added ovpn-client-management.conf

.gitignore

@@ -23,5 +23,4 @@ downloads/
 test/
 tmp/
 var/
-*.conf
 *.log

README.md

@@ -75,7 +75,7 @@ ____
 ## `ovpn-client-management`.sh
 
 **Description:**  
-> Creating or deleting client config for openvpn and sending config and info to email.  
+> Creating or deleting client config for openvpn and sending config and info to email/telegram.  
 
 **Dependencies:**  
 >
@@ -91,8 +91,9 @@ ____
 |-----------|--------------|------------------------|---------------|
 |     1     |**add\|del**|add or delete client config|**REQUIRED**|
 |     2     |**\<username\>**|client username|**REQUIRED**|
-|     3     |**\<password\>**|client password||
+|     3     |**\<password\>**|client password|**REQUIRED**|
-|     4     |**[-f]**,**[--force]**|service will restart after username delete||
+|     4     |**\<additional\>**|client description||
+|     5     |**[-f]**,**[--force]**|service will restart after username delete||
 
 Example usage:  
 
@@ -102,6 +103,22 @@ sudo wget https://git.hmp.today/pavel.muhortov/openvpn-management/raw/branch/mas
 sudo chmod +x /etc/openvpn/server/ovpn-client-management.sh
 ```
 
+```bash
+# edit ovpn-client-management.conf
+sudo tee /etc/openvpn/server/ovpn-client-management.conf > /dev/null <<'EOF'
+# sendmail configuration
+from=user@host.zone
+pass=password
+dest=user@host.zone
+smtp=smtp.host.zone
+port=587
+# telegram configuration
+API_KEY=YOURAPIKEY
+CHAT_ID=-100123456789
+THRD_ID=123
+EOF
+```
+
 ```bash
 # create link
 ln -s /etc/openvpn/server/ovpn-client-management.sh ./ovpn

ovpn-client-management.conf

@@ -0,0 +1,10 @@
+# sendmail configuration
+from=user@host.zone
+pass=password
+dest=user@host.zone
+smtp=smtp.host.zone
+port=587
+# telegram configuration
+API_KEY=YOURAPIKEY
+CHAT_ID=-100123456789
+THRD_ID=123

ovpn-client-management.sh

@@ -3,7 +3,7 @@
 # DESCRIPTION:
 #   creating or deleting client config for openvpn
 #   and
-#   sending config and info to email
+#   sending config and info to email/telegram
 #
 # DEPENDENCIES:
 #   - privileged rights
@@ -18,6 +18,7 @@
 #   1: "add|del" - add or delete client config
 #   2: username - client username
 #   3: password - client password
+#   4: additional - client description
 #   -f|--force - service will restart after username delete
 #
 # FUNCTIONS:
@@ -31,7 +32,7 @@
 #   1: message to print and logging
 #######################################
 addtologs() {
-  echo "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
+  printf "%s\n" "$(date +'%Y.%m.%d-%H:%M:%S') $1" | tee -a "${logs}"
 }
 
 #######################################
@@ -43,11 +44,11 @@ addtologs() {
 #######################################
 execquite() {
   addtologs "execution time is $(($(date +%s)-time)) seconds, exit"
-  exit
+  exit "${1}"
 }
 
 #######################################
-# Error exit procedure
+# Error exit procedure.
 # Globals:
 #   None
 # Arguments:
@@ -55,7 +56,37 @@ execquite() {
 #######################################
 execerror() {
   addtologs "error: $1"
-  execquite
+  execquite 1
+}
+
+#######################################
+# Parsing config file and creating global vars.
+# Globals:
+#   None
+# Arguments:
+#   None
+#######################################
+getconfig() {
+  logs=/var/log/openvpn/$(basename -s .sh "$(realpath "$0")").log
+  conf="$(dirname "$(realpath "$0")")/$(basename -s .sh "$(realpath "$0")").conf"
+  # easyrsa configuration
+  easyrsadir="/etc/openvpn/easy-rsa"
+  easyrsaidx="${easyrsadir}/pki/index.txt"
+  easyrsaexe="${easyrsadir}/easyrsa"
+  easyrsavar="${easyrsadir}/vars"
+  easyrsacap="openvpnca"
+  ovpncfgdir="/etc/openvpn/client"
+  ovpncfgdef="${ovpncfgdir}/client.conf.default"
+  # mail configuration
+  from="$(grep "from=" "${conf}" | cut -d= -f2)"
+  pass="$(grep "pass=" "${conf}" | cut -d= -f2)"
+  dest="$(grep "dest=" "${conf}" | cut -d= -f2)"
+  smtp="$(grep "smtp=" "${conf}" | cut -d= -f2)"
+  port="$(grep "port=" "${conf}" | cut -d= -f2)"
+  # telegram configuration
+  API_KEY=$(grep "API_KEY=" "${conf}" | cut -d= -f2)
+  CHAT_ID=$(grep "CHAT_ID=" "${conf}" | cut -d= -f2)
+  THRD_ID=$(grep "THRD_ID=" "${conf}" | cut -d= -f2)
 }
 
 #######################################
@@ -76,7 +107,7 @@ checkroot() {
 }
 
 #######################################
-# Creating linux user
+# Creating linux user.
 # Globals:
 #   clientname
 #   clientpass
@@ -84,12 +115,18 @@ checkroot() {
 #   None
 #######################################
 createuser() {
+  if ! id -u "${clientname}" >/dev/null 2>&1; then
     useradd "${clientname}" --shell /sbin/nologin
-  echo "${clientname}:${clientpass}" | chpasswd
+    addtologs "created Linux user '${clientname}'"
+  else
+    addtologs "${clientname} Linux user exists, create skipped"
+  fi
+  printf "%s\n" "${clientname}:${clientpass}" | chpasswd
+  addtologs "changed '${clientname}' user password"
 }
 
 #######################################
-# Creating Easy-RSA user certificate
+# Creating Easy-RSA user certificate.
 # Globals:
 #   easyrsadir
 #   easyrsavar
@@ -102,15 +139,22 @@ createuser() {
 #######################################
 # shellcheck disable=SC2016
 createcert() {
-    cd ${easyrsadir} || execerror ""
+  if ! grep -w "${clientname}" ${easyrsaidx} | grep "^V" > /dev/null 2>&1; then
-    sed -i -e '$aset_var EASYRSA_REQ_CN         '"${clientname}"'' ${easyrsavar}
+    (
+      cd "${easyrsadir}" || execerror ""
+      sed -i -e '$aset_var EASYRSA_REQ_CN         '"${clientname}"'' "${easyrsavar}"
       # ${easyrsaexe} --passout=pass:"${clientpass}" --passin=pass:${easyrsacap} build-client-full "${clientname}"
       ${easyrsaexe} --passin=pass:"${easyrsacap}" build-client-full "${clientname}" nopass
-    sed -i '/EASYRSA_REQ_CN/d' ${easyrsavar}
+      sed -i '/EASYRSA_REQ_CN/d' "${easyrsavar}"
+    ) > /dev/null 2>&1
+    addtologs "created ${clientname} easyrsa certificate"
+  else
+    addtologs "${clientname} certificate exists, create skipped"
+  fi
 }
 
 #######################################
-# Creating ovpn config file
+# Creating ovpn config file.
 # Globals:
 #   easyrsadir
 #   ovpncfgdef
@@ -120,23 +164,19 @@ createcert() {
 #   None
 #######################################
 createovpn() {
-  cd ${easyrsadir} || execerror ""
+  cd "${easyrsadir}" || execerror ""
   {
     cat "${ovpncfgdef}"
-    echo -e '<ca>'
+    printf "%s\n" "<ca>" "$(cat "${easyrsadir}/pki/ca.crt")" "</ca>"
-    cat "${easyrsadir}/pki/ca.crt"
+    printf "%s\n" "<cert>" "$(cat "${easyrsadir}/pki/issued/${clientname}.crt")" "</cert>"
-    echo -e '</ca>\n<cert>'
+    printf "%s\n" "<key>" "$(cat "${easyrsadir}/pki/private/${clientname}.key")" "</key>"
-    cat "${easyrsadir}/pki/issued/${clientname}.crt"
+    printf "%s\n" "<tls-auth>" "$(cat "${easyrsadir}/pki/private/ta.key")" "</tls-auth>"
-    echo -e '</cert>\n<key>'
-    cat "${easyrsadir}/pki/private/${clientname}.key"
-    echo -e '</key>\n<tls-auth>'
-    cat "${easyrsadir}/pki/private/ta.key"
-    echo -e '</tls-auth>'
   } >> "${ovpncfgdir}/${clientname}.ovpn"
+  addtologs "created ${clientname} ovpn config file"
 }
 
 #######################################
-# Creating tar with config file
+# Creating tar with config file.
 # Globals:
 #   easyrsadir
 #   clientname
@@ -146,17 +186,18 @@ createovpn() {
 #######################################
 createtars() {
   cp "${ovpncfgdir}/${clientname}.ovpn" "${ovpncfgdir}/vpn.cnf"
-  sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" ${ovpncfgdir}/vpn.cnf
+  sed -i "s#auth-user-pass#auth-user-pass /config/openvpn/vpn.txt#g" "${ovpncfgdir}/vpn.cnf"
   {
-    echo -e "${clientname}"
+    printf "%s\n" "${clientname}"
-    echo -e "${clientpass}"
+    printf "%s\n" "${clientpass}"
   } >> "${ovpncfgdir}/vpn.txt"
-  cd ${ovpncfgdir} || execerror ""
+  cd "${ovpncfgdir}" || execerror ""
   tar cf "${clientname}.tar" --remove-files vpn.cnf vpn.txt
+  addtologs "created ${clientname} tar with config file"
 }
 
 #######################################
-# Creating info file
+# Creating info file.
 # Globals:
 #   easyrsadir
 #   easyrsaexe
@@ -166,30 +207,35 @@ createtars() {
 #   None
 #######################################
 createinfo() {
-  cd ${easyrsadir} || execerror
+  cd "${easyrsadir}" || execerror ""
   validuntil=$(${easyrsaexe} show-cert "${clientname}" | grep "Not After" | cut -d: -f2-)
-
+  faqprofile=$(printf "%s\n" \
-faqprofile=$(cat <<END
+    "OpenVPN Connect client:" \
-OpenVPN Connect client and installation instructions:
+    "https://openvpn.net/client/" \
-https://openvpn.net/vpn-client/
+    "OpenVPN GUI client:" \
-OpenVPN GUI client:
+    "https://openvpn.net/community-downloads/" \
-https://openvpn.net/community-downloads/
+    "" \
-
+    "${additional}" \
-User Login: ${clientname}
+    "" \
-User Password: ${clientpass}
+    "User Login: \`${clientname}\`" \
-Time Expired: ${validuntil}
+    "User Password: \`${clientpass}\`" \
-END
+    "Time Expired: ${validuntil}"
-)
+  )
-
+  printf "%s\n" "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
-  echo -e "${faqprofile}" > "${ovpncfgdir}/${clientname}.info"
+  addtologs "created ${clientname} info file"
 }
 
 #######################################
-# Send email notification about client connect
+# Send email notification about client config.
 # Globals:
 #   clientname
 #   faqprofile
 #   ovpncfgdir
+#   from
+#   pass
+#   dest
+#   smtp
+#   port
 # Arguments:
 #   None
 #######################################
@@ -197,33 +243,72 @@ startsendmail() {
   subj="[OVPN Settings] $(cat /etc/hostname): ${clientname}.ovpn client profile"
   (
     python3 /usr/local/bin/sendmail.py \
-    -u "$(grep "from=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
+    -u "${from}" \
-    -p "$(grep "pass=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
+    -p "${pass}" \
-    -d "$(grep "dest=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
+    -d "${dest}" \
-    --smtp "$(grep "smtp=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
+    --smtp "${smtp}" \
-    --port "$(grep "port=" /usr/local/bin/sendmail.config | cut -d= -f2)" \
+    --port "${port}" \
     --stls "True" \
     --subj "${subj}" \
-    --text "${faqprofile}" \
+    --text "$(printf "%s\n" "${faqprofile}" | sed 's|`||g')" \
-    --file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar" \
+    --file "${ovpncfgdir}/${clientname}.ovpn,${ovpncfgdir}/${clientname}.tar"
-    >> /dev/null 2>&1 &
+  ) > /dev/null 2>&1
-  )
+  addtologs "sent mail with subject '${subj}' to ${dest}"
-  addtologs "sent mail with subject '${subj}'"
 }
 
 #######################################
-# Deleting linux user
+# Send telegram notification about client config.
+# Globals:
+#   clientname
+#   faqprofile
+#   ovpncfgdir
+#   API_KEY
+#   CHAT_ID
+#   THRD_ID
+# Arguments:
+#   None
+#######################################
+# shellcheck disable=SC2030,2031
+startsendtlgm() {
+  (
+    API_URL="https://api.telegram.org/bot${API_KEY}/sendMediaGroup?chat_id=${CHAT_ID}"
+
+    if grep -q "_" <<< "${CHAT_ID}"; then
+      THRD_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f2)
+      CHAT_ID=$(printf "%s\n" "${CHAT_ID}" | cut -d_ -f1)
+    fi
+    if [ -n "${THRD_ID}" ]; then
+      API_URL="${API_URL}&message_thread_id=${THRD_ID}"
+    fi
+
+    curl "${API_URL}" \
+         -F "media=[{\"type\": \"document\", \"media\": \"attach://ovpn\", \"caption\": \"${faqprofile}\", \"parse_mode\": \"Markdown\"}, {\"type\": \"document\", \"media\": \"attach://tars\" }]" \
+         -F "ovpn=@${ovpncfgdir}/${clientname}.ovpn" \
+         -F "tars=@${ovpncfgdir}/${clientname}.tar"
+  ) > /dev/null 2>&1
+  addtologs "sent telegram media with ${clientname}.ovpn client profile to ${CHAT_ID}"
+}
+
+#######################################
+# Deleting linux user.
 # Globals:
 #   clientname
 # Arguments:
 #   None
 #######################################
 deleteuser() {
+  if id -u "${clientname}" > /dev/null 2>&1; then
+    (
       userdel -f -r "${clientname}"
+    ) > /dev/null 2>&1
+    addtologs "deleted Linux user '${clientname}'"
+  else
+    addtologs "${clientname} Linux user does not exist, delete skipped"
+  fi
 }
 
 #######################################
-# Deleting Easy-RSA user certificate
+# Deleting Easy-RSA user certificate.
 # Globals:
 #   easyrsadir
 #   easyrsavar
@@ -234,13 +319,20 @@ deleteuser() {
 #   None
 #######################################
 deletecert() {
-    cd ${easyrsadir} || execerror
+  if grep -w "${clientname}" ${easyrsaidx} > /dev/null 2>&1; then
-    ${easyrsaexe} --batch --passin=pass:${easyrsacap} revoke "${clientname}"
+    (
-    ${easyrsaexe} --batch --passin=pass:${easyrsacap} gen-crl
+      cd "${easyrsadir}" || execerror
+      ${easyrsaexe} --batch --passin=pass:"${easyrsacap}" revoke "${clientname}"
+      ${easyrsaexe} --batch --passin=pass:"${easyrsacap}" gen-crl
+    ) > /dev/null 2>&1
+    addtologs "revoked ${clientname} easyrsa certificate"
+  else
+    addtologs "${clientname} certificate does not exist, revoke skipped"
+  fi
 }
 
 #######################################
-# Deleting ovpn config file
+# Deleting ovpn config file.
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -248,11 +340,16 @@ deletecert() {
 #   None
 #######################################
 deleteovpn() {
+  if [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
     rm -f "${ovpncfgdir}/${clientname}.ovpn"
+    addtologs "deleted ${clientname} ovpn config file"
+  else
+    addtologs "${clientname} ovpn config does not exist, delete skipped"
+  fi
 }
 
 #######################################
-# Deleting tar with config file
+# Deleting tar with config file.
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -260,11 +357,16 @@ deleteovpn() {
 #   None
 #######################################
 deletetars() {
+  if [ -e "${ovpncfgdir}/${clientname}.tar" ]; then
     rm -f "${ovpncfgdir}/${clientname}.tar"
+    addtologs "deleted ${clientname} tar with config"
+  else
+    addtologs "${clientname} tar does not exist, delete skipped"
+  fi
 }
 
 #######################################
-# Deleting info file
+# Deleting info file.
 # Globals:
 #   clientname
 #   ovpncfgdir
@@ -272,24 +374,22 @@ deletetars() {
 #   None
 #######################################
 deleteinfo() {
+  if [ -e "${ovpncfgdir}/${clientname}.info" ]; then
     rm -f "${ovpncfgdir}/${clientname}.info"
+    addtologs "deleted ${clientname} info file"
+  else
+    addtologs "${clientname} info file does not exist, delete skipped"
+  fi
 }
 
 #
 # VARIABLES:
 #
 
-easyrsadir="/etc/openvpn/easy-rsa"
-easyrsaidx="${easyrsadir}/pki/index.txt"
-easyrsaexe="${easyrsadir}/easyrsa"
-easyrsavar="${easyrsadir}/vars"
-easyrsacap="openvpnca"
-ovpncfgdir="/etc/openvpn/client"
-ovpncfgdef="${ovpncfgdir}/client.conf.default"
-
 clienttodo=$1
 clientname=$2
 clientpass=$3
+additional=$4
 
 resetforce=0
 for argument in "${@}"; do
@@ -310,45 +410,35 @@ logs=/dev/null
 #
 
 if checkroot; then
-  logs=/var/log/openvpn/$(basename -s .sh "$0").log
+  getconfig
   if [ "${clienttodo}" == "add" ] && \
      [ -n "${clientname}" ] && \
      [ "${#clientpass}" -ge 8 ]; then
-    if id -u "${clientname}" >/dev/null 2>&1 || \
+    createuser
-       grep -w "${clientname}" ${easyrsaidx} || \
+    createcert
-       [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
+    createovpn
-      execerror "linux user or certificate or ovpn config exist, exit"
+    createtars
-    else
+    createinfo
-      createuser && addtologs "created Linux user '${clientname}'"
-      createcert && addtologs "created certificate for ${clientname}"
-      createovpn && addtologs "created ovpn config file for ${clientname}"
-      createtars && addtologs "created tar with config file for ${clientname}"
-      createinfo && addtologs "created info file for ${clientname}"
     startsendmail
-    fi
+    startsendtlgm
-  elif [ "${clienttodo}" == "del" ] && [ -n "${clientname}" ]; then
+  elif [ "${clienttodo}" == "del" ] && \
-    if id -u "${clientname}" >/dev/null 2>&1 || \
+       [ -n "${clientname}" ]; then
-       grep -w "${clientname}" ${easyrsaidx} || \
-       [ -e "${ovpncfgdir}/${clientname}.ovpn" ]; then
     deleteuser
-      addtologs "deleted Linux user '${clientname}'"
+    deletecert
-      deletecert && addtologs "deleted certificate for ${clientname}"
+    deleteovpn
-      deleteovpn && addtologs "deleted ovpn config file for ${clientname}"
+    deletetars
-      deletetars && addtologs "deleted tar with config file for ${clientname}"
+    deleteinfo
-      deleteinfo && addtologs "deleted info file for ${clientname}"
     if [ "${resetforce}" -eq 1 ];then
       addtologs "restarting openvpn@server..."
       systemctl restart openvpn@server
     fi
-    else
-      execerror "linux user and certificate and ovpn config not exist, exit"
-    fi
   else
     printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)'"
+    printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'password(not less 8 symbols)' 'additional client description'"
     printf "%s\n" "Usage example: $0 'del' 'username(surname)'"
     printf "%s\n" "Usage example: $0 'del' 'username(surname)' -f"
   fi
 else
   execerror "Restart this as root!"
 fi
-execquite
+execquite 0