- Uncommented lines inside the cloneandupdate() function in the update script, so pivpn -up can pull scripts from the master branch
- The script was checking for the existence of PiVPN rules in the INPUT and FORWARD chain by passing 'iptables -t nat -S' to grep, but it couldn't find them as they belong to the filer table and not the nat table. The correct command is 'iptables -S'
- Update variables inside unattended examples
- Remove openvpn logging setting when uninstalling the package
- Run 'apt-get update' after removing the WireGuard PPA
install.sh
installScripts function:
update script not being copied over to /opt therefore update funcion was probably broken.
changed script to copy all .sh scripts from .pivpn/scripts directory.
Issue #871: fix backup script
I was probably very drunk when i first wrote this backup script.
fixed it, now works with new code refactoring,
loads vars from setupVars
Added backup for wireguard
Moved script to global pivpnscripts.
Added backup script to bash-completion
Added backup script to pivpn script
update.sh
Commented the update from master branch to avoid users trying to update test from master.
Updated LatestChages.md
install.sh
installScripts function:
update script not being copied over to /opt therefore update funcion was probably broken.
changed script to copy all .sh scripts from .pivpn/scripts directory.
Issue #871: fix backup script
I was probably very drunk when i first wrote this backup script.
fixed it, now works with new code refactoring,
loads vars from setupVars
Added backup for wireguard
Moved script to global pivpnscripts.
Added backup script to bash-completion
Added backup script to pivpn script
update.sh
Commented the update from master branch to avoid users trying to update test from master.
Updated LatestChages.md
Handle running the install script over an existing installation (as the script already did before branching to test-wireguard), providing:
- Update, downloads latest scripts from git repo
- Repair, reinstall PiVPN while keeping existing settings
- Reconfigure, start over overwriting the existing settings
Tag iptables rules as an attempt to make sure that the uninstall script only removes PiVPN rules
Change the armv6l installation to reflect the split of WireGuard snapshots into wireguard-linux-compat and wireguard-tools
DNS resolution even if the user does not route the local network through the tunnel.
- Format listCONF in a similar way as listOVPN
- Specifically look for a free octet in the last word of clients.txt and not just any word.
Necessary otherwhise public keys starting with a number will match against an octet.
Example: if line is 'name 5abcdefgh 4', then looking for ' 5' will match but '5$' will
not (correctly).
- 'pivpn -c' will show the Connected Clients List for WireGuard too
Currently apt pulls all packages from the unstable repo because the
script intendation created the file 'limit-unstable' with tabs in it.
Fixed using printf to create a multiline file (which is the way
wireguard.com/install suggests).
- exit code 1 means general error hence should not be used for exiting successfully
* added backup script to backup openvpn and pivpn generated certificates
* added update script to update /opt/pivpn scripts, -t | --test | test update from test branch
* Fixed hostname length issue #831
- the script now checks for hostname length right at the beginning and prompts for a new one.
- HOST_NAME to host_name, as best practice variables with capitals, should be used by system variables only.
* fixed ubuntu 18.04 being detected as not supported OS, now fully supported and tested.
* changed how scripts are copied to /opt/pivpn, it hat a lot of long repetitive lines, now it copies all *.sh files making it easier to manage when adding new scripts/features
* Changed how supported OS are presented when maybeOS_Support() is called.
Install script not creating ovpns dir, and throwing error:
```
cp: cannot stat '/tmp/OLD_UFW': No such file or directory
mkdir: cannot create directory ‘/root\n/usr/sbin\n/bin\n/dev\n/bin\n/usr/games\n/var/cache/man\n/var/spool/lpd\n/var/mail\n/var/spool/news\n/var/spool/uucp\n/bin\n/var/www\n/var/backups\n/var/list\n/var/run/ircd\n/var/lib/gnats\n/nonexistent\n/nonexistent\n/run/systemd\n/run/systemd\n/run/systemd\n/nonexistent\n/run/sshd\n/\n/home/pivpntest/ovpns’: No such file or directory
chmod: cannot access '/root'$'\n''/usr/sbin'$'\n''/bin'$'\n''/dev'$'\n''/bin'$'\n''/usr/games'$'\n''/var/cache/man'$'\n''/var/spool/lpd'$'\n''/var/mail'$'\n''/var/spool/news'$'\n''/var/spool/uucp'$'\n''/bin'$'\n''/var/www'$'\n''/var/backups'$'\n''/var/list'$'\n''/var/run/ircd'$'\n''/var/lib/gnats'$'\n''/nonexistent'$'\n''/nonexistent'$'\n''/run/systemd'$'\n''/run/systemd'$'\n''/run/systemd'$'\n''/nonexistent'$'\n''/run/sshd'$'\n''/'$'\n''/home/pivpntest/ovpns': No such file or directory
```
Found incosistencies in instalation user var/files namings, to have it consistend and easy to understand and considering everyone is more familiar with INSTALL_USER
Changed $pivpnUser to INSTALL_USER
Changed pivpnUSR to INSTALL_USER
Removed PiVPN Secure Notes from PiVPN ADD introduced with PR #794
- Notes not being pushed to BW Vault
- OVPN files not going to ovpns dir
- Needs investigation
+ When estimating $INSTALL_HOME, assure grep can only match user names, to avoid possible wrong multi-line value
+ Remove possible trailing slash from $INSTALL_HOME, to avoid double slash in "$INSTALL_HOME/ovpns"
+ Avoid "cat <file> | grep <pattern>", since grep can process files directly
+ Avoid "VAR=$(cat file)", since "VAR=$(<file)" has the same result without using a slow external command
Signed-off-by: MichaIng <micha@dietpi.com>
+ When estimating $INSTALL_HOME, assure grep can only match user names, to avoid possible wrong multi-line value
+ Remove possible trailing slash from $INSTALL_HOME, to avoid double slash in "$INSTALL_HOME/ovpns"
+ Avoid "cat <file> | grep <pattern>", since grep can process files directly
+ Avoid "VAR=$(cat file)", since "VAR=$(<file)" has the same result without using a slow external command
Signed-off-by: MichaIng <micha@dietpi.com>
+ When estimating $INSTALL_HOME, assure grep can only match user names, to avoid possible wrong multi-line value
+ Remove possible trailing slash from $INSTALL_HOME, to avoid double slash in "$INSTALL_HOME/ovpns"
+ Avoid "cat <file> | grep <pattern>", since grep can process files directly
Signed-off-by: MichaIng <micha@dietpi.com>
Code assumes that the specified user directory is under /home. This code parses the /etc/passwd file in order to determine what that user's proper home directory is.
the makeOVPN.sh now generates .ovpn12 files in the /home/${INSTALL_USER}/ovpns/ directory.
The remove script was updated to remove both the .ovpn and .ovpn12 files
Added new step to create an .ovpn12 file that can be stored on iOS keychain
This step is more secure method and does not require the end-user to keep entering passwords, or storing the client private cert where it can be easily tampered based on documentation located:
https://openvpn.net/faq/how-do-i-use-a-client-certificate-and-private-key-from-the-ios-keychain/
Someone can improve upon this by adding a parameter (possibly -i|--iOS) and then generating the original .ovpn file to not contain the client private certificate.
As @fyellin There is some chatter on other groups that some
OpenVPN implementations cannot handle client keys that are
encrypted with RSA.
If the client key is encrypted, we might re-encrypting the
current client key using 3DES.
This commit will convert user client key to 3DES in command
`pivpn -a`
P/S: All credits to @fyellin. Many thanks to him.
::: Create a client ovpn profile, optional nopass
:::
::: Usage: pivpn <-a|add> [-n|--name <arg>] [-p|--password
<arg>]|[nopass] [-h|--help]
:::
::: Commands:
::: nopass Create a client without a password
::: -n,--name Name for the Client (default: 'raspberrypi')
::: -p,--password Password for the Client (no default)
::: -h,--help Show this help dialog
If user had space in some cert fields, like city was "Fort Worth"
the current way would have fell apart.
This fixes these issues in 'pivpn list' and hence 'pivpn revoke'
clients get two more security parameters to harden connection further and...
hopefully fix use of testing branch and...
why is there no modern Road Rash game, that was the best.
