Commit graph

324 commits

Author SHA1 Message Date
Orazio
8e514a5f74 Update EasyRSA and unattended upgrades config
- EasyRSA 3.0.6 -> 3.0.7
  - Unattended upgrades config 1.16 -> 2.4
2020-06-06 15:39:37 +02:00
Orazio
ad363b717b Moved package check to relevant preconfigurePackages() function 2020-05-29 17:49:25 +02:00
Orazio
ba7c46aae8 Avoid hardcoding distribution codenames
- Actually check for apt >= 1.5 instead of checking for distributions
    known for having a newer package
2020-05-29 15:56:43 +02:00
Orazio
c8a9e2100a Changed how undocumented flags are managed
- Renamed '--i_do_not_follow_recommendations' to '--skip-space-check', since
    the argument actually skips the space check.
  - Obtain the unattended configuration dynamically, by looking at the argument
    next to '--unattended', instead of looking at the second argument, which
    was a too fragile parsing.
  - Because of the previous one, figuring out when no argument has been passed
    to '--unattended' doesn't seem trivial, because the next argument could be
    an undocumented flag as well, which would be intepreted as a filename.
2020-05-28 15:16:45 +02:00
Orazio
ba4c2c91db Allow (potentially) unsupported network interfaces via the '--show-unsupported-nics' argument 2020-05-28 13:59:18 +02:00
Orazio
61c7151e3b Create directory structure if missing
- /usr/local/src, when cloning the git repository
  - /opt (this one was already taken into account but I had accidentally
    removed the mkdir command in the previous commit).
2020-05-28 12:09:02 +02:00
Orazio
823afa3fbb Improved dual VPN uninstallation, remove duplicate code/script
- Allow using 'pivpn vpn -u' to directly uninstall VPN 'vpn'
  - Also allow using 'pivpn -u' with two VPNs (will present a dialog).
  - During uninstall, ask which VPN to remove only if there are two VPNs
  - PiVPN git repo will be downloaded to '/usr/local/src/pivpn'. All scripts
    in /opt/pivpn, the main pivpn script and the bash completion file,
    are now just symbolic links. Resolves issue #695.
  - Remove unused call to updateWireGuard().
2020-05-27 16:36:26 +02:00
Orazio
1dc10e7d54
Merge pull request #1054 from shelleycat485/test
Tidy dual VPN protocol install
2020-05-26 09:55:22 +02:00
shelleycat485
3f1b2ba576 put repository back to pivpn/pivpn 2020-05-25 15:54:39 +01:00
shelleycat485
6cfe936f55 self_check assign parameter 2020-05-25 15:43:31 +01:00
shelleycat485
15804dff39 selfcheck checks one VPN type again 2020-05-25 15:24:50 +01:00
Orazio
5dc7ac2a38 Fix issue #1047 2020-05-23 15:26:03 +02:00
Orazio
3ec566c762 Fix issue #1015 2020-05-23 15:12:14 +02:00
shelleycat485
4ac2855990
Update install.sh
remove refs to /etc/pivpn/setupVars in selfcheck and debug scripts
tidy indenting
on install, check if symlink already exists before making one to avoid error
uninstall indicates which vpns are available for uninstall
selfcheck checks both protocols if both present
install - additional text in reconfigure saying 2nd protocol can be added
change to use pivpn ovpn instaed of pivpn opv when dual protocols exist
2020-05-22 17:47:01 +01:00
shelleycat485
e110286a13 added install.sh to change 2020-05-22 12:46:37 +01:00
Orazio
35f07b2147
Merge pull request #1048 from shelleycat485/master
Both wireguard and openvpn can be installed together (Issue #968)
2020-05-19 14:06:58 +02:00
shelleycat485
d4b3c9ee89 both wg and openvpn can be installed 2020-05-14 15:32:19 +01:00
Ubuntu
e700cf1c8f bash_completion not used in dual 2020-05-13 19:49:48 +00:00
shelleycat485
4e3a57b9aa better uninstall.sh 2020-05-13 00:51:45 +01:00
shelleycat485
be3ee13586
Update install.sh 2020-05-11 16:49:10 +01:00
Ubuntu
501b9919a8 after ubuntu testing 2020-05-10 16:37:30 +00:00
shelleycat485
052376a133 install.sh path correct 2020-05-06 22:03:38 +01:00
shelleycat485
081bf912c2 still debugging dual 2020-05-05 23:12:32 +01:00
shelleycat485
4e3a58702f more dual 2020-05-05 00:05:10 +01:00
shelleycat485
3ed9ec5724 install and uninstall 2020-05-02 00:06:09 +01:00
root
f379ca2e10 initial dual install try 2020-04-28 23:44:56 +01:00
Orazio
1f506f50a6
Merge pull request #1023 from jellemdekker/feature/unique_client_psk
Generate unique pre-shared key for each client
2020-04-23 11:15:48 +02:00
jellemdekker
e643acce17 Generate a unique pre-shared key for each client as per WireGuard protocol to improve post-quantum resistance. 2020-04-21 10:52:35 +02:00
James
9b772ac4fb
fix: typos and grammar 2020-04-20 17:33:27 +02:00
rayden84
df43513354
Update install.sh
fix small typo in whiptail dialog text word ("especially")
2020-03-22 17:51:41 +01:00
Orazio
650032e5f2 Use safer 'apt-cache policy' filtering 2020-03-16 18:32:39 +01:00
Orazio
eae70d0295 Verify that the available OpenVPN version has ECC support 2020-03-12 13:00:18 +01:00
Orazio
9c4b87f4ab Do not add repositories if OpenVPN or WireGuard can be found inside available sources 2020-03-10 14:14:16 +01:00
Orazio
32acdd634b Use LC_ALL=C for the whole script
- Fixes 'apt-cache policy something | grep somethingelse'
2020-03-10 13:02:35 +01:00
Orazio
c1c1720aef Download OpenVPN key via HTTPS if retrieving via keyserver fails 2020-03-10 13:00:23 +01:00
Orazio
0a30365d65 Some changes from pull request 963
- Make sure to install WireGuard only if platform is Raspbian or an x86 Debian/Ubuntu
  - Install WireGuard from bullseye repository instead of unstable
  - Reduced WireGuard package priority to the minimum that allows upgrades
2020-03-04 12:48:14 +01:00
Orazio
f749d6b722 Fix for issue #962 2020-02-26 09:49:49 +01:00
MichaIng
ba79e14175
Apply the x86-only OpenVPN repo on x86 systems only 2020-02-26 00:13:46 +01:00
Orazio
9846d3787a Use variables to define VPN ranges instead of hard coding IPs 2020-02-16 09:09:09 +01:00
Orazio
edbd23a2a1 Fixed missing condition in if statement when deciding whether to listen on tun0/wg0 2020-02-15 13:24:42 +01:00
Orazio
660d83468c Drop libmnl-dev requirement on armv6l
- https://lists.zx2c4.com/pipermail/wireguard/2020-February/004963.html
2020-02-13 11:42:23 +01:00
Orazio
87cf243abc Fix Pi-hole support when dnsmasq is set to listen on all interfaces 2020-02-13 11:30:13 +01:00
Orazio
41ed9c4a6f Minor fixes
- LC_ALL=C should be the canonical way to override the locale, instead
    of setting a specific one.
  - apt-transport-https is required on Ubuntu < Bionic and Debian < Buster
2020-02-11 12:17:34 +01:00
Orazio
337fa10fdc Improvements when importing GPG keys
- Importing OpenVPN PGP key from keyserver should be more secure than
    downloading from the website as we specifically tell the keyserver
    which key we want, referring to its fingerprint
  - Exit if import is unsuccessful
2020-02-11 12:17:29 +01:00
Orazio
3730d315e9 Automatic backup of existing OpenVPN/WireGuard folder should only be readable by root 2020-02-10 17:58:32 +01:00
Orazio
6fd451dac0 apt-transport-https is required since we will use HTTPS repos in the script 2020-02-10 17:34:11 +01:00
Orazio
ead280e60f Set static IPs when using OpenVPN
- Preparation for feature request from issue #942
2020-02-09 18:51:30 +01:00
Orazio
3f616d9254 Implemented feature request from issue #942 (WireGuard) 2020-02-07 18:07:15 +01:00
4s3ti
5b8494c57c Going back to pivpn.io
replaced pivpn.dev with pivpn.io
2020-02-05 20:29:14 +01:00
Orazio
d691321b3e
Merge test (#929)
* added link to server status dashboard

* Replaced Header with bold instead

* More safeguards, some fixes, standardized some code, WireGuard update script, removed redundant code

  - Add curl as a dependency for those who run the script without 'curl URL | bash'.
  - Use POSIX 'command -v' instead of 'hash'.
  - Check if packages have actually been installed and abort execution if they have not.
  - Fixed issue with getStaticIPv4Settings() that prevented existing network settings
    to be used as static IP settings when running the script unattended with empty
    $IPv4addr and $IPv4gw variables.
  - Exit if processing wireguard-linux-compat fails.
  - Exit if 50unattended-upgrades fails to extract.
  - Exit clientSTAT.sh if the wg0 interface is not available.
  - Moved the Self Check to a single script since dedicated versions were very similar.
  - Add 'pivpn -wg' to update WireGuard for users running Raspbian with armv6l kernel.

* Fixed cosmetic issue with spinner, added missing spinner to some APT commands

* Detect current netmask, validate user input when configuring a static IP

* Inform the user when updating the package cache, which can be slow on some RPis

* Invalidate $IPv4Addr and $IPv4gw when the user claims those settings are not correct

* Restart pihole in the more appropriate restartServices() function

* Improve static IP selection, validate public DNS name of the server
  - Default to 'No' when asking if the RPi has DHCP reservation, considered
    that the user may not be fully aware, furthermore, setting a static IP
    anyways doesn't do harm.
  - Validate existing IPv4 settings (address, gateway, DNS) to avoid filling
    '/etc/dhcpcd.conf' with invalid data.
  - Validate public DNS name of the server inside askPublicIPOrDNS() function

* Check DH parameters, fix 'pivpn -c', improvements when dealing with external repositories
  - Added a basic sanity check to downloaded DH paramenters, which doubles as a
    check for missing .pem file.
  - Fix 'pivpn -c' showing the month number instead of the day of the month when
    using WireGuard.
  - Removing APT keys is risky, it would break APT update/upgrade if the user
    already was already using the unstable repo.
  - Replaced 'Checking for $i... installed' in favor of a more clear 'Checking for
    $i... already installed'.
  - Check whether the OpenVPN repo and the Debian unstable repo are already used.

* Improvements to getStaticIPv4Settings()

  - Use a regular expression to extract IPs from the 'ip' command. With this,
    there is a little need to validate output. Even though the regex will match
    invalid IPs like 192.168.23.444, 'ip' can't return them, and even if it did,
    the script would not have reached this function due to previous functions
    using the network with broken routes and addresses.

  - Get the IP address from the selected interface rather then from the 'ip route'
    command as it's not guaranteed that such IP is the same of the interface the
    user decided to use (though on a Raspberry Pi inside a home LAN, most likely
    it is, but it also maskes easier to get the IP in the CIDR notation with a
    single 'ip | grep' pipe).

* Moved command substitution to specific functions to avoid unnecessary execution

  - Moved $availableInterfaces and $CurrentIPv4gw from the script header to
    their relevant function, considered that if the OS is not Raspbian a static
    IP is not set, so those variables are not used.

* Copy files from git repo using the 'install' command, switch DH params from 2ton.com.au to RFC 7919

  - Now using DH parameters suggested by the RFC 7919 for use by TLS servers (the user can
    still generate his own if he wishes).
    https://wiki.mozilla.org/Security/Archive/Server_Side_TLS_4.0#Pre-defined_DHE_groups
2020-01-31 16:40:09 +01:00