Commit graph

341 commits

Author SHA1 Message Date
Orazio
32acdd634b Use LC_ALL=C for the whole script
- Fixes 'apt-cache policy something | grep somethingelse'
2020-03-10 13:02:35 +01:00
Orazio
c1c1720aef Download OpenVPN key via HTTPS if retrieving via keyserver fails 2020-03-10 13:00:23 +01:00
Orazio
0a30365d65 Some changes from pull request 963
- Make sure to install WireGuard only if platform is Raspbian or an x86 Debian/Ubuntu
  - Install WireGuard from bullseye repository instead of unstable
  - Reduced WireGuard package priority to the minimum that allows upgrades
2020-03-04 12:48:14 +01:00
Orazio
f749d6b722 Fix for issue 2020-02-26 09:49:49 +01:00
MichaIng
ba79e14175
Apply the x86-only OpenVPN repo on x86 systems only 2020-02-26 00:13:46 +01:00
Orazio
9846d3787a Use variables to define VPN ranges instead of hard coding IPs 2020-02-16 09:09:09 +01:00
Orazio
edbd23a2a1 Fixed missing condition in if statement when deciding whether to listen on tun0/wg0 2020-02-15 13:24:42 +01:00
Orazio
660d83468c Drop libmnl-dev requirement on armv6l
- https://lists.zx2c4.com/pipermail/wireguard/2020-February/004963.html
2020-02-13 11:42:23 +01:00
Orazio
87cf243abc Fix Pi-hole support when dnsmasq is set to listen on all interfaces 2020-02-13 11:30:13 +01:00
Orazio
41ed9c4a6f Minor fixes
- LC_ALL=C should be the canonical way to override the locale, instead
    of setting a specific one.
  - apt-transport-https is required on Ubuntu < Bionic and Debian < Buster
2020-02-11 12:17:34 +01:00
Orazio
337fa10fdc Improvements when importing GPG keys
- Importing OpenVPN PGP key from keyserver should be more secure than
    downloading from the website as we specifically tell the keyserver
    which key we want, referring to its fingerprint
  - Exit if import is unsuccessful
2020-02-11 12:17:29 +01:00
Orazio
3730d315e9 Automatic backup of existing OpenVPN/WireGuard folder should only be readable by root 2020-02-10 17:58:32 +01:00
Orazio
6fd451dac0 apt-transport-https is required since we will use HTTPS repos in the script 2020-02-10 17:34:11 +01:00
Orazio
ead280e60f Set static IPs when using OpenVPN
- Preparation for feature request from issue 
2020-02-09 18:51:30 +01:00
Orazio
3f616d9254 Implemented feature request from issue (WireGuard) 2020-02-07 18:07:15 +01:00
4s3ti
5b8494c57c Going back to pivpn.io
replaced pivpn.dev with pivpn.io
2020-02-05 20:29:14 +01:00
Orazio
d691321b3e
Merge test ()
* added link to server status dashboard

* Replaced Header with bold instead

* More safeguards, some fixes, standardized some code, WireGuard update script, removed redundant code

  - Add curl as a dependency for those who run the script without 'curl URL | bash'.
  - Use POSIX 'command -v' instead of 'hash'.
  - Check if packages have actually been installed and abort execution if they have not.
  - Fixed issue with getStaticIPv4Settings() that prevented existing network settings
    to be used as static IP settings when running the script unattended with empty
    $IPv4addr and $IPv4gw variables.
  - Exit if processing wireguard-linux-compat fails.
  - Exit if 50unattended-upgrades fails to extract.
  - Exit clientSTAT.sh if the wg0 interface is not available.
  - Moved the Self Check to a single script since dedicated versions were very similar.
  - Add 'pivpn -wg' to update WireGuard for users running Raspbian with armv6l kernel.

* Fixed cosmetic issue with spinner, added missing spinner to some APT commands

* Detect current netmask, validate user input when configuring a static IP

* Inform the user when updating the package cache, which can be slow on some RPis

* Invalidate $IPv4Addr and $IPv4gw when the user claims those settings are not correct

* Restart pihole in the more appropriate restartServices() function

* Improve static IP selection, validate public DNS name of the server
  - Default to 'No' when asking if the RPi has DHCP reservation, considered
    that the user may not be fully aware, furthermore, setting a static IP
    anyways doesn't do harm.
  - Validate existing IPv4 settings (address, gateway, DNS) to avoid filling
    '/etc/dhcpcd.conf' with invalid data.
  - Validate public DNS name of the server inside askPublicIPOrDNS() function

* Check DH parameters, fix 'pivpn -c', improvements when dealing with external repositories
  - Added a basic sanity check to downloaded DH paramenters, which doubles as a
    check for missing .pem file.
  - Fix 'pivpn -c' showing the month number instead of the day of the month when
    using WireGuard.
  - Removing APT keys is risky, it would break APT update/upgrade if the user
    already was already using the unstable repo.
  - Replaced 'Checking for $i... installed' in favor of a more clear 'Checking for
    $i... already installed'.
  - Check whether the OpenVPN repo and the Debian unstable repo are already used.

* Improvements to getStaticIPv4Settings()

  - Use a regular expression to extract IPs from the 'ip' command. With this,
    there is a little need to validate output. Even though the regex will match
    invalid IPs like 192.168.23.444, 'ip' can't return them, and even if it did,
    the script would not have reached this function due to previous functions
    using the network with broken routes and addresses.

  - Get the IP address from the selected interface rather then from the 'ip route'
    command as it's not guaranteed that such IP is the same of the interface the
    user decided to use (though on a Raspberry Pi inside a home LAN, most likely
    it is, but it also maskes easier to get the IP in the CIDR notation with a
    single 'ip | grep' pipe).

* Moved command substitution to specific functions to avoid unnecessary execution

  - Moved $availableInterfaces and $CurrentIPv4gw from the script header to
    their relevant function, considered that if the OS is not Raspbian a static
    IP is not set, so those variables are not used.

* Copy files from git repo using the 'install' command, switch DH params from 2ton.com.au to RFC 7919

  - Now using DH parameters suggested by the RFC 7919 for use by TLS servers (the user can
    still generate his own if he wishes).
    https://wiki.mozilla.org/Security/Archive/Server_Side_TLS_4.0#Pre-defined_DHE_groups
2020-01-31 16:40:09 +01:00
Orazio
f2fa01e3a5 Fix WireGuard not starting on a clean install of Raspbian
- If the kernel is out of sync with the repo, have the user upgrade
    his system and reboot before installing WireGuard.
2020-01-30 14:16:39 +01:00
Orazio
4a49787b28 Changed variable name, corrected rm typo 2020-01-21 15:54:20 +01:00
Orazio
44feb0b853 Added back ECDSA and tls-crypt 2020-01-21 13:51:25 +01:00
Orazio
30b374054c Enable cloneandupdate() function, fixed detecting existing iptables rules.
- Uncommented lines inside the cloneandupdate() function in the update script, so pivpn -up can pull scripts from the master branch
  - The script was checking for the existence of PiVPN rules in the INPUT and FORWARD chain by passing 'iptables -t nat -S' to grep, but it couldn't find them as they belong to the filer table and not the nat table. The correct command is 'iptables -S'
2020-01-20 21:51:36 +01:00
Orazio
038473c6c5 Rename 'limit-unstable' to 'pivpn-limit-unstable' 2020-01-20 11:46:17 +01:00
Orazio
0999b0dd7c Resolved merge conflicts (2) 2020-01-20 11:13:39 +01:00
Orazio
dba3e6ad3e - Prepend 'pivpn-' to unstable repo files to limit naming conflicts
- Update variables inside unattended examples
- Remove openvpn logging setting when uninstalling the package
- Run 'apt-get update' after removing the WireGuard PPA
2020-01-20 09:56:07 +01:00
Orazio
69606f7207 - Allow setting DHCP reservation preference with --unattended
- Flip condition check on $dhcpReserv: first check if empty, and if not, check if it's not 1.
  Doing it the other way (first check if not 1) would give a shell error if $dhcpReserv was empty.
2020-01-20 09:34:43 +01:00
Orazio
fc9a9f5ab7
Use metapackage to install kernel headers on Ubuntu
The ‘linux-headers-generic’ package is preferred over the version-specific headers package as the generic will be automatically  updated with the kernel, whereas the other will not.
2020-01-18 22:04:18 +01:00
4s3ti
1884be8afb Distro Support, Bug Fixes, Unattended install
Tested and added Support on Debian 9
tested and added support on Ubuntu 16.04 & 18.08
  * Fixed wireguard not installing, added pkg cache update after adding ppa
  * added kernel headers to dependencies as its requred for wireguard-dkms
unattended install
  * When user is provided and doest exist, it will create one without password set
2020-01-18 20:01:39 +01:00
4s3ti
e0d45db762 Variable Quoting
Quoted variables,
Added shellcheck disables.
2020-01-09 00:45:04 +01:00
4s3ti
e2eea482d0 Replace /etc/.pivpn/ with $pivpnFilesDir
/etc/.pivpn/ is refferenced multiple times trough the script,
Replaced all of them with $pivpnFilesDir
Quoted some unquoted vars
2020-01-09 00:22:15 +01:00
4s3ti
dd6bb069f0 Updates and improvements
install.sh
  installScripts function:
    update script not being copied over to /opt therefore update funcion was probably broken.
    changed script to copy all .sh scripts from .pivpn/scripts directory.

Issue : fix backup script
  I was probably very drunk when i first wrote this backup script.
  fixed it, now works with new code refactoring,
  loads vars from setupVars
  Added backup for wireguard
  Moved script to global pivpnscripts.
  Added backup script to bash-completion
  Added backup script to pivpn script

update.sh
  Commented the update from master branch to avoid users trying to update test from master.

Updated LatestChages.md
2020-01-08 19:38:38 +01:00
4s3ti
412c8e83ac Issue
InstallScripts function:
  Added -p flag on mkdir, this fixes script silently exiting if /opt
  does not exist (Issue )
2020-01-08 13:16:01 +01:00
4s3ti
92381fc2a6 Removed echos
Removed echos i have introduced before exits,
for the *dumb* obvious reasons were causing script to exit.
2020-01-08 02:12:13 +01:00
4s3ti
e6fdfd29b7 Code review, Cleanup.
Moved installPiVPN up, to better match the order when it is called.
Added Some cuotes to make shellcheck happy.
Added exit codes and error messages in case cd fails to not exit
silently.
2020-01-07 20:27:19 +01:00
Orazio
1d0c66a970 Use radiolist to select a VPN 2020-01-07 01:45:06 +01:00
4s3ti
b9f237fe92 Changes for FR
Support For DHCP IP Reservation

Main:
  - added If statement to skipp SetStaticIPv4 if dhcpRserv=1

getStaticIPv4Settings:
  - Added Whiptail asking if user wants to use DHCP reservation Settings, this will add dhcpReserv and
    skip setStaticIPv4 while still logging everything.
ConfigExample files:
  - Added staticReserv=0 to config examples. so it can be used with Unattended install
    * 0 means static ip will be setup.
    * 1 means DHCP Reservation will be used and no chage will be made to the interfaces
2020-01-07 01:30:17 +01:00
4s3ti
5cea5bddf8 Code Review: Improvements & Bug Fixes
* Removed Unecessary pipe on availableInterfaces
* Changed OS Support messages accross the script
  - Removed OS Version names from the script, this avoids having to change the code everytime a new OS Version is Released, instead we update the wiki with propper information.
* Changed MaybeOSSupport whiptail tiltes and messages to make it more clear.
  - Messages and titles could cause confusion to users and specially developers
* Moved Funcions Comment to correct place.
* DistroCheck Function:
  - Moved up before other functions so it better refflects the order they are called.
  - changed Case identation to make it easier to read.
  - Added info to # compatibility Comment, Removed unecessary comments
  - added break to exit out of case, easier to understand that the script should move on.
* Added Shellcheck ignores,
* chooseinterface Function:
  - Changed function Logic and cleaned it up
  - Fixed Issue 
  - Added exit code if no interfaces are found
* Updated LatestUpdate.md
2020-01-06 02:06:47 +01:00
Orazio
ba3bf24d89
Merge branch 'test' into test 2020-01-03 18:08:23 +01:00
h-town
465d157a19
Revise route query for IP & GW selection from Quad9 to TEST-NET-1 2020-01-03 10:56:28 -06:00
h-town
78a6f14742
Replace mention of 'Google' with 'Quad9' 2020-01-03 10:43:23 -06:00
Orazio
ef6e84419e Fix typo and mv command 2020-01-02 18:50:12 +01:00
Orazio
ed46588900 Add rm safeguard to updateRepo(), update README 2019-12-31 10:43:10 +01:00
Orazio
41984e5f40 Fix update scripts from test branch 2019-12-30 11:44:33 +01:00
Orazio
a6087f8bda bc is not actually required when installing via DKMS 2019-12-29 18:35:37 +01:00
Orazio
a561607272 Mostly changes to the install script, see below
Handle running the install script over an existing installation (as the script already did before branching to test-wireguard), providing:
    - Update, downloads latest scripts from git repo
    - Repair, reinstall PiVPN while keeping existing settings
    - Reconfigure, start over overwriting the existing settings
  Tag iptables rules as an attempt to make sure that the uninstall script only removes PiVPN rules
  Change the armv6l installation to reflect the split of WireGuard snapshots into wireguard-linux-compat and wireguard-tools
2019-12-29 18:25:35 +01:00
Orazio
d17d381049 - When suggesting to use Pi-hole, use the VPN server IP instead of the LAN IP to allow
DNS resolution even if the user does not route the local network through the tunnel.

- Format listCONF in a similar way as listOVPN

- Specifically look for a free octet in the last word of clients.txt and not just any word.
  Necessary otherwhise public keys starting with a number will match against an octet.
  Example: if line is 'name 5abcdefgh 4', then looking for ' 5' will match but '5$' will
  not (correctly).

- 'pivpn -c' will show the Connected Clients List for WireGuard too
2019-12-27 15:48:42 +01:00
h-town
e01089945e
Remove Google DNS
Remove Google DNS for privacy purposes, replace with Quad9
2019-12-24 03:18:11 -06:00
4s3ti
33b2b2468d pivpn.io to pivpn.dev, http to https
Changed all appearances of pivpn.io to pivpn.dev
Changed all appearances of http to https
2019-12-20 23:30:00 +01:00
Orazio
5f82a0740e Use variable, create openvpn home, add shellcheck reminder 2019-12-10 19:07:08 +01:00
Orazio
c20e7d2150 Use ${pivpnNET} and ${subnetClass} when adding ufw nat rules 2019-12-10 16:49:40 +01:00
Orazio
d022cafa25 Revert some minor changes 2019-12-10 16:06:28 +01:00
Orazio
ca11f79629
Merge pull request from corbolais/shellcheck4test
Shellcheck4test
2019-12-10 14:57:44 +01:00
Orazio
95b5934814
Merge branch 'test' into ufw-care 2019-12-10 14:56:38 +01:00
Orazio
85907f6b80
Merge branch 'test' into shellcheck4test 2019-12-10 14:53:11 +01:00
Orazio
8936dd2b08
Merge pull request from corbolais/debian-ownership
debian openvpn has dedicated user and group, so rather use those than…
2019-12-10 14:49:23 +01:00
Orazio
3687a124bd
Merge pull request from corbolais/dns-4test
add local resolver as DNS option.
2019-12-10 14:36:30 +01:00
corbolais
41dbf2b5c6 merge: drop bsdmainutils pkg
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-09 19:18:58 +01:00
Orazio
cd1b8fbf7f Use printf with column in the listCONF.sh script 2019-12-09 17:05:34 +01:00
corbolais
e76f3755ab consistent use of pivpnNET, subnetClass and vpnGw.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-09 12:41:40 +01:00
corbolais
55dc52d3e0 use openvpn:openvpn user/group ownership unconditionally.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 20:41:11 +01:00
corbolais
e72786e8de W/space
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 20:37:41 +01:00
corbolais
3c280e0a94 Mostly bug fixes. Mostly harmless.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 20:35:41 +01:00
corbolais
a05754ea19 shellcheck install.sh. render into sound bashing. correct sed call.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 20:14:23 +01:00
corbolais
1aa6472b72 chg: openvpn-user home, shell.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 17:40:30 +01:00
corbolais
6e763e0240 Debian: add openvpn user/group if missing.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 17:34:57 +01:00
corbolais
9c62fe0991 take care of /etc/ufw/before.rules nat section. safeguard against accidentally killing the file.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 17:18:08 +01:00
corbolais
8affc9a313 debian openvpn has dedicated user and group, so rather use those than nobody:nogroup (as do _many_ other packages and thus all having access to such owned files).
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 16:39:46 +01:00
corbolais
93044d6f6d add local resolver as DNS option.
Signed-off-by: corbolais <corbolais@gmail.com>
2019-12-08 16:13:26 +01:00
Orazio
4466f1503c Better client stats formatting 2019-12-03 17:59:27 +01:00
Orazio
e2941f8fae Properly avoid pulling unwanted packages from unstable repo
Currently apt pulls all packages from the unstable repo because the
  script intendation created the file 'limit-unstable' with tabs in it.
  Fixed using printf to create a multiline file (which is the way
  wireguard.com/install suggests).
2019-12-02 17:00:39 +01:00
cfcolaco
d243d9ae12 Fixed Typo
Line 1262: s/jkkprintf/printf/
2019-11-29 10:45:32 +01:00
Orazio
d34577329e Removed reference to deleted branch 2019-11-27 11:59:53 +01:00
Orazio
a03d4e1be2 Fix typo 2019-11-20 18:50:57 +01:00
Orazio
e2da52b1a7 Added Ubuntu Bionic support 2019-11-19 17:29:41 +01:00
Orazio
1ff6f7e9e8 Removed trivial command output 2019-11-18 12:42:04 +01:00
Orazio
34c10a81f3 Renamed pivpnDOMAIN to pivpnSEARCHDOMAIN 2019-11-16 21:25:34 +01:00
Orazio
8ab71601ff Automatically fetch latest WireGuard snapshot 2019-11-16 17:02:15 +01:00
Orazio
d7ebb4cca9 Unattended installation 2019-11-16 14:58:58 +01:00
Orazio
5cb8a05317 Minor unattended fixes, adjusted openvpn settings 2019-11-14 17:42:56 +01:00
Orazio
07abfc97e9 Added unattended installation, fixed some variables 2019-11-14 15:07:01 +01:00
Orazio
6bd0beeb94 Fixed missing protocol variable 2019-11-07 18:12:06 +01:00
Orazio
84f90b00a4 Added uninstall and Pi-hole detection 2019-11-07 17:29:21 +01:00
4s3ti
080b335047
Merge pull request from IcedComputer/patch-3
Create OVPN12_Compatible file
2019-10-19 11:58:03 +02:00
IcedComputer
fa21666869
Create OVPN12_capable file
MakeOVPN has been updated to include the -i iOS function to allow users to create an OVPN12 format file that can be used with the iOS keychain.  Since the OVPN12 format is incompatible with OpenVPN 2.4 - this change creates a configuration file that determines if the user can create a -i request via MakeOVPN.
2019-10-18 21:00:00 -07:00
Orazio
e77f668021 Kernel headers are required when installing from package too 2019-10-16 18:17:16 +02:00
Orazio
5c97221d3f Revert some variable names and fix iptables rules 2019-10-16 12:01:50 +02:00
Orazio
3c973e2a48 Bugfixes 2019-10-14 16:51:43 +02:00
Orazio
1777d5c239 Added back Debian 10 support 2019-10-14 15:06:34 +02:00
Orazio
24a1a00d37 Refactoring + WireGuard support 2019-10-14 12:11:16 +02:00
Rob Gill
da4cc1ced5 Regex specifies : must start with alphanumeric, may have no more
than two consecutive hyphens, must not end or start with hyphen,
final must be at least two apha characters.

Signed-off-by: Rob Gill <rrobgill@protonmail.com>
2019-10-14 19:59:00 +10:00
4s3ti
9f20f50e61 Bugfixes and improvements, check update notes 2019-10-12 18:34:37 +02:00
4s3ti
d0c10db6ec install.sh: apt-get with , uninstall.sh: added var PKG_MANAGER and replaced apt-get with 2019-09-03 10:09:48 +02:00
cfcolaco
510979ae90 removing bitwarden installation from script 2019-09-02 14:27:10 +02:00
cfcolaco
50ad223e83 after merge bugfixes, bitwarden optional, error handling, perm fixes 2019-09-02 13:35:54 +02:00
4s3ti
b1dbe27b2d fixed conflicts between pr and local works 2019-09-01 19:48:50 +02:00
4s3ti
a884d22cbc Issues Introduced with lastest commits:
Install script not creating ovpns dir, and throwing error:

```
cp: cannot stat '/tmp/OLD_UFW': No such file or directory
mkdir: cannot create directory ‘/root\n/usr/sbin\n/bin\n/dev\n/bin\n/usr/games\n/var/cache/man\n/var/spool/lpd\n/var/mail\n/var/spool/news\n/var/spool/uucp\n/bin\n/var/www\n/var/backups\n/var/list\n/var/run/ircd\n/var/lib/gnats\n/nonexistent\n/nonexistent\n/run/systemd\n/run/systemd\n/run/systemd\n/nonexistent\n/run/sshd\n/\n/home/pivpntest/ovpns’: No such file or directory
chmod: cannot access '/root'$'\n''/usr/sbin'$'\n''/bin'$'\n''/dev'$'\n''/bin'$'\n''/usr/games'$'\n''/var/cache/man'$'\n''/var/spool/lpd'$'\n''/var/mail'$'\n''/var/spool/news'$'\n''/var/spool/uucp'$'\n''/bin'$'\n''/var/www'$'\n''/var/backups'$'\n''/var/list'$'\n''/var/run/ircd'$'\n''/var/lib/gnats'$'\n''/nonexistent'$'\n''/nonexistent'$'\n''/run/systemd'$'\n''/run/systemd'$'\n''/run/systemd'$'\n''/nonexistent'$'\n''/run/sshd'$'\n''/'$'\n''/home/pivpntest/ovpns': No such file or directory
```

Found incosistencies in instalation user var/files namings, to have it consistend and easy to understand and considering everyone is more familiar with INSTALL_USER

Changed $pivpnUser to INSTALL_USER
Changed pivpnUSR to INSTALL_USER

Removed PiVPN Secure Notes from PiVPN ADD introduced with PR 
	- Notes not being pushed to BW Vault
	- OVPN files not going to ovpns dir
	- Needs investigation
2019-09-01 19:39:37 +02:00
MichaIng
73b23c525b
Failsafe home dir obtaining
+ When estimating $INSTALL_HOME, assure grep can only match user names, to avoid possible wrong multi-line value
+ Remove possible trailing slash from $INSTALL_HOME, to avoid double slash in "$INSTALL_HOME/ovpns"
+ Avoid "cat <file> | grep <pattern>", since grep can process files directly

Signed-off-by: MichaIng <micha@dietpi.com>
2019-09-01 17:39:38 +02:00
4s3ti
ad466f8728 Permissions hardening and Standardization 2019-09-01 16:10:53 +02:00
4s3ti
1bd8169aa6
Merge branch 'test' into master 2019-09-01 15:32:56 +02:00
IcedComputer
a2f7ef7e34
Update install.sh 2019-08-27 15:46:56 -07:00
IcedComputer
64353e337b
Update install.sh 2019-08-27 15:20:00 -07:00