From a05754ea192c33c9c65660aee4ad42788e07765d Mon Sep 17 00:00:00 2001 From: corbolais Date: Sun, 8 Dec 2019 20:14:23 +0100 Subject: [PATCH] shellcheck install.sh. render into sound bashing. correct sed call. Signed-off-by: corbolais --- auto_install/install.sh | 149 +++++++++++++++++++++------------------- 1 file changed, 77 insertions(+), 72 deletions(-) diff --git a/auto_install/install.sh b/auto_install/install.sh index 2305458..bd7abad 100755 --- a/auto_install/install.sh +++ b/auto_install/install.sh @@ -39,8 +39,8 @@ UNATTUPG_CONFIG="https://github.com/mvo5/unattended-upgrades/archive/${UNATTUPG_ # Find the rows and columns. Will default to 80x24 if it can not be detected. screen_size=$(stty size 2>/dev/null || echo 24 80) -rows=$(echo $screen_size | awk '{print $1}') -columns=$(echo $screen_size | awk '{print $2}') +rows=$(echo "$screen_size" | awk '{print $1}') +columns=$(echo "$screen_size" | awk '{print $2}') runUnattended=false @@ -101,6 +101,7 @@ distroCheck(){ else # else get info from os-release + # shellcheck disable=SC1091 source /etc/os-release PLAT=$(awk '{print $1}' <<< "$NAME") VER="$VERSION_ID" @@ -142,7 +143,7 @@ checkHostname(){ exit 1 fi until [[ ${#host_name} -le 28 && $host_name =~ ^[a-zA-Z0-9][a-zA-Z0-9-]{1,28}$ ]]; do - host_name=$(whiptail --inputbox "Your hostname is too long.\nEnter new hostname with less then 28 characters\nNo special characters allowed." \ + host_name=$(whiptail --inputbox "Your hostname is too long.\\nEnter new hostname with less then 28 characters\\nNo special characters allowed." \ --title "Hostname too long" ${r} ${c} 3>&1 1>&2 2>&3) $SUDO hostnamectl set-hostname "${host_name}" if [[ ${#host_name} -le 28 && $host_name =~ ^[a-zA-Z0-9][a-zA-Z0-9-]{1,28}$ ]]; then @@ -159,21 +160,22 @@ spinner(){ local pid=$1 local delay=0.50 local spinstr='/-\|' - while [ "$(ps a | awk '{print $1}' | grep "${pid}")" ]; do + while ps a | awk '{print $1}' | grep "${pid}"; do local temp=${spinstr#?} printf " [%c] " "${spinstr}" local spinstr=${temp}${spinstr%"$temp"} sleep ${delay} - printf "\b\b\b\b\b\b" + printf "\\b\\b\\b\\b\\b\\b" done - printf " \b\b\b\b" + printf " \\b\\b\\b\\b" } verifyFreeDiskSpace(){ # If user installs unattended-upgrades we'd need about 60MB so will check for 75MB free echo "::: Verifying free disk space..." local required_free_kilobytes=76800 - local existing_free_kilobytes=$(df -Pk | grep -m1 '\/$' | awk '{print $4}') + local existing_free_kilobytes + existing_free_kilobytes=$(df -Pk | grep -m1 '\/$' | awk '{print $4}') # - Unknown free disk space , not a integer if ! [[ "${existing_free_kilobytes}" =~ ^([0-9])+$ ]]; then @@ -220,8 +222,8 @@ updatePackageCache(){ if [ ! "${today}" == "${timestampAsDate}" ]; then #update package lists echo ":::" - echo -ne "::: ${PKG_MANAGER} update has not been run today. Running now...\n" - $SUDO ${UPDATE_PKG_CACHE} &> /dev/null + echo -ne "::: ${PKG_MANAGER} update has not been run today. Running now...\\n" + $SUDO "${UPDATE_PKG_CACHE}" &> /dev/null echo " done!" fi } @@ -274,7 +276,7 @@ installDependentPackages(){ done if command -v debconf-apt-progress &> /dev/null; then - $SUDO debconf-apt-progress -- ${PKG_INSTALL} "${argArray1[@]}" + $SUDO debconf-apt-progress -- "${PKG_INSTALL}" "${argArray1[@]}" else ${PKG_INSTALL} "${argArray1[@]}" fi @@ -347,9 +349,9 @@ chooseInterface(){ # Find out how many interfaces are available to choose from interfaceCount=$(echo "${availableInterfaces}" | wc -l) - chooseInterfaceCmd=(whiptail --separate-output --radiolist "Choose An Interface (press space to select):" ${r} ${c} ${interfaceCount}) - chooseInterfaceOptions=$("${chooseInterfaceCmd[@]}" "${interfacesArray[@]}" 2>&1 >/dev/tty) - if [[ $? = 0 ]]; then + chooseInterfaceCmd=(whiptail --separate-output --radiolist "Choose An + Interface (press space to select):" "${r}" "${c}" "${interfaceCount}") + if chooseInterfaceOptions=$("${chooseInterfaceCmd[@]}" "${interfacesArray[@]}" 2>&1 >/dev/tty) ; then for desiredInterface in ${chooseInterfaceOptions}; do IPv4dev=${desiredInterface} echo "::: Using interface: $IPv4dev" @@ -380,7 +382,7 @@ validIP(){ if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then OIFS=$IFS IFS='.' - ip=($ip) + read -r -a ip <<< "$ip" IFS=$OIFS [[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \ && ${ip[2]} -le 255 && ${ip[3]} -le 255 ]] @@ -456,12 +458,10 @@ It is also possible to use a DHCP reservation, but if you are going to do that, # Start a loop to let the user enter their information with the chance to go back and edit it if necessary until [[ ${ipSettingsCorrect} = True ]]; do # Ask for the IPv4 address - IPv4addr=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 address" --inputbox "Enter your desired IPv4 address" ${r} ${c} "${IPv4addr}" 3>&1 1>&2 2>&3) - if [[ $? = 0 ]]; then + if IPv4addr=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 address" --inputbox "Enter your desired IPv4 address" ${r} ${c} "${IPv4addr}" 3>&1 1>&2 2>&3) ; then echo "::: Your static IPv4 address: ${IPv4addr}" # Ask for the gateway - IPv4gw=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" --inputbox "Enter your desired IPv4 default gateway" ${r} ${c} "${IPv4gw}" 3>&1 1>&2 2>&3) - if [[ $? = 0 ]]; then + if IPv4gw=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" --inputbox "Enter your desired IPv4 default gateway" ${r} ${c} "${IPv4gw}" 3>&1 1>&2 2>&3) ; then echo "::: Your static IPv4 gateway: ${IPv4gw}" # Give the user a chance to review their settings before moving on if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Are these settings correct? @@ -556,8 +556,7 @@ chooseUser(){ # See http://askubuntu.com/a/667842/459815 PASSWORD=$(whiptail --title "password dialog" --passwordbox "Please enter the new user password" ${r} ${c} 3>&1 1>&2 2>&3) CRYPT=$(perl -e 'printf("%s\n", crypt($ARGV[0], "password"))' "${PASSWORD}") - $SUDO useradd -m -p "${CRYPT}" -s /bin/bash "${userToAdd}" - if [[ $? = 0 ]]; then + if $SUDO useradd -m -p "${CRYPT}" -s /bin/bash "${userToAdd}" ; then echo "Succeeded" ((numUsers+=1)) else @@ -580,9 +579,9 @@ chooseUser(){ fi userArray+=("${line}" "" "${mode}") done <<< "${availableUsers}" - chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist "Choose (press space to select):" ${r} ${c} ${numUsers}) - chooseUserOptions=$("${chooseUserCmd[@]}" "${userArray[@]}" 2>&1 >/dev/tty) - if [[ $? = 0 ]]; then + chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist + "Choose (press space to select):" "${r}" "${c}" "${numUsers}") + if chooseUserOptions=$("${chooseUserCmd[@]}" "${userArray[@]}" 2>&1 >/dev/tty) ; then for desiredUser in ${chooseUserOptions}; do install_user=${desiredUser} echo "::: Using User: $install_user" @@ -610,10 +609,10 @@ updateRepo(){ # Pull the latest commits echo -n "::: Updating repo in $1..." $SUDO rm -rf "${1}" - # Go back to /etc otherwhise git will complain when the current working + # Go back to /etc otherwise git will complain when the current working # directory has just been deleted (/etc/.pivpn). - cd /etc - $SUDO git clone -q --depth 1 --no-single-branch "${2}" "${1}" > /dev/null & spinner $! + cd /etc && \ + $SUDO git clone -q --depth 1 --no-single-branch "${2}" "${1}" > /dev/null & spinner $! cd "${1}" || exit 1 if [ -z "${TESTING+x}" ]; then : @@ -629,8 +628,8 @@ makeRepo(){ $SUDO rm -rf "${1}" # Go back to /etc otherwhise git will complain when the current working # directory has just been deleted (/etc/.pivpn). - cd /etc - $SUDO git clone -q --depth 1 --no-single-branch "${2}" "${1}" > /dev/null & spinner $! + cd /etc && \ + $SUDO git clone -q --depth 1 --no-single-branch "${2}" "${1}" > /dev/null & spinner $! cd "${1}" || exit 1 if [ -z "${TESTING+x}" ]; then : @@ -676,7 +675,7 @@ askWhichVPN(){ fi fi else - if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\n\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\n\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\n\nChoose 'Yes' to use WireGuard or 'No' to use OpenVPN." ${r} ${c}); + if (whiptail --backtitle "Setup PiVPN" --title "Installation mode" --yesno "WireGuard is a new kind of VPN that provides near-istantaneous connection speed, high performance, modern cryptography.\\n\\nIt's the recommended choise expecially if you use mobile devices where WireGuard is easier on battery than OpenVPN.\\n\\nOpenVPN is still available if you need the traditional, flexible, trusted VPN protocol. Or if you need features like TCP and custom search domain.\\n\\nChoose 'Yes' to use WireGuard or 'No' to use OpenVPN." ${r} ${c}); then VPN="wireguard" else @@ -700,6 +699,7 @@ installOpenVPN(){ echo "::: Installing OpenVPN from Debian package... " # grepcidr is used to redact IPs in the debug log, expect is used to feed easy-rsa # with passwords, bsdmainutils provides column to format the terminal output + local PIVPN_DEPS PIVPN_DEPS=(openvpn grepcidr expect bsdmainutils) installDependentPackages PIVPN_DEPS[@] } @@ -725,7 +725,7 @@ installWireGuard(){ printf 'Package: *\nPin: release a=unstable\nPin-Priority: 1\n\nPackage: wireguard wireguard-dkms wireguard-tools\nPin: release a=unstable\nPin-Priority: 500\n' | $SUDO tee /etc/apt/preferences.d/limit-unstable > /dev/null $SUDO apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC 648ACFD622F3D138 - $SUDO ${UPDATE_PKG_CACHE} &> /dev/null + $SUDO "${UPDATE_PKG_CACHE}" &> /dev/null PIVPN_DEPS=(raspberrypi-kernel-headers wireguard wireguard-tools wireguard-dkms) installDependentPackages PIVPN_DEPS[@] @@ -745,11 +745,11 @@ installWireGuard(){ wget -qO- "${WG_SOURCE}" | $SUDO tar Jxf - --directory /usr/src echo "done!" - cd /usr/src + cd /usr/src && \ $SUDO mv WireGuard-"${WG_SNAPSHOT}" wireguard-"${WG_SNAPSHOT}" - cd wireguard-"${WG_SNAPSHOT}" - $SUDO mv src/* . - $SUDO rmdir src + cd wireguard-"${WG_SNAPSHOT}" && \ + $SUDO mv src/* . && \ + $SUDO rmdir src # We install the userspace tools manually since DKMS only compiles and # installs the kernel module @@ -811,7 +811,7 @@ installWireGuard(){ echo "::: Adding Debian repository... " echo "deb http://deb.debian.org/debian/ unstable main" | $SUDO tee /etc/apt/sources.list.d/unstable.list > /dev/null printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' | $SUDO tee /etc/apt/preferences.d/limit-unstable > /dev/null - $SUDO ${UPDATE_PKG_CACHE} &> /dev/null + $SUDO "${UPDATE_PKG_CACHE}" &> /dev/null PIVPN_DEPS=(linux-headers-amd64 qrencode wireguard wireguard-tools wireguard-dkms) installDependentPackages PIVPN_DEPS[@] @@ -900,7 +900,7 @@ askCustomPort(){ fi fi - if pivpnPORT=$(whiptail --title "Default $VPN Port" --inputbox "You can modify the default $VPN port. \nEnter a new value or hit 'Enter' to retain the default" ${r} ${c} $DEFAULT_PORT 3>&1 1>&2 2>&3) + if pivpnPORT=$(whiptail --title "Default $VPN Port" --inputbox "You can modify the default $VPN port. \\nEnter a new value or hit 'Enter' to retain the default" ${r} ${c} $DEFAULT_PORT 3>&1 1>&2 2>&3) then if [[ "$pivpnPORT" =~ ^[0-9]+$ ]] && [ "$pivpnPORT" -ge 1 ] && [ "$pivpnPORT" -le 65535 ]; then : @@ -913,10 +913,10 @@ askCustomPort(){ fi if [[ $pivpnPORT == "$portInvalid" ]]; then - whiptail --msgbox --backtitle "Invalid Port" --title "Invalid Port" "You entered an invalid Port number.\n Please enter a number from 1 - 65535.\n If you are not sure, please just keep the default." ${r} ${c} + whiptail --msgbox --backtitle "Invalid Port" --title "Invalid Port" "You entered an invalid Port number.\\n Please enter a number from 1 - 65535.\\n If you are not sure, please just keep the default." ${r} ${c} PORTNumCorrect=False else - if (whiptail --backtitle "Specify Custom Port" --title "Confirm Custom Port Number" --yesno "Are these settings correct?\n PORT: $pivpnPORT" ${r} ${c}) then + if (whiptail --backtitle "Specify Custom Port" --title "Confirm Custom Port Number" --yesno "Are these settings correct?\\n PORT: $pivpnPORT" ${r} ${c}) then PORTNumCorrect=True else # If the settings are wrong, the loop continues @@ -975,7 +975,9 @@ askClientDNS(){ fi fi - DNSChoseCmd=(whiptail --separate-output --radiolist "Select the DNS Provider for your VPN Clients (press space to select). To use your own, select Custom." ${r} ${c} 6) + DNSChoseCmd=(whiptail --separate-output --radiolist "Select the DNS Provider + for your VPN Clients (press space to select). To use your own, select Custom." + "${r}" "${c}" 6) DNSChooseOptions=(Google "" on OpenDNS "" off Level3 "" off @@ -1007,7 +1009,7 @@ askClientDNS(){ until [[ $DNSSettingsCorrect = True ]]; do strInvalid="Invalid" - if pivpnDNS=$(whiptail --backtitle "Specify Upstream DNS Provider(s)" --inputbox "Enter your desired upstream DNS provider(s), separated by a comma.\n\nFor example '8.8.8.8, 8.8.4.4'" ${r} ${c} "" 3>&1 1>&2 2>&3) + if pivpnDNS=$(whiptail --backtitle "Specify Upstream DNS Provider(s)" --inputbox "Enter your desired upstream DNS provider(s), separated by a comma.\\n\\nFor example '8.8.8.8, 8.8.4.4'" ${r} ${c} "" 3>&1 1>&2 2>&3) then pivpnDNS1=$(echo "$pivpnDNS" | sed 's/[, \t]\+/,/g' | awk -F, '{print$1}') pivpnDNS2=$(echo "$pivpnDNS" | sed 's/[, \t]\+/,/g' | awk -F, '{print$2}') @@ -1023,7 +1025,7 @@ askClientDNS(){ fi if [[ $pivpnDNS1 == "$strInvalid" ]] || [[ $pivpnDNS2 == "$strInvalid" ]]; then - whiptail --msgbox --backtitle "Invalid IP" --title "Invalid IP" "One or both entered IP addresses were invalid. Please try again.\n\n DNS Server 1: $pivpnDNS1\n DNS Server 2: $pivpnDNS2" ${r} ${c} + whiptail --msgbox --backtitle "Invalid IP" --title "Invalid IP" "One or both entered IP addresses were invalid. Please try again.\\n\\n DNS Server 1: $pivpnDNS1\\n DNS Server 2: $pivpnDNS2" ${r} ${c} if [[ $pivpnDNS1 == "$strInvalid" ]]; then pivpnDNS1="" fi @@ -1032,7 +1034,7 @@ askClientDNS(){ fi DNSSettingsCorrect=False else - if (whiptail --backtitle "Specify Upstream DNS Provider(s)" --title "Upstream DNS Provider(s)" --yesno "Are these settings correct?\n DNS Server 1: $pivpnDNS1\n DNS Server 2: $pivpnDNS2" ${r} ${c}) then + if (whiptail --backtitle "Specify Upstream DNS Provider(s)" --title "Upstream DNS Provider(s)" --yesno "Are these settings correct?\\n DNS Server 1: $pivpnDNS1\\n DNS Server 2: $pivpnDNS2" ${r} ${c}) then DNSSettingsCorrect=True else # If the settings are wrong, the loop continues @@ -1081,20 +1083,20 @@ askCustomDomain(){ DomainSettingsCorrect=False - if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno --defaultno "Would you like to add a custom search domain? \n (This is only for advanced users who have their own domain)\n" ${r} ${c}); then + if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno --defaultno "Would you like to add a custom search domain? \\n (This is only for advanced users who have their own domain)\\n" ${r} ${c}); then until [[ $DomainSettingsCorrect = True ]] do - if pivpnSEARCHDOMAIN=$(whiptail --inputbox "Enter Custom Domain\nFormat: mydomain.com" ${r} ${c} --title "Custom Domain" 3>&1 1>&2 2>&3); then + if pivpnSEARCHDOMAIN=$(whiptail --inputbox "Enter Custom Domain\\nFormat: mydomain.com" ${r} ${c} --title "Custom Domain" 3>&1 1>&2 2>&3); then if validDomain "$pivpnSEARCHDOMAIN"; then - if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Are these settings correct?\n Custom Search Domain: $pivpnSEARCHDOMAIN" ${r} ${c}); then + if (whiptail --backtitle "Custom Search Domain" --title "Custom Search Domain" --yesno "Are these settings correct?\\n Custom Search Domain: $pivpnSEARCHDOMAIN" ${r} ${c}); then DomainSettingsCorrect=True else # If the settings are wrong, the loop continues DomainSettingsCorrect=False fi else - whiptail --msgbox --backtitle "Invalid Domain" --title "Invalid Domain" "Domain is invalid. Please try again.\n\n DOMAIN: $pivpnSEARCHDOMAIN\n" ${r} ${c} + whiptail --msgbox --backtitle "Invalid Domain" --title "Invalid Domain" "Domain is invalid. Please try again.\\n\\n DOMAIN: $pivpnSEARCHDOMAIN\\n" ${r} ${c} DomainSettingsCorrect=False fi else @@ -1155,7 +1157,7 @@ askPublicIPOrDNS(){ echo "::: Cancel selected. Exiting..." exit 1 fi - if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\n\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then + if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\\n\\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then publicDNSCorrect=True pivpnHOST="${PUBLICDNS}" else @@ -1194,7 +1196,7 @@ askEncryption(){ fi pivpnENCRYPT=$(whiptail --backtitle "Setup OpenVPN" --title "RSA certificate size" --radiolist \ - "Choose the desired size of your certificate (press space to select):\nThis is a certificate that will be generated on your system. The larger the certificate, the more time this will take. For most applications, it is recommended to use 2048 bits. If you are paranoid about ... things... then grab a cup of joe and pick 4096 bits." ${r} ${c} 3 \ + "Choose the desired size of your certificate (press space to select):\\nThis is a certificate that will be generated on your system. The larger the certificate, the more time this will take. For most applications, it is recommended to use 2048 bits. If you are paranoid about ... things... then grab a cup of joe and pick 4096 bits." ${r} ${c} 3 \ "2048" "Use a 2048-bit certificate (recommended level)" ON \ "3072" "Use a 3072-bit certificate " OFF \ "4096" "Use a 4096-bit certificate (paranoid level)" OFF 3>&1 1>&2 2>&3) @@ -1205,7 +1207,7 @@ askEncryption(){ exit 1 fi - if ([ "$pivpnENCRYPT" -ge "3072" ] && whiptail --backtitle "Setup OpenVPN" --title "Download Diffie-Hellman Parameters" --yesno --defaultno "Download Diffie-Hellman parameters from a public DH parameter generation service?\n\nGenerating DH parameters for a $pivpnENCRYPT-bit key can take many hours on a Raspberry Pi. You can instead download DH parameters from \"2 Ton Digital\" that are generated at regular intervals as part of a public service. Downloaded DH parameters will be randomly selected from their database.\nMore information about this service can be found here: https://2ton.com.au/safeprimes/\n\nIf you're paranoid, choose 'No' and Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then + if ([ "$pivpnENCRYPT" -ge "3072" ] && whiptail --backtitle "Setup OpenVPN" --title "Download Diffie-Hellman Parameters" --yesno --defaultno "Download Diffie-Hellman parameters from a public DH parameter generation service?\\n\\nGenerating DH parameters for a $pivpnENCRYPT-bit key can take many hours on a Raspberry Pi. You can instead download DH parameters from \"2 Ton Digital\" that are generated at regular intervals as part of a public service. Downloaded DH parameters will be randomly selected from their database.\\nMore information about this service can be found here: https://2ton.com.au/safeprimes/\\n\\nIf you're paranoid, choose 'No' and Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then DOWNLOAD_DH_PARAM=1 else DOWNLOAD_DH_PARAM=0 @@ -1262,9 +1264,9 @@ set_var EASYRSA_KEY_SIZE ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null ${SUDOE} ./easyrsa --batch init-pki # Build the certificate authority - printf "::: Building CA...\n" + printf "::: Building CA...\\n" ${SUDOE} ./easyrsa --batch build-ca nopass - printf "\n::: CA Complete.\n" + printf "\\n::: CA Complete.\\n" if [ "${runUnattended}" = 'true' ]; then echo "::: The server key, Diffie-Hellman parameters, and HMAC key will now be generated." @@ -1273,7 +1275,7 @@ set_var EASYRSA_KEY_SIZE ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null fi # Build the server - EASYRSA_CERT_EXPIRE=3650 ${SUDOE} ./easyrsa build-server-full ${SERVER_NAME} nopass + EASYRSA_CERT_EXPIRE=3650 ${SUDOE} ./easyrsa build-server-full "${SERVER_NAME}" nopass if [ ${DOWNLOAD_DH_PARAM} -eq 1 ]; then # Downloading parameters @@ -1281,7 +1283,7 @@ set_var EASYRSA_KEY_SIZE ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null else # Generate Diffie-Hellman key exchange ${SUDOE} ./easyrsa gen-dh - ${SUDOE} mv pki/dh.pem pki/dh${pivpnENCRYPT}.pem + ${SUDOE} mv "pki/dh.pem pki/dh${pivpnENCRYPT}.pem" fi # Generate static HMAC key to defend against DDoS @@ -1305,7 +1307,7 @@ set_var EASYRSA_KEY_SIZE ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null fi # Set the user encryption key size - $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/\1${pivpnENCRYPT}.pem/" /etc/openvpn/server.conf + $SUDO sed -i "s#\\(dh /etc/openvpn/easy-rsa/pki/dh\\).*#\\1${pivpnENCRYPT}.pem#" /etc/openvpn/server.conf # if they modified port put value in server.conf if [ "$pivpnPORT" != 1194 ]; then @@ -1318,12 +1320,12 @@ set_var EASYRSA_KEY_SIZE ${pivpnENCRYPT}" | $SUDO tee vars >/dev/null fi if [ -n "$pivpnSEARCHDOMAIN" ]; then - $SUDO sed -i "0,/\(.*dhcp-option.*\)/s//\push \"dhcp-option DOMAIN ${pivpnSEARCHDOMAIN}\" \n&/" /etc/openvpn/server.conf + $SUDO sed -i "0,/\\(.*dhcp-option.*\\)/s//push \"dhcp-option DOMAIN ${pivpnSEARCHDOMAIN}\" \\n&/" /etc/openvpn/server.conf fi # write out server certs to conf file - $SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/pki\/private\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf - $SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/pki\/issued\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf + $SUDO sed -i "s#\\(key /etc/openvpn/easy-rsa/pki/private/\\).*#\\1${SERVER_NAME}.key#" /etc/openvpn/server.conf + $SUDO sed -i "s#\\(cert /etc/openvpn/easy-rsa/pki/issued/\\).*#\\1${SERVER_NAME}.crt#" /etc/openvpn/server.conf } confOVPN(){ @@ -1401,7 +1403,7 @@ confNetwork(){ USING_UFW=1 echo "::: Detected UFW is enabled." echo "::: Adding UFW rules..." - $SUDO sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s ${pivpnNET}\/24 -o ${IPv4dev} -j MASQUERADE\nCOMMIT\n" -i /etc/ufw/before.rules + $SUDO sed "/delete these required/i *nat\\n:POSTROUTING ACCEPT [0:0]\\n-I POSTROUTING -s ${pivpnNET}\\/24 -o ${IPv4dev} -j MASQUERADE\\nCOMMIT\\n" -i /etc/ufw/before.rules # Insert rules at the beginning of the chain (in case there are other rules that may drop the traffic) $SUDO ufw insert 1 allow "${pivpnPORT}"/"${pivpnPROTO}" >/dev/null $SUDO ufw route insert 1 allow in on "${pivpnDEV}" from "${pivpnNET}/24" out on "${IPv4dev}" to any >/dev/null @@ -1531,7 +1533,7 @@ askUnattendedUpgrades(){ return fi - whiptail --msgbox --backtitle "Security Updates" --title "Unattended Upgrades" "Since this server will have at least one port open to the internet, it is recommended you enable unattended-upgrades.\nThis feature will check daily for security package updates only and apply them when necessary.\nIt will NOT automatically reboot the server so to fully apply some updates you should periodically reboot." ${r} ${c} + whiptail --msgbox --backtitle "Security Updates" --title "Unattended Upgrades" "Since this server will have at least one port open to the internet, it is recommended you enable unattended-upgrades.\\nThis feature will check daily for security package updates only and apply them when necessary.\\nIt will NOT automatically reboot the server so to fully apply some updates you should periodically reboot." ${r} ${c} if (whiptail --backtitle "Security Updates" --title "Unattended Upgrades" --yesno "Do you want to enable unattended upgrades of security patches to this server?" ${r} ${c}); then UNATTUPG=1 @@ -1543,10 +1545,10 @@ askUnattendedUpgrades(){ } confUnattendedUpgrades(){ - PIVPN_DEPS=(unattended-upgrades) + local PIVPN_DEPS + PIVPN_DEPS+=(unattended-upgrades) installDependentPackages PIVPN_DEPS[@] - - cd /etc/apt/apt.conf.d + aptConfDir="/etc/apt/apt.conf.d" if [ "$PLAT" = "Ubuntu" ]; then @@ -1555,15 +1557,16 @@ confUnattendedUpgrades(){ echo "APT::Periodic::Update-Package-Lists \"1\"; APT::Periodic::Download-Upgradeable-Packages \"1\"; APT::Periodic::AutocleanInterval \"5\"; - APT::Periodic::Unattended-Upgrade \"1\";" | $SUDO tee 10periodic > /dev/null + APT::Periodic::Unattended-Upgrade \"1\";" | $SUDO tee "${aptConfDir}/10periodic" > /dev/null else # Fix Raspbian config if [ "$PLAT" = "Raspbian" ]; then - wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz - $SUDO cp "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" 50unattended-upgrades - $SUDO rm -rf "unattended-upgrades-$UNATTUPG_RELEASE" + wget -q -O "/tmp/${UNATTUPG_RELEASE}.tar.gz" "$UNATTUPG_CONFIG" + cd /tmp/ && $SUDO tar xzf "/tmp/${UNATTUPG_RELEASE}.tar.gz" + $SUDO cp /tmp/"unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" "${aptConfDir}/50unattended-upgrades" + $SUDO rm -rf "/tmp/unattended-upgrades-$UNATTUPG_RELEASE" fi # Add the remaining settings for all other distributions @@ -1572,14 +1575,14 @@ confUnattendedUpgrades(){ APT::Periodic::Download-Upgradeable-Packages \"1\"; APT::Periodic::Unattended-Upgrade \"1\"; APT::Periodic::AutocleanInterval \"7\"; - APT::Periodic::Verbose \"0\";" | $SUDO tee 02periodic > /dev/null + APT::Periodic::Verbose \"0\";" | $SUDO tee "${aptConfDir}/02periodic" > /dev/null fi # Enable automatic updates via the unstable repository when installing from debian package if [ "$VPN" = "wireguard" ] && [ "$PLAT" != "Ubuntu" ] && [ "$(uname -m)" != "armv6l" ]; then - if ! grep -q '"o=Debian,a=unstable";' 50unattended-upgrades; then - $SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' 50unattended-upgrades + if ! grep -q '"o=Debian,a=unstable";' "${aptConfDir}/50unattended-upgrades"; then + $SUDO sed -i '/Unattended-Upgrade::Origins-Pattern {/a"o=Debian,a=unstable";' "${aptConfDir}/50unattended-upgrades" fi fi } @@ -1600,6 +1603,7 @@ installScripts(){ $SUDO cp /etc/.pivpn/scripts/$VPN/pivpn /usr/local/bin/pivpn $SUDO chmod 0755 /usr/local/bin/pivpn $SUDO cp /etc/.pivpn/scripts/$VPN/bash-completion /etc/bash_completion.d/pivpn + # shellcheck disable=SC1091 . /etc/bash_completion.d/pivpn echo " done." } @@ -1620,11 +1624,11 @@ displayFinalMessage(){ # Final completion message to user whiptail --msgbox --backtitle "Make it so." --title "Installation Complete!" "Now run 'pivpn add' to create the ovpn profiles. -Run 'pivpn help' to see what else you can do!\n\nIf you run into any issue, please read all our documentation carefully. -All incomplete posts or bug reports will be ignored or deleted.\n\nThank you for using PiVPN." ${r} ${c} +Run 'pivpn help' to see what else you can do!\\n\\nIf you run into any issue, please read all our documentation carefully. +All incomplete posts or bug reports will be ignored or deleted.\\n\\nThank you for using PiVPN." ${r} ${c} if (whiptail --title "Reboot" --yesno --defaultno "It is strongly recommended you reboot after installation. Would you like to reboot now?" ${r} ${c}); then whiptail --title "Rebooting" --msgbox "The system will now reboot." ${r} ${c} - printf "\nRebooting system...\n" + printf "\\nRebooting system...\\n" $SUDO sleep 3 $SUDO shutdown -r now fi @@ -1672,6 +1676,7 @@ main(){ echo "::: No configuration file passed, using default settings..." else if [ -r "$2" ]; then + # shellcheck disable=SC1090 source "$2" else echo "::: Can't open $2"