ESrMTTaR

1#!/bin/bash
2
3help_menu() {
4  echo "Usage:
5
6  ${0##*/} [-h][-d CA_DIR][-p SERVERPORT][-v][-s]
7
8Options:
9
10  -h, --help
11    display this help and exit
12
13  -d, --ca-dir=DIRECTORY
14    ca_dir
15
16  -p, --server-port=PORT
17    server_port
18
19  -s, --skip-update
20    skip update
21    
22  -v, --verbose
23    enable output
24  "
25} &&
26
27server_port=1194 &&
28ca_dir=$HOME &&
29skip_update=false &&
30
31while [ "$1" != "" ]; do
32    PARAM=`echo $1 | awk -F= '{print $1}'`
33    VALUE=`echo $1 | awk -F= '{print $2}'`
34    case $PARAM in
35        -h | --help)
36            help_menu
37            exit
38            ;;
39        -d | --ca-dir)
40            ca_dir=$VALUE
41            ;;
42        -p | --server_port)
43            server_port=$VALUE
44            ;;
45        -s | --skipupdate)
46            skip_update=true
47            ;;
48        -v | --verbose)
49            verbose=true
50            ;;
51        *)
52            echo "ERROR: unknown parameter \"$PARAM\""
53            help_menu
54            exit 1
55            ;;
56    esac
57    shift
58done
59
60command_exists(){
61    command -v "$@" > /dev/null 2>&1
62}
63
64
65
66set_up_ca_dir(){
67    verbose_out "Step 2: Set Up the CA Directory" &&
68    make-cadir "$ca_dir""openvpn-ca" &&
69    cd "$ca_dir""openvpn-ca"
70} &&
71
72configure_ca_vars(){
73    echo ' ' &&
74    verbose_out "Step 3: Configure the CA Variables" &&
75    printf "KEY_COUNTRY(eg: US): " &&
76    read KEY_COUNTRY &&
77    printf "KEY_PROVINCE (eg: NY): " &&
78    read KEY_PROVINCE &&
79    printf "KEY_CITY (eg: New York City): " &&
80    read KEY_CITY &&
81    printf "KEY_ORG (eg: WhitehatBlog): " &&
82    read KEY_ORG &&
83    printf "KEY_EMAIL (eg: admin@example.com): " &&
84    read KEY_EMAIL &&
85    printf "KEY_OU (eg: community): " &&
86    read KEY_OU &&
87    printf "KEY_NAME (eg: server): " &&
88    read KEY_NAME &&
89
90
91    sudo sed -i 's/export KEY_COUNTRY="US"/export KEY_COUNTRY="${KEY_COUNTRY}"/' vars &&
92    sudo sed -i 's/export KEY_PROVINCE="CA"/export KEY_PROVINCE="${KEY_PROVINCE}"/' vars &&
93    sudo sed -i 's/export KEY_CITY="SanFrancisco"/export KEY_CITY="${KEY_CITY}"/' vars &&
94    sudo sed -i 's/export KEY_ORG="Fort-Funston"/export KEY_ORG="${KEY_ORG}"/' vars &&
95    sudo sed -i 's/export KEY_EMAIL="me@myhost.mydomain"/export KEY_EMAIL="${KEY_EMAIL}"/' vars &&
96    sudo sed -i 's/export KEY_OU="MyOrganizationalUnit"/export KEY_OU="${KEY_OU}"/' vars &&
97    echo export KEY_NAME="${KEY_NAME}" >>vars
98
99}&&
100
101build_ca(){
102    verbose_out "Step 4: Build the Certificate Authority" &&
103    cd "$ca_dir""openvpn-ca" &&
104    source ./vars &&
105    ./clean-all &&
106    ./build-ca
107} &&
108
109create_server_cert_key_enc_files(){
110    verbose_out "Step 5: Create the Server Certificate, Key, and Encryption Files"
111    cd "$ca_dir""openvpn-ca" &&
112    ./build-key-server server &&
113    ./build-dh &&
114    openvpn --genkey --secret keys/ta.key
115} &&
116
117generate_client_cert_key_pair(){
118    verbose_out "Step 6: Generate a Client Certificate and Key Pair"
119    cd "$ca_dir""openvpn-ca" &&
120    source vars &&
121    printf "CLIENT_KEY_NAME (eg: client1): " &&
122    read CLIENT_KEY_NAME &&
123    ./build-key "$CLIENT_KEY_NAME"
124
125} &&
126configure_openvpn_service(){
127    verbose_out "Step 7: Configure the OpenVPN Service"
128    cd "$ca_dir""openvpn-ca/keys" &&
129    sudo cp ca.crt server.crt server.key ta.key dh2048.pem /etc/openvpn &&
130    verbose_out "Step 7.1: Unzipping server.conf.gz to /etc/openvpn/server.conf" &&
131    gunzip -c /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz | sudo tee /etc/openvpn/server.conf &&
132    sudo sed -i 's/This file is secret/& \nkey-direction 0 /' /etc/openvpn/server.conf &&
133    sudo sed -i 's/cipher AES-128-CBC/& \ncipher AES-128-CBC\nauth SHA256 /' /etc/openvpn/server.conf &&
134    sudo sed -i 's/user nobody/& \nuser nobody /' /etc/openvpn/server.conf &&
135    sudo sed -i 's/group nogroup/& \ngroup nogroup /' /etc/openvpn/server.conf
136
137} &&
138
139adjust_server_network_configuration(){
140    verbose_out "Step 8: Adjust the Server Networking Configuration"
141    verbose_out "Step 8.1: Allow IP Forwarding"
142    sudo sed -i 's/net.ipv4.ip_forward=1/& \nnet.ipv4.ip_forward=1 /' /etc/sysctl.conf &&
143    sudo sysctl -p &&
144    verbose_out "Step 8.2: Adjust the UFW Rules to Masquerade Client Connections" &&
145    def_int=$(ip route | grep default | cut -d' ' -f5) &&
146    verbose_out "Step 8.2: Detected default interface :$def_int" &&
147    OPENVPN_RULES="$(cat <<-EOF
148# START OPENVPN RULES\n
149# NAT table rules\n
150*nat\n
151:POSTROUTING ACCEPT [0:0]\n
152# Allow traffic from OpenVPN client to ${def_int}\n
153-A POSTROUTING -s 10.8.0.0.8 -o ${def_int} -j MASQUERADE\n
154COMMIT\n
155# END OPENVPN RULES\n
156EOF
157)"
158    sudo echo -e $OPENVPN_RULES > /tmp/before.rules &&
159    sudo cat /etc/ufw/before.rules >> /tmp/before.rules &&
160    sudo cp /tmp/before.rules /etc/ufw/before.rules &&
161    sudo rm /tmp/before.rules &&
162    verbose_out "Step 8.3: Adjusting UFW Rules for OpenVPN" &&
163    sudo sed -i 's/DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw &&
164    sudo ufw allow $server_port/udp &&
165    sudo ufw allow OpenSSH &&
166    verbose_out "Step 8.4: Reloading UFW with new Rules" &&
167    sudo ufw disable &&
168    sudo ufw enable
169
170
171} &&
172
173start_enable_openvpn_service(){
174    verbose_out "Step 9: Start and Enable the OpenVPN Service"
175    sudo systemctl start openvpn@server &&
176    sudo systemctl status openvpn@server &&
177    verbose_out "Checking whether tun0 interface is ready" &&
178    sudo ip addr show tun0 &&
179    verbose_out "Step 9.2 enabling openvpnserver to start on boot" &&
180    sudo systemctl enable openvpn@server
181
182} &&
183
184verbose_out(){
185    if [ "$verbose" = true ]
186    then
187        echo "$@"
188    fi
189
190} &&
191
192install(){
193    if [ "$skip_update" = false ]
194    then
195        verbose_out "Updating : command : sudo apt-get update -y " &&
196        sudo apt update -y
197    else
198        verbose_out  "Skipping update"
199    fi
200
201    verbose_out 'Checking if openvpn exists : ' &&
202
203    if ! command_exists openvpn
204    then
205        verbose_out 'openvpn not found , installing ' &&
206        sudo apt-get install openvpn &&
207        verbose_out 'openvpn has been installed successfully'
208    else
209        verbose_out 'Found openvpn.. Continuing'
210    fi &&
211    if ! command_exists easy-rsa
212    then
213        verbose_out 'easy-rsa not found , installing ' &&
214        sudo apt-get install easy-rsa &&
215        verbose_out 'easy-rsa has been installed successfully'
216    else
217        verbose_out 'Found easy-rsa.. Continuing'
218    fi &&
219
220    verbose_out 'Setting up CA Directory'
221    cwd=$(pwd) &&
222
223    if [ -d "$ca_dir""openvpn-ca" ]
224    then
225        verbose_out 'Skipping creating openvpn-ca directory. Already exists : '"$ca_dir""openvpn-ca"  &&
226        cd "$ca_dir""openvpn-ca"
227    else
228        set_up_ca_dir
229    fi &&
230
231    cwd=$(pwd) &&
232    if [ "$cwd" = "$ca_dir""openvpn-ca" ]
233    then
234        configure_ca_vars &&
235        build_ca &&
236        create_server_cert_key_enc_files &&
237        generate_client_cert_key_pair &&
238        configure_openvpn_service &&
239        adjust_server_network_configuration &&
240        start_enable_openvpn_service
241
242
243    fi
244
245}
246
247install