.gitignore

@@ -23,4 +23,5 @@ downloads/
 test/
 tmp/
 var/
+*.conf
 *.log

README.md

@@ -75,7 +75,7 @@ ____
 ## `ovpn-client-management`.sh
 
 **Description:**  
-> Creating or deleting client config for openvpn and sending config and info to email/telegram.  
+> Creating or deleting client config for openvpn and sending config and info to email.  
 
 **Dependencies:**  
 >
@@ -91,9 +91,8 @@ ____
 |-----------|--------------|------------------------|---------------|
 |     1     |**add\|del**|add or delete client config|**REQUIRED**|
 |     2     |**\<username\>**|client username|**REQUIRED**|
-|     3     |**\<password\>**|client password|**REQUIRED**|
+|     3     |**\<password\>**|client password||
-|     4     |**\<additional\>**|client description||
+|     4     |**[-f]**,**[--force]**|service will restart after username delete||
-|     5     |**[-f]**,**[--force]**|service will restart after username delete||
 
 Example usage:  
 
@@ -103,22 +102,6 @@ sudo wget https://git.hmp.today/pavel.muhortov/openvpn-management/raw/branch/mas
 sudo chmod +x /etc/openvpn/server/ovpn-client-management.sh
 ```
 
-```bash
-# edit ovpn-client-management.conf
-sudo tee /etc/openvpn/server/ovpn-client-management.conf > /dev/null <<'EOF'
-# sendmail configuration
-from=user@host.zone
-pass=password
-dest=user@host.zone
-smtp=smtp.host.zone
-port=587
-# telegram configuration
-API_KEY=YOURAPIKEY
-CHAT_ID=-100123456789
-THRD_ID=123
-EOF
-```
-
 ```bash
 # create link
 ln -s /etc/openvpn/server/ovpn-client-management.sh ./ovpn

ovpn-client-management.conf

@@ -1,10 +0,0 @@
-# sendmail configuration
-from=user@host.zone
-pass=password
-dest=user@host.zone
-smtp=smtp.host.zone
-port=587
-# telegram configuration
-API_KEY=YOURAPIKEY
-CHAT_ID=-100123456789
-THRD_ID=123

ovpn-client-management.sh

@@ -3,7 +3,7 @@
 # DESCRIPTION:
 #   creating or deleting client config for openvpn
 #   and
-#   sending config and info to email/telegram
+#   sending config and info to email
 #
 # DEPENDENCIES:
 #   - privileged rights
@@ -18,7 +18,6 @@
 #   1: "add|del" - add or delete client config
 #   2: username - client username
 #   3: password - client password
-#   4: additional - client description
 #   -f|--force - service will restart after username delete
 #
 # FUNCTIONS:
@@ -32,7 +31,7 @@
 #   1: message to print and logging
 #######################################
 addtologs() {
-  printf "%s\n" "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
+  echo "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
 }
 
 #######################################
@@ -44,11 +43,11 @@ addtologs() {
 #######################################
 execquite() {
   addtologs "execution time is $(($(date +%s)-time)) seconds, exit"
-  exit "${1}"
+  exit
 }
 
 #######################################
-# Error exit procedure.
+# Error exit procedure
 # Globals:
 #   None
 # Arguments:
@@ -56,37 +55,7 @@ execquite() {
 #######################################
 execerror() {
   addtologs "error: $1"
-  execquite 1
+  execquite
-}
-
-#######################################
-# Parsing config file and creating global vars.
-# Globals:
-#   None
-# Arguments:
-#   None
-#######################################
-getconfig() {
-  logs=/var/log/openvpn/$(basename -s .sh "$(realpath "$0")").log
-  conf="$(dirname "$(realpath "$0")")/$(basename -s .sh "$(realpath "$0")").conf"
-  # easyrsa configuration
-  easyrsadir="/etc/openvpn/easy-rsa"
-  easyrsaidx="${easyrsadir}/pki/index.txt"
-  easyrsaexe="${easyrsadir}/easyrsa"
-  easyrsavar="${easyrsadir}/vars"
-  easyrsacap="openvpnca"
-  ovpncfgdir="/etc/openvpn/client"
-  ovpncfgdef="${ovpncfgdir}/client.conf.default"
-  # mail configuration
-  from="$(grep "from=" "${conf}" | cut -d= -f2)"
-  pass="$(grep "pass=" "${conf}" | cut -d= -f2)"
-  dest="$(grep "dest=" "${conf}" | cut -d= -f2)"
-  smtp="$(grep "smtp=" "${conf}" | cut -d= -f2)"
-  port="$(grep "port=" "${conf}" | cut -d= -f2)"
-  # telegram configuration
-  API_KEY=$(grep "API_KEY=" "${conf}" | cut -d= -f2)
-  CHAT_ID=$(grep "CHAT_ID=" "${conf}" | cut -d= -f2)
-  THRD_ID=$(grep "THRD_ID=" "${conf}" | cut -d= -f2)
 }
 
 #######################################
@@ -107,7 +76,7 @@ checkroot() {
 }
 
 #######################################
-# Creating linux user.
+# Creating linux user
 # Globals:
 #   clientname
 #   clientpass
@@ -115,18 +84,12 @@ checkroot() {
 #   None
 #######################################
 createuser() {
-  if ! id -u "${clientname}" >/dev/null 2>&1; then
+  useradd "${clientname}" --shell /sbin/nologin
-    useradd "${clientname}" --shell /sbin/nologin
+  echo "${clientname}:${clientpass}" | chpasswd
-    addtologs "created Linux user '${clientname}'"
-  else
-    addtologs "${clientname} Linux user exists, create skipped"
-  fi
-  printf "%s\n" "${clientname}:${clientpass}" | chpasswd
-  addtologs "changed '${clientname}' user password"
 }
 
 #######################################
-# Creating Easy-RSA user certificate.
+# Creating Easy-RSA user certificate
 # Globals:
 #   easyrsadir
 #   easyrsavar
@@ -139,22 +102,15 @@ createuser() {
 #######################################
 # shellcheck disable=SC2016
 createcert() {
-  if ! grep -w "${clientname}" ${easyrsaidx} | grep "^V" > /dev/null 2>&1; then
+    cd ${easyrsadir} || execerror ""
-    (
+    sed -i -e '$aset_var EASYRSA_REQ_CN         '"${clientname}"'' ${easyrsavar}
-      cd "${easyrsadir}" || execerror ""
+    # ${easyrsaexe} --passout=pass:"${clientpass}" --passin=pass:${easyrsacap} build-client-full "${clientname}"
-      sed -i -e '$aset_var EASYRSA_REQ_CN         '"${clientname}"'' "${easyrsavar}"
+    ${easyrsaexe} --passin=pass:"${easyrsacap}" build-client-full "${clientname}" nopass
-      # ${easyrsaexe} --passout=pass:"${clientpass}" --passin=pass:${easyrsacap} build-client-full "${clientname}"
+    sed -i '/EASYRSA_REQ_CN/d' ${easyrsavar}
-      ${easyrsaexe} --passin=pass:"${easyrsacap}" build-client-full "${clientname}" nopass
-      sed -i '/EASYRSA_REQ_CN/d' "${easyrsavar}"
-    ) > /dev/null 2>&1
-    addtologs "created ${clientname} easyrsa certificate"
-  else
-    addtologs "${clientname} certificate exists, create skipped"
-  fi
 }
 
 #######################################
-# Creating ovpn config file.
+# Creating ovpn config file
 # Globals:
 #   easyrsadir
 #   ovpncfgdef
@@ -164,19 +120,23 @@ createcert() {
 #   None
 #######################################
 createovpn() {
-  cd "${easyrsadir}" || execerror ""
+  cd ${easyrsadir} || execerror ""
   {
     cat "${ovpncfgdef}"
-    printf "%s\n" "<ca>" "$(cat "${easyrsadir}/pki/ca.crt")" "</ca>"
+    echo -e '<ca>'
-    printf "%s\n" "<cert>" "$(cat "${easyrsadir}/pki/issued/${clientname}.crt")" "</cert>"
+    cat "${easyrsadir}/pki/ca.crt"
-    printf "%s\n" "<key>" "$(cat "${easyrsadir}/pki/private/${clientname}.key")" "</key>"
+    echo -e '</ca>\n<cert>'
-    printf "%s\n" "<tls-auth>" "$(cat "${easyrsadir}/pki/private/ta.key")" "</tls-auth>"
+    cat "${easyrsadir}/pki/issued/${clientname}.crt"
+    echo -e '</cert>\n<key>'
+    cat "${easyrsadir}/pki/private/${clientname}.key"
+    echo -e '</key>\n<tls-auth>'
+    cat "${easyrsadir}/pki/private/ta.key"
+    echo -e '</tls-auth>'
   } >> "${ovpncfgdir}/${clientname}.ovpn"
-  addtologs "created ${clientname} ovpn config file"
 }
 
 #######################################
-# Creating tar with config file.
+# Creating tar with config file
 # Globals:
 #   easyrsadir
 #   clientname
@@ -186,18 +146,17 @@ createovpn() {
 #######################################
 createtars() {
   cp "${ovpncfgdir}/${clientname}.ovpn" "${ovpncfgdir}/vpn.cnf"
-  sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" "${ovpncfgdir}/vpn.cnf"
+  sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" ${ovpncfgdir}/vpn.cnf
   {
-    printf "%s\n" "${clientname}"
+    echo -e "${clientname}"
-    printf "%s\n" "${clientpass}"
+    echo -e "${clientpass}"
   } >> "${ovpncfgdir}/vpn.txt"
-  cd "${ovpncfgdir}" || execerror ""
+  cd ${ovpncfgdir} || execerror ""
   tar cf "${clientname}.tar" --remove-files vpn.cnf vpn.txt
-  addtologs "created ${clientname} tar with config file"
 }
 
 #######################################
-# Creating info file.
+# Creating info file
 # Globals:
 #   easyrsadir
 #   easyrsaexe
@@ -207,35 +166,30 @@ createtars() {
 #   None
 #######################################
 createinfo() {
-  cd "${easyrsadir}" || execerror ""
+  cd ${easyrsadir} || execerror
   validuntil=$(${easyrsaexe} show-cert "${clientname}" | grep "Not After" | cut -d: -f2-)
-  faqprofile=$(printf "%s\n" \
+
-    "OpenVPN Connect client:" \
+faqprofile=$(cat <<END
-    "https://openvpn.net/client/" \
+OpenVPN Connect client and installation instructions:
-    "OpenVPN GUI client:" \
+https://openvpn.net/vpn-client/
-    "https://openvpn.net/community-downloads/" \
+OpenVPN GUI client:
-    "" \
+https://openvpn.net/community-downloads/
-    "${additional}" \
+
-    "" \
+User Login: ${clientname}
-    "User Login: \`${clientname}\`" \
+User Password: ${clientpass}
-    "User Password: \`${clientpass}\`" \
+Time Expired: ${validuntil}
-    "Time Expired: ${validuntil}"
+END
-  )
+)
-  printf "%s\n" "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
+
-  addtologs "created ${clientname} info file"
+  echo -e "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
 }
 
 #######################################
-# Send email notification about client config.
+# Send email notification about client connect
 # Globals:
 #   clientname
 #   faqprofile
 #   ovpncfgdir
-#   from
-#   pass
-#   dest
-#   smtp
-#   port
 # Arguments:
 #   None
 #######################################
@@ -243,72 +197,33 @@ startsendmail() {
   subj="[OVPN Settings] $(cat /etc/hostname): ${clientname}.ovpn client profile"
   (
     python3 /usr/local/bin/sendmail.py \
-    -u "${from}" \
+    -u "$(grep "from=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-    -p "${pass}" \
+    -p "$(grep "pass=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-    -d "${dest}" \
+    -d "$(grep "dest=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-    --smtp "${smtp}" \
+    --smtp "$(grep "smtp=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-    --port "${port}" \
+    --port "$(grep "port=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
     --stls "True" \
     --subj "${subj}" \
-    --text "$(printf "%s\n" "${faqprofile}" | sed 's|`||g')" \
+    --text "${faqprofile}" \
-    --file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar"
+    --file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar" \
-  ) > /dev/null 2>&1
+    >> /dev/null 2>&1 &
-  addtologs "sent mail with subject '${subj}' to ${dest}"
+  )
+  addtologs "sent mail with subject '${subj}'"
 }
 
 #######################################
-# Send telegram notification about client config.
+# Deleting linux user
-# Globals:
-#   clientname
-#   faqprofile
-#   ovpncfgdir
-#   API_KEY
-#   CHAT_ID
-#   THRD_ID
-# Arguments:
-#   None
-#######################################
-# shellcheck disable=SC2030,2031
-startsendtlgm() {
-  (
-    API_URL="https://api.telegram.org/bot${API_KEY}/sendMediaGroup?chat_id=${CHAT_ID}"
-
-    if grep -q "_" <<< "${CHAT_ID}"; then
-      THRD_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f2)
-      CHAT_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f1)
-    fi
-    if [ -n "${THRD_ID}" ]; then
-      API_URL="${API_URL}&message_thread_id=${THRD_ID}"
-    fi
-
-    curl "${API_URL}" \
-         -F "media=[{\"type\": \"document\", \"media\": \"attach://ovpn\", \"caption\": \"${faqprofile}\", \"parse_mode\": \"Markdown\"}, {\"type\": \"document\", \"media\": \"attach://tars\" }]" \
-         -F "ovpn=@${ovpncfgdir}/${clientname}.ovpn" \
-         -F "tars=@${ovpncfgdir}/${clientname}.tar"
-  ) > /dev/null 2>&1
-  addtologs "sent telegram media with ${clientname}.ovpn client profile to ${CHAT_ID}"
-}
-
-#######################################
-# Deleting linux user.
 # Globals:
 #   clientname
 # Arguments:
 #   None
 #######################################
 deleteuser() {
-  if id -u "${clientname}" > /dev/null 2>&1; then
+  userdel -f -r "${clientname}"
-    (
-      userdel -f -r "${clientname}"
-    ) > /dev/null 2>&1
-    addtologs "deleted Linux user '${clientname}'"
-  else
-    addtologs "${clientname} Linux user does not exist, delete skipped"
-  fi
 }
 
 #######################################
-# Deleting Easy-RSA user certificate.
+# Deleting Easy-RSA user certificate
 # Globals:
 #   easyrsadir
 #   easyrsavar
@@ -319,20 +234,13 @@ deleteuser() {
 #   None
 #######################################
 deletecert() {
-  if grep -w "${clientname}" ${easyrsaidx} > /dev/null 2>&1; then
+    cd ${easyrsadir} || execerror
-    (
+    ${easyrsaexe} --batch --passin=pass:${easyrsacap} revoke "${clientname}"
-      cd "${easyrsadir}" || execerror
+    ${easyrsaexe} --batch --passin=pass:${easyrsacap} gen-crl
-      ${easyrsaexe} --batch --passin=pass:"${easyrsacap}" revoke "${clientname}"
-      ${easyrsaexe} --batch --passin=pass:"${easyrsacap}" gen-crl
-    ) > /dev/null 2>&1
-    addtologs "revoked ${clientname} easyrsa certificate"
-  else
-    addtologs "${clientname} certificate does not exist, revoke skipped"
-  fi
 }
 
 #######################################
-# Deleting ovpn config file.
+# Deleting ovpn config file
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -340,16 +248,11 @@ deletecert() {
 #   None
 #######################################
 deleteovpn() {
-  if [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
     rm -f "${ovpncfgdir}/${clientname}.ovpn"
-    addtologs "deleted ${clientname} ovpn config file"
-  else
-    addtologs "${clientname} ovpn config does not exist, delete skipped"
-  fi
 }
 
 #######################################
-# Deleting tar with config file.
+# Deleting tar with config file
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -357,16 +260,11 @@ deleteovpn() {
 #   None
 #######################################
 deletetars() {
-  if [ -e "${ovpncfgdir}/${clientname}.tar" ]; then
+  rm -f "${ovpncfgdir}/${clientname}.tar"
-    rm -f "${ovpncfgdir}/${clientname}.tar"
-    addtologs "deleted ${clientname} tar with config"
-  else
-    addtologs "${clientname} tar does not exist, delete skipped"
-  fi
 }
 
 #######################################
-# Deleting info file.
+# Deleting info file
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -374,22 +272,24 @@ deletetars() {
 #   None
 #######################################
 deleteinfo() {
-  if [ -e "${ovpncfgdir}/${clientname}.info" ]; then
+  rm -f "${ovpncfgdir}/${clientname}.info"
-    rm -f "${ovpncfgdir}/${clientname}.info"
-    addtologs "deleted ${clientname} info file"
-  else
-    addtologs "${clientname} info file does not exist, delete skipped"
-  fi
 }
 
 #
 # VARIABLES:
 #
 
+easyrsadir="/etc/openvpn/easy-rsa"
+easyrsaidx="${easyrsadir}/pki/index.txt"
+easyrsaexe="${easyrsadir}/easyrsa"
+easyrsavar="${easyrsadir}/vars"
+easyrsacap="openvpnca"
+ovpncfgdir="/etc/openvpn/client"
+ovpncfgdef="${ovpncfgdir}/client.conf.default"
+
 clienttodo=$1
 clientname=$2
 clientpass=$3
-additional=$4
 
 resetforce=0
 for argument in "${@}"; do
@@ -410,35 +310,45 @@ logs=/dev/null
 #
 
 if checkroot; then
-  getconfig
+  logs=/var/log/openvpn/$(basename -s .sh "$0").log
   if [ "${clienttodo}" == "add" ] && \
      [ -n "${clientname}" ] && \
      [ "${#clientpass}" -ge 8 ]; then
-    createuser
+    if id -u "${clientname}" >/dev/null 2>&1 || \
-    createcert
+       grep -w "${clientname}" ${easyrsaidx} || \
-    createovpn
+       [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
-    createtars
+      execerror "linux user or certificate or ovpn config exist, exit"
-    createinfo
+    else
-    startsendmail
+      createuser && addtologs "created Linux user '${clientname}'"
-    startsendtlgm
+      createcert && addtologs "created certificate for ${clientname}"
-  elif [ "${clienttodo}" == "del" ] && \
+      createovpn && addtologs "created ovpn config file for ${clientname}"
-       [ -n "${clientname}" ]; then
+      createtars && addtologs "created tar with config file for ${clientname}"
-    deleteuser
+      createinfo && addtologs "created info file for ${clientname}"
-    deletecert
+      startsendmail
-    deleteovpn
+    fi
-    deletetars
+  elif [ "${clienttodo}" == "del" ] && [ -n "${clientname}" ]; then
-    deleteinfo
+    if id -u "${clientname}" >/dev/null 2>&1 || \
-    if [ "${resetforce}" -eq 1 ];then
+       grep -w "${clientname}" ${easyrsaidx} || \
-      addtologs "restarting openvpn@server..."
+       [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
-      systemctl restart openvpn@server
+      deleteuser
+      addtologs "deleted Linux user '${clientname}'"
+      deletecert && addtologs "deleted certificate for ${clientname}"
+      deleteovpn && addtologs "deleted ovpn config file for ${clientname}"
+      deletetars && addtologs "deleted tar with config file for ${clientname}"
+      deleteinfo && addtologs "deleted info file for ${clientname}"
+      if [ "${resetforce}" -eq 1 ];then
+        addtologs "restarting openvpn@server..."
+        systemctl restart openvpn@server
+      fi
+    else
+      execerror "linux user and certificate and ovpn config not exist, exit"
     fi
   else
     printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)'"
-    printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)' 'additional client description'"
     printf "%s\n" "Usage example: $0 'del' 'username(surname)'"
     printf "%s\n" "Usage example: $0 'del' 'username(surname)' -f"
   fi
 else
   execerror "Restart this as root!"
 fi
-execquite 0
+execquite