc/openvpn/ipp.txt
-
-# Configure server mode for ethernet bridging.
-# You must first use your OS's bridging capability
-# to bridge the TAP interface with the ethernet
-# NIC interface. Then you must manually set the
-# IP/netmask on the bridge interface, here we
-# assume 10.8.0.4/255.255.255.0. Finally we
-# must set aside an IP range in this subnet
-# (start=10.8.0.50 end=10.8.0.100) to allocate
-# to connecting clients. Leave this line commented
-# out unless you are ethernet bridging.
-;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
-
-# Push routes to the client to allow it
-# to reach other private subnets behind
-# the server. Remember that these
-# private subnets will also need
-# to know to route the OpenVPN client
-# address pool (10.8.0.0/255.255.255.0)
-# back to the OpenVPN server.
-;push "route 10.8.0.0 255.255.255.0"
-push "route 255.255.255.0"
-
-# To assign specific IP addresses to specific
-# clients or if a connecting client has a private
-# subnet behind it that should also have VPN access,
-# use the subdirectory "ccd" for client-specific
-# configuration files (see man page for more info).
-
-client-config-dir /etc/openvpn/ccd/server-gw-ckubu
-
-# ---
-# EXAMPLE: Suppose the client
-# having the certificate common name "Thelonious"
-# also has a small subnet behind his connecting
-# machine, such as 192.168.40.128/255.255.255.248.
-# First, uncomment out these lines:
-;client-config-dir /etc/openvpn/ccd
-;route 192.168.40.128 255.255.255.248
-
-# Then create a file ccd/Thelonious with this line:
-# iroute 192.168.40.128 255.255.255.248
-# This will allow Thelonious' private subnet to
-# access the VPN. This example will only work
-# if you are routing, not bridging, i.e. you are
-# using "dev tun" and "server" directives.
-# ---
-
-# ---
-# EXAMPLE: Suppose you want to give
-# Thelonious a fixed VPN IP address of 10.9.0.1.
-# First uncomment out these lines:
-;client-config-dir ccd
-;route 10.9.0.0 255.255.255.252
-
-# Then add this line to ccd/Thelonious:
-# ifconfig-push 10.9.0.1 10.9.0.2
-# ---
-
-# ---
-# Suppose that you want to enable different
-# firewall access policies for different groups
-# of clients. There are two methods:
-# (1) Run multiple OpenVPN daemons, one for each
-# group, and firewall the TUN/TAP interface
-# for each group/daemon appropriately.
-# (2) (Advanced) Create a script to dynamically
-# modify the firewall in response to access
-# from different clients. See man
-# page for more info on learn-address script.
-;learn-address ./script
-# ---
-
-# If enabled, this directive will configure
-# all clients to redirect their default
-# network gateway through the VPN, causing
-# all IP traffic such as web browsing and
-# and DNS lookups to go through the VPN
-# (The OpenVPN server machine may need to NAT
-# the TUN/TAP interface to the internet in
-# order for this to work properly).
-# CAVEAT: May break client's network config if
-# client's local DHCP server packets get routed
-# through the tunnel. Solution: make sure
-# client's local DHCP server is reachable via
-# a more specific route than the default route
-# of 0.0.0.0/0.0.0.0.
-;push "redirect-gateway"
-
-# Certain Windows-specific network settings
-# can be pushed to clients, such as DNS
-# or WINS server addresses. CAVEAT:
-# http://openvpn.net/faq.html#dhcpcaveats
-;push "dhcp-option WINS 10.8.0.1"
-
-# - Do NOT push DNS settings in THIS configuration. We use
-# - this VPN tunnel as a static line, and the remote host
-# - should user his own dns settings.
-# -
-;push "dhcp-option DNS "
-;push "dhcp-option DOMAIN "
-
-# Uncomment this directive to allow different
-# clients to be able to "see" each other.
-# By default, clients will only see the server.
-# To force clients to only see the server, you
-# will also need to appropriately firewall the
-# server's TUN/TAP interface.
-client-to-client
-
-# Uncomment this directive if multiple clients
-# might connect with the same certificate/key
-# files or common names. This is recommended
-# only for testing purposes. For production use,
-# each client should have its own certificate/key
-# pair.
-#
-# IF YOU HAVE NOT GENERATED INDIVIDUAL
-# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
-# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
-# UNCOMMENT THIS LINE OUT.
-;duplicate-cn
-
-# The keepalive directive causes ping-like
-# messages to be sent back and forth over
-# the link so that each side knows when
-# the other side has gone down.
-# Ping every 10 seconds, assume that remote
-# peer is down if no ping received during
-# a 120 second time period.
-keepalive 10 120
-
-# For extra security beyond that provided
-# by SSL/TLS, create an "HMAC firewall"
-# to help block DoS attacks and UDP port flooding.
-#
-# Generate with:
-# openvpn --genkey --secret ta.key
-#
-# The server and each client must have
-# a copy of this key.
-# The second parameter should be '0'
-# on the server and '1' on the clients.
-;tls-auth ta.key 0 # This file is secret
-tls-auth keys/ta.key 0
-
-# Select a cryptographic cipher.
-# This config item must be copied to
-# the client config file as well.
-;cipher BF-CBC # Blowfish (default)
-;cipher AES-128-CBC # AES
-;cipher DES-EDE3-CBC # Triple-DES
-cipher AES-256-CBC
-
-# Enable compression on the VPN link.
-# If you enable it here, you must also
-# enable it in the client config file.
-comp-lzo
-
-# The maximum number of concurrently connected
-# clients we want to allow.
-;max-clients 100
-
-# It's a good idea to reduce the OpenVPN
-# daemon's privileges after initialization.
-#
-# You can uncomment this out on
-# non-Windows systems.
-user nobody
-group nogroup
-
-# The persist options will try to avoid
-# accessing certain resources on restart
-# that may no longer be accessible because
-# of the privilege downgrade.
-persist-key
-persist-tun
-persist-local-ip
-persist-remote-ip
-
-# Output a short status file showing
-# current connections, truncated
-# and rewritten every minute.
-status /var/log/openvpn/status-server-gw-ckubu.log
-
-# By default, log messages will go to the syslog (or
-# on Windows, if running as a service, they will go to
-# the "\Program Files\OpenVPN\log" directory).
-# Use log or log-append to override this default.
-# "log" will truncate the log file on OpenVPN startup,
-# while "log-append" will append to it. Use one
-# or the other (but not both).
-log /var/log/openvpn/server-gw-ckubu.log
-;log-append openvpn.log
-
-# Set the appropriate level of log
-# file verbosity.
-#
-# 0 is silent, except for fatal errors
-# 4 is reasonable for general usage
-# 5 and 6 can help to debug connection problems
-# 9 is extremely verbose
-verb 4
-
-# Silence repeating messages. At most 20
-# sequential messages of the same message
-# category will be output to the log.
-;mute 20
-
-crl-verify /etc/openvpn/keys/crl.pem
diff --git a/conf/server-home.conf.sample b/conf/server-home.conf.sample
deleted file mode 100644
index 621a333..0000000
--- a/conf/server-home.conf.sample
+++ /dev/null
@@ -1,311 +0,0 @@
-#################################################
-# Sample OpenVPN 2.0 config file for #
-# multi-client server. #
-# #
-# This file is for the server side #
-# of a many-clients <-> one-server #
-# OpenVPN configuration. #
-# #
-# OpenVPN also supports #
-# single-machine <-> single-machine #
-# configurations (See the Examples page #
-# on the web site for more info). #
-# #
-# This config should work on Windows #
-# or Linux/BSD systems. Remember on #
-# Windows to quote pathnames and use #
-# double backslashes, e.g.: #
-# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
-# #
-# Comments are preceded with '#' or ';' #
-#################################################
-
-# Which local IP address should OpenVPN
-# listen on? (optional)
-;local a.b.c.d
-
-# Which TCP/UDP port should OpenVPN listen on?
-# If you want to run multiple OpenVPN instances
-# on the same machine, use a different port
-# number for each one. You will need to
-# open up this port on your firewall.
-port
-
-# TCP or UDP server?
-;proto tcp
-proto udp
-
-
-topology subnet
-#route 192.168.63.0 255.255.255.0 10.1.72.1
-#route 192.168.64.0 255.255.255.0 10.1.72.1
-
-# "dev tun" will create a routed IP tunnel,
-# "dev tap" will create an ethernet tunnel.
-# Use "dev tap" if you are ethernet bridging.
-# If you want to control access policies
-# over the VPN, you must create firewall
-# rules for the the TUN/TAP interface.
-# On non-Windows systems, you can give
-# an explicit unit number, such as tun0.
-# On Windows, use "dev-node" for this.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-;dev tap
-dev tun
-
-# Windows needs the TAP-Win32 adapter name
-# from the Network Connections panel if you
-# have more than one. On XP SP2 or higher,
-# you may need to selectively disable the
-# Windows firewall for the TAP adapter.
-# Non-Windows systems usually don't need this.
-;dev-node MyTap
-
-# SSL/TLS root certificate (ca), certificate
-# (cert), and private key (key). Each client
-# and the server must have their own cert and
-# key file. The server and all clients will
-# use the same ca file.
-#
-# See the "easy-rsa" directory for a series
-# of scripts for generating RSA certificates
-# and private keys. Remember to use
-# a unique Common Name for the server
-# and each of the client certificates.
-#
-# Any X509 key management system can be used.
-# OpenVPN can also use a PKCS #12 formatted key file
-# (see "pkcs12" directive in man page).
-ca keys/ca.crt
-cert keys/server.crt
-key keys/server.key # This file should be kept secret
-
-# Diffie hellman parameters.
-# Generate your own with:
-# openssl dhparam -out dh1024.pem 1024
-# Substitute 2048 for 1024 if you are using
-# 2048 bit keys.
-dh keys/dh2048.pem
-
-# Configure server mode and supply a VPN subnet
-# for OpenVPN to draw client addresses from.
-# The server will take 10.8.0.1 for itself,
-# the rest will be made available to clients.
-# Each client will be able to reach the server
-# on 10.8.0.1. Comment this line out if you are
-# ethernet bridging. See the man page for more info.
-server 255.255.255.0
-
-# Maintain a record of client <-> virtual IP address
-# associations in this file. If OpenVPN goes down or
-# is restarted, reconnecting clients can be assigned
-# the same virtual IP address from the pool that was
-# previously assigned.
-ifconfig-pool-persist /etc/openvpn/ipp.txt
-
-# Configure server mode for ethernet bridging.
-# You must first use your OS's bridging capability
-# to bridge the TAP interface with the ethernet
-# NIC interface. Then you must manually set the
-# IP/netmask on the bridge interface, here we
-# assume 10.8.0.4/255.255.255.0. Finally we
-# must set aside an IP range in this subnet
-# (start=10.8.0.50 end=10.8.0.100) to allocate
-# to connecting clients. Leave this line commented
-# out unless you are ethernet bridging.
-;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
-
-# Push routes to the client to allow it
-# to reach other private subnets behind
-# the server. Remember that these
-# private subnets will also need
-# to know to route the OpenVPN client
-# address pool (10.8.0.0/255.255.255.0)
-# back to the OpenVPN server.
-;push "route 10.8.0.0 255.255.255.0"
-push "route 255.255.255.0"
-
-# To assign specific IP addresses to specific
-# clients or if a connecting client has a private
-# subnet behind it that should also have VPN access,
-# use the subdirectory "ccd" for client-specific
-# configuration files (see man page for more info).
-
-client-config-dir
-
-# ---
-# EXAMPLE: Suppose the client
-# having the certificate common name "Thelonious"
-# also has a small subnet behind his connecting
-# machine, such as 192.168.40.128/255.255.255.248.
-# First, uncomment out these lines:
-;client-config-dir /etc/openvpn/ccd
-;route 192.168.40.128 255.255.255.248
-
-# Then create a file ccd/Thelonious with this line:
-# iroute 192.168.40.128 255.255.255.248
-# This will allow Thelonious' private subnet to
-# access the VPN. This example will only work
-# if you are routing, not bridging, i.e. you are
-# using "dev tun" and "server" directives.
-# ---
-
-# ---
-# EXAMPLE: Suppose you want to give
-# Thelonious a fixed VPN IP address of 10.9.0.1.
-# First uncomment out these lines:
-;client-config-dir ccd
-;route 10.9.0.0 255.255.255.252
-
-# Then add this line to ccd/Thelonious:
-# ifconfig-push 10.9.0.1 10.9.0.2
-# ---
-
-# ---
-# Suppose that you want to enable different
-# firewall access policies for different groups
-# of clients. There are two methods:
-# (1) Run multiple OpenVPN daemons, one for each
-# group, and firewall the TUN/TAP interface
-# for each group/daemon appropriately.
-# (2) (Advanced) Create a script to dynamically
-# modify the firewall in response to access
-# from different clients. See man
-# page for more info on learn-address script.
-;learn-address ./script
-# ---
-
-# If enabled, this directive will configure
-# all clients to redirect their default
-# network gateway through the VPN, causing
-# all IP traffic such as web browsing and
-# and DNS lookups to go through the VPN
-# (The OpenVPN server machine may need to NAT
-# the TUN/TAP interface to the internet in
-# order for this to work properly).
-# CAVEAT: May break client's network config if
-# client's local DHCP server packets get routed
-# through the tunnel. Solution: make sure
-# client's local DHCP server is reachable via
-# a more specific route than the default route
-# of 0.0.0.0/0.0.0.0.
-;push "redirect-gateway"
-
-# Certain Windows-specific network settings
-# can be pushed to clients, such as DNS
-# or WINS server addresses. CAVEAT:
-# http://openvpn.net/faq.html#dhcpcaveats
-;push "dhcp-option WINS 10.8.0.1"
-push "dhcp-option DNS "
-push "dhcp-option DOMAIN "
-
-# Uncomment this directive to allow different
-# clients to be able to "see" each other.
-# By default, clients will only see the server.
-# To force clients to only see the server, you
-# will also need to appropriately firewall the
-# server's TUN/TAP interface.
-client-to-client
-
-# Uncomment this directive if multiple clients
-# might connect with the same certificate/key
-# files or common names. This is recommended
-# only for testing purposes. For production use,
-# each client should have its own certificate/key
-# pair.
-#
-# IF YOU HAVE NOT GENERATED INDIVIDUAL
-# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
-# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
-# UNCOMMENT THIS LINE OUT.
-;duplicate-cn
-
-# The keepalive directive causes ping-like
-# messages to be sent back and forth over
-# the link so that each side knows when
-# the other side has gone down.
-# Ping every 10 seconds, assume that remote
-# peer is down if no ping received during
-# a 120 second time period.
-keepalive 10 120
-
-# For extra security beyond that provided
-# by SSL/TLS, create an "HMAC firewall"
-# to help block DoS attacks and UDP port flooding.
-#
-# Generate with:
-# openvpn --genkey --secret ta.key
-#
-# The server and each client must have
-# a copy of this key.
-# The second parameter should be '0'
-# on the server and '1' on the clients.
-;tls-auth ta.key 0 # This file is secret
-tls-auth keys/ta.key 0
-
-# Select a cryptographic cipher.
-# This config item must be copied to
-# the client config file as well.
-;cipher BF-CBC # Blowfish (default)
-;cipher AES-128-CBC # AES
-;cipher DES-EDE3-CBC # Triple-DES
-cipher AES-256-CBC
-
-# Enable compression on the VPN link.
-# If you enable it here, you must also
-# enable it in the client config file.
-comp-lzo
-
-# The maximum number of concurrently connected
-# clients we want to allow.
-;max-clients 100
-
-# It's a good idea to reduce the OpenVPN
-# daemon's privileges after initialization.
-#
-# You can uncomment this out on
-# non-Windows systems.
-user nobody
-group nogroup
-
-# The persist options will try to avoid
-# accessing certain resources on restart
-# that may no longer be accessible because
-# of the privilege downgrade.
-persist-key
-persist-tun
-persist-local-ip
-persist-remote-ip
-
-# Output a short status file showing
-# current connections, truncated
-# and rewritten every minute.
-status /var/log/openvpn/status-server-home.log
-
-# By default, log messages will go to the syslog (or
-# on Windows, if running as a service, they will go to
-# the "\Program Files\OpenVPN\log" directory).
-# Use log or log-append to override this default.
-# "log" will truncate the log file on OpenVPN startup,
-# while "log-append" will append to it. Use one
-# or the other (but not both).
-log /var/log/openvpn/server-home.log
-;log-append openvpn.log
-
-# Set the appropriate level of log
-# file verbosity.
-#
-# 0 is silent, except for fatal errors
-# 4 is reasonable for general usage
-# 5 and 6 can help to debug connection problems
-# 9 is extremely verbose
-verb 4
-
-# Silence repeating messages. At most 20
-# sequential messages of the same message
-# category will be output to the log.
-;mute 20
-
-crl-verify /etc/openvpn/keys/crl.pem
diff --git a/install_openvpn.sh b/install_openvpn.sh
index 3ca0f6e..af9eaee 100755
--- a/install_openvpn.sh
+++ b/install_openvpn.sh
@@ -30,6 +30,57 @@ clean_up() {
exit $1
}
+trim() {
+ local var="$*"
+ var="${var#"${var%%[![:space:]]*}"}" # remove leading whitespace characters
+ var="${var%"${var##*[![:space:]]}"}" # remove trailing whitespace characters
+ echo -n "$var"
+}
+
+# - Test of valid IPv4 Address
+# -
+# - Returns 0 if valid, > 0 otherwise
+# -
+is_valid_ipv4() {
+ local -a octets=( ${1//\./ } )
+ local RETURNVALUE=0
+
+ # return an error if the IP doesn't have exactly 4 octets
+ [[ ${#octets[@]} -ne 4 ]] && return 1
+
+ for octet in ${octets[@]}
+ do
+ if [[ ${octet} =~ ^[0-9]{1,3}$ ]]
+ then # shift number by 8 bits, anything larger than 255 will be > 0
+ ((RETURNVALUE += octet>>8 ))
+ else # octet wasn't numeric, return error
+ return 1
+ fi
+ done
+ return ${RETURNVALUE}
+}
+
+# - Convert CIDR to netmask
+# -
+cidr2mask() {
+ local i mask=""
+ local full_octets=$(($1/8))
+ local partial_octet=$(($1%8))
+
+ for ((i=0;i<4;i+=1)); do
+ if [ $i -lt $full_octets ]; then
+ mask+=255
+ elif [ $i -eq $full_octets ]; then
+ mask+=$((256 - 2**(8-$partial_octet)))
+ else
+ mask+=0
+ fi
+ test $i -lt 3 && mask+=.
+ done
+
+ echo $mask
+}
+
echononl(){
echo X\\c > /tmp/shprompt$$
if [ `wc -c /tmp/shprompt$$ | awk '{print $1}'` -eq 1 ]; then
@@ -107,21 +158,47 @@ else
fi
+clear
+echo -e "\n\t\033[32mStart script for installation of OpenVPN on this Server..\033[m"
+
+#---------------------------------------
+#-----------------------------
+# Setting Defaults
+#-----------------------------
+#---------------------------------------
+
+DEFAULT_SERVER_PORT=1194
+
+DEFAULT_CA_EXPIRE=11688
+DEFAULT_KEY_EXPIRE=7305
+
+DEFAULT_KEY_SIZE=4096
+
+DEFAULT_KEY_COUNTRY="DE"
+DEFAULT_KEY_PROVINCE="Berlin"
+DEFAULT_KEY_CITY="Berlin"
+DEFAULT_KEY_EMAIL='support@oopen.de'
+DEFAULT_KEY_OU="Network Services"
+
+DEFAULT_SERVER_CIPHER="AES-256-CBC"
+
+
+#---------------------------------------
+#-----------------------------
+# Load default values from install_openvpn.conf
+#
+# Overwrites the settings above
+#
+#-----------------------------
+#---------------------------------------
echo ""
-
-#---------------------------------------
-#-----------------------------
-# Read Configurations from $conf_file
-#-----------------------------
-#---------------------------------------
-
-echononl " Load configuration file.."
+echo ""
+echononl " Load Configuration File $(basename ${conf_file}).."
if [[ ! -f "$conf_file" ]]; then
- echo_failed
- fatal "Configuration file \033[37m\033[1m$(basename ${conf_file})\033[m not found!"
+ echo_skipped
else
- source "${conf_file}"
+ source "${conf_file}" > $log_file 2>&1
if [[ $? -eq 0 ]]; then
echo_ok
else
@@ -130,6 +207,558 @@ else
fi
fi
+echo ""
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo "Common parameters"
+echo -e "\033[32m--\033[m"
+
+echo ""
+echo "Insert IP-Address/Hostname of OpenVPN Server"
+echo ""
+OPENVPN_SERVER=""
+if [[ -n "$DEFAULT_SERVER" ]] ; then
+ echononl "Server Port [${DEFAULT_SERVER}]: "
+ read OPENVPN_SERVER
+ if [[ "X$OPENVPN_SERVER" = "X" ]]; then
+ OPENVPN_SERVER="$DEFAULT_SERVER"
+ fi
+else
+ echononl "OpenVPN Server: "
+ read OPENVPN_SERVER
+ while [ "X$OPENVPN_SERVER" = "X" ] ; do
+ echo -e "\n\t\033[33m\033[1mSetting 'OpenVPN Server' is required!\033[m\n"
+ echononl "OpenVPN Server: "
+ read OPENVPN_SERVER
+ done
+fi
+
+
+echo ""
+SERVER_PORT=""
+
+echononl "Server Port [${DEFAULT_SERVER_PORT}]: "
+while [[ "X${SERVER_PORT}" = "X" ]]; do
+ read SERVER_PORT
+ if [[ "X$SERVER_PORT" = "X" ]]; then
+ SERVER_PORT="$DEFAULT_SERVER_PORT"
+ fi
+done
+
+if $(grep -q -E "SERVER_PORT=$SERVER_PORT" ${script_dir}/conf/server-*.conf 2> /dev/null) ; then
+ warn "Port '$SERVER_PORT' is already in use by an other OpenVPN Service on this Server"
+fi
+
+echo ""
+echo "Insert Name of OpenVPN Service (i.e. so36, gw-ckubu, opferperspektive)"
+echo ""
+echo " Example: 'so36' or 'gw-ckubu' or 'opferperspektive' or.."
+echo ""
+OPENVPN_NAME=""
+echononl "OpenVPN Name: "
+read OPENVPN_NAME
+while [ "X$OPENVPN_NAME" = "X" ] ; do
+ echo -e "\n\t\033[33m\033[1mSetting 'OpenVPN Name' is required!\033[m\n"
+ echononl "OpenVPN Name: "
+ read OPENVPN_NAME
+done
+
+DEFAULT_OPENVPN_BASE_DIR="/etc/openvpn/${OPENVPN_NAME}"
+
+[[ -n "$DEFAULT_KEY_ORG" ]] || DEFAULT_KEY_ORG="$OPENVPN_NAME"
+
+DEFAULT_KEY_NAME="$OPENVPN_NAME"
+DEFAULT_KEY_CN="$OPENVPN_NAME"
+DEFAULT_KEY_ALTNAMES="$OPENVPN_NAME"
+
+echo ""
+echo ""
+echo "Insert OpenVPN Base Directory for Service '$OPENVPN_NAME'"
+echo ""
+echo " Note: must be a subdirectory of '/etc/openvpn'"
+echo ""
+OPENVPN_BASE_DIR=""
+
+echononl "OpenVPN Base Directory [${DEFAULT_OPENVPN_BASE_DIR}]: "
+while [[ "X${OPENVPN_BASE_DIR}" = "X" ]]; do
+ read OPENVPN_BASE_DIR
+ if [[ "X$OPENVPN_BASE_DIR" = "X" ]]; then
+ OPENVPN_BASE_DIR="$DEFAULT_OPENVPN_BASE_DIR"
+ else
+ if [[ ! "$(dirname ${OPENVPN_BASE_DIR})" = "/etc/openvpn" ]]; then
+ echo -e "\n\t\033[33m\033[1mGiven entry is NOT a subdirectory of '/etc/openvpn'. Retry..\033[m\n"
+ echononl "OpenVPN Base Directory [${DEFAULT_OPENVPN_BASE_DIR}]: "
+ OPENVPN_BASE_DIR=""
+ fi
+ fi
+done
+
+EASY_RSA_DIR="${OPENVPN_BASE_DIR}/easy-rsa"
+OPENVPN_CCD_DIR="${OPENVPN_BASE_DIR}/ccd/server-${OPENVPN_NAME}"
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo "KEY generation parameters"
+echo -e "\033[32m--\033[m"
+
+echo ""
+echo "Insert expiration time for ROOT CA"
+echo ""
+echo " Example: (3*365+366)*8 = 11688 = 32 Jahre"
+echo " expiration time: 11688"
+echo ""
+CA_EXPIRE=""
+
+echononl "Expiration time ROOT CA [${DEFAULT_CA_EXPIRE}]: "
+while [[ "X${CA_EXPIRE}" = "X" ]]; do
+ read CA_EXPIRE
+ if [[ "X$CA_EXPIRE" = "X" ]]; then
+ CA_EXPIRE="$DEFAULT_CA_EXPIRE"
+ fi
+done
+
+echo ""
+echo ""
+echo "Insert expiration time for user/server certificates"
+echo ""
+echo " Example: (3*365+366)*5 = 7305 = 20 Jahre"
+echo " expiration time: 7305"
+echo ""
+KEY_EXPIRE=""
+
+echononl "Expiration time certificates [${DEFAULT_KEY_EXPIRE}]: "
+while [[ "X${KEY_EXPIRE}" = "X" ]]; do
+ read KEY_EXPIRE
+ if [[ "X$KEY_EXPIRE" = "X" ]]; then
+ KEY_EXPIRE="$DEFAULT_KEY_EXPIRE"
+ fi
+done
+
+echo ""
+echo ""
+echo "Insert key size for user/server keys"
+echo ""
+KEY_SIZE=""
+
+echononl "KEY_SIZE [${DEFAULT_KEY_SIZE}]: "
+while [[ "X${KEY_SIZE}" = "X" ]]; do
+ read KEY_SIZE
+ if [[ "X$KEY_SIZE" = "X" ]]; then
+ KEY_SIZE="$DEFAULT_KEY_SIZE"
+ fi
+done
+
+echo ""
+echo ""
+echo "Insert key meta-data"
+echo ""
+KEY_COUNTRY=""
+echononl "KEY_COUNTRY [${DEFAULT_KEY_COUNTRY}]: "
+read KEY_COUNTRY
+if [[ "X$KEY_COUNTRY" = "X" ]]; then
+ KEY_COUNTRY="$DEFAULT_KEY_COUNTRY"
+fi
+
+KEY_PROVINCE=""
+echo ""
+echononl "KEY_PROVINCE [${DEFAULT_KEY_PROVINCE}]: "
+read KEY_PROVINCE
+if [[ "X$KEY_PROVINCE" = "X" ]]; then
+ KEY_PROVINCE="$DEFAULT_KEY_PROVINCE"
+fi
+
+KEY_CITY=""
+echo ""
+echononl "KEY_CITY [${DEFAULT_KEY_CITY}]: "
+read KEY_CITY
+if [[ "X$KEY_CITY" = "X" ]]; then
+ KEY_CITY="$DEFAULT_KEY_CITY"
+fi
+
+KEY_ORG=""
+echo ""
+echononl "KEY_ORG [${DEFAULT_KEY_ORG}]: "
+read KEY_ORG
+if [[ "X$KEY_ORG" = "X" ]]; then
+ KEY_ORG="$DEFAULT_KEY_ORG"
+fi
+
+KEY_EMAIL=""
+echo ""
+echononl "KEY_EMAIL [${DEFAULT_KEY_EMAIL}]: "
+read KEY_EMAIL
+if [[ "X$KEY_EMAIL" = "X" ]]; then
+ KEY_EMAIL="$DEFAULT_KEY_EMAIL"
+fi
+EMAIL_PREFIX="$(echo $KEY_EMAIL | cut -d '@' -f1)"
+EMAIL_DOMAIN="$(echo $KEY_EMAIL | cut -d '@' -f2)"
+
+KEY_OU=""
+echo ""
+echononl "KEY_OU [${DEFAULT_KEY_OU}]: "
+read KEY_OU
+if [[ "X$KEY_OU" = "X" ]]; then
+ KEY_OU="$DEFAULT_KEY_OU"
+fi
+
+KEY_NAME=
+echo ""
+echononl "KEY_NAME [${DEFAULT_KEY_NAME}]: "
+read KEY_NAME
+if [[ "X$KEY_NAME" = "X" ]]; then
+ KEY_NAME="$DEFAULT_KEY_NAME"
+else
+ DEFAULT_KEY_CN="$KEY_NAME"
+ DEFAULT_KEY_ALTNAMES="$KEY_NAME"
+fi
+
+KEY_CN=""
+echo ""
+echononl "KEY_CN [${DEFAULT_KEY_CN}]: "
+read KEY_CN
+if [[ "X$KEY_CN" = "X" ]]; then
+ KEY_CN="$DEFAULT_KEY_CN"
+else
+ DEFAULT_KEY_ALTNAMES="$KEY_CN"
+fi
+
+KEY_ALTNAMES=""
+echo ""
+echononl "KEY_ALTNAMES [${DEFAULT_KEY_ALTNAMES}]: "
+read KEY_ALTNAMES
+if [[ "X$KEY_ALTNAMES" = "X" ]]; then
+ KEY_ALTNAMES="$DEFAULT_KEY_ALTNAMES"
+fi
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo "Parameters for Server Configurations"
+echo -e "\033[32m--\033[m"
+
+echo ""
+echo "Set OpenVPN Network used for the connection."
+echo ""
+OPENVPN_NETWORK=""
+echononl "OpenVPN Network: "
+read OPENVPN_NETWORK
+while [ "X$OPENVPN_NETWORK" = "X" ] ; do
+ echo -e "\n\t\033[33m\033[1mSetting 'OpenVPN Server' is required!\033[m\n"
+ echononl "OpenVPN Network: "
+ read OPENVPN_NETWORK
+done
+OPENVPN_SERVER_IP="${OPENVPN_NETWORK%.*}.1"
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+echo ""
+echo "Set server-side 'cryptographic cipher'."
+echo ""
+echo "Note: if setting this parameter at the server configuration, this parameter *must'"
+echo " also set this parameter at client configuration"
+echo ""
+echo -e "Type \"\033[33mNone\033[m\" if no default cipher should be set."
+echo ""
+SERVER_CIPHER=""
+echononl "Server cryptographic cipher [${DEFAULT_SERVER_CIPHER}]: "
+read SERVER_CIPHER
+if [[ "X$SERVER_CIPHER" = "X" ]]; then
+ SERVER_CIPHER="$DEFAULT_SERVER_CIPHER"
+else
+ _to_lower_server_cipher="$( trim ${SERVER_CIPHER,,})"
+ if [[ "$_to_lower_server_cipher" = "none" ]]; then
+ SERVER_CIPHER=""
+ fi
+fi
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+echo ""
+echo "Networks to push from OpenVPN server to the client"
+echo ""
+echo " - use CIDR notation"
+echo " - multiple networks are possible: use blank separated list of CIDR-networks"
+echo ""
+echo -e "Type \"\033[33mNone\033[m\" if no network should be pushed from OpenVPN server."
+echo ""
+REMOTE_NETWORKS=""
+declare -a REMOTE_NETWORK_ARR=()
+echononl "Networks to push from server: "
+while [[ "X$REMOTE_NETWORKS" = "X" ]] ; do
+ read REMOTE_NETWORKS
+ _to_lower_remote_networks="$(trim ${REMOTE_NETWORKS,,})"
+ if [[ "X$_to_lower_remote_networks" = "none" ]]; then
+ REMOTE_NETWORKS=""
+ break
+ fi
+ if [[ "X$REMOTE_NETWORKS" = "X" ]] ; then
+ echo -e "\n\t\033[33m\033[1mWrong Entry!\033[m\n"
+ echononl "Networks to push from server: "
+ continue
+ fi
+
+ for _net in ${REMOTE_NETWORKS} ; do
+ IFS='/' read -a _net_arr <<< "${_net}"
+ if ! is_valid_ipv4 ${_net_arr[0]} ; then
+ REMOTE_NETWORKS=""
+ REMOTE_NETWORK_ARR=()
+ echo -e "\n\t\033[33m\033[1mNo valid network(s) given!\033[m\n"
+ echononl "Networks to push from server: "
+ break
+ fi
+ REMOTE_NETWORK_ARR+=("$_net")
+ done
+done
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+echo ""
+echo "IP-Address of DNS server to push from OpenVPN server to the client."
+echo ""
+echo -e "Type \"\033[33mNone\033[m\" if no DNS Server should be pushed."
+echo ""
+DNS_SERVER=""
+echononl "DNS server to push to clients: "
+while [[ "X$DNS_SERVER" = "X" ]]; do
+ read DNS_SERVER
+ if [[ "X$DNS_SERVER" = "X" ]]; then
+ echo -e "\n\t\033[33m\033[1mWrong Entry!\033[m\n"
+ echononl "DNS server to pusch to clients"
+ continue
+ else
+ _to_lower_dns_server="$(trim ${DNS_SERVER,,})"
+ if [[ "$_to_lower_dns_server" = "none" ]]; then
+ DNS_SERVER=""
+ break;
+ fi
+ fi
+done
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+echo ""
+echo "Default Domain to push from OpenVPN server to the client."
+echo ""
+echo -e "Type \"\033[33mNone\033[m\" if no default domain should be pushed."
+echo ""
+DEFAULT_DOMAIN=""
+echononl "Default Domain to push to clients: "
+while [[ "X$DEFAULT_DOMAIN" = "X" ]]; do
+ read DEFAULT_DOMAIN
+ if [[ "X$DEFAULT_DOMAIN" = "X" ]]; then
+ echo -e "\n\t\033[33m\033[1mWrong Entry!\033[m\n"
+ echononl "Default Domain to pusch to clients"
+ continue
+ else
+ _to_lower_default_domain="$(trim ${DEFAULT_DOMAIN,,})"
+ if [[ "$_to_lower_default_domain" = "none" ]]; then
+ DEFAULT_DOMAIN=""
+ break;
+ fi
+ fi
+done
+
+echo ""
+echo -e "\033[32m--\033[m"
+echo ""
+
+echo ""
+echo "Local networks to route through OpenVPN line"
+echo ""
+echo " - use CIDR notation"
+echo " - multiple networks are possible: use blank separated list of CIDR-networks"
+echo ""
+echo -e "Type \"\033[33mNone\033[m\" if no network should be pushed from OpenVPN server."
+echo ""
+LOCAL_NETWORKS=""
+declare -a LOCAL_NETWORK_ARR=()
+echononl "Local networks to route through OpenVPN line: "
+while [[ "X$LOCAL_NETWORKS" = "X" ]] ; do
+ read LOCAL_NETWORKS
+ _to_lower_local_networks="$(trim ${LOCAL_NETWORKS,,})"
+ if [[ "$_to_lower_local_networks" = "none" ]]; then
+ LOCAL_NETWORKS=""
+ break
+ fi
+ if [[ "X$LOCAL_NETWORKS" = "X" ]] ; then
+ echo -e "\n\t\033[33m\033[1mWrong Entry!\033[m\n"
+ echononl "Local networks to route through OpenVPN line: "
+ continue
+ fi
+
+ for _net in ${LOCAL_NETWORKS} ; do
+ IFS='/' read -a _net_arr <<< "${_net}"
+ if ! is_valid_ipv4 ${_net_arr[0]} ; then
+ LOCAL_NETWORKS=""
+ LOCAL_NETWORK_ARR=()
+ echo -e "\n\t\033[33m\033[1mNo valid network(s) given!\033[m\n"
+ echononl "Local networks to route through OpenVPN line: "
+ break
+ fi
+ LOCAL_NETWORK_ARR+=("$_net")
+ done
+done
+
+
+echo ""
+echo ""
+echo -e "\033[1;32mSettings for installation of \033[1;37mOpenVPN\033[m"
+echo ""
+echo -e "\tOpenVPN IP-Address/Hostname.........: $OPENVPN_SERVER"
+echo -e "\tOpenVPN Server.Port.................: $SERVER_PORT"
+echo ""
+echo -e "\tOpenVPN Servive Name................: $OPENVPN_NAME"
+echo -e "\tOpenVPN Base Directory..............: $OPENVPN_BASE_DIR"
+echo -e "\tOpenVPN 'easy-rsa' Directory........: $EASY_RSA_DIR"
+echo -e "\tOpenVPN 'ccd' Directory.............: $OPENVPN_CCD_DIR"
+echo ""
+echo -e "\tExpiration time ROOT CA.............: $CA_EXPIRE"
+echo -e "\tExpiration time certificates........: $KEY_EXPIRE"
+echo -e "\tKey size............................: $KEY_SIZE"
+echo ""
+echo -e "\tKEY_COUNTRY.........................: $KEY_COUNTRY"
+echo -e "\tKEY_PROVINCE........................: $KEY_PROVINCE"
+echo -e "\tKEY_CITY............................: $KEY_CITY"
+echo -e "\tKEY_ORG.............................: $KEY_ORG"
+echo -e "\tKEY_EMAIL...........................: $KEY_EMAIL"
+echo -e "\tKEY_OU..............................: $KEY_OU"
+echo ""
+echo -e "\tKEY_NAME............................: $KEY_NAME"
+echo -e "\tKEY_CN..............................: $KEY_CN"
+echo ""
+echo -e "\tKEY_ALTNAMES........................: $KEY_ALTNAMES"
+echo ""
+echo -e "\tOpenVPN Network.....................: $OPENVPN_NETWORK"
+echo -e "\tOpenVPN Server IP-Address...........: $OPENVPN_SERVER_IP"
+echo ""
+if [[ -n "$SERVER_CIPHER" ]] ; then
+ echo -e "\tServer cipher setting...............: $SERVER_CIPHER"
+else
+ echo -e "\tServer cipher setting...............: \033[33mNone\033[m"
+fi
+echo ""
+if [[ ${#REMOTE_NETWORK_ARR[@]} -gt 0 ]]; then
+ echo -e "\tRemote networks to push to cliente..: ${REMOTE_NETWORK_ARR[@]}"
+else
+ echo -e "\tRemote networks to push to cliente..: \033[33mNone\033[m"
+fi
+if [[ -n "$DNS_SERVER" ]]; then
+ echo -e "\tDNS Server (push from server).......: $DNS_SERVER"
+else
+ echo -e "\tDNS Server (push from server).......: \033[33mNone\033[m"
+fi
+if [[ -n "$DEFAULT_DOMAIN" ]]; then
+ echo -e "\tDefault Domain (push from server)...: $DEFAULT_DOMAIN"
+else
+ echo -e "\tDefault Domain (push from server)...: \033[33mNone\033[m"
+fi
+echo ""
+if [[ ${#LOCAL_NETWORK_ARR[@]} -gt 0 ]]; then
+ echo -e "\tLocal networks to route through VPN.: ${LOCAL_NETWORK_ARR[@]}"
+else
+ echo -e "\tLocal networks to route through VPN.: \033[33mNone\033[m"
+fi
+
+
+echo ""
+info "Starting Installation of OpenVPN Service \033[37m\033[1m${OPENVPN_NAME}\033[m.."
+echo -n "To continue type uppercase 'YES': "
+read OK
+echo ""
+if [[ "$OK" != "YES" ]] ; then
+ fatal "Abort by user request - Answer as not 'YES'"
+fi
+
+
+
+#---------------------------------------
+#-----------------------------
+# Write Configuration for $OPENVPN_NAME
+#-----------------------------
+#---------------------------------------
+
+
+_openvpn_name_conf_file="${script_dir}/conf/server-${OPENVPN_NAME}.conf"
+
+echononl " Write Configuration for OpenVPN Service '$OPENVPN_NAME'"
+cat << EOF > $_openvpn_name_conf_file 2> $log_file
+## - Configuration/Initialization OpenVPN
+## -
+
+# ====================
+# - Some Parameter Settings
+# ====================
+
+# ---
+# - Common parameters
+# ---
+
+OPENVPN_SERVER="$OPENVPN_SERVER"
+SERVER_PORT=$SERVER_PORT
+
+OPENVPN_NAME="$OPENVPN_NAME"
+
+OPENVPN_BASE_DIR="$OPENVPN_BASE_DIR"
+
+# ---
+# - Parameters OpenVPN Configuration / KEY Creation
+# ---
+
+# - Example: (3*365+366)*8 = 11688 = 32 Jahre
+# - CA_EXPIRE=11688
+# -
+CA_EXPIRE=$CA_EXPIRE
+
+# - Example: (3*365+366)*5 = 7305 = 20 Jahre
+# - KEY_EXPIRE=7305
+# -
+KEY_EXPIRE=$KEY_EXPIRE
+
+KEY_SIZE=$KEY_SIZE
+
+KEY_COUNTRY="$KEY_COUNTRY"
+KEY_PROVINCE="$KEY_PROVINCE"
+KEY_CITY="$KEY_CITY"
+KEY_ORG="$KEY_ORG"
+KEY_EMAIL="${EMAIL_PREFIX}\\@${EMAIL_DOMAIN}"
+KEY_OU="$KEY_OU"
+
+KEY_NAME="$KEY_NAME"
+KEY_CN="$KEY_CN"
+
+KEY_ALTNAMES="$KEY_ALTNAMES"
+
+
+# ---
+# - Parameters for Server Configurations
+# ---
+
+OPENVPN_NETWORK="$OPENVPN_NETWORK"
+
+SERVER_CIPHER="$SERVER_CIPHER"
+
+REMOTE_NETWORKS="${REMOTE_NETWORK_ARR[@]}"
+DNS_SERVER="$DNS_SERVER"
+DEFAULT_DOMAIN="$DEFAULT_DOMAIN"
+
+LOCAL_NETWORKS="${LOCAL_NETWORK_ARR[@]}"
+EOF
+if [[ $? -eq 0 ]] ; then
+ echo_ok
+else
+ echo_failed
+ fatal "$(cat $log_file)"
+fi
+
+
#---------------------------------------
#-----------------------------
@@ -383,6 +1012,7 @@ if [[ $? -ne 0 ]]; then
_failed=true
fi
+
perl -i -n -p -e "s/^(\s*#*\s*export\s+KEY_SIZE=.*)/##\1\nexport KEY_SIZE=$KEY_SIZE/" ${EASY_RSA_DIR}/vars > "$log_file"
2>&1
if [[ $? -ne 0 ]]; then
@@ -419,7 +1049,7 @@ perl -i -n -p -e "s/^(\s*#*\s*export\s+KEY_ORG=.*)/##\1\nexport KEY_ORG=\"${KEY_
if [[ $? -ne 0 ]]; then
_failed=true
fi
-perl -i -n -p -e "s/^(\s*#*\s*export\s+KEY_EMAIL=.*)/##\1\nexport KEY_EMAIL=\"${KEY_EMAIL}\"/" ${EASY_RSA_DIR}/vars > "$log_file"
+perl -i -n -p -e "s/^(\s*#*\s*export\s+KEY_EMAIL=.*)/##\1\nexport KEY_EMAIL=\"${EMAIL_PREFIX}\@${EMAIL_DOMAIN}\"/" ${EASY_RSA_DIR}/vars > "$log_file"
2>&1
if [[ $? -ne 0 ]]; then
_failed=true
@@ -533,7 +1163,7 @@ fi
#echononl " Create Sever Key"
echo ""
echo -e " \033[32mNow create the server key. Tis procedure works interactive.\033[m"
-echo -e " Use \033[37m\033[1m${KEY_CN}-server\033[m as commonName"
+echo -e " Use \033[37m\033[1m${KEY_CN}-server\033[m as 'commonName'"
echo ""
echononl "Type to continue: "
read ok
@@ -568,7 +1198,7 @@ fi
# - Create empty CRL (Certificate Revokation List)
# -
echononl " Create CRL (Certificate Revokation List) '${OPENVPN_BASE_DIR}/crl.pem'.."
-openssl ca -gencrl -out /etc/openvpn/crl.pem -config $KEY_CONFIG > "$log_file" 2>&1
+openssl ca -gencrl -out ${OPENVPN_BASE_DIR}/crl.pem -config $KEY_CONFIG > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
else
@@ -577,7 +1207,7 @@ else
fi
echononl " Create symlink for '${OPENVPN_BASE_DIR}/keys/crl.pem'.."
-ln -s ../crl.pem /etc/openvpn/keys/crl.pem > "$log_file" 2>&1
+ln -s ../crl.pem ${OPENVPN_BASE_DIR}/keys/crl.pem > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
else
@@ -596,9 +1226,9 @@ echo "Server configurations .."
echo -e "\033[32m--\033[m"
echo ""
-echononl " Backup Client configuration directory '$CCD_HOME'"
-if [[ -d "$CCD_HOME" ]]; then
- mv "$CCD_HOME" "${CCD_HOME}.$_date"
+echononl " Backup Client configuration directory '$OPENVPN_CCD_DIR'"
+if [[ -d "$OPENVPN_CCD_DIR" ]]; then
+ mv "$OPENVPN_CCD_DIR" "${OPENVPN_CCD_DIR}.$_date"
if [[ $? -eq 0 ]] ; then
echo_ok
else
@@ -610,8 +1240,8 @@ else
fi
-echononl " Create Client configuration directory '$CCD_HOME'"
-mkdir "$CCD_HOME" > "$log_file" 2>&1
+echononl " Create Client configuration directory '$OPENVPN_CCD_DIR'"
+mkdir "$OPENVPN_CCD_DIR" > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
else
@@ -619,9 +1249,17 @@ else
error "$(cat $log_file)"
fi
-echononl " Backup file ${OPENVPN_BASE_DIR}/server-home.conf"
-if [[ -f "${OPENVPN_BASE_DIR}/server-home.conf" ]] ; then
- mv "${OPENVPN_BASE_DIR}/server-home.conf" "${OPENVPN_BASE_DIR}/server-home.conf.$_date" > "$log_file" 2>&1
+
+#---------------------------------------
+#-----------------------------
+# Write Server Configuration for $OPENVPN_NAME
+#-----------------------------
+#---------------------------------------
+_server_conf_file="/etc/openvpn/server-${OPENVPN_NAME}.conf"
+
+echononl " Backup file $_server_conf_file"
+if [[ -f "$_server_conf_file" ]] ; then
+ mv "$_server_conf_file" "${_server_conf_file}.$_date" > "$log_file" 2>&1
if [[ $? -eq 0 ]] ; then
echo_ok
else
@@ -632,8 +1270,8 @@ else
echo_skipped
fi
-echononl " Create configuration '${OPENVPN_BASE_DIR}/server-home.conf"
-cat < ${OPENVPN_BASE_DIR}/server-home.conf 2> "$log_file"
+echononl " Create configuration '${_server_conf_file}"
+cat < ${_server_conf_file} 2> "$log_file"
#################################################
# Sample OpenVPN 2.0 config file for #
# multi-client server. #
@@ -651,7 +1289,7 @@ cat < ${OPENVPN_BASE_DIR}/server-home.conf 2> "$log_file"
# or Linux/BSD systems. Remember on #
# Windows to quote pathnames and use #
# double backslashes, e.g.: #
-# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
+# "C:\\\\Program Files\\\\OpenVPN\\\\config\\\\foo.key" #
# #
# Comments are preceded with '#' or ';' #
#################################################
@@ -665,16 +1303,30 @@ cat < ${OPENVPN_BASE_DIR}/server-home.conf 2> "$log_file"
# on the same machine, use a different port
# number for each one. You will need to
# open up this port on your firewall.
-port $SERVER_PORT_HOME
+port $SERVER_PORT
# TCP or UDP server?
;proto tcp
proto udp
-
topology subnet
-#route 192.168.63.0 255.255.255.0 10.1.72.1
-#route 192.168.64.0 255.255.255.0 10.1.72.1
+EOF
+
+if [[ ${#LOCAL_NETWORK_ARR[@]} -gt 0 ]]; then
+ for _local_network in ${LOCAL_NETWORK_ARR[@]} ; do
+ IFS='/' read -a _net_arr <<< "${_local_network}"
+ if [[ -n ${_net_arr[1]} ]]; then
+ _netmask=$(cidr2mask ${_net_arr[1]})
+ else
+ _netmask="255.255.255.0"
+ fi
+ cat <> ${_server_conf_file} 2>> "$log_file"
+route ${_net_arr[0]} $_netmask $OPENVPN_SERVER_IP
+EOF
+ done
+fi
+
+cat <> ${_server_conf_file} 2>> "$log_file"
# "dev tun" will create a routed IP tunnel,
# "dev tap" will create an ethernet tunnel.
@@ -691,6 +1343,9 @@ topology subnet
;dev tap
dev tun
+# Enable TUN IPv6 module
+;tun-ipv6
+
# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel if you
# have more than one. On XP SP2 or higher,
@@ -723,7 +1378,7 @@ key ${OPENVPN_BASE_DIR}/keys/server.key # This file should be kept secret
# openssl dhparam -out dh1024.pem 1024
# Substitute 2048 for 1024 if you are using
# 2048 bit keys.
-dh ${OPENVPN_BASE_DIR}/keys/dh2048.pem
+dh ${OPENVPN_BASE_DIR}/keys/dh${KEY_SIZE}.pem
# Configure server mode and supply a VPN subnet
# for OpenVPN to draw client addresses from.
@@ -732,14 +1387,16 @@ dh ${OPENVPN_BASE_DIR}/keys/dh2048.pem
# Each client will be able to reach the server
# on 10.8.0.1. Comment this line out if you are
# ethernet bridging. See the man page for more info.
-server $OPENVPN_NETWORK_HOME 255.255.255.0
+;server 10.8.0.0 255.255.255.0
+;server-ipv6 2a01:30:1fff:fd00::/64
+server $OPENVPN_NETWORK 255.255.255.0
# Maintain a record of client <-> virtual IP address
# associations in this file. If OpenVPN goes down or
# is restarted, reconnecting clients can be assigned
# the same virtual IP address from the pool that was
# previously assigned.
-ifconfig-pool-persist /etc/openvpn/ipp.txt
+ifconfig-pool-persist ${OPENVPN_BASE_DIR}/ipp.txt
# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
@@ -761,15 +1418,29 @@ ifconfig-pool-persist /etc/openvpn/ipp.txt
# address pool (10.8.0.0/255.255.255.0)
# back to the OpenVPN server.
;push "route 10.8.0.0 255.255.255.0"
-push "route $MAIN_NETWORK 255.255.255.0"
+EOF
+if [[ ${#REMOTE_NETWORK_ARR[@]} -gt 0 ]]; then
+ for _remote_network in ${REMOTE_NETWORK_ARR[@]} ; do
+ IFS='/' read -a _net_arr <<< "${_remote_network}"
+ if [[ -n ${_net_arr[1]} ]]; then
+ _netmask=$(cidr2mask ${_net_arr[1]})
+ else
+ _netmask="255.255.255.0"
+ fi
+ cat <> ${_server_conf_file} 2>> "$log_file"
+push "route ${_net_arr[0]} $_netmask"
+EOF
+ done
+fi
+
+cat <> ${_server_conf_file} 2>> "$log_file"
# To assign specific IP addresses to specific
# clients or if a connecting client has a private
# subnet behind it that should also have VPN access,
# use the subdirectory "ccd" for client-specific
# configuration files (see man page for more info).
-
-client-config-dir $CCD_HOME
+client-config-dir $OPENVPN_CCD_DIR
# ---
# EXAMPLE: Suppose the client
@@ -834,8 +1505,19 @@ client-config-dir $CCD_HOME
# or WINS server addresses. CAVEAT:
# http://openvpn.net/faq.html#dhcpcaveats
;push "dhcp-option WINS 10.8.0.1"
+EOF
+if [[ -n "$DNS_SERVER" ]]; then
+ cat <> ${_server_conf_file} 2>> "$log_file"
push "dhcp-option DNS ${DNS_SERVER}"
-push "dhcp-option DOMAIN ${DOMAIN}"
+EOF
+fi
+if [[ -n "$DEFAULT_DOMAIN" ]]; then
+ cat <> ${_server_conf_file} 2>> "$log_file"
+push "dhcp-option DOMAIN ${DEFAULT_DOMAIN}"
+EOF
+fi
+
+cat <> ${_server_conf_file} 2>> "$log_file"
# Uncomment this directive to allow different
# clients to be able to "see" each other.
@@ -887,7 +1569,16 @@ tls-auth ${OPENVPN_BASE_DIR}/keys/ta.key 0
;cipher BF-CBC # Blowfish (default)
;cipher AES-128-CBC # AES
;cipher DES-EDE3-CBC # Triple-DES
+EOF
+
+if [[ -n "$SERVER_CIPHER" ]]; then
+ cat <> ${_server_conf_file} 2>> "$log_file"
cipher AES-256-CBC
+EOF
+
+fi
+
+cat <> ${_server_conf_file} 2>> "$log_file"
# Enable compression on the VPN link.
# If you enable it here, you must also
@@ -918,7 +1609,9 @@ persist-remote-ip
# Output a short status file showing
# current connections, truncated
# and rewritten every minute.
-status /var/log/openvpn/status-server-home.log
+;status openvpn-status.log
+status /var/log/openvpn/status-server-${OPENVPN_NAME}.log
+
# By default, log messages will go to the syslog (or
# on Windows, if running as a service, they will go to
# the "\Program Files\OpenVPN\log" directory).
@@ -926,8 +1619,9 @@ status /var/log/openvpn/status-server-home.log
# "log" will truncate the log file on OpenVPN startup,
# while "log-append" will append to it. Use one
# or the other (but not both).
-log /var/log/openvpn/server-home.log
;log-append openvpn.log
+;log openvpn.log
+log /var/log/openvpn/server-${OPENVPN_NAME}.log
# Set the appropriate level of log
# file verbosity.
@@ -936,7 +1630,7 @@ log /var/log/openvpn/server-home.log
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
-verb 4
+verb 1
# Silence repeating messages. At most 20
# sequential messages of the same message
@@ -945,7 +1639,6 @@ verb 4
# CRL (certificate revocation list) verification
crl-verify ${OPENVPN_BASE_DIR}/crl.pem
-
EOF
if [[ $? -eq 0 ]] ; then
echo_ok
@@ -956,369 +1649,6 @@ fi
echo ""
-echononl " Backup Client configuration directory '$CCD_GW_CKUBU'"
-if [[ -d "$CCD_GW_CKUBU" ]]; then
- mv "$CCD_GW_CKUBU" "${CCD_GW_CKUBU}.$_date"
- if [[ $? -eq 0 ]] ; then
- echo_ok
- else
- echo_failed
- error "$(cat $log_file)"
- fi
-else
- echo_skipped
-fi
-
-
-echononl " Create Client configuration directory '$CCD_HOME'"
-mkdir "$CCD_GW_CKUBU" > "$log_file" 2>&1
-if [[ $? -eq 0 ]] ; then
- echo_ok
-else
- echo_failed
- error "$(cat $log_file)"
-fi
-
-echononl " Backup file ${OPENVPN_BASE_DIR}/server-gw-ckubu.conf"
-if [[ -f "${OPENVPN_BASE_DIR}/server-gw-ckubu.conf" ]]; then
- mv "${OPENVPN_BASE_DIR}/server-gw-ckubu.conf" "${OPENVPN_BASE_DIR}/server-gw-ckubu.conf.$_date" > "$log_file" 2>&1
- if [[ $? -eq 0 ]] ; then
- echo_ok
- else
- echo_failed
- error "$(cat $log_file)"
- fi
-else
- echo_skipped
-fi
-
-echononl " Create configuration '${OPENVPN_BASE_DIR}/erver-gw-ckubu.conf"
-cat < ${OPENVPN_BASE_DIR}/server-gw-ckubu.conf 2> "$log_file"
-#################################################
-# Sample OpenVPN 2.0 config file for #
-# multi-client server. #
-# #
-# This file is for the server side #
-# of a many-clients <-> one-server #
-# OpenVPN configuration. #
-# #
-# OpenVPN also supports #
-# single-machine <-> single-machine #
-# configurations (See the Examples page #
-# on the web site for more info). #
-# #
-# This config should work on Windows #
-# or Linux/BSD systems. Remember on #
-# Windows to quote pathnames and use #
-# double backslashes, e.g.: #
-# "C:\\Program Files\\OpenVPN\\config\\foo.key" #
-# #
-# Comments are preceded with '#' or ';' #
-#################################################
-
-# Which local IP address should OpenVPN
-# listen on? (optional)
-;local a.b.c.d
-
-# Which TCP/UDP port should OpenVPN listen on?
-# If you want to run multiple OpenVPN instances
-# on the same machine, use a different port
-# number for each one. You will need to
-# open up this port on your firewall.
-port $SERVER_PORT_GW_CKUBU
-
-# TCP or UDP server?
-;proto tcp
-proto udp
-
-
-topology subnet
-route 192.168.63.0 255.255.255.0 $IPV4_OPENVPN_GW_CKUBU
-route 192.168.64.0 255.255.255.0 $IPV4_OPENVPN_GW_CKUBU
-
-# "dev tun" will create a routed IP tunnel,
-# "dev tap" will create an ethernet tunnel.
-# Use "dev tap" if you are ethernet bridging.
-# If you want to control access policies
-# over the VPN, you must create firewall
-# rules for the the TUN/TAP interface.
-# On non-Windows systems, you can give
-# an explicit unit number, such as tun0.
-# On Windows, use "dev-node" for this.
-# On most systems, the VPN will not function
-# unless you partially or fully disable
-# the firewall for the TUN/TAP interface.
-;dev tap
-dev tun
-
-# Windows needs the TAP-Win32 adapter name
-# from the Network Connections panel if you
-# have more than one. On XP SP2 or higher,
-# you may need to selectively disable the
-# Windows firewall for the TAP adapter.
-# Non-Windows systems usually don't need this.
-;dev-node MyTap
-
-# SSL/TLS root certificate (ca), certificate
-# (cert), and private key (key). Each client
-# and the server must have their own cert and
-# key file. The server and all clients will
-# use the same ca file.
-#
-# See the "easy-rsa" directory for a series
-# of scripts for generating RSA certificates
-# and private keys. Remember to use
-# a unique Common Name for the server
-# and each of the client certificates.
-#
-# Any X509 key management system can be used.
-# OpenVPN can also use a PKCS #12 formatted key file
-# (see "pkcs12" directive in man page).
-ca keys/ca.crt
-cert keys/server.crt
-key keys/server.key # This file should be kept secret
-
-# Diffie hellman parameters.
-# Generate your own with:
-# openssl dhparam -out dh1024.pem 1024
-# Substitute 2048 for 1024 if you are using
-# 2048 bit keys.
-dh keys/dh2048.pem
-
-# Configure server mode and supply a VPN subnet
-# for OpenVPN to draw client addresses from.
-# The server will take 10.8.0.1 for itself,
-# the rest will be made available to clients.
-# Each client will be able to reach the server
-# on 10.8.0.1. Comment this line out if you are
-# ethernet bridging. See the man page for more info.
-server $OPENVPN_NETWORK_GW_CKUBU 255.255.255.0
-
-# Maintain a record of client <-> virtual IP address
-# associations in this file. If OpenVPN goes down or
-# is restarted, reconnecting clients can be assigned
-# the same virtual IP address from the pool that was
-# previously assigned.
-ifconfig-pool-persist /etc/openvpn/ipp.txt
-
-# Configure server mode for ethernet bridging.
-# You must first use your OS's bridging capability
-# to bridge the TAP interface with the ethernet
-# NIC interface. Then you must manually set the
-# IP/netmask on the bridge interface, here we
-# assume 10.8.0.4/255.255.255.0. Finally we
-# must set aside an IP range in this subnet
-# (start=10.8.0.50 end=10.8.0.100) to allocate
-# to connecting clients. Leave this line commented
-# out unless you are ethernet bridging.
-;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
-
-# Push routes to the client to allow it
-# to reach other private subnets behind
-# the server. Remember that these
-# private subnets will also need
-# to know to route the OpenVPN client
-# address pool (10.8.0.0/255.255.255.0)
-# back to the OpenVPN server.
-;push "route 10.8.0.0 255.255.255.0"
-push "route $MAIN_NETWORK 255.255.255.0"
-
-# To assign specific IP addresses to specific
-# clients or if a connecting client has a private
-# subnet behind it that should also have VPN access,
-# use the subdirectory "ccd" for client-specific
-# configuration files (see man page for more info).
-
-client-config-dir $CCD_GW_CKUBU
-
-# ---
-# EXAMPLE: Suppose the client
-# having the certificate common name "Thelonious"
-# also has a small subnet behind his connecting
-# machine, such as 192.168.40.128/255.255.255.248.
-# First, uncomment out these lines:
-;client-config-dir /etc/openvpn/ccd
-;route 192.168.40.128 255.255.255.248
-
-# Then create a file ccd/Thelonious with this line:
-# iroute 192.168.40.128 255.255.255.248
-# This will allow Thelonious' private subnet to
-# access the VPN. This example will only work
-# if you are routing, not bridging, i.e. you are
-# using "dev tun" and "server" directives.
-# ---
-
-# ---
-# EXAMPLE: Suppose you want to give
-# Thelonious a fixed VPN IP address of 10.9.0.1.
-# First uncomment out these lines:
-;client-config-dir ccd
-;route 10.9.0.0 255.255.255.252
-
-# Then add this line to ccd/Thelonious:
-# ifconfig-push 10.9.0.1 10.9.0.2
-# ---
-
-# ---
-# Suppose that you want to enable different
-# firewall access policies for different groups
-# of clients. There are two methods:
-# (1) Run multiple OpenVPN daemons, one for each
-# group, and firewall the TUN/TAP interface
-# for each group/daemon appropriately.
-# (2) (Advanced) Create a script to dynamically
-# modify the firewall in response to access
-# from different clients. See man
-# page for more info on learn-address script.
-;learn-address ./script
-# ---
-
-# If enabled, this directive will configure
-# all clients to redirect their default
-# network gateway through the VPN, causing
-# all IP traffic such as web browsing and
-# and DNS lookups to go through the VPN
-# (The OpenVPN server machine may need to NAT
-# the TUN/TAP interface to the internet in
-# order for this to work properly).
-# CAVEAT: May break client's network config if
-# client's local DHCP server packets get routed
-# through the tunnel. Solution: make sure
-# client's local DHCP server is reachable via
-# a more specific route than the default route
-# of 0.0.0.0/0.0.0.0.
-;push "redirect-gateway"
-
-# Certain Windows-specific network settings
-# can be pushed to clients, such as DNS
-# or WINS server addresses. CAVEAT:
-# http://openvpn.net/faq.html#dhcpcaveats
-;push "dhcp-option WINS 10.8.0.1"
-
-# - Do NOT push DNS settings in THIS configuration. We use
-# - this VPN tunnel as a static line, and the remote host
-# - should user his own dns settings.
-# -
-;push "dhcp-option DNS ${DNS_SERVER}"
-;push "dhcp-option DOMAIN ${DOMAIN}"
-
-# Uncomment this directive to allow different
-# clients to be able to "see" each other.
-# By default, clients will only see the server.
-# To force clients to only see the server, you
-# will also need to appropriately firewall the
-# server's TUN/TAP interface.
-client-to-client
-
-# Uncomment this directive if multiple clients
-# might connect with the same certificate/key
-# files or common names. This is recommended
-# only for testing purposes. For production use,
-# each client should have its own certificate/key
-# pair.
-#
-# IF YOU HAVE NOT GENERATED INDIVIDUAL
-# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
-# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
-# UNCOMMENT THIS LINE OUT.
-;duplicate-cn
-
-# The keepalive directive causes ping-like
-# messages to be sent back and forth over
-# the link so that each side knows when
-# the other side has gone down.
-# Ping every 10 seconds, assume that remote
-# peer is down if no ping received during
-# a 120 second time period.
-keepalive 10 120
-
-# For extra security beyond that provided
-# by SSL/TLS, create an "HMAC firewall"
-# to help block DoS attacks and UDP port flooding.
-#
-# Generate with:
-# openvpn --genkey --secret ta.key
-#
-# The server and each client must have
-# a copy of this key.
-# The second parameter should be '0'
-# on the server and '1' on the clients.
-;tls-auth ta.key 0 # This file is secret
-tls-auth keys/ta.key 0
-
-# Select a cryptographic cipher.
-# This config item must be copied to
-# the client config file as well.
-;cipher BF-CBC # Blowfish (default)
-;cipher AES-128-CBC # AES
-;cipher DES-EDE3-CBC # Triple-DES
-cipher AES-256-CBC
-
-# Enable compression on the VPN link.
-# If you enable it here, you must also
-# enable it in the client config file.
-comp-lzo
-
-# The maximum number of concurrently connected
-# clients we want to allow.
-;max-clients 100
-
-# It's a good idea to reduce the OpenVPN
-# daemon's privileges after initialization.
-#
-# You can uncomment this out on
-# non-Windows systems.
-user nobody
-group nogroup
-
-# The persist options will try to avoid
-# accessing certain resources on restart
-# that may no longer be accessible because
-# of the privilege downgrade.
-persist-key
-persist-tun
-persist-local-ip
-persist-remote-ip
-
-# Output a short status file showing
-# current connections, truncated
-# and rewritten every minute.
-status /var/log/openvpn/status-server-gw-ckubu.log
-
-# By default, log messages will go to the syslog (or
-# on Windows, if running as a service, they will go to
-# the "\Program Files\OpenVPN\log" directory).
-# Use log or log-append to override this default.
-# "log" will truncate the log file on OpenVPN startup,
-# while "log-append" will append to it. Use one
-# or the other (but not both).
-log /var/log/openvpn/server-gw-ckubu.log
-;log-append openvpn.log
-
-# Set the appropriate level of log
-# file verbosity.
-#
-# 0 is silent, except for fatal errors
-# 4 is reasonable for general usage
-# 5 and 6 can help to debug connection problems
-# 9 is extremely verbose
-verb 4
-
-# Silence repeating messages. At most 20
-# sequential messages of the same message
-# category will be output to the log.
-;mute 20
-
-#crl-verify /etc/openvpn/keys/crl.pem
-crl-verify /etc/openvpn/crl.pem
-EOF
-if [[ $? -eq 0 ]] ; then
- echo_ok
-else
- echo_failed
- error "$(cat $log_file)"
-fi
-
# - Start OpenVPN Service
# -
@@ -1353,7 +1683,5 @@ if [[ "X${PID}" = "X" ]]; then
fi
-
-
echo ""
-clean_up
+clean_up 0