freedombone-app-vpn 25KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733
  1. #!/bin/bash
  2. # _____ _ _
  3. # | __|___ ___ ___ _| |___ _____| |_ ___ ___ ___
  4. # | __| _| -_| -_| . | . | | . | . | | -_|
  5. # |__| |_| |___|___|___|___|_|_|_|___|___|_|_|___|
  6. #
  7. # Freedom in the Cloud
  8. #
  9. # VPN functions
  10. # https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8
  11. # https://jamielinux.com/blog/force-all-network-traffic-through-openvpn-using-iptables/
  12. # http://www.farrellf.com/projects/software/2016-05-04_Running_a_VPN_Server_with_OpenVPN_and_Stunnel/index_.php
  13. #
  14. # License
  15. # =======
  16. #
  17. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  18. #
  19. # This program is free software: you can redistribute it and/or modify
  20. # it under the terms of the GNU Affero General Public License as published by
  21. # the Free Software Foundation, either version 3 of the License, or
  22. # (at your option) any later version.
  23. #
  24. # This program is distributed in the hope that it will be useful,
  25. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  26. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  27. # GNU Affero General Public License for more details.
  28. #
  29. # You should have received a copy of the GNU Affero General Public License
  30. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  31. VARIANTS='full full-vim'
  32. IN_DEFAULT_INSTALL=0
  33. SHOW_ON_ABOUT=0
  34. OPENVPN_SERVER_NAME="server"
  35. OPENVPN_KEY_FILENAME='client.ovpn'
  36. VPN_COUNTRY_CODE="US"
  37. VPN_AREA="Apparent Free Speech Zone"
  38. VPN_LOCATION="Freedomville"
  39. VPN_ORGANISATION="Freedombone"
  40. VPN_UNIT="Freedombone Unit"
  41. STUNNEL_PORT=3439
  42. VPN_TLS_PORT=553
  43. VPN_MESH_TLS_PORT=653
  44. vpn_variables=(MY_EMAIL_ADDRESS
  45. DEFAULT_DOMAIN_NAME
  46. MY_USERNAME
  47. VPN_COUNTRY_CODE
  48. VPN_AREA
  49. VPN_LOCATION
  50. VPN_ORGANISATION
  51. VPN_UNIT
  52. VPN_TLS_PORT)
  53. function logging_on_vpn {
  54. if [ ! -f /etc/openvpn/server.conf ]; then
  55. return
  56. fi
  57. sed -i 's|status .*|status /var/log/openvpn.log|g' /etc/openvpn/server.conf
  58. systemctl restart openvpn
  59. }
  60. function logging_off_vpn {
  61. if [ ! -f /etc/openvpn/server.conf ]; then
  62. return
  63. fi
  64. sed -i 's|status .*|status /dev/null|g' /etc/openvpn/server.conf
  65. systemctl restart openvpn
  66. }
  67. function install_interactive_vpn {
  68. read_config_param VPN_TLS_PORT
  69. if [ ! $VPN_TLS_PORT ]; then
  70. VPN_TLS_PORT=553
  71. fi
  72. VPN_DETAILS_COMPLETE=
  73. while [ ! $VPN_DETAILS_COMPLETE ]
  74. do
  75. data=$(mktemp 2>/dev/null)
  76. currtlsport=$(grep 'VPN_TLS_PORT' temp.cfg | awk -F '=' '{print $2}')
  77. if [ "$currtlsport" ]; then
  78. VPN_TLS_PORT=$currtlsport
  79. fi
  80. dialog --backtitle $"Freedombone Configuration" \
  81. --title $"VPN Configuration" \
  82. --form $"\\nPlease enter your VPN details. Changing the port to 443 will help defend against censorship but will prevent other web apps from running." 12 65 1 \
  83. $"TLS port:" 1 1 "$VPN_TLS_PORT" 1 12 5 5 \
  84. 2> "$data"
  85. sel=$?
  86. case $sel in
  87. 1) rm -f "$data"
  88. exit 1;;
  89. 255) rm -f "$data"
  90. exit 1;;
  91. esac
  92. tlsport=$(sed -n 1p < "$data")
  93. if [ ${#tlsport} -gt 1 ]; then
  94. if [[ "$tlsport" != *' '* && "$tlsport" != *'.'* ]]; then
  95. VPN_TLS_PORT="$tlsport"
  96. VPN_DETAILS_COMPLETE="yes"
  97. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  98. fi
  99. fi
  100. rm -f "$data"
  101. done
  102. clear
  103. APP_INSTALLED=1
  104. }
  105. function vpn_change_tls_port {
  106. if ! grep -q "VPN-TLS" "$FIREWALL_CONFIG"; then
  107. EXISTING_VPN_TLS_PORT=443
  108. else
  109. EXISTING_VPN_TLS_PORT=$(grep "VPN-TLS" "$FIREWALL_CONFIG" | awk -F '=' '{print $2}')
  110. fi
  111. data=$(mktemp 2>/dev/null)
  112. dialog --title $"VPN Configuration" \
  113. --backtitle $"Freedombone Control Panel" \
  114. --inputbox $'Change TLS port' 10 50 "$EXISTING_VPN_TLS_PORT" 2>"$data"
  115. sel=$?
  116. case $sel in
  117. 0)
  118. tlsport=$(<"$data")
  119. if [ ${#tlsport} -gt 0 ]; then
  120. if [[ "$tlsport" != "$EXISTING_VPN_TLS_PORT" ]]; then
  121. clear
  122. VPN_TLS_PORT=$tlsport
  123. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  124. sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf
  125. sed -i "s|connect =.*|connect = :$VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf
  126. for d in /home/*/ ; do
  127. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  128. if [ -f "/home/$USERNAME/stunnel-client.conf" ]; then
  129. cp "/etc/stunnel/stunnel-client.conf" "/home/$USERNAME/stunnel-client.conf"
  130. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel-client.conf"
  131. fi
  132. done
  133. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  134. if [[ "$PREVIOUS_VPN_TLS_PORT" != "443" ]]; then
  135. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  136. fi
  137. systemctl stop nginx
  138. systemctl disable nginx
  139. else
  140. if [[ "$PREVIOUS_VPN_TLS_PORT" != "$VPN_TLS_PORT" ]]; then
  141. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  142. firewall_add VPN-TLS "${VPN_TLS_PORT}" tcp
  143. fi
  144. systemctl enable nginx
  145. systemctl restart nginx
  146. fi
  147. systemctl restart stunnel
  148. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  149. dialog --title $"VPN Configuration" \
  150. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  151. else
  152. dialog --title $"VPN Configuration" \
  153. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  154. fi
  155. fi
  156. fi
  157. ;;
  158. esac
  159. rm -f "$data"
  160. }
  161. function vpn_regenerate_client_keys {
  162. data=$(mktemp 2>/dev/null)
  163. dialog --title $"Regenerate VPN keys for a user" \
  164. --backtitle $"Freedombone Control Panel" \
  165. --inputbox $'username' 10 50 2>"$data"
  166. sel=$?
  167. case $sel in
  168. 0)
  169. USERNAME=$(<"$data")
  170. if [ ${#USERNAME} -gt 0 ]; then
  171. if [ -d "/home/$USERNAME" ]; then
  172. clear
  173. create_user_vpn_key "$USERNAME"
  174. dialog --title $"Regenerate VPN keys for a user" \
  175. --msgbox $"VPN keys were regenerated for $USERNAME" 6 60
  176. fi
  177. fi
  178. ;;
  179. esac
  180. rm -f "$data"
  181. }
  182. function configure_interactive_vpn {
  183. read_config_param VPN_TLS_PORT
  184. while true
  185. do
  186. W=(1 $"Change TLS port (currently $VPN_TLS_PORT)"
  187. 2 $"Regenerate keys for a user")
  188. # shellcheck disable=SC2068
  189. selection=$(dialog --backtitle $"Freedombone Administrator Control Panel" --title $"VPN" --menu $"Choose an operation, or ESC to exit:" 10 60 2 "${W[@]}" 3>&2 2>&1 1>&3)
  190. if [ ! "$selection" ]; then
  191. break
  192. fi
  193. case $selection in
  194. 1) vpn_change_tls_port;;
  195. 2) vpn_regenerate_client_keys;;
  196. esac
  197. done
  198. }
  199. function reconfigure_vpn {
  200. echo -n ''
  201. }
  202. function upgrade_vpn {
  203. echo -n ''
  204. }
  205. function backup_local_vpn {
  206. for d in /home/*/ ; do
  207. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  208. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  209. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  210. fi
  211. done
  212. function_check backup_directory_to_usb
  213. backup_directory_to_usb /etc/openvpn/easy-rsa/keys vpn
  214. backup_directory_to_usb /etc/stunnel vpnstunnel
  215. }
  216. function restore_local_vpn {
  217. temp_restore_dir=/root/tempvpn
  218. restore_directory_from_usb $temp_restore_dir vpn
  219. if [ -d ${temp_restore_dir} ]; then
  220. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  221. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  222. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  223. rm -rf ${temp_restore_dir}
  224. for d in /home/*/ ; do
  225. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  226. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  227. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  228. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  229. fi
  230. done
  231. fi
  232. temp_restore_dir=/root/tempvpnstunnel
  233. restore_directory_from_usb $temp_restore_dir vpnstunnel
  234. if [ -d ${temp_restore_dir} ]; then
  235. cp -r ${temp_restore_dir}/* /etc/stunnel
  236. rm -rf ${temp_restore_dir}
  237. for d in /home/*/ ; do
  238. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  239. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  240. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  241. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  242. fi
  243. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  244. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  245. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  246. fi
  247. done
  248. fi
  249. }
  250. function backup_remote_vpn {
  251. for d in /home/*/ ; do
  252. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  253. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  254. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  255. fi
  256. done
  257. function_check backup_directory_to_friend
  258. backup_directory_to_friend /etc/openvpn/easy-rsa/keys vpn
  259. backup_directory_to_friend /etc/stunnel vpnstunnel
  260. }
  261. function restore_remote_vpn {
  262. temp_restore_dir=/root/tempvpn
  263. restore_directory_from_friend $temp_restore_dir vpn
  264. if [ -d ${temp_restore_dir} ]; then
  265. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  266. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  267. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  268. rm -rf ${temp_restore_dir}
  269. for d in /home/*/ ; do
  270. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  271. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  272. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  273. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  274. fi
  275. done
  276. fi
  277. temp_restore_dir=/root/tempvpnstunnel
  278. restore_directory_from_friend $temp_restore_dir vpnstunnel
  279. if [ -d ${temp_restore_dir} ]; then
  280. cp -r ${temp_restore_dir}/* /etc/stunnel
  281. rm -rf ${temp_restore_dir}
  282. for d in /home/*/ ; do
  283. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  284. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  285. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  286. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  287. fi
  288. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  289. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  290. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  291. fi
  292. done
  293. fi
  294. }
  295. function remove_vpn {
  296. systemctl stop stunnel
  297. systemctl disable stunnel
  298. rm /etc/systemd/system/stunnel.service
  299. systemctl stop openvpn
  300. if [ "$VPN_TLS_PORT" -ne 443 ]; then
  301. firewall_remove VPN-TLS "$VPN_TLS_PORT"
  302. else
  303. systemctl enable nginx
  304. systemctl restart nginx
  305. fi
  306. apt-get -yq remove --purge fastd openvpn easy-rsa
  307. apt-get -yq remove stunnel4
  308. if [ -d /etc/openvpn ]; then
  309. rm -rf /etc/openvpn
  310. fi
  311. firewall_disable_vpn
  312. echo 0 > /proc/sys/net/ipv4/ip_forward
  313. sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf
  314. remove_completion_param install_vpn
  315. # remove any client keys
  316. for d in /home/*/ ; do
  317. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  318. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  319. shred -zu "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  320. fi
  321. rm "/home/$USERNAME/stunnel*"
  322. done
  323. userdel -f vpn
  324. groupdel -f vpn
  325. if [ -d /etc/stunnel ]; then
  326. rm -rf /etc/stunnel
  327. fi
  328. }
  329. function create_user_vpn_key {
  330. username=$1
  331. if [ ! -d "/home/$username" ]; then
  332. return
  333. fi
  334. echo $"Creating VPN key for $username"
  335. cd /etc/openvpn/easy-rsa || exit 4728468246
  336. if [ -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  337. rm "/etc/openvpn/easy-rsa/keys/$username.crt"
  338. fi
  339. if [ -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  340. rm "/etc/openvpn/easy-rsa/keys/$username.key"
  341. fi
  342. if [ -f "/etc/openvpn/easy-rsa/keys/$username.csr" ]; then
  343. rm "/etc/openvpn/easy-rsa/keys/$username.csr"
  344. fi
  345. sed -i 's| --interact||g' build-key
  346. ./build-key "$username"
  347. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  348. echo $'VPN user cert not generated'
  349. exit 783528
  350. fi
  351. user_cert=$(cat "/etc/openvpn/easy-rsa/keys/$username.crt")
  352. if [ ${#user_cert} -lt 10 ]; then
  353. cat "/etc/openvpn/easy-rsa/keys/$username.crt"
  354. echo $'User cert generation failed'
  355. exit 634659
  356. fi
  357. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  358. echo $'VPN user key not generated'
  359. exit 682523
  360. fi
  361. user_key=$(cat "/etc/openvpn/easy-rsa/keys/$username.key")
  362. if [ ${#user_key} -lt 10 ]; then
  363. cat "/etc/openvpn/easy-rsa/keys/$username.key"
  364. echo $'User key generation failed'
  365. exit 285838
  366. fi
  367. user_vpn_cert_file=/home/$username/$OPENVPN_KEY_FILENAME
  368. { echo 'client';
  369. echo 'dev tun';
  370. echo 'proto tcp';
  371. echo "remote localhost $STUNNEL_PORT";
  372. echo "route $DEFAULT_DOMAIN_NAME 255.255.255.255 net_gateway";
  373. echo 'resolv-retry infinite';
  374. echo 'nobind';
  375. echo 'tun-mtu 1500';
  376. echo 'tun-mtu-extra 32';
  377. echo 'mssfix 1450';
  378. echo 'persist-key';
  379. echo 'persist-tun';
  380. echo 'auth-nocache';
  381. echo 'remote-cert-tls server';
  382. echo 'comp-lzo';
  383. echo 'verb 3';
  384. echo ''; } > "$user_vpn_cert_file"
  385. {
  386. echo '<ca>';
  387. cat /etc/openvpn/ca.crt;
  388. echo '</ca>';
  389. echo '<cert>';
  390. cat "/etc/openvpn/easy-rsa/keys/$username.crt;"
  391. echo '</cert>';
  392. echo '<key>';
  393. cat "/etc/openvpn/easy-rsa/keys/$username.key;"
  394. echo '</key>'; } >> "$user_vpn_cert_file"
  395. chown "$username":"$username" "$user_vpn_cert_file"
  396. # keep a backup
  397. cp "$user_vpn_cert_file" "/etc/openvpn/easy-rsa/keys/$username.ovpn"
  398. #rm /etc/openvpn/easy-rsa/keys/$username.crt
  399. #rm /etc/openvpn/easy-rsa/keys/$username.csr
  400. shred -zu "/etc/openvpn/easy-rsa/keys/$username.key"
  401. echo $"VPN key created at $user_vpn_cert_file"
  402. }
  403. function add_user_vpn {
  404. new_username="$1"
  405. # new_user_password="$2"
  406. create_user_vpn_key "$new_username"
  407. if [ -f /etc/stunnel/stunnel.pem ]; then
  408. cp /etc/stunnel/stunnel.pem "/home/$new_username/stunnel.pem"
  409. chown "$new_username":"$new_username" "/home/$new_username/stunnel.pem"
  410. fi
  411. if [ -f /etc/stunnel/stunnel.p12 ]; then
  412. cp /etc/stunnel/stunnel.p12 "/home/$new_username/stunnel.p12"
  413. chown "$new_username":"$new_username" "/home/$new_username/stunnel.p12"
  414. fi
  415. cp /etc/stunnel/stunnel-client.conf "/home/$new_username/stunnel-client.conf"
  416. chown "$new_username":"$new_username" "/home/$new_username/stunnel-client.conf"
  417. }
  418. function remove_user_vpn {
  419. new_username="$1"
  420. }
  421. function mesh_setup_vpn {
  422. vpn_generate_keys
  423. if [ -d /home/fbone ]; then
  424. cp /etc/stunnel/stunnel-client.conf /home/fbone/stunnel-client.conf
  425. chown fbone:fbone /home/fbone/stunnel*
  426. fi
  427. generate_stunnel_keys
  428. systemctl restart openvpn
  429. }
  430. function generate_stunnel_keys {
  431. openssl req -x509 -nodes -days 3650 -sha256 \
  432. -subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \
  433. -newkey rsa:2048 -keyout /etc/stunnel/key.pem \
  434. -out /etc/stunnel/cert.pem
  435. if [ ! -f /etc/stunnel/key.pem ]; then
  436. echo $'stunnel key not created'
  437. exit 793530
  438. fi
  439. if [ ! -f /etc/stunnel/cert.pem ]; then
  440. echo $'stunnel cert not created'
  441. exit 204587
  442. fi
  443. chmod 400 /etc/stunnel/key.pem
  444. chmod 640 /etc/stunnel/cert.pem
  445. cat /etc/stunnel/key.pem /etc/stunnel/cert.pem >> /etc/stunnel/stunnel.pem
  446. chmod 640 /etc/stunnel/stunnel.pem
  447. openssl pkcs12 -export -out /etc/stunnel/stunnel.p12 -inkey /etc/stunnel/key.pem -in /etc/stunnel/cert.pem -passout pass:
  448. if [ ! -f /etc/stunnel/stunnel.p12 ]; then
  449. echo $'stunnel pkcs12 not created'
  450. exit 639353
  451. fi
  452. chmod 640 /etc/stunnel/stunnel.p12
  453. cp /etc/stunnel/stunnel.pem "/home/$MY_USERNAME/stunnel.pem"
  454. cp /etc/stunnel/stunnel.p12 "/home/$MY_USERNAME/stunnel.p12"
  455. chown "$MY_USERNAME":"$MY_USERNAME" "$prefix/home/$MY_USERNAME/stunnel*"
  456. }
  457. function install_stunnel {
  458. prefix=
  459. prefixchroot=
  460. # shellcheck disable=SC2154
  461. if [ "$rootdir" ]; then
  462. prefix=$rootdir
  463. prefixchroot="chroot $rootdir"
  464. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  465. fi
  466. $prefixchroot apt-get -yq install stunnel4
  467. if [ ! "$prefix" ]; then
  468. cd /etc/stunnel || exit 46284624
  469. generate_stunnel_keys
  470. fi
  471. { echo 'chroot = /var/lib/stunnel4';
  472. echo 'pid = /stunnel4.pid';
  473. echo 'setuid = stunnel4';
  474. echo 'setgid = stunnel4';
  475. echo 'socket = l:TCP_NODELAY=1';
  476. echo 'socket = r:TCP_NODELAY=1';
  477. echo 'cert = /etc/stunnel/stunnel.pem';
  478. echo '[openvpn]';
  479. echo "accept = $VPN_TLS_PORT";
  480. echo 'connect = localhost:1194';
  481. echo 'cert = /etc/stunnel/stunnel.pem';
  482. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel.conf"
  483. sed -i 's|ENABLED=.*|ENABLED=1|g' "$prefix/etc/default/stunnel4"
  484. { echo '[openvpn]';
  485. echo 'client = yes';
  486. echo "accept = $STUNNEL_PORT";
  487. echo "connect = $DEFAULT_DOMAIN_NAME:$VPN_TLS_PORT";
  488. echo 'cert = stunnel.pem';
  489. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel-client.conf"
  490. { echo '[Unit]';
  491. echo 'Description=SSL tunnel for network daemons';
  492. echo 'Documentation=man:stunnel https://www.stunnel.org/docs.html';
  493. echo 'DefaultDependencies=no';
  494. echo 'After=network.target';
  495. echo 'After=syslog.target';
  496. echo '';
  497. echo '[Install]';
  498. echo 'WantedBy=multi-user.target';
  499. echo 'Alias=stunnel.target';
  500. echo '';
  501. echo '[Service]';
  502. echo 'Type=forking';
  503. echo 'RuntimeDirectory=stunnel';
  504. echo 'EnvironmentFile=-/etc/stunnel/stunnel.conf';
  505. echo 'ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf';
  506. echo 'ExecStop=/usr/bin/killall -9 stunnel';
  507. echo 'RemainAfterExit=yes'; } > "$prefix/etc/systemd/system/stunnel.service"
  508. if [ ! "$prefix" ]; then
  509. if [ $VPN_TLS_PORT -eq 443 ]; then
  510. systemctl stop nginx
  511. systemctl disable nginx
  512. else
  513. systemctl enable nginx
  514. systemctl restart nginx
  515. fi
  516. systemctl enable stunnel
  517. systemctl daemon-reload
  518. systemctl start stunnel
  519. cp /etc/stunnel/stunnel-client.conf "/home/$MY_USERNAME/stunnel-client.conf"
  520. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/stunnel*"
  521. fi
  522. }
  523. function vpn_generate_keys {
  524. # generate host keys
  525. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  526. "${PROJECT_NAME}-dhparam" -o /etc/openvpn/dh2048.pem
  527. fi
  528. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  529. echo $'vpn dhparams were not generated'
  530. exit 73724523
  531. fi
  532. cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem
  533. cd /etc/openvpn/easy-rsa || exit 5628756256
  534. # shellcheck disable=SC1091
  535. . ./vars
  536. ./clean-all
  537. vpn_openssl_version='1.0.0'
  538. if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then
  539. echo $"openssl-${vpn_openssl_version}.cnf was not found"
  540. exit 7392353
  541. fi
  542. cp openssl-${vpn_openssl_version}.cnf openssl.cnf
  543. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  544. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  545. fi
  546. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  547. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key
  548. fi
  549. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then
  550. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr
  551. fi
  552. sed -i 's| --interact||g' build-key-server
  553. sed -i 's| --interact||g' build-ca
  554. ./build-ca
  555. ./build-key-server ${OPENVPN_SERVER_NAME}
  556. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  557. echo $'OpenVPN crt not found'
  558. exit 7823352
  559. fi
  560. server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt)
  561. if [ ${#server_cert} -lt 10 ]; then
  562. cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  563. echo $'Server cert generation failed'
  564. exit 3284682
  565. fi
  566. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  567. echo $'OpenVPN key not found'
  568. exit 6839436
  569. fi
  570. if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then
  571. echo $'OpenVPN ca not found'
  572. exit 7935203
  573. fi
  574. cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn
  575. create_user_vpn_key "${MY_USERNAME}"
  576. }
  577. function install_vpn {
  578. prefix=
  579. prefixchroot=
  580. if [ "$rootdir" ]; then
  581. prefix=$rootdir
  582. prefixchroot="chroot $rootdir"
  583. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  584. fi
  585. $prefixchroot apt-get -yq install fastd openvpn easy-rsa
  586. $prefixchroot groupadd vpn
  587. $prefixchroot useradd -r -s /bin/false -g vpn vpn
  588. # server configuration
  589. { echo 'port 1194';
  590. echo 'proto tcp';
  591. echo 'dev tun';
  592. echo 'tun-mtu 1500';
  593. echo 'tun-mtu-extra 32';
  594. echo 'mssfix 1450';
  595. echo 'ca /etc/openvpn/ca.crt';
  596. echo 'cert /etc/openvpn/server.crt';
  597. echo 'key /etc/openvpn/server.key';
  598. echo 'dh /etc/openvpn/dh2048.pem';
  599. echo 'server 10.8.0.0 255.255.255.0';
  600. echo 'push "redirect-gateway def1 bypass-dhcp"';
  601. echo "push \"dhcp-option DNS 91.239.100.100\"";
  602. echo "push \"dhcp-option DNS 89.233.43.71\"";
  603. echo 'keepalive 5 30';
  604. echo 'comp-lzo';
  605. echo 'persist-key';
  606. echo 'persist-tun';
  607. echo 'status /dev/null';
  608. echo 'verb 3';
  609. echo ''; } > "$prefix/etc/openvpn/server.conf"
  610. if [ ! "$prefix" ]; then
  611. echo 1 > /proc/sys/net/ipv4/ip_forward
  612. fi
  613. sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  614. sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  615. sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' "$prefix/etc/sysctl.conf"
  616. cp -r "$prefix/usr/share/easy-rsa/" "$prefix/etc/openvpn"
  617. if [ ! -d "$prefix/etc/openvpn/easy-rsa/keys" ]; then
  618. mkdir "$prefix/etc/openvpn/easy-rsa/keys"
  619. fi
  620. # keys configuration
  621. sed -i "s|export KEY_COUNTRY.*|export KEY_COUNTRY=\"US\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  622. sed -i "s|export KEY_PROVINCE.*|export KEY_PROVINCE=\"TX\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  623. sed -i "s|export KEY_CITY.*|export KEY_CITY=\"Dallas\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  624. sed -i "s|export KEY_ORG.*|export KEY_ORG=\"$PROJECT_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  625. sed -i "s|export KEY_EMAIL.*|export KEY_EMAIL=\"$MY_EMAIL_ADDRESS\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  626. sed -i "s|export KEY_OU=.*|export KEY_OU=\"MoonUnit\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  627. sed -i "s|export KEY_NAME.*|export KEY_NAME=\"$OPENVPN_SERVER_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  628. if [ ! "$prefix" ]; then
  629. vpn_generate_keys
  630. firewall_enable_vpn
  631. if [ ${VPN_TLS_PORT} -ne 443 ]; then
  632. firewall_add VPN-TLS ${VPN_TLS_PORT} tcp
  633. fi
  634. systemctl start openvpn
  635. fi
  636. install_stunnel
  637. if [ ! "$prefix" ]; then
  638. systemctl restart openvpn
  639. fi
  640. APP_INSTALLED=1
  641. }
  642. # NOTE: deliberately there is no "exit 0"