freedombone-app-vpn 25KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # VPN functions
  12. # https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8
  13. # https://jamielinux.com/blog/force-all-network-traffic-through-openvpn-using-iptables/
  14. # http://www.farrellf.com/projects/software/2016-05-04_Running_a_VPN_Server_with_OpenVPN_and_Stunnel/index_.php
  15. #
  16. # License
  17. # =======
  18. #
  19. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  20. #
  21. # This program is free software: you can redistribute it and/or modify
  22. # it under the terms of the GNU Affero General Public License as published by
  23. # the Free Software Foundation, either version 3 of the License, or
  24. # (at your option) any later version.
  25. #
  26. # This program is distributed in the hope that it will be useful,
  27. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  28. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  29. # GNU Affero General Public License for more details.
  30. #
  31. # You should have received a copy of the GNU Affero General Public License
  32. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  33. VARIANTS='full full-vim'
  34. IN_DEFAULT_INSTALL=0
  35. SHOW_ON_ABOUT=0
  36. OPENVPN_SERVER_NAME="server"
  37. OPENVPN_KEY_FILENAME='client.ovpn'
  38. VPN_COUNTRY_CODE="US"
  39. VPN_AREA="Apparent Free Speech Zone"
  40. VPN_LOCATION="Freedomville"
  41. VPN_ORGANISATION="Freedombone"
  42. VPN_UNIT="Freedombone Unit"
  43. STUNNEL_PORT=3439
  44. VPN_TLS_PORT=553
  45. VPN_MESH_TLS_PORT=653
  46. vpn_variables=(MY_EMAIL_ADDRESS
  47. DEFAULT_DOMAIN_NAME
  48. MY_USERNAME
  49. VPN_COUNTRY_CODE
  50. VPN_AREA
  51. VPN_LOCATION
  52. VPN_ORGANISATION
  53. VPN_UNIT
  54. VPN_TLS_PORT)
  55. function logging_on_vpn {
  56. if [ ! -f /etc/openvpn/server.conf ]; then
  57. return
  58. fi
  59. sed -i 's|status .*|status /var/log/openvpn.log|g' /etc/openvpn/server.conf
  60. systemctl restart openvpn
  61. }
  62. function logging_off_vpn {
  63. if [ ! -f /etc/openvpn/server.conf ]; then
  64. return
  65. fi
  66. sed -i 's|status .*|status /dev/null|g' /etc/openvpn/server.conf
  67. systemctl restart openvpn
  68. }
  69. function install_interactive_vpn {
  70. read_config_param VPN_TLS_PORT
  71. if [ ! $VPN_TLS_PORT ]; then
  72. VPN_TLS_PORT=553
  73. fi
  74. VPN_DETAILS_COMPLETE=
  75. while [ ! $VPN_DETAILS_COMPLETE ]
  76. do
  77. data=$(mktemp 2>/dev/null)
  78. currtlsport=$(grep 'VPN_TLS_PORT' temp.cfg | awk -F '=' '{print $2}')
  79. if [ "$currtlsport" ]; then
  80. VPN_TLS_PORT=$currtlsport
  81. fi
  82. dialog --backtitle $"Freedombone Configuration" \
  83. --title $"VPN Configuration" \
  84. --form $"\\nPlease enter your VPN details. Changing the port to 443 will help defend against censorship but will prevent other web apps from running." 12 65 1 \
  85. $"TLS port:" 1 1 "$VPN_TLS_PORT" 1 12 5 5 \
  86. 2> "$data"
  87. sel=$?
  88. case $sel in
  89. 1) rm -f "$data"
  90. exit 1;;
  91. 255) rm -f "$data"
  92. exit 1;;
  93. esac
  94. tlsport=$(sed -n 1p < "$data")
  95. if [ ${#tlsport} -gt 1 ]; then
  96. if [[ "$tlsport" != *' '* && "$tlsport" != *'.'* ]]; then
  97. VPN_TLS_PORT="$tlsport"
  98. VPN_DETAILS_COMPLETE="yes"
  99. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  100. fi
  101. fi
  102. rm -f "$data"
  103. done
  104. clear
  105. APP_INSTALLED=1
  106. }
  107. function vpn_change_tls_port {
  108. if ! grep -q "VPN-TLS" "$FIREWALL_CONFIG"; then
  109. EXISTING_VPN_TLS_PORT=443
  110. else
  111. EXISTING_VPN_TLS_PORT=$(grep "VPN-TLS" "$FIREWALL_CONFIG" | awk -F '=' '{print $2}')
  112. fi
  113. data=$(mktemp 2>/dev/null)
  114. dialog --title $"VPN Configuration" \
  115. --backtitle $"Freedombone Control Panel" \
  116. --inputbox $'Change TLS port' 10 50 "$EXISTING_VPN_TLS_PORT" 2>"$data"
  117. sel=$?
  118. case $sel in
  119. 0)
  120. tlsport=$(<"$data")
  121. if [ ${#tlsport} -gt 0 ]; then
  122. if [[ "$tlsport" != "$EXISTING_VPN_TLS_PORT" ]]; then
  123. clear
  124. VPN_TLS_PORT=$tlsport
  125. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  126. sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf
  127. sed -i "s|connect =.*|connect = :$VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf
  128. for d in /home/*/ ; do
  129. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  130. if [ -f "/home/$USERNAME/stunnel-client.conf" ]; then
  131. cp "/etc/stunnel/stunnel-client.conf" "/home/$USERNAME/stunnel-client.conf"
  132. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel-client.conf"
  133. fi
  134. done
  135. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  136. if [[ "$PREVIOUS_VPN_TLS_PORT" != "443" ]]; then
  137. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  138. fi
  139. systemctl stop nginx
  140. systemctl disable nginx
  141. else
  142. if [[ "$PREVIOUS_VPN_TLS_PORT" != "$VPN_TLS_PORT" ]]; then
  143. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  144. firewall_add VPN-TLS "${VPN_TLS_PORT}" tcp
  145. fi
  146. systemctl enable nginx
  147. systemctl restart nginx
  148. fi
  149. systemctl restart stunnel
  150. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  151. dialog --title $"VPN Configuration" \
  152. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  153. else
  154. dialog --title $"VPN Configuration" \
  155. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  156. fi
  157. fi
  158. fi
  159. ;;
  160. esac
  161. rm -f "$data"
  162. }
  163. function vpn_regenerate_client_keys {
  164. data=$(mktemp 2>/dev/null)
  165. dialog --title $"Regenerate VPN keys for a user" \
  166. --backtitle $"Freedombone Control Panel" \
  167. --inputbox $'username' 10 50 2>"$data"
  168. sel=$?
  169. case $sel in
  170. 0)
  171. USERNAME=$(<"$data")
  172. if [ ${#USERNAME} -gt 0 ]; then
  173. if [ -d "/home/$USERNAME" ]; then
  174. clear
  175. create_user_vpn_key "$USERNAME"
  176. dialog --title $"Regenerate VPN keys for a user" \
  177. --msgbox $"VPN keys were regenerated for $USERNAME" 6 60
  178. fi
  179. fi
  180. ;;
  181. esac
  182. rm -f "$data"
  183. }
  184. function configure_interactive_vpn {
  185. read_config_param VPN_TLS_PORT
  186. while true
  187. do
  188. data=$(mktemp 2>/dev/null)
  189. dialog --backtitle $"Freedombone Control Panel" \
  190. --title $"VPN Configuration" \
  191. --radiolist $"Choose an operation:" 13 70 3 \
  192. 1 $"Change TLS port (currently $VPN_TLS_PORT)" off \
  193. 2 $"Regenerate keys for a user" off \
  194. 3 $"Exit" on 2> "$data"
  195. sel=$?
  196. case $sel in
  197. 1) rm -f "$data"
  198. return;;
  199. 255) rm -f "$data"
  200. return;;
  201. esac
  202. case $(cat "$data") in
  203. 1) vpn_change_tls_port;;
  204. 2) vpn_regenerate_client_keys;;
  205. 3) rm -f "$data"
  206. break;;
  207. esac
  208. rm -f "$data"
  209. done
  210. }
  211. function reconfigure_vpn {
  212. echo -n ''
  213. }
  214. function upgrade_vpn {
  215. echo -n ''
  216. }
  217. function backup_local_vpn {
  218. for d in /home/*/ ; do
  219. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  220. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  221. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  222. fi
  223. done
  224. function_check backup_directory_to_usb
  225. backup_directory_to_usb /etc/openvpn/easy-rsa/keys vpn
  226. backup_directory_to_usb /etc/stunnel vpnstunnel
  227. }
  228. function restore_local_vpn {
  229. temp_restore_dir=/root/tempvpn
  230. restore_directory_from_usb $temp_restore_dir vpn
  231. if [ -d ${temp_restore_dir} ]; then
  232. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  233. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  234. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  235. rm -rf ${temp_restore_dir}
  236. for d in /home/*/ ; do
  237. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  238. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  239. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  240. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  241. fi
  242. done
  243. fi
  244. temp_restore_dir=/root/tempvpnstunnel
  245. restore_directory_from_usb $temp_restore_dir vpnstunnel
  246. if [ -d ${temp_restore_dir} ]; then
  247. cp -r ${temp_restore_dir}/* /etc/stunnel
  248. rm -rf ${temp_restore_dir}
  249. for d in /home/*/ ; do
  250. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  251. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  252. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  253. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  254. fi
  255. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  256. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  257. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  258. fi
  259. done
  260. fi
  261. }
  262. function backup_remote_vpn {
  263. for d in /home/*/ ; do
  264. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  265. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  266. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  267. fi
  268. done
  269. function_check backup_directory_to_friend
  270. backup_directory_to_friend /etc/openvpn/easy-rsa/keys vpn
  271. backup_directory_to_friend /etc/stunnel vpnstunnel
  272. }
  273. function restore_remote_vpn {
  274. temp_restore_dir=/root/tempvpn
  275. restore_directory_from_friend $temp_restore_dir vpn
  276. if [ -d ${temp_restore_dir} ]; then
  277. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  278. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  279. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  280. rm -rf ${temp_restore_dir}
  281. for d in /home/*/ ; do
  282. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  283. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  284. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  285. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  286. fi
  287. done
  288. fi
  289. temp_restore_dir=/root/tempvpnstunnel
  290. restore_directory_from_friend $temp_restore_dir vpnstunnel
  291. if [ -d ${temp_restore_dir} ]; then
  292. cp -r ${temp_restore_dir}/* /etc/stunnel
  293. rm -rf ${temp_restore_dir}
  294. for d in /home/*/ ; do
  295. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  296. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  297. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  298. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  299. fi
  300. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  301. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  302. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  303. fi
  304. done
  305. fi
  306. }
  307. function remove_vpn {
  308. systemctl stop stunnel
  309. systemctl disable stunnel
  310. rm /etc/systemd/system/stunnel.service
  311. systemctl stop openvpn
  312. if [ "$VPN_TLS_PORT" -ne 443 ]; then
  313. firewall_remove VPN-TLS "$VPN_TLS_PORT"
  314. else
  315. systemctl enable nginx
  316. systemctl restart nginx
  317. fi
  318. apt-get -yq remove --purge fastd openvpn easy-rsa
  319. apt-get -yq remove stunnel4
  320. if [ -d /etc/openvpn ]; then
  321. rm -rf /etc/openvpn
  322. fi
  323. firewall_disable_vpn
  324. echo 0 > /proc/sys/net/ipv4/ip_forward
  325. sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf
  326. remove_completion_param install_vpn
  327. # remove any client keys
  328. for d in /home/*/ ; do
  329. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  330. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  331. shred -zu "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  332. fi
  333. rm "/home/$USERNAME/stunnel*"
  334. done
  335. userdel -f vpn
  336. groupdel -f vpn
  337. if [ -d /etc/stunnel ]; then
  338. rm -rf /etc/stunnel
  339. fi
  340. }
  341. function create_user_vpn_key {
  342. username=$1
  343. if [ ! -d "/home/$username" ]; then
  344. return
  345. fi
  346. echo $"Creating VPN key for $username"
  347. cd /etc/openvpn/easy-rsa || exit 4728468246
  348. if [ -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  349. rm "/etc/openvpn/easy-rsa/keys/$username.crt"
  350. fi
  351. if [ -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  352. rm "/etc/openvpn/easy-rsa/keys/$username.key"
  353. fi
  354. if [ -f "/etc/openvpn/easy-rsa/keys/$username.csr" ]; then
  355. rm "/etc/openvpn/easy-rsa/keys/$username.csr"
  356. fi
  357. sed -i 's| --interact||g' build-key
  358. ./build-key "$username"
  359. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  360. echo $'VPN user cert not generated'
  361. exit 783528
  362. fi
  363. user_cert=$(cat "/etc/openvpn/easy-rsa/keys/$username.crt")
  364. if [ ${#user_cert} -lt 10 ]; then
  365. cat "/etc/openvpn/easy-rsa/keys/$username.crt"
  366. echo $'User cert generation failed'
  367. exit 634659
  368. fi
  369. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  370. echo $'VPN user key not generated'
  371. exit 682523
  372. fi
  373. user_key=$(cat "/etc/openvpn/easy-rsa/keys/$username.key")
  374. if [ ${#user_key} -lt 10 ]; then
  375. cat "/etc/openvpn/easy-rsa/keys/$username.key"
  376. echo $'User key generation failed'
  377. exit 285838
  378. fi
  379. user_vpn_cert_file=/home/$username/$OPENVPN_KEY_FILENAME
  380. { echo 'client';
  381. echo 'dev tun';
  382. echo 'proto tcp';
  383. echo "remote localhost $STUNNEL_PORT";
  384. echo "route $DEFAULT_DOMAIN_NAME 255.255.255.255 net_gateway";
  385. echo 'resolv-retry infinite';
  386. echo 'nobind';
  387. echo 'tun-mtu 1500';
  388. echo 'tun-mtu-extra 32';
  389. echo 'mssfix 1450';
  390. echo 'persist-key';
  391. echo 'persist-tun';
  392. echo 'auth-nocache';
  393. echo 'remote-cert-tls server';
  394. echo 'comp-lzo';
  395. echo 'verb 3';
  396. echo ''; } > "$user_vpn_cert_file"
  397. {
  398. echo '<ca>';
  399. cat /etc/openvpn/ca.crt;
  400. echo '</ca>';
  401. echo '<cert>';
  402. cat "/etc/openvpn/easy-rsa/keys/$username.crt;"
  403. echo '</cert>';
  404. echo '<key>';
  405. cat "/etc/openvpn/easy-rsa/keys/$username.key;"
  406. echo '</key>'; } >> "$user_vpn_cert_file"
  407. chown "$username":"$username" "$user_vpn_cert_file"
  408. # keep a backup
  409. cp "$user_vpn_cert_file" "/etc/openvpn/easy-rsa/keys/$username.ovpn"
  410. #rm /etc/openvpn/easy-rsa/keys/$username.crt
  411. #rm /etc/openvpn/easy-rsa/keys/$username.csr
  412. shred -zu "/etc/openvpn/easy-rsa/keys/$username.key"
  413. echo $"VPN key created at $user_vpn_cert_file"
  414. }
  415. function add_user_vpn {
  416. new_username="$1"
  417. # new_user_password="$2"
  418. create_user_vpn_key "$new_username"
  419. if [ -f /etc/stunnel/stunnel.pem ]; then
  420. cp /etc/stunnel/stunnel.pem "/home/$new_username/stunnel.pem"
  421. chown "$new_username":"$new_username" "/home/$new_username/stunnel.pem"
  422. fi
  423. if [ -f /etc/stunnel/stunnel.p12 ]; then
  424. cp /etc/stunnel/stunnel.p12 "/home/$new_username/stunnel.p12"
  425. chown "$new_username":"$new_username" "/home/$new_username/stunnel.p12"
  426. fi
  427. cp /etc/stunnel/stunnel-client.conf "/home/$new_username/stunnel-client.conf"
  428. chown "$new_username":"$new_username" "/home/$new_username/stunnel-client.conf"
  429. }
  430. function remove_user_vpn {
  431. new_username="$1"
  432. }
  433. function mesh_setup_vpn {
  434. vpn_generate_keys
  435. if [ -d /home/fbone ]; then
  436. cp /etc/stunnel/stunnel-client.conf /home/fbone/stunnel-client.conf
  437. chown fbone:fbone /home/fbone/stunnel*
  438. fi
  439. generate_stunnel_keys
  440. systemctl restart openvpn
  441. }
  442. function generate_stunnel_keys {
  443. openssl req -x509 -nodes -days 3650 -sha256 \
  444. -subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \
  445. -newkey rsa:2048 -keyout /etc/stunnel/key.pem \
  446. -out /etc/stunnel/cert.pem
  447. if [ ! -f /etc/stunnel/key.pem ]; then
  448. echo $'stunnel key not created'
  449. exit 793530
  450. fi
  451. if [ ! -f /etc/stunnel/cert.pem ]; then
  452. echo $'stunnel cert not created'
  453. exit 204587
  454. fi
  455. chmod 400 /etc/stunnel/key.pem
  456. chmod 640 /etc/stunnel/cert.pem
  457. cat /etc/stunnel/key.pem /etc/stunnel/cert.pem >> /etc/stunnel/stunnel.pem
  458. chmod 640 /etc/stunnel/stunnel.pem
  459. openssl pkcs12 -export -out /etc/stunnel/stunnel.p12 -inkey /etc/stunnel/key.pem -in /etc/stunnel/cert.pem -passout pass:
  460. if [ ! -f /etc/stunnel/stunnel.p12 ]; then
  461. echo $'stunnel pkcs12 not created'
  462. exit 639353
  463. fi
  464. chmod 640 /etc/stunnel/stunnel.p12
  465. cp /etc/stunnel/stunnel.pem "/home/$MY_USERNAME/stunnel.pem"
  466. cp /etc/stunnel/stunnel.p12 "/home/$MY_USERNAME/stunnel.p12"
  467. chown "$MY_USERNAME":"$MY_USERNAME" "$prefix/home/$MY_USERNAME/stunnel*"
  468. }
  469. function install_stunnel {
  470. prefix=
  471. prefixchroot=
  472. # shellcheck disable=SC2154
  473. if [ "$rootdir" ]; then
  474. prefix=$rootdir
  475. prefixchroot="chroot $rootdir"
  476. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  477. fi
  478. $prefixchroot apt-get -yq install stunnel4
  479. if [ ! "$prefix" ]; then
  480. cd /etc/stunnel || exit 46284624
  481. generate_stunnel_keys
  482. fi
  483. { echo 'chroot = /var/lib/stunnel4';
  484. echo 'pid = /stunnel4.pid';
  485. echo 'setuid = stunnel4';
  486. echo 'setgid = stunnel4';
  487. echo 'socket = l:TCP_NODELAY=1';
  488. echo 'socket = r:TCP_NODELAY=1';
  489. echo 'cert = /etc/stunnel/stunnel.pem';
  490. echo '[openvpn]';
  491. echo "accept = $VPN_TLS_PORT";
  492. echo 'connect = localhost:1194';
  493. echo 'cert = /etc/stunnel/stunnel.pem';
  494. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel.conf"
  495. sed -i 's|ENABLED=.*|ENABLED=1|g' "$prefix/etc/default/stunnel4"
  496. { echo '[openvpn]';
  497. echo 'client = yes';
  498. echo "accept = $STUNNEL_PORT";
  499. echo "connect = $DEFAULT_DOMAIN_NAME:$VPN_TLS_PORT";
  500. echo 'cert = stunnel.pem';
  501. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel-client.conf"
  502. { echo '[Unit]';
  503. echo 'Description=SSL tunnel for network daemons';
  504. echo 'Documentation=man:stunnel https://www.stunnel.org/docs.html';
  505. echo 'DefaultDependencies=no';
  506. echo 'After=network.target';
  507. echo 'After=syslog.target';
  508. echo '';
  509. echo '[Install]';
  510. echo 'WantedBy=multi-user.target';
  511. echo 'Alias=stunnel.target';
  512. echo '';
  513. echo '[Service]';
  514. echo 'Type=forking';
  515. echo 'RuntimeDirectory=stunnel';
  516. echo 'EnvironmentFile=-/etc/stunnel/stunnel.conf';
  517. echo 'ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf';
  518. echo 'ExecStop=/usr/bin/killall -9 stunnel';
  519. echo 'RemainAfterExit=yes'; } > "$prefix/etc/systemd/system/stunnel.service"
  520. if [ ! "$prefix" ]; then
  521. if [ $VPN_TLS_PORT -eq 443 ]; then
  522. systemctl stop nginx
  523. systemctl disable nginx
  524. else
  525. systemctl enable nginx
  526. systemctl restart nginx
  527. fi
  528. systemctl enable stunnel
  529. systemctl daemon-reload
  530. systemctl start stunnel
  531. cp /etc/stunnel/stunnel-client.conf "/home/$MY_USERNAME/stunnel-client.conf"
  532. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/stunnel*"
  533. fi
  534. }
  535. function vpn_generate_keys {
  536. # generate host keys
  537. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  538. "${PROJECT_NAME}-dhparam" -o /etc/openvpn/dh2048.pem
  539. fi
  540. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  541. echo $'vpn dhparams were not generated'
  542. exit 73724523
  543. fi
  544. cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem
  545. cd /etc/openvpn/easy-rsa || exit 5628756256
  546. # shellcheck disable=SC1091
  547. . ./vars
  548. ./clean-all
  549. vpn_openssl_version='1.0.0'
  550. if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then
  551. echo $"openssl-${vpn_openssl_version}.cnf was not found"
  552. exit 7392353
  553. fi
  554. cp openssl-${vpn_openssl_version}.cnf openssl.cnf
  555. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  556. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  557. fi
  558. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  559. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key
  560. fi
  561. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then
  562. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr
  563. fi
  564. sed -i 's| --interact||g' build-key-server
  565. sed -i 's| --interact||g' build-ca
  566. ./build-ca
  567. ./build-key-server ${OPENVPN_SERVER_NAME}
  568. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  569. echo $'OpenVPN crt not found'
  570. exit 7823352
  571. fi
  572. server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt)
  573. if [ ${#server_cert} -lt 10 ]; then
  574. cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  575. echo $'Server cert generation failed'
  576. exit 3284682
  577. fi
  578. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  579. echo $'OpenVPN key not found'
  580. exit 6839436
  581. fi
  582. if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then
  583. echo $'OpenVPN ca not found'
  584. exit 7935203
  585. fi
  586. cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn
  587. create_user_vpn_key "${MY_USERNAME}"
  588. }
  589. function install_vpn {
  590. prefix=
  591. prefixchroot=
  592. if [ "$rootdir" ]; then
  593. prefix=$rootdir
  594. prefixchroot="chroot $rootdir"
  595. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  596. fi
  597. $prefixchroot apt-get -yq install fastd openvpn easy-rsa
  598. $prefixchroot groupadd vpn
  599. $prefixchroot useradd -r -s /bin/false -g vpn vpn
  600. # server configuration
  601. { echo 'port 1194';
  602. echo 'proto tcp';
  603. echo 'dev tun';
  604. echo 'tun-mtu 1500';
  605. echo 'tun-mtu-extra 32';
  606. echo 'mssfix 1450';
  607. echo 'ca /etc/openvpn/ca.crt';
  608. echo 'cert /etc/openvpn/server.crt';
  609. echo 'key /etc/openvpn/server.key';
  610. echo 'dh /etc/openvpn/dh2048.pem';
  611. echo 'server 10.8.0.0 255.255.255.0';
  612. echo 'push "redirect-gateway def1 bypass-dhcp"';
  613. echo "push \"dhcp-option DNS 85.214.73.63\"";
  614. echo "push \"dhcp-option DNS 213.73.91.35\"";
  615. echo 'keepalive 5 30';
  616. echo 'comp-lzo';
  617. echo 'persist-key';
  618. echo 'persist-tun';
  619. echo 'status /dev/null';
  620. echo 'verb 3';
  621. echo ''; } > "$prefix/etc/openvpn/server.conf"
  622. if [ ! "$prefix" ]; then
  623. echo 1 > /proc/sys/net/ipv4/ip_forward
  624. fi
  625. sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  626. sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  627. sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' "$prefix/etc/sysctl.conf"
  628. cp -r "$prefix/usr/share/easy-rsa/" "$prefix/etc/openvpn"
  629. if [ ! -d "$prefix/etc/openvpn/easy-rsa/keys" ]; then
  630. mkdir "$prefix/etc/openvpn/easy-rsa/keys"
  631. fi
  632. # keys configuration
  633. sed -i "s|export KEY_COUNTRY.*|export KEY_COUNTRY=\"US\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  634. sed -i "s|export KEY_PROVINCE.*|export KEY_PROVINCE=\"TX\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  635. sed -i "s|export KEY_CITY.*|export KEY_CITY=\"Dallas\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  636. sed -i "s|export KEY_ORG.*|export KEY_ORG=\"$PROJECT_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  637. sed -i "s|export KEY_EMAIL.*|export KEY_EMAIL=\"$MY_EMAIL_ADDRESS\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  638. sed -i "s|export KEY_OU=.*|export KEY_OU=\"MoonUnit\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  639. sed -i "s|export KEY_NAME.*|export KEY_NAME=\"$OPENVPN_SERVER_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  640. if [ ! "$prefix" ]; then
  641. vpn_generate_keys
  642. firewall_enable_vpn
  643. if [ ${VPN_TLS_PORT} -ne 443 ]; then
  644. firewall_add VPN-TLS ${VPN_TLS_PORT} tcp
  645. fi
  646. systemctl start openvpn
  647. fi
  648. install_stunnel
  649. if [ ! "$prefix" ]; then
  650. systemctl restart openvpn
  651. fi
  652. APP_INSTALLED=1
  653. }
  654. # NOTE: deliberately there is no "exit 0"