#!/bin/bash # install_openvpn.sh - Install OpenVPN and generate required certificates # # install_openvpn.sh --client name # install_openvpn.sh --server [name] # # name is used on the CN of the generated cert, and the filename of # the configuration, certificate and key files. # # --server mode configures the host with a running OpenVPN server instance # --client mode creates a tarball of a client configuration for this server # Get config file if [ -e localrc ]; then . localrc fi if [ -e vpnrc ]; then . vpnrc fi # Do some IP manipulation function cidr2netmask() { set -- $(( 5 - ($1 / 8) )) 255 255 255 255 $(( (255 << (8 - ($1 % 8))) & 255 )) 0 0 0 if [[ $1 -gt 1 ]]; then shift $1 else shift fi echo ${1-0}.${2-0}.${3-0}.${4-0} } FIXED_NET=`echo $FIXED_RANGE | cut -d'/' -f1` FIXED_CIDR=`echo $FIXED_RANGE | cut -d'/' -f2` FIXED_MASK=`cidr2netmask $FIXED_CIDR` # VPN Config VPN_SERVER=${VPN_SERVER:-`ifconfig eth0 | awk "/inet addr:/ { print \$2 }" | cut -d: -f2`} # 50.56.12.212 VPN_PROTO=${VPN_PROTO:-tcp} VPN_PORT=${VPN_PORT:-6081} VPN_DEV=${VPN_DEV:-tap0} VPN_BRIDGE=${VPN_BRIDGE:-br100} VPN_BRIDGE_IF=${VPN_BRIDGE_IF:-$FLAT_INTERFACE} VPN_CLIENT_NET=${VPN_CLIENT_NET:-$FIXED_NET} VPN_CLIENT_MASK=${VPN_CLIENT_MASK:-$FIXED_MASK} VPN_CLIENT_DHCP="${VPN_CLIENT_DHCP:-net.1 net.254}" VPN_DIR=/etc/openvpn CA_DIR=$VPN_DIR/easy-rsa usage() { echo "$0 - OpenVPN install and certificate generation" echo "" echo "$0 --client name" echo "$0 --server [name]" echo "" echo " --server mode configures the host with a running OpenVPN server instance" echo " --client mode creates a tarball of a client configuration for this server" exit 1 } if [ -z $1 ]; then usage fi # Install OpenVPN VPN_EXEC=`which openvpn` if [ -z "$VPN_EXEC" -o ! -x "$VPN_EXEC" ]; then apt-get install -y openvpn bridge-utils fi if [ ! -d $CA_DIR ]; then cp -pR /usr/share/doc/openvpn/examples/easy-rsa/2.0/ $CA_DIR fi # Keep track of the current directory TOOLS_DIR=$(cd $(dirname "$0") && pwd) TOP_DIR=$(cd $TOOLS_DIR/.. && pwd) WEB_DIR=$TOP_DIR/../vpn if [[ ! -d $WEB_DIR ]]; then mkdir -p $WEB_DIR fi WEB_DIR=$(cd $TOP_DIR/../vpn && pwd) cd $CA_DIR source ./vars # Override the defaults export KEY_COUNTRY="US" export KEY_PROVINCE="TX" export KEY_CITY="SanAntonio" export KEY_ORG="Cloudbuilders" export KEY_EMAIL="rcb@lists.rackspace.com" if [ ! -r $CA_DIR/keys/dh1024.pem ]; then # Initialize a new CA $CA_DIR/clean-all $CA_DIR/build-dh $CA_DIR/pkitool --initca openvpn --genkey --secret $CA_DIR/keys/ta.key ## Build a TLS key fi do_server() { NAME=$1 # Generate server certificate $CA_DIR/pkitool --server $NAME (cd $CA_DIR/keys; cp $NAME.crt $NAME.key ca.crt dh1024.pem ta.key $VPN_DIR ) cat >$VPN_DIR/br-up <$VPN_DIR/br-down <$VPN_DIR/$NAME.conf <$TMP_DIR/$HOST.conf <$VPN_DIR/hostname fi do_server $NAME ;; --clean) $CA_DIR/clean-all ;; *) usage esac