1
0
Fork 0
mirror of https://github.com/pivpn/pivpn.git synced 2024-12-24 22:00:16 +00:00
pivpn/scripts/removeOVPN.sh

79 lines
2.2 KiB
Bash
Raw Normal View History

2016-04-19 18:01:55 +00:00
#!/usr/bin/env bash
# PiVPN: revoke client script
INSTALL_USER=$(cat /etc/pivpn/INSTALL_USER)
REVOKE_STATUS=$(cat /etc/pivpn/REVOKE_STATUS)
PLAT=$(cat /etc/pivpn/DET_PLATFORM)
INDEX="/etc/openvpn/easy-rsa/pki/index.txt"
2016-04-19 18:01:55 +00:00
if [ ! -f "${INDEX}" ]; then
2016-10-04 19:02:02 +00:00
printf "The file: %s was not found\n" "$INDEX"
2016-04-19 18:01:55 +00:00
exit 1
fi
printf "\n"
printf " ::\e[4m Certificate List \e[0m:: \n"
i=0
2016-10-04 19:02:02 +00:00
while read -r line || [ -n "$line" ]; do
STATUS=$(echo "$line" | awk '{print $1}')
if [[ "${STATUS}" = "V" ]]; then
NAME=$(echo "$line" | sed -e 's:.*/CN=::')
CERTS[$i]=${NAME}
if [ "$i" != 0 ]; then
2016-10-04 19:02:02 +00:00
# Prevent printing "server" certificate
printf " %s\n" "$NAME"
2016-04-19 18:01:55 +00:00
fi
let i=i+1
2016-04-19 18:01:55 +00:00
fi
done <${INDEX}
2016-04-19 18:01:55 +00:00
printf "\n"
echo "::: Please enter the Name of the client to be revoked from the list above:"
2016-10-04 19:02:02 +00:00
read -r NAME
2016-04-19 18:01:55 +00:00
if [[ -z "${NAME}" ]]; then
2016-10-04 19:02:02 +00:00
echo "::: You can not leave this blank!"
exit 1
fi
2016-10-04 19:02:02 +00:00
for((x=1;x<=i;++x)); do
if [ "${CERTS[$x]}" = "${NAME}" ]; then
VALID=1
fi
done
if [ -z "${VALID}" ]; then
printf "::: You didn't enter a valid cert name!\n"
exit 1
fi
2016-10-04 19:02:02 +00:00
cd /etc/openvpn/easy-rsa || exit
2016-04-19 18:01:55 +00:00
if [ "${REVOKE_STATUS}" == 0 ]; then
2016-04-19 18:01:55 +00:00
echo 1 > /etc/pivpn/REVOKE_STATUS
printf "\nThis seems to be the first time you have revoked a cert.\n"
printf "First we need to initialize the Certificate Revocation List.\n"
printf "Then add the CRL to your server config and restart openvpn.\n"
./easyrsa gen-crl
cp pki/crl.pem /etc/openvpn/crl.pem
chown nobody:nogroup /etc/openvpn/crl.pem
2016-04-19 18:01:55 +00:00
sed -i '/#crl-verify/c\crl-verify /etc/openvpn/crl.pem' /etc/openvpn/server.conf
2016-05-25 21:58:08 +00:00
if [[ ${PLAT} == "Ubuntu" || ${PLAT} == "Debian" ]]; then
service openvpn restart
else
systemctl restart openvpn.service
fi
2016-04-19 18:01:55 +00:00
fi
./easyrsa --batch revoke "${NAME}"
2016-12-08 14:59:19 +00:00
./easyrsa gen-crl
printf "\n::: Certificate revoked, and CRL file updated.\n"
printf "::: Removing certs and client configuration for this profile.\n"
rm -rf "pki/reqs/${NAME}.req"
rm -rf "pki/private/${NAME}.key"
rm -rf "pki/issued/${NAME}.crt"
rm -rf "/home/${INSTALL_USER}/ovpns/${NAME}.ovpn"
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
printf "::: Completed!\n"