shadowsocks-all.sh

fudyou

- G7 {* e, }  [: ^( Y$ Z

1. #!/bin/bash
   / y$ x+ b# t. B8 r# N) B2 Z
2. #
   ' l+ P) O- ?( h: W/ W8 n& D
3. # https://github.com/Nyr/openvpn-install
   
4. #
   
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   
6. 
   
7. 
   1 m$ Y0 b7 \& Y5 r  I# H% G1 T
8. # Detect Debian users running the script with "sh" instead of bash
   : w" k0 m6 ~3 ]% B
9. if readlink /proc/$$/exe | grep -q "dash"; then
   
10.         echo 'This installer needs to be run with "bash", not "sh".'
    
11.         exit
    , D2 R+ f# H1 ]
12. fi
    7 @. n' ?. u  [8 c4 q
13. 
    $ q. A# n8 x- Z* c8 u
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    ) k* w: k" c8 }& S' `9 s$ [( a
15. read -N 999999 -t 0.001
    
16. 
    6 I# x+ k1 `- j" p' J
17. # Detect OpenVZ 6
    . j% U/ ]! D4 N  q- I/ e1 i7 j
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    / e) l: Z1 a* y$ p5 W6 S* x+ j8 Y4 o$ w
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    
20.         exit
    3 C0 U  S' _) N8 Y& y9 n( Z
21. fi
    " }6 `+ G  F4 v
22. 
    0 `( u9 N( b5 H) R1 k9 H/ G9 I3 p
23. # Detect OS
    0 F& e" H  q0 T) |9 {7 ~0 w" O3 ~- [% N
24. # $os_version variables aren't always in use, but are kept here for convenience
    
25. if grep -qs "ubuntu" /etc/os-release; then
    
26.         os="ubuntu"
    
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    6 G0 _& R1 h1 w- v
28.         group_name="nogroup"
    7 g0 u* ]- N, v$ z6 `
29. elif [[ -e /etc/debian_version ]]; then
    
30.         os="debian"
    
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    
32.         group_name="nogroup"
    - ~# \0 i' U' p$ z( C1 ?
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    
34.         os="centos"
    & I2 J' w1 U: z; m( b. f
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    9 A  s6 r: u% d  G! ]2 i, b2 ^
36.         group_name="nobody"
    
37. elif [[ -e /etc/fedora-release ]]; then
    7 h* E% [8 H# U9 p0 A
38.         os="fedora"
    . o5 i2 e8 [9 C' ^! J
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    
40.         group_name="nobody"
    
41. else
    
42.         echo "This installer seems to be running on an unsupported distribution.
    
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    / C* D- b# c: l" C  E% \' W
44.         exit
    
45. fi
    + v5 V+ o4 ^0 v3 [1 `8 ~. P7 r
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    + H; Y- a9 v8 W; o
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    7 p. {3 R) O+ i- T6 G4 ]9 b
49. This version of Ubuntu is too old and unsupported."
    + s( P+ k+ ~- D( Q9 ~6 O
50.         exit
    ' |# @4 e) Y" j/ D
51. fi
    + R; h% e6 l& c6 T8 u+ x2 u
52. 
    6 y/ v8 f7 }" [; ^5 b
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    
54.         echo "Debian 9 or higher is required to use this installer.
    ! |3 P' H  Q% R' ]5 @
55. This version of Debian is too old and unsupported."
    
56.         exit
    ) L4 Q4 b' H3 g2 F9 ]3 ?
57. fi
    & S$ o) v" v5 m: Z- R9 V* C) H
58. 
    - u4 m* g( {3 v
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    8 B2 w, \; H! f1 J% F
60.         echo "CentOS 7 or higher is required to use this installer.
    
61. This version of CentOS is too old and unsupported."
    
62.         exit
    / C  `5 r1 j, t# u9 X. G( z$ y
63. fi
    % J$ }8 A. V$ e' U9 P
64. 
    6 }2 b6 j( p: q) |4 B5 O
65. # Detect environments where $PATH does not include the sbin directories
    
66. if ! grep -q sbin <<< "$PATH"; then
    
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    5 g2 E2 _2 `8 N+ s! H
68.         exit
    
69. fi
    * n4 ]" s: K3 |+ ^' X
70. 
    ! ]4 Q% h- `  N! p( k
71. if [[ "$EUID" -ne 0 ]]; then
    
72.         echo "This installer needs to be run with superuser privileges."
    0 C' _5 F3 z+ e
73.         exit
    
74. fi
    6 j' q' b% j- Z+ s
75. 
    ' M* v2 E$ m$ t$ i
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
    & q- s9 i) F  O
78. TUN needs to be enabled before running this installer."
    # x3 h# n; E! F! l7 T4 C: z
79.         exit
    ' ]' M# f+ [9 T$ y" c- `1 {/ O
80. fi
    & ^) J7 T# Y# o6 J1 O
81. 
    2 z0 E1 g+ \4 z; U0 ~; @9 |
82. new_client () {
    , Q& q4 G6 `. ?
83.         # Generates the custom client.ovpn
    6 k) B! f' h0 |( c
84.         {
    + b. W  c% h+ C9 D; }
85.         cat /etc/openvpn/server/client-common.txt
    ' {% U2 j: I2 c" w
86.         echo "<ca>"
    0 E$ h9 Q7 B% |
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
      h& z5 i5 n1 u% K( Z
88.         echo "</ca>"
    " A) M+ Z. `$ A4 M9 f( @# a; v( I
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    9 @% p. H4 h: a1 T  u9 [& d- W
91.         echo "</cert>"
    6 a& M# ?& a- a1 V! _. z
92.         echo "<key>"
    6 Z# d' l0 p/ i( N, a6 G; S
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    + N! y) e+ M  n6 I* E' u7 L; w4 k/ k
94.         echo "</key>"
    
95.         echo "<tls-crypt>"
    
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    ' _# w, x7 X- o
97.         echo "</tls-crypt>"
    
98.         } > ~/"$client".ovpn
    9 J% u. S2 M0 |: w: _7 D6 I
99. }
    
100. 
     
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     ' `6 X( |% z% ]; f- r
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     
104.                 echo "Wget is required to use this installer."
     
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     
106.                 apt-get update
     ! r7 p* T# G! S. y6 k
107.                 apt-get install -y wget
     6 _; P- k2 Y/ ^2 R" G" s
108.         fi
     - T$ m" e  m* ^3 }: Y' n1 E7 C7 s
109.         clear
     
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     % k- Q( K/ x- t! W5 d
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     9 p# J% t, M+ i* N: k( M& T
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     # X, z* d+ W. M7 [( [- o( G4 u
114.         else
     $ |. h) v' X1 I( a3 W
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     
117.                 echo "Which IPv4 address should be used?"
     " ^% i- z0 l" q) O
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     
119.                 read -p "IPv4 address [1]: " ip_number
     ( F8 U& v- h: Z
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     ! i7 |' F% I9 g. H5 }
121.                         echo "$ip_number: invalid selection."
     
122.                         read -p "IPv4 address [1]: " ip_number
     
123.                 done
     ; i3 O6 M: f7 u9 o- H8 m" G5 _4 y
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     ( s" a( B8 Q" ?3 R8 d4 ^
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     ) |( d  _& Q1 m  j5 g$ [
126.         fi
     5 Z0 x$ o' _/ v& o, r; E. N
127.         # If $ip is a private IP address, the server must be behind NAT
     3 V  l) v. S2 Y. w" U4 T
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     
129.                 echo
     1 r3 e- e; z5 n2 J: O
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     
131.                 # Get public IP and sanitize with grep
     
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     . j+ T% M. U, p2 F! [7 K. ?- ?8 Z
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     . @# E+ h! Y5 T9 j% u4 d
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     
138.                 done
     + @/ b( ^5 Y% x& g# h, M; @% V
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     
140.         fi
     
141.         # If system has a single IPv6, it is selected automatically
     & _  c# u5 S  g* B
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     * _% y4 f0 l; l7 u1 B& I
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     7 B6 F* h: E8 |/ O1 ~6 G3 c
144.         fi
     
145.         # If system has multiple IPv6, ask the user to select one
     
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     + e, Y/ h/ J" F$ T& B% i
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     
148.                 echo
     . D9 w' o& x- U5 _
149.                 echo "Which IPv6 address should be used?"
     % l7 f0 y# V/ \
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     
151.                 read -p "IPv6 address [1]: " ip6_number
     
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     / P/ N1 {2 I$ V2 [
153.                         echo "$ip6_number: invalid selection."
     * c# v, n1 P) A* Q) M
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     8 c' M* f$ y0 {8 J6 L# T) S9 n8 H0 G
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     
158.         fi
     ! }* R3 O/ w  P$ i
159.         echo
     1 U- \1 f- h/ }) R( h8 g
160.         echo "Which protocol should OpenVPN use?"
     
161.         echo "   1) UDP (recommended)"
     1 l5 ?" P: O; |7 S# L
162.         echo "   2) TCP"
     1 p6 v3 x: o5 ~2 r! `$ k# P$ p
163.         read -p "Protocol [1]: " protocol
     $ Q  f  W1 i( d/ }% V% G& t
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     5 g: @9 c: X8 `
165.                 echo "$protocol: invalid selection."
     
166.                 read -p "Protocol [1]: " protocol
     7 ~0 ?& z, |# x0 v+ x0 b& n
167.         done
     
168.         case "$protocol" in
     " h) w4 H' Q8 f7 s. o
169.                 1|"")
     & o- t9 ]; A3 O
170.                 protocol=udp
     
171.                 ;;
     . k0 J" ~5 [0 M$ |1 \2 N9 ~
172.                 2)
     
173.                 protocol=tcp
     
174.                 ;;
     
175.         esac
     
176.         echo
     
177.         echo "What port should OpenVPN listen to?"
     
178.         read -p "Port [1194]: " port
     5 g$ A. T) q' L% g
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     
180.                 echo "$port: invalid port."
     
181.                 read -p "Port [1194]: " port
     ' m. l  `1 e# Z5 H9 J2 s
182.         done
     
183.         [[ -z "$port" ]] && port="1194"
     
184.         echo
     ) d) G; }! U2 W
185.         echo "Select a DNS server for the clients:"
     % }1 `5 e* K1 O% D# U
186.         echo "   1) Current system resolvers"
     
187.         echo "   2) Google"
     
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     / c6 v# o+ V4 }& Z' y& `
190.         echo "   5) Quad9"
     
191.         echo "   6) AdGuard"
     ' f/ O; c7 s& t2 R& H
192.         read -p "DNS server [1]: " dns
     
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     4 M6 ~& x% d. A& Z6 F9 U/ G
194.                 echo "$dns: invalid selection."
     0 ]. f: L! E9 X% P7 R/ L/ o
195.                 read -p "DNS server [1]: " dns
     2 p- o7 k, c) u# x: u5 ^" t5 }, x
196.         done
     ) E# _& x2 E! p/ t4 C6 ]
197.         echo
     ) L" N* K; E3 _) `1 v) P- E
198.         echo "Enter a name for the first client:"
     1 H" ]- M5 f# |. c8 h
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
     ) _: ~6 ^$ v6 \' ?1 z$ X
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     1 ]& c" {& @/ D. `' U6 G9 y) B
202.         [[ -z "$client" ]] && client="client"
     . K& J: Z# `  |+ e" }
203.         echo
     5 `/ x5 Y5 O6 S( H" U, ]  x* L
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
     4 G1 \5 {4 j  c. C# c8 {" z" D
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     2 u* W: R' O& M: S
208.                         firewall="firewalld"
     
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     
210.                         # If the user continues, firewalld will be installed and enabled during setup
     
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     1 \. d, `* E  L2 m5 \4 Z. p
213.                         # iptables is way less invasive than firewalld so no warning is given
     * J# A, A% s9 {. j6 z
214.                         firewall="iptables"
     % d# E+ s) i0 `, M6 q* a3 n
215.                 fi
     ' K* k( f# \" V/ |
216.         fi
     5 \! l; D7 m7 v
217.         read -n1 -r -p "Press any key to continue..."
     
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     
219.         if systemd-detect-virt -cq; then
     2 N& n6 n0 Q$ O* V
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     " `# o  Q0 D5 I+ {
221.                 echo "[Service]
     % Y9 w2 u  O* ~! q( \
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     ' z& t; y- H( j/ Y5 g: \, }
223.         fi
     
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     4 t% p% B7 }- V: |# T7 ~/ H
225.                 apt-get update
     
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     4 U& K- |$ }2 p5 m. m: H
227.         elif [[ "$os" = "centos" ]]; then
     
228.                 yum install -y epel-release
     
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     
230.         else
     
231.                 # Else, OS must be Fedora
     . J' {; h# Y5 \, n
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     ; E# e' \/ ]! {- e
233.         fi
     
234.         # If firewalld was just installed, enable it
     
235.         if [[ "$firewall" == "firewalld" ]]; then
     
236.                 systemctl enable --now firewalld.service
     
237.         fi
     $ h# n9 p1 L% K5 S! _: p  o
238.         # Get easy-rsa
     
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     3 {* f6 L& u* W% ^2 k6 x
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     9 X6 {* P, r4 d& E
244.         # Create the PKI, set up the CA and the server and client certificates
     # L  n. H9 _, O
245.         ./easyrsa init-pki
       b1 d6 ]( z: h  n9 K
246.         ./easyrsa --batch build-ca nopass
     
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     , ~: A8 ~; y$ a$ k
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     # C/ o( z" O( x( ]
250.         # Move the stuff we need
     
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     + k* j' E. R4 ~4 A) d* Y
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     $ ~" }% @" _: V" q9 l3 i% B
255.         chmod o+x /etc/openvpn/server/
     
256.         # Generate key for tls-crypt
     
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     & l0 y! C( Q4 r% b. s& V
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     
259.         echo '-----BEGIN DH PARAMETERS-----
     
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     2 Q5 X/ v  e0 Z5 u. R3 _7 M  A) ?
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     . C9 l. K1 S0 o0 H8 K
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     8 [9 @* I8 K2 C1 Z
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     2 b+ F: L1 |. m# _' ^
267.         # Generate server.conf
     
268.         echo "local $ip
     
269. port $port
     
270. proto $protocol
       j# P& N4 T: ]! |4 _# ~- {0 k
271. dev tun
     
272. ca ca.crt
     
273. cert server.crt
     8 W3 {1 ?! v1 r$ i! Z% F1 j* c+ p
274. key server.key
     0 C, o" a* D1 C7 y0 V! Q# o
275. dh dh.pem
     
276. auth SHA512
     1 m4 c& j6 ]' I) J  B4 n
277. tls-crypt tc.key
     
278. topology subnet
     7 Z9 {# D5 o" v8 I
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     
280.         # IPv6
     5 i8 y( V8 a& l: @( S$ t
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
283.         else
     ' k" T- {, k& q1 i- ?0 Q  x
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     9 E9 `' X- v) L3 |0 h, a5 P
286.         fi
     
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     8 \- I2 D. T1 F" N3 v
288.         # DNS
     
289.         case "$dns" in
     5 z: O/ G# n' D  D1 o% A* }
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     ! {7 O' Z  O& h. ^4 u: I! [/ ~* ?
292.                         # Needed for systems running systemd-resolved
     5 Q9 g5 o' i9 q  G
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     6 h5 ?9 {3 V* r5 f2 o6 A2 c
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     
295.                         else
     ' h* H* _: M2 ?* p& N  B. W
296.                                 resolv_conf="/etc/resolv.conf"
     + q1 t& M: Q5 h
297.                         fi
     * ]. ^$ c9 @! q1 C; j
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     ! D9 `& a7 W0 P: g
301.                         done
     7 C0 q3 W# d) V. E$ z
302.                 ;;
     
303.                 2)
     / l" R5 y  b; t9 {, L  q
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     ; s8 y* }: z  `) l
306.                 ;;
     
307.                 3)
     
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     ! i/ O8 T4 u' f8 ]
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     4 i( u! ]2 d9 N) h: s  u- U  Q
310.                 ;;
     
311.                 4)
     
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     3 l$ U! o4 N* n$ o" o' |* z
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     
314.                 ;;
     5 @5 d- y5 \( X5 b3 y9 F( m( n
315.                 5)
     4 Z2 \  B& a7 q
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     
318.                 ;;
     1 F0 e5 [1 }7 z
319.                 6)
     
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     ; a- Z3 w' S9 {( t
322.                 ;;
     9 L3 V+ r8 H2 z
323.         esac
     
324.         echo "keepalive 10 120
     ) u% B  W. [  @1 A
325. cipher AES-256-CBC
     
326. user nobody
     / p! P- W0 ?( `" q/ V, y% `
327. group $group_name
     9 R* H0 H8 u+ M- h8 o1 i0 h# L( w
328. persist-key
     2 w2 c' V6 H& C4 q
329. persist-tun
     ; G* l8 @6 q, ]/ n3 V) C
330. verb 3
     
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     / P1 w1 A3 u  {; z5 x1 [
332.         if [[ "$protocol" = "udp" ]]; then
     7 H4 U3 n6 {4 u. k4 a
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     
334.         fi
     
335.         # Enable net.ipv4.ip_forward for the system
     & C/ O& {7 k6 L" c# T
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     & V( _5 G" W/ i+ ?  a
337.         # Enable without waiting for a reboot or service restart
     : {% f. f0 x, p* V5 E
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     . \) q( }( m0 w( D4 k  A' `# v
339.         if [[ -n "$ip6" ]]; then
     
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     / p3 a) w* H% j
342.                 # Enable without waiting for a reboot or service restart
     * r/ ?& D/ K3 ]1 u& M5 t/ X
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     1 v( N, d# S& x6 q- h
344.         fi
     8 ]( O' p( ~4 c; O; B3 u. J: {
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     
347.                 # reload.
     
348.                 # We don't use --add-service=openvpn because that would only work with
     0 [% r( n8 p* y
349.                 # the default port and protocol.
     
350.                 firewall-cmd --add-port="$port"/"$protocol"
     
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     3 ]! r! c" b/ W* M! q" w
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     ) p: T) P& i* b" }
354.                 # Set NAT for the VPN subnet
     ' J! Y1 C5 p7 ~: O. _! y$ ~
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     5 U( J/ N2 l+ V2 h$ J; Z# b8 t3 ]
362.                 fi
     - a7 T8 M7 @2 l9 m& H+ g( R; o
363.         else
     
364.                 # Create a service to set up persistent iptables rules
     " m$ z& G9 O4 O1 U8 _
365.                 iptables_path=$(command -v iptables)
     8 J% @- v# x7 D2 f- i; |
366.                 ip6tables_path=$(command -v ip6tables)
     
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     $ o+ S3 r) Q, a0 h4 ]! B
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     7 O- @& [$ `! @- s! X7 `+ R
370.                         iptables_path=$(command -v iptables-legacy)
     
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     0 {! U2 ~& e3 O9 F: M7 E
372.                 fi
     $ A% d4 l& \  ?6 x1 b
373.                 echo "[Unit]
     * Q4 p, ]: _- t( l; A8 H8 u
374. Before=network.target
     + S, S9 j( U, D8 H
375. [Service]
     ) O# P+ a# }& B0 a
376. Type=oneshot
     
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     8 U& i$ K6 _, r
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     & ^& y0 J+ @5 ?  j
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     7 R6 a! V; P( m; h# t
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     $ w$ n$ y0 Z$ ]$ c% w, ?; p
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     3 J$ z6 Y0 R+ X7 h7 K' H' |2 U
385.                 if [[ -n "$ip6" ]]; then
     
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     ' }4 }# P- Y! M+ E
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     ' U  c# a- B9 L; `" C) I
392.                 fi
     
393.                 echo "RemainAfterExit=yes
     ; n6 k! R- l9 x* k" v$ H5 O4 i
394. [Install]
     $ x  X5 a2 X* c' v9 N4 D8 ~
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     
396.                 systemctl enable --now openvpn-iptables.service
     ) f( y0 S; O& q+ n0 q9 T) s2 B
397.         fi
     
398.         # If SELinux is enabled and a custom port was selected, we need this
     
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     ( |* _$ b0 ~6 m6 g5 A1 X, X
400.                 # Install semanage if not already present
     5 |0 H& v7 R. n1 G
401.                 if ! hash semanage 2>/dev/null; then
     
402.                         if [[ "$os_version" -eq 7 ]]; then
     . H$ e( X* C5 U9 S9 W# i
403.                                 # Centos 7
     , l; S9 j  i$ {$ k
404.                                 yum install -y policycoreutils-python
     
405.                         else
     ! r; k, d. o( j' d+ k& Z' j
406.                                 # CentOS 8 or Fedora
     5 V) w5 @9 Y' \1 ~& D
407.                                 dnf install -y policycoreutils-python-utils
     
408.                         fi
     
409.                 fi
     : o' B+ R4 [8 d/ c( G- F' E
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     
411.         fi
     
412.         # If the server is behind NAT, use the correct IP address
     7 x+ e% v. ^3 D2 e! m
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     
414.         # client-common.txt is created so we have a template to add further users later
     4 U$ A  B- t* q5 K0 s, O
415.         echo "client
     
416. dev tun
     ) Z$ K8 |% `/ S, h3 A
417. proto $protocol
     4 C6 W9 Z' l" _
418. remote $ip $port
     ! [1 X$ @3 ?9 }  C
419. resolv-retry infinite
       R& ]! r" E0 _# N' k$ K! b
420. nobind
     
421. persist-key
     + |  p0 W* ?  z! a6 E
422. persist-tun
     
423. remote-cert-tls server
     
424. auth SHA512
     
425. cipher AES-256-CBC
     
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     
428. verb 3" > /etc/openvpn/server/client-common.txt
     
429.         # Enable and start the OpenVPN service
     + I$ l$ A1 t4 M8 c  S7 i9 c
430.         systemctl enable --now openvpn-server@server.service
     
431.         # Generates the custom client.ovpn
     , n) a2 [% T9 D3 Y& d: d1 {
432.         new_client
     * |$ c" }$ Q/ M' J( J+ M" {3 s9 F
433.         echo
     
434.         echo "Finished!"
     
435.         echo
     / q, b( c* V. U. g' _* C/ w- i/ R, W
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     7 B8 M" O5 Q) D8 d4 i! w
437.         echo "New clients can be added by running this script again."
     
438. else
     / F; \- \3 p% `
439.         clear
     
440.         echo "OpenVPN is already installed."
     
441.         echo
     
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     1 C: G: Y" S* H7 s. E5 a3 [
444.         echo "   2) Revoke an existing client"
     , D# \4 F, j+ ?
445.         echo "   3) Remove OpenVPN"
     , u$ v1 H5 A1 v% v" c
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     
449.                 echo "$option: invalid selection."
     3 t" _' t4 H) Y0 t6 d# l% q0 H
450.                 read -p "Option: " option
     
451.         done
     
452.         case "$option" in
     # ~  X$ {7 M+ h4 C: q: f# I- t8 E
453.                 1)
     
454.                         echo
     
455.                         echo "Provide a name for the client:"
     
456.                         read -p "Name: " unsanitized_client
     - l+ J1 a; R, p9 Q  a& r  a7 {( S
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     0 r% s+ g- J8 n
462.                         done
     ( U5 B! ^3 l1 N' {5 P: B
463.                         cd /etc/openvpn/server/easy-rsa/
     
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     8 F: j1 Y. N7 e! v# G1 \' f* R
467.                         echo
     
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     # e1 `( Y/ ]' h* t7 m1 U
469.                         exit
     
470.                 ;;
     
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
     # z* {& c- K2 y
473.                         # ...but what can I say, I want some sleep too
     ' [9 N, u1 L3 w/ ^0 ~+ t
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     2 T! ]* I! N8 ]; Q
475.                         if [[ "$number_of_clients" = 0 ]]; then
     , J: U% Z" d( p  D! e$ b& Z
476.                                 echo
     0 @9 g( b3 ?/ K" j& K2 `# T' X
477.                                 echo "There are no existing clients!"
     7 c! n5 S4 d4 f
478.                                 exit
     
479.                         fi
     / U; P! ]/ r6 B6 r3 V% V9 t! {
480.                         echo
     
481.                         echo "Select the client to revoke:"
     + ]7 H7 M, ^+ T0 U7 G0 H( |
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     & S) M' c0 O8 P* P
483.                         read -p "Client: " client_number
     % t% `; \: R  @4 f' P! [
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     $ a4 x& c, N1 i
487.                         done
     3 M( a5 H5 \9 e3 _$ D$ n
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     4 M9 C& r7 U. |( s; y( Y6 z1 g
489.                         echo
     
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     " T: S- I+ ~$ U& {+ _( j
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     
492.                                 echo "$revoke: invalid selection."
     
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     
494.                         done
     - m0 j2 C: d, u0 k
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     
496.                                 cd /etc/openvpn/server/easy-rsa/
     
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     - @9 c; B# ?: y
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     " V1 V: }' R8 l( c% L) [
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     2 W0 u! l0 s  {# h! @) ?. w  v
503.                                 echo
     
504.                                 echo "$client revoked!"
     ' Y/ }  I7 N) Y/ K2 c! a# S
505.                         else
     + T; O  z; b3 {$ t" K
506.                                 echo
     ' ]( |+ [4 w( E: q& c/ S. k6 E
507.                                 echo "$client revocation aborted!"
     
508.                         fi
     
509.                         exit
     
510.                 ;;
     
511.                 3)
     % O; i+ l" u5 o1 a% ^8 T0 g' |; l/ j
512.                         echo
     ' O+ Z( H7 s& Y* R0 p9 C8 f
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     
515.                                 echo "$remove: invalid selection."
     , Q! u, A6 D2 v' T# `  ?
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     
517.                         done
     
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     6 Q2 b. I) W1 S4 x) g
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
521.                                 if systemctl is-active --quiet firewalld.service; then
     5 e; i* z3 G8 n( M
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     0 w: H2 W9 d+ |3 B! h
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     ( O0 d  i5 P" H7 t
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     % S' f3 ]6 t' s2 u/ V, Z! }1 x
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     " f7 E6 T* }; R! S% d* j/ Q  A- S
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     6 ^7 U0 V% k/ b# [0 j& G0 U
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     ! ]( \( ]- ?( Z
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     # v- P, D- C7 ]! q3 F
536.                                         fi
     
537.                                 else
     
538.                                         systemctl disable --now openvpn-iptables.service
     
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     * S: s% @7 e) [/ z9 v0 w
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     2 f) Y5 l7 U$ V8 i
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     
544.                                 systemctl disable --now openvpn-server@server.service
     ( S7 {! m' L  e& x7 m5 M
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     ! _# |# u) M; W3 g+ J0 {  p
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     & ^- K: {5 Q3 a  h" B
548.                                         rm -rf /etc/openvpn/server
     0 H6 v. O; L1 L1 G9 W$ w
549.                                         apt-get remove --purge -y openvpn
     
550.                                 else
     - B2 f: ^" y+ s$ G) L( B* F
551.                                         # Else, OS must be CentOS or Fedora
     
552.                                         yum remove -y openvpn
     ! N' s9 g+ Y0 q7 d" t: C
553.                                         rm -rf /etc/openvpn/server
     & [  d) x+ s- L  \- ^8 t+ E
554.                                 fi
     
555.                                 echo
     
556.                                 echo "OpenVPN removed!"
     . {: B/ D+ F% y% _! G( M" l
557.                         else
     
558.                                 echo
     
559.                                 echo "OpenVPN removal aborted!"
     
560.                         fi
     ! Y7 Q$ D' O# Y( R5 j+ ^; S  O# K: K
561.                         exit
     
562.                 ;;
     , C8 g. l( \2 J, ?$ D
563.                 4)
     
564.                         exit
     
565.                 ;;
     2 G" [7 G0 K  _0 }! f
566.         esac
     
567. fi
       a. }& g# w  E9 g

复制代码

8 f/ h! x$ z& M0 g! P; L8 e
3 I% M! B6 F2 p
; m2 _" r8 ]8 P2 F" g