Serverman@VPSでOpenVPNを作ってくれるbash

寂しい心を紛らわすために昔作ったやつを供養する（後付の口上）

Serverman@VPSでCentOS6以下を想定、古いので適宜rpmの取得先などを変更する必要もあるはず。というか今動くかわからん。sudoでうごくヤバゲなbash scriptの参考にでもしてくれや…

$ sudo ./openvpninstaller.sh yourusername yourpassword

ちなみにVPNの使用範囲などについては、DTIの利用規約等に従うようにしようね。

# !/bin/bash

cat <<__EOC__
OpenVPN install script for Serversman@VPS

__EOC__

# 実行時に指定された引数の数、つまり変数 $# の値が 2 でなければエラー終了。
if [ $# -ne 2 ]; then
  echo "引数がたりません"
  echo "sudo ./openvpninstaller.sh [SetUsername] [SetPassword]" 
  exit 1
fi

# ipの取得
ip=`grep IPADDR /etc/sysconfig/network-scripts/ifcfg-venet0:0 | awk -F= '{print $2}'`

# 取得結果を出す
cat <<__EOT__
	Set Username: $1
	Set Password: $2
	IP Address: $ip
__EOT__

# スタートして良いか判定
echo -n "Start? [Y/n]:"
read start
case "$start" in
	y | yes | Y   ) echo "OK Starting." ;;
	*             ) exit ;;
esac

# ユーザーの作成
useradd $1
echo "Created user account [$1]"
echo $1":"$2 | chpasswd

# lzoとrpmforgeのインストールなど
yum install -y zip yum-cron gcc make rpm-build autoconf.noarch zlib-devel pam-devel openssl-devel bridge-utils
wget http://openvpn.net/release/lzo-1.08-4.rf.src.rpm
wget http://pkgs.repoforge.org/rpmforge-release/rpmforge-release-0.5.2-2.el6.rf.x86_64.rpm
rpmbuild --rebuild lzo-1.08-4.rf.src.rpm
rpm -Uvh lzo-*.rpm
rpm -Uvh rpmforge-release*

# 必要なもののインストール・アップデート
yum update -y
yum install -y dnsmasq openvpn

# OpenVPN設定
cp -R /usr/share/doc/openvpn-2.2.2/easy-rsa/ /etc/openvpn/
sed -i -e 's;KEY_CONFIG=.$EASY_RSA/whichopensslcnf $EASY_RSA.;KEY_CONFIG=/etc/openvpn/easy-rsa/2\.0/openssl-1\.0\.0\.cnf;g' /etc/openvpn/easy-rsa/2.0/vars
cd /etc/openvpn/easy-rsa/2.0
chmod 755 *
source ./vars
./vars
./clean-all
./build-ca
./build-key-server server
./build-dh

# サーバーコンフィグ
serverconf='	port 1194
	proto udp
	dev tun
	tun-mtu 1500
	tun-mtu-extra 32
	mssfix 1450
	reneg-sec 0
	ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
	cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
	key /etc/openvpn/easy-rsa/2.0/keys/server.key
	dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
	plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so /etc/pam.d/login
	client-cert-not-required
	username-as-common-name
	ifconfig-pool-persist ipp.txt
	server 10.8.0.0 255.255.255.0
	push "route 10.8.0.0 255.255.255.0"
	push "redirect-gateway def1 bypass-dhcp"
	push "dhcp-option DNS 8.8.8.8"
	push "dhcp-option DNS 8.8.4.4"
	keepalive 5 30
	client-to-client
	duplicate-cn
	comp-lzo
	persist-key
	persist-tun
	status 1194.log
	verb 3'
echo "$serverconf" > /etc/openvpn/server.conf

# sysctl書き換え
sed -i -e 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
echo 'net.ipv4.conf.all.send_redirects = 0' >> /etc/sysctl.conf
echo 'net.ipv4.conf.all.accept_redirects = 0' >> /etc/sysctl.conf
sysctl -p

# iptables書き換え
iptables -A FORWARD -s 10.8.0.0/255.255.255.0 -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
iptables -t nat -A POSTROUTING -s 10.8.0.0/255.255.255.0 -j SNAT --to-source ${ip}
iptables-save > /etc/sysconfig/iptables
sed -i 's/eth0/venet0/g' /etc/sysconfig/iptables

# .ca .ovpnの書き出し
cd ~
vpndir=vpn-${1}
mkdir $vpndir
echo "Make directory [${vpndir}]"
cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ${vpndir}/ca-${1}.crt
echo "Copy certification file: [${vpndir}/ca-${1}.crt]"
vpnfile='	client
	dev tun
	proto udp
	remote '${ip}' 1194
	resolv-retry infinite
	nobind
	tun-mtu 1500
	tun-mtu-extra 32
	mssfix 1450
	persist-key
	persist-tun
	ca ca-'${1}'.crt
	auth-user-pass
	comp-lzo
	reneg-sec 0
	verb 3'
echo "${vpnfile}" > ${vpndir}/vpn-${1}.ovpn
echo "Make OpenVPN config file: [${vpndir}/vpn-${1}.ovpn]"
zip -r ~/${vpndir}.zip ${vpndir}

# インストールしたサービスのON
service yum-cron start
chkconfig yum-cron on
service openvpn start
chkconfig openvpn on
service dnsmasq start
chkconfig dnsmasq on

cat <<__EOC__
Finished install OpenVPN!

__EOC__

ちなみに5年ほど彼女おらん