From e6d945f24864f4ea278566e7dce2785ba3c01fd0 Mon Sep 17 00:00:00 2001 From: bedefaced Date: Tue, 11 Apr 2017 17:02:22 +0300 Subject: [PATCH] pptp --- pptp/adduser.sh | 47 ++++++++++++++++++++++++++++ pptp/checkuser.sh | 22 +++++++++++++ pptp/deluser.sh | 22 +++++++++++++ pptp/dns.sh | 25 +++++++++++++++ pptp/env.sh | 14 +++++++++ pptp/install.sh | 64 +++++++++++++++++++++++++++++++++++++ pptp/iptables-setup.sh | 71 ++++++++++++++++++++++++++++++++++++++++++ pptp/options.pptp.dist | 34 ++++++++++++++++++++ pptp/pptpd.conf.dist | 3 ++ pptp/sysctl.sh | 33 ++++++++++++++++++++ 10 files changed, 335 insertions(+) create mode 100755 pptp/adduser.sh create mode 100755 pptp/checkuser.sh create mode 100755 pptp/deluser.sh create mode 100755 pptp/dns.sh create mode 100755 pptp/env.sh create mode 100755 pptp/install.sh create mode 100755 pptp/iptables-setup.sh create mode 100644 pptp/options.pptp.dist create mode 100644 pptp/pptpd.conf.dist create mode 100755 pptp/sysctl.sh diff --git a/pptp/adduser.sh b/pptp/adduser.sh new file mode 100755 index 0000000..0f831b7 --- /dev/null +++ b/pptp/adduser.sh @@ -0,0 +1,47 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]] || [[ ! -w $CHAPSECRETS ]]; then + echo "$CHAPSECRETS is not exist or not accessible (are you root?)" + exit 1 +fi + +if [[ $# -gt 0 ]]; then + LOGIN="$1" +fi + +while [[ -z "$LOGIN" ]]; +do + read -p "Enter name: " LOGIN +done + +unset PASSWORD + +while [[ -z "$PASSWORD" ]]; +do + read -p "Enter password: " PASSWORD + echo +done + +$DIR/checkuser.sh $LOGIN + +if [[ $? -eq 0 ]]; then + NOTREM="no" + read -p "User '$LOGIN' already exists. Do you want to remove existing user? [no] " ANSREM + : ${ANSREM:=$NOTREM} + + if [ "$NOTREM" == "$ANSREM" ]; then + exit 1 + else + $DIR/deluser.sh $LOGIN + # to avoid dublicate message + echo -e "$LOGIN\t *\t $PASSWORD\t *" >> $CHAPSECRETS + exit 0 + fi +fi + +echo -e "$LOGIN\t *\t $PASSWORD\t *" >> $CHAPSECRETS + +echo "$CHAPSECRETS updated!" diff --git a/pptp/checkuser.sh b/pptp/checkuser.sh new file mode 100755 index 0000000..2178ce8 --- /dev/null +++ b/pptp/checkuser.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]]; then + echo "$CHAPSECRETS is not exist or not accessible (are you root?)" + exit 1 +fi + +if [[ $# -gt 0 ]]; then + LOGIN="$1" +fi + +while [[ -z "$LOGIN" ]]; +do + read -p "Enter name: " LOGIN +done + +RET=$(grep -P "^$LOGIN\s+" $CHAPSECRETS) + +exit $? diff --git a/pptp/deluser.sh b/pptp/deluser.sh new file mode 100755 index 0000000..107851c --- /dev/null +++ b/pptp/deluser.sh @@ -0,0 +1,22 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]] || [[ ! -w $CHAPSECRETS ]]; then + echo "$CHAPSECRETS is not exist or not accessible (are you root?)" + exit 1 +fi + +if [[ $# -gt 0 ]]; then + LOGIN="$1" +fi + +while [[ -z "$LOGIN" ]]; +do + read -p "Enter name: " LOGIN +done + +sed -i -e "/^$LOGIN[[:space:]]/d" $CHAPSECRETS + +echo "$CHAPSECRETS updated!" diff --git a/pptp/dns.sh b/pptp/dns.sh new file mode 100755 index 0000000..0034687 --- /dev/null +++ b/pptp/dns.sh @@ -0,0 +1,25 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $PPTPOPTIONS ]] || [[ ! -r $PPTPOPTIONS ]] || [[ ! -w $PPTPOPTIONS ]]; then + echo "$PPTPOPTIONS is not exist or not accessible (are you root?)" + exit 1 +fi + +DEFAULTDNS1="8.8.8.8" +DEFAULTDNS2="8.8.4.4" + +read -p "Preffered DNS resolver #1: " -e -i $DEFAULTDNS1 DNS1 +: ${DNS1:=$DEFAULTDNS1} + +read -p "Preffered DNS resolver #2: " -e -i $DEFAULTDNS2 DNS2 +: ${DNS2:=$DEFAULTDNS2} + +sed -i -e "/ms-dns/d" $PPTPOPTIONS + +echo "ms-dns $DNS1" >> $PPTPOPTIONS +echo "ms-dns $DNS2" >> $PPTPOPTIONS + +echo "$PPTPOPTIONS updated!" diff --git a/pptp/env.sh b/pptp/env.sh new file mode 100755 index 0000000..3f2e5e8 --- /dev/null +++ b/pptp/env.sh @@ -0,0 +1,14 @@ +#!/usr/bin/env bash + +SYSCTLCONFIG=/etc/sysctl.conf +PPTPDCONFIG=/etc/pptpd.conf +PPTPOPTIONS=/etc/ppp/options.pptp +CHAPSECRETS=/etc/ppp/chap-secrets +IPTABLES=/etc/iptables.rules +RCLOCAL=/etc/rc.local + +LOCALPREFIX="172.16" +LOCALIP="$LOCALPREFIX.0.0" +LOCALMASK="/24" + +LOCALIPMASK="$LOCALIP$LOCALMASK" diff --git a/pptp/install.sh b/pptp/install.sh new file mode 100755 index 0000000..7de54c2 --- /dev/null +++ b/pptp/install.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ "$EUID" -ne 0 ]]; then + echo "Sorry, you need to run this as root" + exit 1 +fi + +echo +echo "Installing PPTP server..." +apt-get install pptpd + +ADDUSER="no" +ANSUSER="yes" + +echo +echo "Configuring VPN users..." +while [ "$ANSUSER" != "$ADDUSER" ]; +do + $DIR/adduser.sh + + read -p "Would you want add another user? [no] " ANSUSER + : ${ANSUSER:=$ADDUSER} +done + +echo +echo "Configuring iptables firewall..." +$DIR/iptables-setup.sh + +echo +echo "Configuring routing..." +$DIR/sysctl.sh + +echo +echo "Installing configuration files for PPTP..." +yes | cp -rf $DIR/options.pptp.dist $PPTPOPTIONS +yes | cp -rf $DIR/pptpd.conf.dist $PPTPDCONFIG + +sed -i -e "s@PPTPOPTIONS@$PPTPOPTIONS@g" $PPTPDCONFIG +sed -i -e "s@LOCALPREFIX@$LOCALPREFIX@g" $PPTPDCONFIG + +echo +echo "Configuring DNS parameters..." +$DIR/dns.sh + +echo +echo "Starting pptpd..." +service pptpd restart +systemctl enable pptpd + +IPTABLESRESTOR=$(which iptables-restore) +if [[ ! -z $IPTABLESRESTOR ]]; then + sed -i -e "/exit 0/d" $RCLOCAL + echo "$IPTABLESRESTOR < $IPTABLES" >> $RCLOCAL + echo "exit 0" >> $RCLOCAL +else + echo "Cannot save iptables-restore from $IPTABLES to $RCLOCAL." +fi + +echo +echo "Installation script completed!" + diff --git a/pptp/iptables-setup.sh b/pptp/iptables-setup.sh new file mode 100755 index 0000000..47cf9ce --- /dev/null +++ b/pptp/iptables-setup.sh @@ -0,0 +1,71 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $IPTABLES ]]; then + touch $IPTABLES +fi + +if [[ ! -e $IPTABLES ]] || [[ ! -r $IPTABLES ]] || [[ ! -w $IPTABLES ]]; then + echo "$IPTABLES is not exist or not accessible (are you root?)" + exit 1 +fi + +IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) +if [[ "$IP" = "" ]]; then + IP=$(wget -4qO- "http://whatismyip.akamai.com/") +fi + +# backup and remove rules with $LOCALIP +iptables-save | uniq -u > $IPTABLES.backup + +IFS=$'\n' + +iptablesclear=$(iptables -S -t nat | sed -n -e '/$LOCALPREFIX/p' | sed -e 's/-A/-D/g') +for line in $iptablesclear +do + cmd="iptables -t nat $line" + eval $cmd +done + +# detect default gateway interface +echo "Found next network interfaces:" +ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' +echo +GATE=$(route | grep '^default' | grep -o '[^ ]*$') +read -p "Enter your external network interface: " -i $GATE -e GATE + +STATIC="yes" +read -p "Your external IP is $IP. Is this IP static? [yes] " ANSIP +: ${ANSIP:=$STATIC} + +if [ "$STATIC" == "$ANSIP" ]; then + # SNAT + iptables -t nat -A POSTROUTING -s $LOCALIPMASK -o $GATE -j SNAT --to-source $IP +else + # MASQUERADE + iptables -t nat -A POSTROUTING -o $GATE -j MASQUERADE +fi + +DROP="yes" +read -p "Would you want to disable client-to-client routing? [yes] " ANSDROP +: ${ANSDROP:=$DROP} + +if [ "$DROP" == "$ANSDROP" ]; then + # disable forwarding + iptables -I FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP +fi + +# PPP +iptables -A INPUT -i ppp+ -j ACCEPT +iptables -A OUTPUT -o ppp+ -j ACCEPT + +# PPTP +iptables -A INPUT -p tcp --dport 1723 -j ACCEPT + +# GRE +iptables -A INPUT -p 47 -j ACCEPT +iptables -A OUTPUT -p 47 -j ACCEPT + +iptables-save > $IPTABLES diff --git a/pptp/options.pptp.dist b/pptp/options.pptp.dist new file mode 100644 index 0000000..9efb8be --- /dev/null +++ b/pptp/options.pptp.dist @@ -0,0 +1,34 @@ +# The name of the local system for authentication purposes +name pptpd + +# Refuse EAP, PAP, CHAP or MS-CHAP connections +# Accept ONLY MS-CHAPv2 or MPPE with 128-bit encryption +refuse-eap +refuse-pap +refuse-chap +refuse-mschap +require-mschap-v2 +require-mppe +require-mppe-128 + +# Require authorization +auth + +# Add entry to the ARP system table +proxyarp + +# For the serial device to ensure exclusive access to the device +lock + +# Disable BSD-Compress and Van Jacobson TCP/IP header compression +nobsdcomp +novj +novjccomp + +# Disable logging +nolog +nologfd + +# DNS options for Windows clients +ms-dns 8.8.8.8 +ms-dns 8.8.4.4 diff --git a/pptp/pptpd.conf.dist b/pptp/pptpd.conf.dist new file mode 100644 index 0000000..65cc88e --- /dev/null +++ b/pptp/pptpd.conf.dist @@ -0,0 +1,3 @@ +option PPTPOPTIONS +localip LOCALPREFIX.0.1 +remoteip LOCALPREFIX.0.10-100 diff --git a/pptp/sysctl.sh b/pptp/sysctl.sh new file mode 100755 index 0000000..2c7b237 --- /dev/null +++ b/pptp/sysctl.sh @@ -0,0 +1,33 @@ +#!/usr/bin/env bash + +DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" +source $DIR/env.sh + +if [[ ! -e $SYSCTLCONFIG ]] || [[ ! -r $SYSCTLCONFIG ]] || [[ ! -w $SYSCTLCONFIG ]]; then + echo "$SYSCTLCONFIG is not exist or not accessible (are you root?)" + exit 1 +fi + +sed -i -e "/net.ipv4.ip_forward/d" $SYSCTLCONFIG +echo "net.ipv4.ip_forward=1" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.conf.all.accept_redirects/d" $SYSCTLCONFIG +echo "net.ipv4.conf.all.accept_redirects=0" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.conf.all.send_redirects/d" $SYSCTLCONFIG +echo "net.ipv4.conf.all.send_redirects=0" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.conf.default.rp_filter/d" $SYSCTLCONFIG +echo "net.ipv4.conf.default.rp_filter=0" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.conf.default.accept_source_route/d" $SYSCTLCONFIG +echo "net.ipv4.conf.default.accept_source_route=0" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.conf.default.send_redirects/d" $SYSCTLCONFIG +echo "net.ipv4.conf.default.send_redirects=0" >> $SYSCTLCONFIG + +sed -i -e "/net.ipv4.icmp_ignore_bogus_error_responses/d" $SYSCTLCONFIG +echo "net.ipv4.icmp_ignore_bogus_error_responses=1" >> $SYSCTLCONFIG + +sysctl -p +service procps restart