Compare commits

..

No commits in common. "8983e51896bcab6b5521efc8aacc6bad20798dd3" and "c206d33a724197dca185289daae6de384d46ee88" have entirely different histories.

4 changed files with 110 additions and 226 deletions

1
.gitignore vendored
View File

@ -23,4 +23,5 @@ downloads/
test/
tmp/
var/
*.conf
*.log

View File

@ -75,7 +75,7 @@ ____
## `ovpn-client-management`.sh
**Description:**
> Creating or deleting client config for openvpn and sending config and info to email/telegram.
> Creating or deleting client config for openvpn and sending config and info to email.
**Dependencies:**
>
@ -91,9 +91,8 @@ ____
|-----------|--------------|------------------------|---------------|
| 1 |**add\|del**|add or delete client config|**REQUIRED**|
| 2 |**\<username\>**|client username|**REQUIRED**|
| 3 |**\<password\>**|client password|**REQUIRED**|
| 4 |**\<additional\>**|client description||
| 5 |**[-f]**,**[--force]**|service will restart after username delete||
| 3 |**\<password\>**|client password||
| 4 |**[-f]**,**[--force]**|service will restart after username delete||
Example usage:
@ -103,22 +102,6 @@ sudo wget https://git.hmp.today/pavel.muhortov/openvpn-management/raw/branch/mas
sudo chmod +x /etc/openvpn/server/ovpn-client-management.sh
```
```bash
# edit ovpn-client-management.conf
sudo tee /etc/openvpn/server/ovpn-client-management.conf > /dev/null <<'EOF'
# sendmail configuration
from=user@host.zone
pass=password
dest=user@host.zone
smtp=smtp.host.zone
port=587
# telegram configuration
API_KEY=YOURAPIKEY
CHAT_ID=-100123456789
THRD_ID=123
EOF
```
```bash
# create link
ln -s /etc/openvpn/server/ovpn-client-management.sh ./ovpn

View File

@ -1,10 +0,0 @@
# sendmail configuration
from=user@host.zone
pass=password
dest=user@host.zone
smtp=smtp.host.zone
port=587
# telegram configuration
API_KEY=YOURAPIKEY
CHAT_ID=-100123456789
THRD_ID=123

View File

@ -3,7 +3,7 @@
# DESCRIPTION:
# creating or deleting client config for openvpn
# and
# sending config and info to email/telegram
# sending config and info to email
#
# DEPENDENCIES:
# - privileged rights
@ -18,7 +18,6 @@
# 1: "add|del" - add or delete client config
# 2: username - client username
# 3: password - client password
# 4: additional - client description
# -f|--force - service will restart after username delete
#
# FUNCTIONS:
@ -32,7 +31,7 @@
# 1: message to print and logging
#######################################
addtologs() {
printf "%s\n" "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
echo "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
}
#######################################
@ -44,11 +43,11 @@ addtologs() {
#######################################
execquite() {
addtologs "execution time is $(($(date +%s)-time)) seconds, exit"
exit "${1}"
exit
}
#######################################
# Error exit procedure.
# Error exit procedure
# Globals:
# None
# Arguments:
@ -56,37 +55,7 @@ execquite() {
#######################################
execerror() {
addtologs "error: $1"
execquite 1
}
#######################################
# Parsing config file and creating global vars.
# Globals:
# None
# Arguments:
# None
#######################################
getconfig() {
logs=/var/log/openvpn/$(basename -s .sh "$(realpath "$0")").log
conf="$(dirname "$(realpath "$0")")/$(basename -s .sh "$(realpath "$0")").conf"
# easyrsa configuration
easyrsadir="/etc/openvpn/easy-rsa"
easyrsaidx="${easyrsadir}/pki/index.txt"
easyrsaexe="${easyrsadir}/easyrsa"
easyrsavar="${easyrsadir}/vars"
easyrsacap="openvpnca"
ovpncfgdir="/etc/openvpn/client"
ovpncfgdef="${ovpncfgdir}/client.conf.default"
# mail configuration
from="$(grep "from=" "${conf}" | cut -d= -f2)"
pass="$(grep "pass=" "${conf}" | cut -d= -f2)"
dest="$(grep "dest=" "${conf}" | cut -d= -f2)"
smtp="$(grep "smtp=" "${conf}" | cut -d= -f2)"
port="$(grep "port=" "${conf}" | cut -d= -f2)"
# telegram configuration
API_KEY=$(grep "API_KEY=" "${conf}" | cut -d= -f2)
CHAT_ID=$(grep "CHAT_ID=" "${conf}" | cut -d= -f2)
THRD_ID=$(grep "THRD_ID=" "${conf}" | cut -d= -f2)
execquite
}
#######################################
@ -107,7 +76,7 @@ checkroot() {
}
#######################################
# Creating linux user.
# Creating linux user
# Globals:
# clientname
# clientpass
@ -115,18 +84,12 @@ checkroot() {
# None
#######################################
createuser() {
if ! id -u "${clientname}" >/dev/null 2>&1; then
useradd "${clientname}" --shell /sbin/nologin
addtologs "created Linux user '${clientname}'"
else
addtologs "${clientname} Linux user exists, create skipped"
fi
printf "%s\n" "${clientname}:${clientpass}" | chpasswd
addtologs "changed '${clientname}' user password"
echo "${clientname}:${clientpass}" | chpasswd
}
#######################################
# Creating Easy-RSA user certificate.
# Creating Easy-RSA user certificate
# Globals:
# easyrsadir
# easyrsavar
@ -139,22 +102,15 @@ createuser() {
#######################################
# shellcheck disable=SC2016
createcert() {
if ! grep -w "${clientname}" ${easyrsaidx} | grep "^V" > /dev/null 2>&1; then
(
cd "${easyrsadir}" || execerror ""
sed -i -e '$aset_var EASYRSA_REQ_CN '"${clientname}"'' "${easyrsavar}"
cd ${easyrsadir} || execerror ""
sed -i -e '$aset_var EASYRSA_REQ_CN '"${clientname}"'' ${easyrsavar}
# ${easyrsaexe} --passout=pass:"${clientpass}" --passin=pass:${easyrsacap} build-client-full "${clientname}"
${easyrsaexe} --passin=pass:"${easyrsacap}" build-client-full "${clientname}" nopass
sed -i '/EASYRSA_REQ_CN/d' "${easyrsavar}"
) > /dev/null 2>&1
addtologs "created ${clientname} easyrsa certificate"
else
addtologs "${clientname} certificate exists, create skipped"
fi
sed -i '/EASYRSA_REQ_CN/d' ${easyrsavar}
}
#######################################
# Creating ovpn config file.
# Creating ovpn config file
# Globals:
# easyrsadir
# ovpncfgdef
@ -164,19 +120,23 @@ createcert() {
# None
#######################################
createovpn() {
cd "${easyrsadir}" || execerror ""
cd ${easyrsadir} || execerror ""
{
cat "${ovpncfgdef}"
printf "%s\n" "<ca>" "$(cat "${easyrsadir}/pki/ca.crt")" "</ca>"
printf "%s\n" "<cert>" "$(cat "${easyrsadir}/pki/issued/${clientname}.crt")" "</cert>"
printf "%s\n" "<key>" "$(cat "${easyrsadir}/pki/private/${clientname}.key")" "</key>"
printf "%s\n" "<tls-auth>" "$(cat "${easyrsadir}/pki/private/ta.key")" "</tls-auth>"
echo -e '<ca>'
cat "${easyrsadir}/pki/ca.crt"
echo -e '</ca>\n<cert>'
cat "${easyrsadir}/pki/issued/${clientname}.crt"
echo -e '</cert>\n<key>'
cat "${easyrsadir}/pki/private/${clientname}.key"
echo -e '</key>\n<tls-auth>'
cat "${easyrsadir}/pki/private/ta.key"
echo -e '</tls-auth>'
} >> "${ovpncfgdir}/${clientname}.ovpn"
addtologs "created ${clientname} ovpn config file"
}
#######################################
# Creating tar with config file.
# Creating tar with config file
# Globals:
# easyrsadir
# clientname
@ -186,18 +146,17 @@ createovpn() {
#######################################
createtars() {
cp "${ovpncfgdir}/${clientname}.ovpn" "${ovpncfgdir}/vpn.cnf"
sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" "${ovpncfgdir}/vpn.cnf"
sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" ${ovpncfgdir}/vpn.cnf
{
printf "%s\n" "${clientname}"
printf "%s\n" "${clientpass}"
echo -e "${clientname}"
echo -e "${clientpass}"
} >> "${ovpncfgdir}/vpn.txt"
cd "${ovpncfgdir}" || execerror ""
cd ${ovpncfgdir} || execerror ""
tar cf "${clientname}.tar" --remove-files vpn.cnf vpn.txt
addtologs "created ${clientname} tar with config file"
}
#######################################
# Creating info file.
# Creating info file
# Globals:
# easyrsadir
# easyrsaexe
@ -207,35 +166,30 @@ createtars() {
# None
#######################################
createinfo() {
cd "${easyrsadir}" || execerror ""
cd ${easyrsadir} || execerror
validuntil=$(${easyrsaexe} show-cert "${clientname}" | grep "Not After" | cut -d: -f2-)
faqprofile=$(printf "%s\n" \
"OpenVPN Connect client:" \
"https://openvpn.net/client/" \
"OpenVPN GUI client:" \
"https://openvpn.net/community-downloads/" \
"" \
"${additional}" \
"" \
"User Login: \`${clientname}\`" \
"User Password: \`${clientpass}\`" \
"Time Expired: ${validuntil}"
faqprofile=$(cat <<END
OpenVPN Connect client and installation instructions:
https://openvpn.net/vpn-client/
OpenVPN GUI client:
https://openvpn.net/community-downloads/
User Login: ${clientname}
User Password: ${clientpass}
Time Expired: ${validuntil}
END
)
printf "%s\n" "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
addtologs "created ${clientname} info file"
echo -e "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
}
#######################################
# Send email notification about client config.
# Send email notification about client connect
# Globals:
# clientname
# faqprofile
# ovpncfgdir
# from
# pass
# dest
# smtp
# port
# Arguments:
# None
#######################################
@ -243,72 +197,33 @@ startsendmail() {
subj="[OVPN Settings] $(cat /etc/hostname): ${clientname}.ovpn client profile"
(
python3 /usr/local/bin/sendmail.py \
-u "${from}" \
-p "${pass}" \
-d "${dest}" \
--smtp "${smtp}" \
--port "${port}" \
-u "$(grep "from=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-p "$(grep "pass=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
-d "$(grep "dest=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
--smtp "$(grep "smtp=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
--port "$(grep "port=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
--stls "True" \
--subj "${subj}" \
--text "$(printf "%s\n" "${faqprofile}" | sed 's|`||g')" \
--file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar"
) > /dev/null 2>&1
addtologs "sent mail with subject '${subj}' to ${dest}"
--text "${faqprofile}" \
--file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar" \
>> /dev/null 2>&1 &
)
addtologs "sent mail with subject '${subj}'"
}
#######################################
# Send telegram notification about client config.
# Globals:
# clientname
# faqprofile
# ovpncfgdir
# API_KEY
# CHAT_ID
# THRD_ID
# Arguments:
# None
#######################################
# shellcheck disable=SC2030,2031
startsendtlgm() {
(
API_URL="https://api.telegram.org/bot${API_KEY}/sendMediaGroup?chat_id=${CHAT_ID}"
if grep -q "_" <<< "${CHAT_ID}"; then
THRD_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f2)
CHAT_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f1)
fi
if [ -n "${THRD_ID}" ]; then
API_URL="${API_URL}&message_thread_id=${THRD_ID}"
fi
curl "${API_URL}" \
-F "media=[{\"type\": \"document\", \"media\": \"attach://ovpn\", \"caption\": \"${faqprofile}\", \"parse_mode\": \"Markdown\"}, {\"type\": \"document\", \"media\": \"attach://tars\" }]" \
-F "ovpn=@${ovpncfgdir}/${clientname}.ovpn" \
-F "tars=@${ovpncfgdir}/${clientname}.tar"
) > /dev/null 2>&1
addtologs "sent telegram media with ${clientname}.ovpn client profile to ${CHAT_ID}"
}
#######################################
# Deleting linux user.
# Deleting linux user
# Globals:
# clientname
# Arguments:
# None
#######################################
deleteuser() {
if id -u "${clientname}" > /dev/null 2>&1; then
(
userdel -f -r "${clientname}"
) > /dev/null 2>&1
addtologs "deleted Linux user '${clientname}'"
else
addtologs "${clientname} Linux user does not exist, delete skipped"
fi
}
#######################################
# Deleting Easy-RSA user certificate.
# Deleting Easy-RSA user certificate
# Globals:
# easyrsadir
# easyrsavar
@ -319,20 +234,13 @@ deleteuser() {
# None
#######################################
deletecert() {
if grep -w "${clientname}" ${easyrsaidx} > /dev/null 2>&1; then
(
cd "${easyrsadir}" || execerror
${easyrsaexe} --batch --passin=pass:"${easyrsacap}" revoke "${clientname}"
${easyrsaexe} --batch --passin=pass:"${easyrsacap}" gen-crl
) > /dev/null 2>&1
addtologs "revoked ${clientname} easyrsa certificate"
else
addtologs "${clientname} certificate does not exist, revoke skipped"
fi
cd ${easyrsadir} || execerror
${easyrsaexe} --batch --passin=pass:${easyrsacap} revoke "${clientname}"
${easyrsaexe} --batch --passin=pass:${easyrsacap} gen-crl
}
#######################################
# Deleting ovpn config file.
# Deleting ovpn config file
# Globals:
# clientname
# ovpncfgdir
@ -340,16 +248,11 @@ deletecert() {
# None
#######################################
deleteovpn() {
if [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
rm -f "${ovpncfgdir}/${clientname}.ovpn"
addtologs "deleted ${clientname} ovpn config file"
else
addtologs "${clientname} ovpn config does not exist, delete skipped"
fi
}
#######################################
# Deleting tar with config file.
# Deleting tar with config file
# Globals:
# clientname
# ovpncfgdir
@ -357,16 +260,11 @@ deleteovpn() {
# None
#######################################
deletetars() {
if [ -e "${ovpncfgdir}/${clientname}.tar" ]; then
rm -f "${ovpncfgdir}/${clientname}.tar"
addtologs "deleted ${clientname} tar with config"
else
addtologs "${clientname} tar does not exist, delete skipped"
fi
}
#######################################
# Deleting info file.
# Deleting info file
# Globals:
# clientname
# ovpncfgdir
@ -374,22 +272,24 @@ deletetars() {
# None
#######################################
deleteinfo() {
if [ -e "${ovpncfgdir}/${clientname}.info" ]; then
rm -f "${ovpncfgdir}/${clientname}.info"
addtologs "deleted ${clientname} info file"
else
addtologs "${clientname} info file does not exist, delete skipped"
fi
}
#
# VARIABLES:
#
easyrsadir="/etc/openvpn/easy-rsa"
easyrsaidx="${easyrsadir}/pki/index.txt"
easyrsaexe="${easyrsadir}/easyrsa"
easyrsavar="${easyrsadir}/vars"
easyrsacap="openvpnca"
ovpncfgdir="/etc/openvpn/client"
ovpncfgdef="${ovpncfgdir}/client.conf.default"
clienttodo=$1
clientname=$2
clientpass=$3
additional=$4
resetforce=0
for argument in "${@}"; do
@ -410,35 +310,45 @@ logs=/dev/null
#
if checkroot; then
getconfig
logs=/var/log/openvpn/$(basename -s .sh "$0").log
if [ "${clienttodo}" == "add" ] && \
[ -n "${clientname}" ] && \
[ "${#clientpass}" -ge 8 ]; then
createuser
createcert
createovpn
createtars
createinfo
if id -u "${clientname}" >/dev/null 2>&1 || \
grep -w "${clientname}" ${easyrsaidx} || \
[ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
execerror "linux user or certificate or ovpn config exist, exit"
else
createuser && addtologs "created Linux user '${clientname}'"
createcert && addtologs "created certificate for ${clientname}"
createovpn && addtologs "created ovpn config file for ${clientname}"
createtars && addtologs "created tar with config file for ${clientname}"
createinfo && addtologs "created info file for ${clientname}"
startsendmail
startsendtlgm
elif [ "${clienttodo}" == "del" ] && \
[ -n "${clientname}" ]; then
fi
elif [ "${clienttodo}" == "del" ] && [ -n "${clientname}" ]; then
if id -u "${clientname}" >/dev/null 2>&1 || \
grep -w "${clientname}" ${easyrsaidx} || \
[ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
deleteuser
deletecert
deleteovpn
deletetars
deleteinfo
addtologs "deleted Linux user '${clientname}'"
deletecert && addtologs "deleted certificate for ${clientname}"
deleteovpn && addtologs "deleted ovpn config file for ${clientname}"
deletetars && addtologs "deleted tar with config file for ${clientname}"
deleteinfo && addtologs "deleted info file for ${clientname}"
if [ "${resetforce}" -eq 1 ];then
addtologs "restarting openvpn@server..."
systemctl restart openvpn@server
fi
else
execerror "linux user and certificate and ovpn config not exist, exit"
fi
else
printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)'"
printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)' 'additional client description'"
printf "%s\n" "Usage example: $0 'del' 'username(surname)'"
printf "%s\n" "Usage example: $0 'del' 'username(surname)' -f"
fi
else
execerror "Restart this as root!"
fi
execquite 0
execquite