freedombone-app-vpn 25KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735
  1. #!/bin/bash
  2. #
  3. # .---. . .
  4. # | | |
  5. # |--- .--. .-. .-. .-.| .-. .--.--. |.-. .-. .--. .-.
  6. # | | (.-' (.-' ( | ( )| | | | )( )| | (.-'
  7. # ' ' --' --' -' - -' ' ' -' -' -' ' - --'
  8. #
  9. # Freedom in the Cloud
  10. #
  11. # VPN functions
  12. # https://www.digitalocean.com/community/tutorials/how-to-set-up-an-openvpn-server-on-debian-8
  13. # https://jamielinux.com/blog/force-all-network-traffic-through-openvpn-using-iptables/
  14. # http://www.farrellf.com/projects/software/2016-05-04_Running_a_VPN_Server_with_OpenVPN_and_Stunnel/index_.php
  15. #
  16. # License
  17. # =======
  18. #
  19. # Copyright (C) 2014-2018 Bob Mottram <bob@freedombone.net>
  20. #
  21. # This program is free software: you can redistribute it and/or modify
  22. # it under the terms of the GNU Affero General Public License as published by
  23. # the Free Software Foundation, either version 3 of the License, or
  24. # (at your option) any later version.
  25. #
  26. # This program is distributed in the hope that it will be useful,
  27. # but WITHOUT ANY WARRANTY; without even the implied warranty of
  28. # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  29. # GNU Affero General Public License for more details.
  30. #
  31. # You should have received a copy of the GNU Affero General Public License
  32. # along with this program. If not, see <http://www.gnu.org/licenses/>.
  33. VARIANTS='full full-vim'
  34. IN_DEFAULT_INSTALL=0
  35. SHOW_ON_ABOUT=0
  36. OPENVPN_SERVER_NAME="server"
  37. OPENVPN_KEY_FILENAME='client.ovpn'
  38. VPN_COUNTRY_CODE="US"
  39. VPN_AREA="Apparent Free Speech Zone"
  40. VPN_LOCATION="Freedomville"
  41. VPN_ORGANISATION="Freedombone"
  42. VPN_UNIT="Freedombone Unit"
  43. STUNNEL_PORT=3439
  44. VPN_TLS_PORT=553
  45. VPN_MESH_TLS_PORT=653
  46. vpn_variables=(MY_EMAIL_ADDRESS
  47. DEFAULT_DOMAIN_NAME
  48. MY_USERNAME
  49. VPN_COUNTRY_CODE
  50. VPN_AREA
  51. VPN_LOCATION
  52. VPN_ORGANISATION
  53. VPN_UNIT
  54. VPN_TLS_PORT)
  55. function logging_on_vpn {
  56. if [ ! -f /etc/openvpn/server.conf ]; then
  57. return
  58. fi
  59. sed -i 's|status .*|status /var/log/openvpn.log|g' /etc/openvpn/server.conf
  60. systemctl restart openvpn
  61. }
  62. function logging_off_vpn {
  63. if [ ! -f /etc/openvpn/server.conf ]; then
  64. return
  65. fi
  66. sed -i 's|status .*|status /dev/null|g' /etc/openvpn/server.conf
  67. systemctl restart openvpn
  68. }
  69. function install_interactive_vpn {
  70. read_config_param VPN_TLS_PORT
  71. if [ ! $VPN_TLS_PORT ]; then
  72. VPN_TLS_PORT=553
  73. fi
  74. VPN_DETAILS_COMPLETE=
  75. while [ ! $VPN_DETAILS_COMPLETE ]
  76. do
  77. data=$(mktemp 2>/dev/null)
  78. currtlsport=$(grep 'VPN_TLS_PORT' temp.cfg | awk -F '=' '{print $2}')
  79. if [ "$currtlsport" ]; then
  80. VPN_TLS_PORT=$currtlsport
  81. fi
  82. dialog --backtitle $"Freedombone Configuration" \
  83. --title $"VPN Configuration" \
  84. --form $"\\nPlease enter your VPN details. Changing the port to 443 will help defend against censorship but will prevent other web apps from running." 12 65 1 \
  85. $"TLS port:" 1 1 "$VPN_TLS_PORT" 1 12 5 5 \
  86. 2> "$data"
  87. sel=$?
  88. case $sel in
  89. 1) rm -f "$data"
  90. exit 1;;
  91. 255) rm -f "$data"
  92. exit 1;;
  93. esac
  94. tlsport=$(sed -n 1p < "$data")
  95. if [ ${#tlsport} -gt 1 ]; then
  96. if [[ "$tlsport" != *' '* && "$tlsport" != *'.'* ]]; then
  97. VPN_TLS_PORT="$tlsport"
  98. VPN_DETAILS_COMPLETE="yes"
  99. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  100. fi
  101. fi
  102. rm -f "$data"
  103. done
  104. clear
  105. APP_INSTALLED=1
  106. }
  107. function vpn_change_tls_port {
  108. if ! grep -q "VPN-TLS" "$FIREWALL_CONFIG"; then
  109. EXISTING_VPN_TLS_PORT=443
  110. else
  111. EXISTING_VPN_TLS_PORT=$(grep "VPN-TLS" "$FIREWALL_CONFIG" | awk -F '=' '{print $2}')
  112. fi
  113. data=$(mktemp 2>/dev/null)
  114. dialog --title $"VPN Configuration" \
  115. --backtitle $"Freedombone Control Panel" \
  116. --inputbox $'Change TLS port' 10 50 "$EXISTING_VPN_TLS_PORT" 2>"$data"
  117. sel=$?
  118. case $sel in
  119. 0)
  120. tlsport=$(<"$data")
  121. if [ ${#tlsport} -gt 0 ]; then
  122. if [[ "$tlsport" != "$EXISTING_VPN_TLS_PORT" ]]; then
  123. clear
  124. VPN_TLS_PORT=$tlsport
  125. write_config_param "VPN_TLS_PORT" "$VPN_TLS_PORT"
  126. sed -i "s|accept =.*|accept = $VPN_TLS_PORT|g" /etc/stunnel/stunnel.conf
  127. sed -i "s|connect =.*|connect = :$VPN_TLS_PORT|g" /etc/stunnel/stunnel-client.conf
  128. for d in /home/*/ ; do
  129. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  130. if [ -f "/home/$USERNAME/stunnel-client.conf" ]; then
  131. cp "/etc/stunnel/stunnel-client.conf" "/home/$USERNAME/stunnel-client.conf"
  132. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel-client.conf"
  133. fi
  134. done
  135. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  136. if [[ "$PREVIOUS_VPN_TLS_PORT" != "443" ]]; then
  137. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  138. fi
  139. systemctl stop nginx
  140. systemctl disable nginx
  141. else
  142. if [[ "$PREVIOUS_VPN_TLS_PORT" != "$VPN_TLS_PORT" ]]; then
  143. firewall_remove VPN-TLS "${EXISTING_VPN_TLS_PORT}"
  144. firewall_add VPN-TLS "${VPN_TLS_PORT}" tcp
  145. fi
  146. systemctl enable nginx
  147. systemctl restart nginx
  148. fi
  149. systemctl restart stunnel
  150. if [ "$VPN_TLS_PORT" -eq 443 ]; then
  151. dialog --title $"VPN Configuration" \
  152. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  153. else
  154. dialog --title $"VPN Configuration" \
  155. --msgbox $"TLS port changed to ${VPN_TLS_PORT}. Forward this port from your internet router." 10 60
  156. fi
  157. fi
  158. fi
  159. ;;
  160. esac
  161. rm -f "$data"
  162. }
  163. function vpn_regenerate_client_keys {
  164. data=$(mktemp 2>/dev/null)
  165. dialog --title $"Regenerate VPN keys for a user" \
  166. --backtitle $"Freedombone Control Panel" \
  167. --inputbox $'username' 10 50 2>"$data"
  168. sel=$?
  169. case $sel in
  170. 0)
  171. USERNAME=$(<"$data")
  172. if [ ${#USERNAME} -gt 0 ]; then
  173. if [ -d "/home/$USERNAME" ]; then
  174. clear
  175. create_user_vpn_key "$USERNAME"
  176. dialog --title $"Regenerate VPN keys for a user" \
  177. --msgbox $"VPN keys were regenerated for $USERNAME" 6 60
  178. fi
  179. fi
  180. ;;
  181. esac
  182. rm -f "$data"
  183. }
  184. function configure_interactive_vpn {
  185. read_config_param VPN_TLS_PORT
  186. while true
  187. do
  188. W=(1 $"Change TLS port (currently $VPN_TLS_PORT)"
  189. 2 $"Regenerate keys for a user")
  190. # shellcheck disable=SC2068
  191. selection=$(dialog --backtitle $"Freedombone Administrator Control Panel" --title $"VPN" --menu $"Choose an operation, or ESC to exit:" 10 60 2 "${W[@]}" 3>&2 2>&1 1>&3)
  192. if [ ! "$selection" ]; then
  193. break
  194. fi
  195. case $selection in
  196. 1) vpn_change_tls_port;;
  197. 2) vpn_regenerate_client_keys;;
  198. esac
  199. done
  200. }
  201. function reconfigure_vpn {
  202. echo -n ''
  203. }
  204. function upgrade_vpn {
  205. echo -n ''
  206. }
  207. function backup_local_vpn {
  208. for d in /home/*/ ; do
  209. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  210. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  211. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  212. fi
  213. done
  214. function_check backup_directory_to_usb
  215. backup_directory_to_usb /etc/openvpn/easy-rsa/keys vpn
  216. backup_directory_to_usb /etc/stunnel vpnstunnel
  217. }
  218. function restore_local_vpn {
  219. temp_restore_dir=/root/tempvpn
  220. restore_directory_from_usb $temp_restore_dir vpn
  221. if [ -d ${temp_restore_dir} ]; then
  222. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  223. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  224. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  225. rm -rf ${temp_restore_dir}
  226. for d in /home/*/ ; do
  227. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  228. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  229. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  230. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  231. fi
  232. done
  233. fi
  234. temp_restore_dir=/root/tempvpnstunnel
  235. restore_directory_from_usb $temp_restore_dir vpnstunnel
  236. if [ -d ${temp_restore_dir} ]; then
  237. cp -r ${temp_restore_dir}/* /etc/stunnel
  238. rm -rf ${temp_restore_dir}
  239. for d in /home/*/ ; do
  240. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  241. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  242. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  243. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  244. fi
  245. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  246. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  247. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  248. fi
  249. done
  250. fi
  251. }
  252. function backup_remote_vpn {
  253. for d in /home/*/ ; do
  254. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  255. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  256. cp "/home/$USERNAME/$OPENVPN_KEY_FILENAME" "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}"
  257. fi
  258. done
  259. function_check backup_directory_to_friend
  260. backup_directory_to_friend /etc/openvpn/easy-rsa/keys vpn
  261. backup_directory_to_friend /etc/stunnel vpnstunnel
  262. }
  263. function restore_remote_vpn {
  264. temp_restore_dir=/root/tempvpn
  265. restore_directory_from_friend $temp_restore_dir vpn
  266. if [ -d ${temp_restore_dir} ]; then
  267. cp -r ${temp_restore_dir}/* /etc/openvpn/easy-rsa/keys
  268. cp -r ${temp_restore_dir}/${OPENVPN_SERVER_NAME}* /etc/openvpn/
  269. cp -r ${temp_restore_dir}/dh* /etc/openvpn/
  270. rm -rf ${temp_restore_dir}
  271. for d in /home/*/ ; do
  272. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  273. if [ -f "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" ]; then
  274. cp "/etc/openvpn/easy-rsa/keys/${USERNAME}_${OPENVPN_KEY_FILENAME}" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  275. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  276. fi
  277. done
  278. fi
  279. temp_restore_dir=/root/tempvpnstunnel
  280. restore_directory_from_friend $temp_restore_dir vpnstunnel
  281. if [ -d ${temp_restore_dir} ]; then
  282. cp -r ${temp_restore_dir}/* /etc/stunnel
  283. rm -rf ${temp_restore_dir}
  284. for d in /home/*/ ; do
  285. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  286. if [ -f "/home/$USERNAME/stunnel.pem" ]; then
  287. cp /etc/stunnel/stunnel.pem "/home/$USERNAME/stunnel.pem"
  288. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.pem"
  289. fi
  290. if [ -f "/home/$USERNAME/stunnel.p12" ]; then
  291. cp /etc/stunnel/stunnel.p12 "/home/$USERNAME/stunnel.p12"
  292. chown "$USERNAME":"$USERNAME" "/home/$USERNAME/stunnel.p12"
  293. fi
  294. done
  295. fi
  296. }
  297. function remove_vpn {
  298. systemctl stop stunnel
  299. systemctl disable stunnel
  300. rm /etc/systemd/system/stunnel.service
  301. systemctl stop openvpn
  302. if [ "$VPN_TLS_PORT" -ne 443 ]; then
  303. firewall_remove VPN-TLS "$VPN_TLS_PORT"
  304. else
  305. systemctl enable nginx
  306. systemctl restart nginx
  307. fi
  308. apt-get -yq remove --purge fastd openvpn easy-rsa
  309. apt-get -yq remove stunnel4
  310. if [ -d /etc/openvpn ]; then
  311. rm -rf /etc/openvpn
  312. fi
  313. firewall_disable_vpn
  314. echo 0 > /proc/sys/net/ipv4/ip_forward
  315. sed -i 's|net.ipv4.ip_forward=.*|net.ipv4.ip_forward=0|g' /etc/sysctl.conf
  316. remove_completion_param install_vpn
  317. # remove any client keys
  318. for d in /home/*/ ; do
  319. USERNAME=$(echo "$d" | awk -F '/' '{print $3}')
  320. if [ -f "/home/$USERNAME/$OPENVPN_KEY_FILENAME" ]; then
  321. shred -zu "/home/$USERNAME/$OPENVPN_KEY_FILENAME"
  322. fi
  323. rm "/home/$USERNAME/stunnel*"
  324. done
  325. userdel -f vpn
  326. groupdel -f vpn
  327. if [ -d /etc/stunnel ]; then
  328. rm -rf /etc/stunnel
  329. fi
  330. }
  331. function create_user_vpn_key {
  332. username=$1
  333. if [ ! -d "/home/$username" ]; then
  334. return
  335. fi
  336. echo $"Creating VPN key for $username"
  337. cd /etc/openvpn/easy-rsa || exit 4728468246
  338. if [ -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  339. rm "/etc/openvpn/easy-rsa/keys/$username.crt"
  340. fi
  341. if [ -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  342. rm "/etc/openvpn/easy-rsa/keys/$username.key"
  343. fi
  344. if [ -f "/etc/openvpn/easy-rsa/keys/$username.csr" ]; then
  345. rm "/etc/openvpn/easy-rsa/keys/$username.csr"
  346. fi
  347. sed -i 's| --interact||g' build-key
  348. ./build-key "$username"
  349. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.crt" ]; then
  350. echo $'VPN user cert not generated'
  351. exit 783528
  352. fi
  353. user_cert=$(cat "/etc/openvpn/easy-rsa/keys/$username.crt")
  354. if [ ${#user_cert} -lt 10 ]; then
  355. cat "/etc/openvpn/easy-rsa/keys/$username.crt"
  356. echo $'User cert generation failed'
  357. exit 634659
  358. fi
  359. if [ ! -f "/etc/openvpn/easy-rsa/keys/$username.key" ]; then
  360. echo $'VPN user key not generated'
  361. exit 682523
  362. fi
  363. user_key=$(cat "/etc/openvpn/easy-rsa/keys/$username.key")
  364. if [ ${#user_key} -lt 10 ]; then
  365. cat "/etc/openvpn/easy-rsa/keys/$username.key"
  366. echo $'User key generation failed'
  367. exit 285838
  368. fi
  369. user_vpn_cert_file=/home/$username/$OPENVPN_KEY_FILENAME
  370. { echo 'client';
  371. echo 'dev tun';
  372. echo 'proto tcp';
  373. echo "remote localhost $STUNNEL_PORT";
  374. echo "route $DEFAULT_DOMAIN_NAME 255.255.255.255 net_gateway";
  375. echo 'resolv-retry infinite';
  376. echo 'nobind';
  377. echo 'tun-mtu 1500';
  378. echo 'tun-mtu-extra 32';
  379. echo 'mssfix 1450';
  380. echo 'persist-key';
  381. echo 'persist-tun';
  382. echo 'auth-nocache';
  383. echo 'remote-cert-tls server';
  384. echo 'comp-lzo';
  385. echo 'verb 3';
  386. echo ''; } > "$user_vpn_cert_file"
  387. {
  388. echo '<ca>';
  389. cat /etc/openvpn/ca.crt;
  390. echo '</ca>';
  391. echo '<cert>';
  392. cat "/etc/openvpn/easy-rsa/keys/$username.crt;"
  393. echo '</cert>';
  394. echo '<key>';
  395. cat "/etc/openvpn/easy-rsa/keys/$username.key;"
  396. echo '</key>'; } >> "$user_vpn_cert_file"
  397. chown "$username":"$username" "$user_vpn_cert_file"
  398. # keep a backup
  399. cp "$user_vpn_cert_file" "/etc/openvpn/easy-rsa/keys/$username.ovpn"
  400. #rm /etc/openvpn/easy-rsa/keys/$username.crt
  401. #rm /etc/openvpn/easy-rsa/keys/$username.csr
  402. shred -zu "/etc/openvpn/easy-rsa/keys/$username.key"
  403. echo $"VPN key created at $user_vpn_cert_file"
  404. }
  405. function add_user_vpn {
  406. new_username="$1"
  407. # new_user_password="$2"
  408. create_user_vpn_key "$new_username"
  409. if [ -f /etc/stunnel/stunnel.pem ]; then
  410. cp /etc/stunnel/stunnel.pem "/home/$new_username/stunnel.pem"
  411. chown "$new_username":"$new_username" "/home/$new_username/stunnel.pem"
  412. fi
  413. if [ -f /etc/stunnel/stunnel.p12 ]; then
  414. cp /etc/stunnel/stunnel.p12 "/home/$new_username/stunnel.p12"
  415. chown "$new_username":"$new_username" "/home/$new_username/stunnel.p12"
  416. fi
  417. cp /etc/stunnel/stunnel-client.conf "/home/$new_username/stunnel-client.conf"
  418. chown "$new_username":"$new_username" "/home/$new_username/stunnel-client.conf"
  419. }
  420. function remove_user_vpn {
  421. new_username="$1"
  422. }
  423. function mesh_setup_vpn {
  424. vpn_generate_keys
  425. if [ -d /home/fbone ]; then
  426. cp /etc/stunnel/stunnel-client.conf /home/fbone/stunnel-client.conf
  427. chown fbone:fbone /home/fbone/stunnel*
  428. fi
  429. generate_stunnel_keys
  430. systemctl restart openvpn
  431. }
  432. function generate_stunnel_keys {
  433. openssl req -x509 -nodes -days 3650 -sha256 \
  434. -subj "/O=$VPN_ORGANISATION/OU=$VPN_UNIT/C=$VPN_COUNTRY_CODE/ST=$VPN_AREA/L=$VPN_LOCATION/CN=$HOSTNAME" \
  435. -newkey rsa:2048 -keyout /etc/stunnel/key.pem \
  436. -out /etc/stunnel/cert.pem
  437. if [ ! -f /etc/stunnel/key.pem ]; then
  438. echo $'stunnel key not created'
  439. exit 793530
  440. fi
  441. if [ ! -f /etc/stunnel/cert.pem ]; then
  442. echo $'stunnel cert not created'
  443. exit 204587
  444. fi
  445. chmod 400 /etc/stunnel/key.pem
  446. chmod 640 /etc/stunnel/cert.pem
  447. cat /etc/stunnel/key.pem /etc/stunnel/cert.pem >> /etc/stunnel/stunnel.pem
  448. chmod 640 /etc/stunnel/stunnel.pem
  449. openssl pkcs12 -export -out /etc/stunnel/stunnel.p12 -inkey /etc/stunnel/key.pem -in /etc/stunnel/cert.pem -passout pass:
  450. if [ ! -f /etc/stunnel/stunnel.p12 ]; then
  451. echo $'stunnel pkcs12 not created'
  452. exit 639353
  453. fi
  454. chmod 640 /etc/stunnel/stunnel.p12
  455. cp /etc/stunnel/stunnel.pem "/home/$MY_USERNAME/stunnel.pem"
  456. cp /etc/stunnel/stunnel.p12 "/home/$MY_USERNAME/stunnel.p12"
  457. chown "$MY_USERNAME":"$MY_USERNAME" "$prefix/home/$MY_USERNAME/stunnel*"
  458. }
  459. function install_stunnel {
  460. prefix=
  461. prefixchroot=
  462. # shellcheck disable=SC2154
  463. if [ "$rootdir" ]; then
  464. prefix=$rootdir
  465. prefixchroot="chroot $rootdir"
  466. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  467. fi
  468. $prefixchroot apt-get -yq install stunnel4
  469. if [ ! "$prefix" ]; then
  470. cd /etc/stunnel || exit 46284624
  471. generate_stunnel_keys
  472. fi
  473. { echo 'chroot = /var/lib/stunnel4';
  474. echo 'pid = /stunnel4.pid';
  475. echo 'setuid = stunnel4';
  476. echo 'setgid = stunnel4';
  477. echo 'socket = l:TCP_NODELAY=1';
  478. echo 'socket = r:TCP_NODELAY=1';
  479. echo 'cert = /etc/stunnel/stunnel.pem';
  480. echo '[openvpn]';
  481. echo "accept = $VPN_TLS_PORT";
  482. echo 'connect = localhost:1194';
  483. echo 'cert = /etc/stunnel/stunnel.pem';
  484. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel.conf"
  485. sed -i 's|ENABLED=.*|ENABLED=1|g' "$prefix/etc/default/stunnel4"
  486. { echo '[openvpn]';
  487. echo 'client = yes';
  488. echo "accept = $STUNNEL_PORT";
  489. echo "connect = $DEFAULT_DOMAIN_NAME:$VPN_TLS_PORT";
  490. echo 'cert = stunnel.pem';
  491. echo 'protocol = socks'; } > "$prefix/etc/stunnel/stunnel-client.conf"
  492. { echo '[Unit]';
  493. echo 'Description=SSL tunnel for network daemons';
  494. echo 'Documentation=man:stunnel https://www.stunnel.org/docs.html';
  495. echo 'DefaultDependencies=no';
  496. echo 'After=network.target';
  497. echo 'After=syslog.target';
  498. echo '';
  499. echo '[Install]';
  500. echo 'WantedBy=multi-user.target';
  501. echo 'Alias=stunnel.target';
  502. echo '';
  503. echo '[Service]';
  504. echo 'Type=forking';
  505. echo 'RuntimeDirectory=stunnel';
  506. echo 'EnvironmentFile=-/etc/stunnel/stunnel.conf';
  507. echo 'ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf';
  508. echo 'ExecStop=/usr/bin/killall -9 stunnel';
  509. echo 'RemainAfterExit=yes'; } > "$prefix/etc/systemd/system/stunnel.service"
  510. if [ ! "$prefix" ]; then
  511. if [ $VPN_TLS_PORT -eq 443 ]; then
  512. systemctl stop nginx
  513. systemctl disable nginx
  514. else
  515. systemctl enable nginx
  516. systemctl restart nginx
  517. fi
  518. systemctl enable stunnel
  519. systemctl daemon-reload
  520. systemctl start stunnel
  521. cp /etc/stunnel/stunnel-client.conf "/home/$MY_USERNAME/stunnel-client.conf"
  522. chown "$MY_USERNAME":"$MY_USERNAME" "/home/$MY_USERNAME/stunnel*"
  523. fi
  524. }
  525. function vpn_generate_keys {
  526. # generate host keys
  527. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  528. "${PROJECT_NAME}-dhparam" -o /etc/openvpn/dh2048.pem
  529. fi
  530. if [ ! -f /etc/openvpn/dh2048.pem ]; then
  531. echo $'vpn dhparams were not generated'
  532. exit 73724523
  533. fi
  534. cp /etc/openvpn/dh2048.pem /etc/openvpn/easy-rsa/keys/dh2048.pem
  535. cd /etc/openvpn/easy-rsa || exit 5628756256
  536. # shellcheck disable=SC1091
  537. . ./vars
  538. ./clean-all
  539. vpn_openssl_version='1.0.0'
  540. if [ ! -f openssl-${vpn_openssl_version}.cnf ]; then
  541. echo $"openssl-${vpn_openssl_version}.cnf was not found"
  542. exit 7392353
  543. fi
  544. cp openssl-${vpn_openssl_version}.cnf openssl.cnf
  545. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  546. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  547. fi
  548. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  549. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key
  550. fi
  551. if [ -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr ]; then
  552. rm /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.csr
  553. fi
  554. sed -i 's| --interact||g' build-key-server
  555. sed -i 's| --interact||g' build-ca
  556. ./build-ca
  557. ./build-key-server ${OPENVPN_SERVER_NAME}
  558. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt ]; then
  559. echo $'OpenVPN crt not found'
  560. exit 7823352
  561. fi
  562. server_cert=$(cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt)
  563. if [ ${#server_cert} -lt 10 ]; then
  564. cat /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.crt
  565. echo $'Server cert generation failed'
  566. exit 3284682
  567. fi
  568. if [ ! -f /etc/openvpn/easy-rsa/keys/${OPENVPN_SERVER_NAME}.key ]; then
  569. echo $'OpenVPN key not found'
  570. exit 6839436
  571. fi
  572. if [ ! -f /etc/openvpn/easy-rsa/keys/ca.key ]; then
  573. echo $'OpenVPN ca not found'
  574. exit 7935203
  575. fi
  576. cp /etc/openvpn/easy-rsa/keys/{$OPENVPN_SERVER_NAME.crt,$OPENVPN_SERVER_NAME.key,ca.crt} /etc/openvpn
  577. create_user_vpn_key "${MY_USERNAME}"
  578. }
  579. function install_vpn {
  580. prefix=
  581. prefixchroot=
  582. if [ "$rootdir" ]; then
  583. prefix=$rootdir
  584. prefixchroot="chroot $rootdir"
  585. VPN_TLS_PORT=$VPN_MESH_TLS_PORT
  586. fi
  587. $prefixchroot apt-get -yq install fastd openvpn easy-rsa
  588. $prefixchroot groupadd vpn
  589. $prefixchroot useradd -r -s /bin/false -g vpn vpn
  590. # server configuration
  591. { echo 'port 1194';
  592. echo 'proto tcp';
  593. echo 'dev tun';
  594. echo 'tun-mtu 1500';
  595. echo 'tun-mtu-extra 32';
  596. echo 'mssfix 1450';
  597. echo 'ca /etc/openvpn/ca.crt';
  598. echo 'cert /etc/openvpn/server.crt';
  599. echo 'key /etc/openvpn/server.key';
  600. echo 'dh /etc/openvpn/dh2048.pem';
  601. echo 'server 10.8.0.0 255.255.255.0';
  602. echo 'push "redirect-gateway def1 bypass-dhcp"';
  603. echo "push \"dhcp-option DNS 91.239.100.100\"";
  604. echo "push \"dhcp-option DNS 89.233.43.71\"";
  605. echo 'keepalive 5 30';
  606. echo 'comp-lzo';
  607. echo 'persist-key';
  608. echo 'persist-tun';
  609. echo 'status /dev/null';
  610. echo 'verb 3';
  611. echo ''; } > "$prefix/etc/openvpn/server.conf"
  612. if [ ! "$prefix" ]; then
  613. echo 1 > /proc/sys/net/ipv4/ip_forward
  614. fi
  615. sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  616. sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' "$prefix/etc/sysctl.conf"
  617. sed -i 's|net.ipv4.ip_forward.*|net.ipv4.ip_forward=1|g' "$prefix/etc/sysctl.conf"
  618. cp -r "$prefix/usr/share/easy-rsa/" "$prefix/etc/openvpn"
  619. if [ ! -d "$prefix/etc/openvpn/easy-rsa/keys" ]; then
  620. mkdir "$prefix/etc/openvpn/easy-rsa/keys"
  621. fi
  622. # keys configuration
  623. sed -i "s|export KEY_COUNTRY.*|export KEY_COUNTRY=\"US\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  624. sed -i "s|export KEY_PROVINCE.*|export KEY_PROVINCE=\"TX\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  625. sed -i "s|export KEY_CITY.*|export KEY_CITY=\"Dallas\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  626. sed -i "s|export KEY_ORG.*|export KEY_ORG=\"$PROJECT_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  627. sed -i "s|export KEY_EMAIL.*|export KEY_EMAIL=\"$MY_EMAIL_ADDRESS\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  628. sed -i "s|export KEY_OU=.*|export KEY_OU=\"MoonUnit\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  629. sed -i "s|export KEY_NAME.*|export KEY_NAME=\"$OPENVPN_SERVER_NAME\"|g" "$prefix/etc/openvpn/easy-rsa/vars"
  630. if [ ! "$prefix" ]; then
  631. vpn_generate_keys
  632. firewall_enable_vpn
  633. if [ ${VPN_TLS_PORT} -ne 443 ]; then
  634. firewall_add VPN-TLS ${VPN_TLS_PORT} tcp
  635. fi
  636. systemctl start openvpn
  637. fi
  638. install_stunnel
  639. if [ ! "$prefix" ]; then
  640. systemctl restart openvpn
  641. fi
  642. APP_INSTALLED=1
  643. }
  644. # NOTE: deliberately there is no "exit 0"