simono41/shell-scripte-code
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix

Browse source
This commit is contained in:
simono41 2017-12-14 12:20:48 -05:00
parent 75faa3a87e
commit 2d96bfe9db
1 changed files with 574 additions and 570 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

44
openvpn-install.sh
View file

@ -3,6 +3,7 @@
# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux # Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux
# https://github.com/Angristan/OpenVPN-install # https://github.com/Angristan/OpenVPN-install
set -ex
if [[ "$EUID" -ne 0 ]]; then if [[ "$EUID" -ne 0 ]]; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
@ -194,7 +195,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
fi fi
exit exit
;; ;;
4) exit;; 4) exit ;;
esac esac
done done
else else
@ -364,7 +365,7 @@ iptables -t mangle -F
iptables -t mangle -X iptables -t mangle -X
iptables -P INPUT ACCEPT iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh
chmod +x /etc/iptables/flush-iptables.sh chmod +x /etc/iptables/flush-iptables.sh
echo "[Unit] echo "[Unit]
Description=Packet Filtering Framework Description=Packet Filtering Framework
@ -378,7 +379,7 @@ ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
ExecStop=/etc/iptables/flush-iptables.sh ExecStop=/etc/iptables/flush-iptables.sh
RemainAfterExit=yes RemainAfterExit=yes
[Install] [Install]
WantedBy=multi-user.target" > /etc/systemd/system/iptables.service WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
systemctl daemon-reload systemctl daemon-reload
systemctl enable iptables.service systemctl enable iptables.service
fi fi
@ -398,7 +399,7 @@ iptables -t mangle -F
iptables -t mangle -X iptables -t mangle -X
iptables -P INPUT ACCEPT iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh
chmod +x /etc/iptables/flush-iptables.sh chmod +x /etc/iptables/flush-iptables.sh
echo "[Unit] echo "[Unit]
Description=Packet Filtering Framework Description=Packet Filtering Framework
@ -412,7 +413,7 @@ ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules
ExecStop=/etc/iptables/flush-iptables.sh ExecStop=/etc/iptables/flush-iptables.sh
RemainAfterExit=yes RemainAfterExit=yes
[Install] [Install]
WantedBy=multi-user.target" > /etc/systemd/system/iptables.service WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
systemctl daemon-reload systemctl daemon-reload
systemctl enable iptables.service systemctl enable iptables.service
# Disable firewalld to allow iptables to start upon reboot # Disable firewalld to allow iptables to start upon reboot
@ -492,7 +493,7 @@ persist-tun
keepalive 10 120 keepalive 10 120
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
# DNS resolvers # DNS resolvers
case $DNS in case $DNS in
1) 1)
@ -529,8 +530,8 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf
;; ;;
esac esac
echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf
echo "crl-verify crl.pem echo "crl-verify crl.pem
ca ca.crt ca ca.crt
cert server.crt cert server.crt
key server.key key server.key
@ -542,7 +543,7 @@ tls-server
tls-version-min 1.2 tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status openvpn.log status openvpn.log
verb 3" >> /etc/openvpn/server.conf verb 3" >> /etc/openvpn/server.conf
# Create the sysctl configuration file if needed (mainly for Arch Linux) # Create the sysctl configuration file if needed (mainly for Arch Linux)
if [[ ! -e $SYSCTL ]]; then if [[ ! -e $SYSCTL ]]; then
@ -614,26 +615,29 @@ verb 3" >> /etc/openvpn/server.conf
sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn-server\@.service sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn-server\@.service
sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn-server\@.service sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn-server\@.service
systemctl daemon-reload systemctl daemon-reload
systemctl restart openvpn-server@openvpn.service systemctl restart openvpn-server\@openvpn.service
systemctl enable openvpn-server@openvpn.service systemctl enable openvpn-server\@openvpn.service
else else
systemctl restart openvpn@server.service sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn\@.service
systemctl daemon-reload
systemctl restart openvpn\@server.service
fi fi
else else
/etc/init.d/openvpn restart /etc/init.d/openvpn restart
fi fi
else else
if pgrep systemd-journal; then if pgrep systemd-journal; then
if [[ "$OS" = 'arch' ]]; then if [[ "$OS" = 'arch' ]] || [[ "$VERSION_ID" = 'VERSION_ID="16.04"' ]]; then
#Workaround to avoid rewriting the entire script for Arch #Workaround to avoid rewriting the entire script for Arch
sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service sed -i 's|LimitNPROC|#LimitNPROC|' /usr/lib/systemd/system/openvpn-server\@.service
sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server\@.service
sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server\@.service
systemctl daemon-reload systemctl daemon-reload
systemctl restart openvpn-server@openvpn.service systemctl restart openvpn-server\@openvpn.service
systemctl enable openvpn-server@openvpn.service systemctl enable openvpn-server\@openvpn.service
else else
systemctl restart openvpn@server.service systemctl restart openvpn\@server.service
systemctl enable openvpn@server.service systemctl enable openvpn\@server.service
fi fi
else else
service openvpn restart service openvpn restart
@ -675,7 +679,7 @@ tls-client
tls-version-min 1.2 tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
setenv opt block-outside-dns setenv opt block-outside-dns
verb 3" >> /etc/openvpn/client-template.txt verb 3" >> /etc/openvpn/client-template.txt
# Generate the custom client.ovpn # Generate the custom client.ovpn
newclient "$CLIENT" newclient "$CLIENT"