Bug fixes for easyrsa3 modifications

Cleanup chooseUser function and fix issue with creating a user
password not being set correctly.
This commit is contained in:
Kaladin Light 2016-12-05 14:55:30 -05:00
parent 27e0fa8bb5
commit ff1ade9e9f

View file

@ -144,10 +144,9 @@ chooseUser() {
then then
# See http://askubuntu.com/a/667842/459815 # See http://askubuntu.com/a/667842/459815
PASSWORD=$(whiptail --title "password dialog" --passwordbox "Please enter the new user password" ${r} ${c} 3>&1 1>&2 2>&3) PASSWORD=$(whiptail --title "password dialog" --passwordbox "Please enter the new user password" ${r} ${c} 3>&1 1>&2 2>&3)
CRYPT=$(perl -e 'printf("%s\n", crypt($ARGV[0], "password"))' "$password") CRYPT=$(perl -e 'printf("%s\n", crypt($ARGV[0], "password"))' "${PASSWORD}")
$SUDO useradd -m -p "$CRYPT" -s /bin/bash "$userToAdd" $SUDO useradd -m -p "${CRYPT}" -s /bin/bash "${userToAdd}"
if [ $? -eq 0 ] if [[ $? = 0 ]]; then
then
echo "Succeeded" echo "Succeeded"
((numUsers+=1)) ((numUsers+=1))
else else
@ -158,8 +157,8 @@ chooseUser() {
fi fi
fi fi
availableUsers=$(awk -F':' '$3>=500 && $3<=60000 {print $1}' /etc/passwd) availableUsers=$(awk -F':' '$3>=500 && $3<=60000 {print $1}' /etc/passwd)
userArray=() local userArray=()
firstloop=1 local firstloop=1
while read -r line while read -r line
do do
@ -168,13 +167,12 @@ chooseUser() {
firstloop=0 firstloop=0
mode="ON" mode="ON"
fi fi
userArray+=("$line" "" "$mode") userArray+=("${line}" "" "${mode}")
done <<< "${availableUsers}" done <<< "${availableUsers}"
chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist "Choose:" ${r} ${c} ${numUsers}) chooseUserCmd=(whiptail --title "Choose A User" --separate-output --radiolist "Choose:" ${r} ${c} ${numUsers})
if chooseUserOptions=$("${chooseUserCmd[@]}" "${userArray[@]}" 2>&1 >/dev/tty) chooseUserOptions=$("${chooseUserCmd[@]}" "${userArray[@]}" 2>&1 >/dev/tty)
then if [[ $? = 0 ]]; then
for desiredUser in ${chooseUserOptions} for desiredUser in ${chooseUserOptions}; do
do
pivpnUser=${desiredUser} pivpnUser=${desiredUser}
echo "::: Using User: $pivpnUser" echo "::: Using User: $pivpnUser"
echo "${pivpnUser}" > /tmp/pivpnUSR echo "${pivpnUser}" > /tmp/pivpnUSR
@ -185,7 +183,6 @@ chooseUser() {
fi fi
} }
verifyFreeDiskSpace() { verifyFreeDiskSpace() {
# If user installs unattended-upgrades we'd need about 60MB so will check for 75MB free # If user installs unattended-upgrades we'd need about 60MB so will check for 75MB free
echo "::: Verifying free disk space..." echo "::: Verifying free disk space..."
@ -240,7 +237,7 @@ chooseInterface() {
mode="ON" mode="ON"
fi fi
interfacesArray+=("${line}" "available" "${mode}") interfacesArray+=("${line}" "available" "${mode}")
done <<< "$availableInterfaces" done <<< "${availableInterfaces}"
# Find out how many interfaces are available to choose from # Find out how many interfaces are available to choose from
interfaceCount=$(echo "${availableInterfaces}" | wc -l) interfaceCount=$(echo "${availableInterfaces}" | wc -l)
@ -709,7 +706,7 @@ confOpenVPN() {
$SUDO rm -rf /etc/openvpn/easy-rsa/ $SUDO rm -rf /etc/openvpn/easy-rsa/
fi fi
# zzz Get the PiVPN easy-rsa # Get the PiVPN easy-rsa
wget -q -O "/tmp/EasyRSA-${easyrsaVer}" "${easyrsaRel}" wget -q -O "/tmp/EasyRSA-${easyrsaVer}" "${easyrsaRel}"
tar xzf /tmp/EasyRSA-${easyrsaVer} -C /tmp tar xzf /tmp/EasyRSA-${easyrsaVer} -C /tmp
$SUDO mv /tmp/EasyRSA-${easyrsaVer}/ /etc/openvpn/easy-rsa/ $SUDO mv /tmp/EasyRSA-${easyrsaVer}/ /etc/openvpn/easy-rsa/
@ -733,7 +730,7 @@ echo "${String}" | $SUDO tee /etc/openvpn/easy-rsa/vars >/dev/null
# Edit the KEY_SIZE variable in the vars file to set user chosen key size # Edit the KEY_SIZE variable in the vars file to set user chosen key size
cd /etc/openvpn/easy-rsa || exit cd /etc/openvpn/easy-rsa || exit
$SUDO sed -i "s/\(KEY_SIZE=\).*/\1 ${ENCRYPT}/" vars $SUDO sed -i "s/\(KEY_SIZE\).*/\1 ${ENCRYPT}/" vars
# Remove any previous keys # Remove any previous keys
${SUDOE} ./easyrsa --batch init-pki ${SUDOE} ./easyrsa --batch init-pki
@ -762,7 +759,6 @@ fi
# Generate static HMAC key to defend against DDoS # Generate static HMAC key to defend against DDoS
${SUDOE} openvpn --genkey --secret pki/ta.key ${SUDOE} openvpn --genkey --secret pki/ta.key
#zzz up to here
# Write config file for server using the template .txt file # Write config file for server using the template .txt file
$SUDO cp /etc/.pivpn/server_config.txt /etc/openvpn/server.conf $SUDO cp /etc/.pivpn/server_config.txt /etc/openvpn/server.conf
@ -770,7 +766,7 @@ fi
$SUDO sed -i "s/LOCALMASK/${LOCALMASK}/g" /etc/openvpn/server.conf $SUDO sed -i "s/LOCALMASK/${LOCALMASK}/g" /etc/openvpn/server.conf
# Set the user encryption key size # Set the user encryption key size
$SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/keys\/dh\).*/\1${ENCRYPT}.pem/" /etc/openvpn/server.conf $SUDO sed -i "s/\(dh \/etc\/openvpn\/easy-rsa\/pki\/dh\).*/\1${ENCRYPT}.pem/" /etc/openvpn/server.conf
# if they modified port put value in server.conf # if they modified port put value in server.conf
if [ $PORT != 1194 ]; then if [ $PORT != 1194 ]; then
@ -783,8 +779,8 @@ fi
fi fi
# write out server certs to conf file # write out server certs to conf file
$SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/keys\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf $SUDO sed -i "s/\(key \/etc\/openvpn\/easy-rsa\/pki\/\).*/\1${SERVER_NAME}.key/" /etc/openvpn/server.conf
$SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/keys\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf $SUDO sed -i "s/\(cert \/etc\/openvpn\/easy-rsa\/pki\/\).*/\1${SERVER_NAME}.crt/" /etc/openvpn/server.conf
} }
confUnattendedUpgrades() { confUnattendedUpgrades() {
@ -881,10 +877,10 @@ confOVPN() {
exit 1 exit 1
fi fi
$SUDO cp /etc/.pivpn/Default.txt /etc/openvpn/easy-rsa/keys/Default.txt $SUDO cp /etc/.pivpn/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt
if [ "$METH" == "$IPv4pub" ]; then if [ "$METH" == "$IPv4pub" ]; then
$SUDO sed -i 's/IPv4pub/'"$IPv4pub"'/' /etc/openvpn/easy-rsa/keys/Default.txt $SUDO sed -i 's/IPv4pub/'"$IPv4pub"'/' /etc/openvpn/easy-rsa/pki/Default.txt
else else
until [[ $publicDNSCorrect = True ]] until [[ $publicDNSCorrect = True ]]
do do
@ -896,7 +892,7 @@ confOVPN() {
fi fi
if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\n\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\n\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then
publicDNSCorrect=True publicDNSCorrect=True
$SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/keys/Default.txt $SUDO sed -i 's/IPv4pub/'"$PUBLICDNS"'/' /etc/openvpn/easy-rsa/pki/Default.txt
else else
publicDNSCorrect=False publicDNSCorrect=False
@ -906,16 +902,16 @@ confOVPN() {
# if they modified port put value in Default.txt for clients to use # if they modified port put value in Default.txt for clients to use
if [ $PORT != 1194 ]; then if [ $PORT != 1194 ]; then
$SUDO sed -i -e "s/1194/${PORT}/g" /etc/openvpn/easy-rsa/keys/Default.txt $SUDO sed -i -e "s/1194/${PORT}/g" /etc/openvpn/easy-rsa/pki/Default.txt
fi fi
# if they modified protocol put value in Default.txt for clients to use # if they modified protocol put value in Default.txt for clients to use
if [ "$PROTO" != "udp" ]; then if [ "$PROTO" != "udp" ]; then
$SUDO sed -i -e "s/proto udp/proto tcp/g" /etc/openvpn/easy-rsa/keys/Default.txt $SUDO sed -i -e "s/proto udp/proto tcp/g" /etc/openvpn/easy-rsa/pki/Default.txt
fi fi
# verify server name to strengthen security # verify server name to strengthen security
$SUDO sed -i "s/SRVRNAME/${SERVER_NAME}/" /etc/openvpn/easy-rsa/keys/Default.txt $SUDO sed -i "s/SRVRNAME/${SERVER_NAME}/" /etc/openvpn/easy-rsa/pki/Default.txt
$SUDO mkdir "/home/$pivpnUser/ovpns" $SUDO mkdir "/home/$pivpnUser/ovpns"
$SUDO chmod 0777 -R "/home/$pivpnUser/ovpns" $SUDO chmod 0777 -R "/home/$pivpnUser/ovpns"