external/iiab
1
0
Fork 0
mirror of https://github.com/iiab/iiab.git synced 2025-03-09 15:40:17 +00:00
Code Issues Releases Wiki Activity

Merge pull request #763 from holta/openvpn

Browse source 
Minor refactor of {iiab-vpn, iiab-remote-off, iiab-remote-on} for readability
This commit is contained in:
A Holt 2018-04-29 02:59:45 -04:00 • committed by GitHub
commit 88c850303c
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 69 additions and 70 deletions
Download patch file Download diff file Expand all files Collapse all files

8
roles/openvpn/templates/iiab-remote-off
View file

@ -4,8 +4,8 @@
# do nothing if it is not installed # do nothing if it is not installed
which openvpn which openvpn
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo Cannot find the openvpn program. echo Cannot find the OpenVPN program (openvpn).
exit 1 exit 1
fi fi
systemctl disable openvpn@xscenet.service systemctl disable openvpn@xscenet.service
systemctl stop openvpn@xscenet.service systemctl stop openvpn@xscenet.service
@ -13,7 +13,7 @@ systemctl stop openvpn@xscenet.service
sleep 5 sleep 5
ps -e|grep vpn ps -e|grep vpn
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
echo Openvpn failed to stop. echo OpenVPN failed to stop.
else else
echo Successfully stopped and disabled Openvpn echo Successfully stopped and disabled OpenVPN.
fi fi

8
roles/openvpn/templates/iiab-remote-on
View file

@ -4,8 +4,8 @@
# do nothing if it is not installed # do nothing if it is not installed
which openvpn which openvpn
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo Cannot find the openvpn program. echo Cannot find the OpenVPN program (openvpn).
exit 1 exit 1
fi fi
systemctl enable openvpn@xscenet.service systemctl enable openvpn@xscenet.service
systemctl start openvpn@xscenet.service systemctl start openvpn@xscenet.service
@ -13,7 +13,7 @@ systemctl start openvpn@xscenet.service
sleep 5 sleep 5
ping -c 2 10.8.0.1 ping -c 2 10.8.0.1
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
echo Openvpn successfully started. echo OpenVPN successfully started.
else else
echo Openvpn failed to contact remote server. echo OpenVPN failed to contact remote server.
fi fi

121
roles/openvpn/templates/iiab-vpn
View file

@ -1,11 +1,12 @@
#!/bin/sh #!/bin/bash
# script to manage openvpn # script to manage openvpn
if [ ! -f "/etc/openvpn/iiab-vpn.conf" ]; then if [ ! -f "/etc/openvpn/iiab-vpn.conf" ]; then
VPNCONFIG='party-line.conf' VPNCONFIG='party-line.conf'
VPNIP={{ openvpn_server_virtual_ip }} VPNIP={{ openvpn_server_virtual_ip }}
else else
# expect the sourced file to set the above variables # expect the sourced file to set the above variables
source /etc/openvpn/iiab-vpn.conf source /etc/openvpn/iiab-vpn.conf
fi fi
# we'd like the user of this script to have root privilege # we'd like the user of this script to have root privilege
@ -15,79 +16,77 @@ if [ "$(id -u)" != "0" ]; then
fi fi
case $1 in case $1 in
"stop" | "no" | "off") "stop" | "no" | "off")
killall openvpn killall openvpn
exit 0 exit 0
;; ;;
"status") "status")
pid=`ps -e|grep openvpn` pid=`ps -e|grep openvpn`
if [ -z "$pid" ]; then if [ -z "$pid" ]; then
echo "The openvpn process is not running" echo "The OpenVPN process is not running"
else else
echo "Openvpn is running with id $pid" echo "OpenVPN is running with id $pid"
ip=`ifconfig tun | gawk '(/netmask /) {print( $2);}'` ip=`ifconfig tun | gawk '(/netmask /) {print( $2);}'`
echo "Local vpn tunnel address is $ip" echo "Local vpn tunnel address is $ip"
fi fi
exit 0 exit 0
;; ;;
esac esac
# we'd like for passwords authentication to be turned off # we'd like for password authentication to be turned off
grep -e^PasswordAuthentication.*[Yy]es /etc/ssh/sshd_config grep -e^PasswordAuthentication.*[Yy]es /etc/ssh/sshd_config
PASSWORDS_ENABLED=$? PASSWORDS_ENABLED=$?
if [ $PASSWORDS_ENABLED -eq 0 ];then if [ $PASSWORDS_ENABLED -eq 0 ];then
case $1 in case $1 in
"test" | "unsafe") ;; "test" | "unsafe") ;;
*) *)
echo "OpenVPN is only safe when public/private keys are used"
echo "Openvpn is only safe when public/private keys are used" echo " And when passwords are turned off in /etc/ssh/sshd_conf"
echo " And when passwords are turned off in /etc/ssh/sshd_conf" exit 1
exit 1 esac
esac
fi fi
# openvpn config file directory # openvpn config file directory
dir=/etc/openvpn dir=/etc/openvpn
if [ $# -eq 0 ]; then if [ $# -eq 0 ]; then
cmd="test" cmd="test"
else else
cmd=$1 cmd=$1
fi fi
case $cmd in case $cmd in
"test" | "unsafe" ) "test" | "unsafe" )
# load TUN/TAP kernel module # load TUN/TAP kernel module
modprobe tun modprobe tun
# make sure the wan is functioning # make sure the wan is functioning
# 8.8.8.8 is one of google's dns servers # 8.8.8.8 is one of google's dns servers
ping -c 3 -i 3 8.8.8.8 ping -c 3 -i 3 8.8.8.8
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo "internet is not available, tunnel not possible" echo "internet is not available, tunnel not possible"
exit 1 exit 1
fi fi
# check the vpn tunnel # check the vpn tunnel
ping -c 5 -i 5 "$VPNIP" ping -c 5 -i 5 "$VPNIP"
# a zero return means the tunnel is up # a zero return means the tunnel is up
if [ $? -ne "0" ]; then if [ $? -ne "0" ]; then
echo "Stopping any openvpn instance" echo "Stopping any openvpn instance"
killall openvpn killall openvpn
sleep 10 sleep 10
echo "Starting openvpn and waiting 10 seconds for daemon to become ready" echo "Starting OpenVPN and waiting 10 seconds for daemon to become ready"
openvpn --cd $dir --daemon --config $VPNCONFIG openvpn --cd $dir --daemon --config $VPNCONFIG
fi fi
sleep 10 sleep 10
echo "Testing VPN connection" echo "Testing VPN connection"
ping -c 4 -i 4 "$VPNIP" ping -c 4 -i 4 "$VPNIP"
if [ $? -eq 0 ]; then if [ $? -eq 0 ]; then
echo "vpn tunnel established" echo "vpn tunnel established"
else else
echo "vpn connection failed" echo "vpn connection failed"
fi fi
;; ;;
esac esac