Big refresh
This commit is contained in:
Chocobozzz
@@ -0,0 +1,31 @@
|
||||
client
|
||||
dev tun
|
||||
proto tcp-client
|
||||
remote xxx.xxx.xxx.xxx 443
|
||||
resolv-retry infinite
|
||||
cipher AES-256-CBC
|
||||
redirect-gateway
|
||||
|
||||
# Keys
|
||||
# Identity
|
||||
ca ca.crt
|
||||
tls-auth ta.key 1
|
||||
key-direction 1
|
||||
ns-cert-type server
|
||||
auth-user-pass
|
||||
auth-nocache
|
||||
|
||||
# Security
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
comp-lzo
|
||||
verb 3
|
||||
|
||||
# DNS
|
||||
script-security 2
|
||||
up ./update-resolv.sh
|
||||
down ./update-resolv.sh
|
||||
|
||||
# Proxy ?
|
||||
# http-proxy cache.univ.fr 3128
|
||||
+55
@@ -0,0 +1,55 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Parses DHCP options from openvpn to update resolv.conf
|
||||
# To use set as 'up' and 'down' script in your openvpn *.conf:
|
||||
# up /etc/openvpn/update-resolv-conf
|
||||
# down /etc/openvpn/update-resolv-conf
|
||||
#
|
||||
# Used snippets of resolvconf script by Thomas Hood <jdthood@yahoo.co.uk>
|
||||
# and Chris Hanson
|
||||
# Licensed under the GNU GPL. See /usr/share/common-licenses/GPL.
|
||||
# 07/2013 colin@daedrum.net Fixed intet name
|
||||
# 05/2006 chlauber@bnc.ch
|
||||
#
|
||||
# Example envs set from openvpn:
|
||||
# foreign_option_1='dhcp-option DNS 193.43.27.132'
|
||||
# foreign_option_2='dhcp-option DNS 193.43.27.133'
|
||||
# foreign_option_3='dhcp-option DOMAIN be.bnc.ch'
|
||||
|
||||
#[ -x $(which resolvconf) ] || exit 0
|
||||
[ -x /usr/bin/resolvconf ] || exit 0
|
||||
|
||||
case $script_type in
|
||||
|
||||
up)
|
||||
for optionname in ${!foreign_option_*} ; do
|
||||
option="${!optionname}"
|
||||
echo $option
|
||||
part1=$(echo "$option" | cut -d " " -f 1)
|
||||
if [ "$part1" == "dhcp-option" ] ; then
|
||||
part2=$(echo "$option" | cut -d " " -f 2)
|
||||
part3=$(echo "$option" | cut -d " " -f 3)
|
||||
if [ "$part2" == "DNS" ] ; then
|
||||
IF_DNS_NAMESERVERS="$IF_DNS_NAMESERVERS $part3"
|
||||
fi
|
||||
if [ "$part2" == "DOMAIN" ] ; then
|
||||
IF_DNS_SEARCH="$IF_DNS_SEARCH $part3"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
R=""
|
||||
if [ "$IF_DNS_SEARCH" ] ; then
|
||||
R="${R}search $IF_DNS_SEARCH
|
||||
"
|
||||
fi
|
||||
for NS in $IF_DNS_NAMESERVERS ; do
|
||||
R="${R}nameserver $NS
|
||||
"
|
||||
done
|
||||
#echo -n "$R" | resolvconf -p -a "${dev}"
|
||||
echo -n "$R" | /usr/bin/resolvconf -a "${dev}.inet"
|
||||
;;
|
||||
down)
|
||||
resolvconf -d "${dev}.inet"
|
||||
;;
|
||||
esac
|
||||
@@ -0,0 +1,26 @@
|
||||
client
|
||||
dev tun
|
||||
proto tcp-client
|
||||
remote xxx.xxx.xxx.xxx 443
|
||||
resolv-retry infinite
|
||||
cipher AES-256-CBC
|
||||
redirect-gateway
|
||||
|
||||
# Keys
|
||||
# Identity
|
||||
ca ca.crt
|
||||
tls-auth ta.key 1
|
||||
key-direction 1
|
||||
ns-cert-type server
|
||||
auth-user-pass
|
||||
auth-nocache
|
||||
|
||||
# Security
|
||||
nobind
|
||||
persist-key
|
||||
persist-tun
|
||||
comp-lzo
|
||||
verb 3
|
||||
|
||||
# Proxy ?
|
||||
# http-proxy cache.univ.fr 3128
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/bash
|
||||
# Serveur
|
||||
HOST='localhost'
|
||||
# Port (par défaut : 3306)
|
||||
PORT='3306'
|
||||
# Username
|
||||
USER='vpn_user'
|
||||
# Password
|
||||
PASS='mdp'
|
||||
# Nom de la base de données
|
||||
DB='vpn'
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
. /etc/openvpn/scripts/config.sh
|
||||
|
||||
# On insert les données dans la table de log
|
||||
mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "INSERT INTO log (log_id, user_id, log_trusted_ip, log_trusted_port, log_remote_ip, log_remote_port, log_start_time, log_end_time, log_received, log_send) VALUES(NULL, '$common_name','$trusted_ip', '$trusted_port','$ifconfig_pool_remote_ip', '$remote_port_1', now(),'0000-00-00 00:00:00', '$bytes_received', '$bytes_sent')"
|
||||
|
||||
# On spécifie que l'utilisateur est en ligne
|
||||
mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "UPDATE user SET user_online=1 WHERE user_id='$common_name'"
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
. /etc/openvpn/scripts/config.sh
|
||||
|
||||
# On précise que l'utilisateur n'est plus en ligne
|
||||
mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "UPDATE user SET user_online=0 WHERE user_id='$common_name'"
|
||||
|
||||
# On insert le datetime de déconnexion
|
||||
mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -e "UPDATE log SET log_end_time=now(), log_received='$bytes_received', log_send='$bytes_sent' WHERE log_trusted_ip='$trusted_ip' AND log_trusted_port='$trusted_port' AND user_id='$common_name' AND log_end_time='0000-00-00 00:00:00'"
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/bash
|
||||
. /etc/openvpn/scripts/config.sh
|
||||
|
||||
# Authentication
|
||||
user_id=$(mysql -h$HOST -P$PORT -u$USER -p$PASS $DB -sN -e "SELECT user_id FROM user WHERE user_id = '$username' AND user_pass = SHA1('$password') AND user_enable=1 AND (TO_DAYS(now()) >= TO_DAYS(user_start_date) OR user_start_date='0000-00-00') AND (TO_DAYS(now()) <= TO_DAYS(user_end_date) OR user_end_date='0000-00-00')")
|
||||
|
||||
# Vérification de l'utilisateur
|
||||
[ "$user_id" != '' ] && [ "$user_id" = "$username" ] && echo "user : $username" && echo 'authentication ok.' && exit 0 || echo 'authentication failed.'; exit 1
|
||||
@@ -0,0 +1,90 @@
|
||||
## GENERAL ##
|
||||
|
||||
# TCP, port 443, tunneling
|
||||
mode server
|
||||
proto tcp
|
||||
port 443
|
||||
dev tun
|
||||
|
||||
## KEY, CERTS AND NETWORK CONFIGURATION ##
|
||||
# Identity
|
||||
ca ca.crt
|
||||
# Public key
|
||||
cert server.crt
|
||||
# Private key
|
||||
key server.key
|
||||
# Symmetric encryption
|
||||
dh dh1024.pem
|
||||
# Improve security (DDOS, port flooding...)
|
||||
# 0 for the server, 1 for the client
|
||||
tls-auth ta.key 0
|
||||
# Encryption protocol
|
||||
cipher AES-256-CBC
|
||||
|
||||
# Network
|
||||
# Subnetwork, the server will be the 10.8.0.1 and clients will take the other ips
|
||||
server 10.8.0.0 255.255.255.0
|
||||
|
||||
# Redirect all IP network traffic originating on client machines to pass through the OpenVPN server
|
||||
push "redirect-gateway def1"
|
||||
|
||||
# Alternatives DNS (FDN)
|
||||
push "dhcp-option DNS 80.67.169.12"
|
||||
push "dhcp-option DNS 80.67.169.40"
|
||||
|
||||
# (OpenDNS)
|
||||
# push "dhcp-option DNS 208.67.222.222"
|
||||
# push "dhcp-option DNS 208.67.220.220"
|
||||
|
||||
# (Google)
|
||||
# push "dhcp-option DNS 8.8.8.8"
|
||||
# push "dhcp-option DNS 8.8.4.4"
|
||||
|
||||
# Ping every 10 seconds and if after 120 seconds the client doesn't respond we disconnect
|
||||
keepalive 10 120
|
||||
# Regenerate key each 5 hours (disconnect the client)
|
||||
reneg-sec 18000
|
||||
|
||||
## SECURITY ##
|
||||
|
||||
# Downgrade privileges of the daemon
|
||||
user nobody
|
||||
group nogroup
|
||||
|
||||
# Persist keys (because we are nobody, so we couldn't read them again)
|
||||
persist-key
|
||||
# Don't close and re open TUN/TAP device
|
||||
persist-tun
|
||||
# Enable compression
|
||||
comp-lzo
|
||||
|
||||
## LOG ##
|
||||
|
||||
# Verbosity
|
||||
# 3/4 for a normal utilisation
|
||||
verb 3
|
||||
# Max 20 messages of the same category
|
||||
mute 20
|
||||
# Log gile where we put the clients status
|
||||
status openvpn-status.log
|
||||
# Log file
|
||||
log-append /var/log/openvpn.log
|
||||
# Configuration directory of the clients
|
||||
client-config-dir ccd
|
||||
|
||||
## PASS ##
|
||||
|
||||
# Autoriser l'exécution de scripts externes en passant les mots de passe via les variables d'environnement
|
||||
script-security 3 system
|
||||
|
||||
# Use the authenticated username as the common name, rather than the common name from the client cert
|
||||
username-as-common-name
|
||||
# Client certificate non requried
|
||||
client-cert-not-required
|
||||
# Use the connection script when a user wants to login
|
||||
auth-user-pass-verify scripts/login.sh via-env
|
||||
# Maximum of clients
|
||||
max-clients 50
|
||||
# Run this scripts when the client connects/disconnects
|
||||
client-connect scripts/connect.sh
|
||||
client-disconnect scripts/disconnect.sh
|
||||
Reference in New Issue
Block a user