pptp
This commit is contained in:
bedefaced
parent
ac41c9f7c7
commit
e6d945f248
47
pptp/adduser.sh
Executable file
47
pptp/adduser.sh
Executable file
@ -0,0 +1,47 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]] || [[ ! -w $CHAPSECRETS ]]; then
|
||||
echo "$CHAPSECRETS is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ $# -gt 0 ]]; then
|
||||
LOGIN="$1"
|
||||
fi
|
||||
|
||||
while [[ -z "$LOGIN" ]];
|
||||
do
|
||||
read -p "Enter name: " LOGIN
|
||||
done
|
||||
|
||||
unset PASSWORD
|
||||
|
||||
while [[ -z "$PASSWORD" ]];
|
||||
do
|
||||
read -p "Enter password: " PASSWORD
|
||||
echo
|
||||
done
|
||||
|
||||
$DIR/checkuser.sh $LOGIN
|
||||
|
||||
if [[ $? -eq 0 ]]; then
|
||||
NOTREM="no"
|
||||
read -p "User '$LOGIN' already exists. Do you want to remove existing user? [no] " ANSREM
|
||||
: ${ANSREM:=$NOTREM}
|
||||
|
||||
if [ "$NOTREM" == "$ANSREM" ]; then
|
||||
exit 1
|
||||
else
|
||||
$DIR/deluser.sh $LOGIN
|
||||
# to avoid dublicate message
|
||||
echo -e "$LOGIN\t *\t $PASSWORD\t *" >> $CHAPSECRETS
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
echo -e "$LOGIN\t *\t $PASSWORD\t *" >> $CHAPSECRETS
|
||||
|
||||
echo "$CHAPSECRETS updated!"
|
||||
22
pptp/checkuser.sh
Executable file
22
pptp/checkuser.sh
Executable file
@ -0,0 +1,22 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]]; then
|
||||
echo "$CHAPSECRETS is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ $# -gt 0 ]]; then
|
||||
LOGIN="$1"
|
||||
fi
|
||||
|
||||
while [[ -z "$LOGIN" ]];
|
||||
do
|
||||
read -p "Enter name: " LOGIN
|
||||
done
|
||||
|
||||
RET=$(grep -P "^$LOGIN\s+" $CHAPSECRETS)
|
||||
|
||||
exit $?
|
||||
22
pptp/deluser.sh
Executable file
22
pptp/deluser.sh
Executable file
@ -0,0 +1,22 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $CHAPSECRETS ]] || [[ ! -r $CHAPSECRETS ]] || [[ ! -w $CHAPSECRETS ]]; then
|
||||
echo "$CHAPSECRETS is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ $# -gt 0 ]]; then
|
||||
LOGIN="$1"
|
||||
fi
|
||||
|
||||
while [[ -z "$LOGIN" ]];
|
||||
do
|
||||
read -p "Enter name: " LOGIN
|
||||
done
|
||||
|
||||
sed -i -e "/^$LOGIN[[:space:]]/d" $CHAPSECRETS
|
||||
|
||||
echo "$CHAPSECRETS updated!"
|
||||
25
pptp/dns.sh
Executable file
25
pptp/dns.sh
Executable file
@ -0,0 +1,25 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $PPTPOPTIONS ]] || [[ ! -r $PPTPOPTIONS ]] || [[ ! -w $PPTPOPTIONS ]]; then
|
||||
echo "$PPTPOPTIONS is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
DEFAULTDNS1="8.8.8.8"
|
||||
DEFAULTDNS2="8.8.4.4"
|
||||
|
||||
read -p "Preffered DNS resolver #1: " -e -i $DEFAULTDNS1 DNS1
|
||||
: ${DNS1:=$DEFAULTDNS1}
|
||||
|
||||
read -p "Preffered DNS resolver #2: " -e -i $DEFAULTDNS2 DNS2
|
||||
: ${DNS2:=$DEFAULTDNS2}
|
||||
|
||||
sed -i -e "/ms-dns/d" $PPTPOPTIONS
|
||||
|
||||
echo "ms-dns $DNS1" >> $PPTPOPTIONS
|
||||
echo "ms-dns $DNS2" >> $PPTPOPTIONS
|
||||
|
||||
echo "$PPTPOPTIONS updated!"
|
||||
14
pptp/env.sh
Executable file
14
pptp/env.sh
Executable file
@ -0,0 +1,14 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
SYSCTLCONFIG=/etc/sysctl.conf
|
||||
PPTPDCONFIG=/etc/pptpd.conf
|
||||
PPTPOPTIONS=/etc/ppp/options.pptp
|
||||
CHAPSECRETS=/etc/ppp/chap-secrets
|
||||
IPTABLES=/etc/iptables.rules
|
||||
RCLOCAL=/etc/rc.local
|
||||
|
||||
LOCALPREFIX="172.16"
|
||||
LOCALIP="$LOCALPREFIX.0.0"
|
||||
LOCALMASK="/24"
|
||||
|
||||
LOCALIPMASK="$LOCALIP$LOCALMASK"
|
||||
64
pptp/install.sh
Executable file
64
pptp/install.sh
Executable file
@ -0,0 +1,64 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ "$EUID" -ne 0 ]]; then
|
||||
echo "Sorry, you need to run this as root"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Installing PPTP server..."
|
||||
apt-get install pptpd
|
||||
|
||||
ADDUSER="no"
|
||||
ANSUSER="yes"
|
||||
|
||||
echo
|
||||
echo "Configuring VPN users..."
|
||||
while [ "$ANSUSER" != "$ADDUSER" ];
|
||||
do
|
||||
$DIR/adduser.sh
|
||||
|
||||
read -p "Would you want add another user? [no] " ANSUSER
|
||||
: ${ANSUSER:=$ADDUSER}
|
||||
done
|
||||
|
||||
echo
|
||||
echo "Configuring iptables firewall..."
|
||||
$DIR/iptables-setup.sh
|
||||
|
||||
echo
|
||||
echo "Configuring routing..."
|
||||
$DIR/sysctl.sh
|
||||
|
||||
echo
|
||||
echo "Installing configuration files for PPTP..."
|
||||
yes | cp -rf $DIR/options.pptp.dist $PPTPOPTIONS
|
||||
yes | cp -rf $DIR/pptpd.conf.dist $PPTPDCONFIG
|
||||
|
||||
sed -i -e "s@PPTPOPTIONS@$PPTPOPTIONS@g" $PPTPDCONFIG
|
||||
sed -i -e "s@LOCALPREFIX@$LOCALPREFIX@g" $PPTPDCONFIG
|
||||
|
||||
echo
|
||||
echo "Configuring DNS parameters..."
|
||||
$DIR/dns.sh
|
||||
|
||||
echo
|
||||
echo "Starting pptpd..."
|
||||
service pptpd restart
|
||||
systemctl enable pptpd
|
||||
|
||||
IPTABLESRESTOR=$(which iptables-restore)
|
||||
if [[ ! -z $IPTABLESRESTOR ]]; then
|
||||
sed -i -e "/exit 0/d" $RCLOCAL
|
||||
echo "$IPTABLESRESTOR < $IPTABLES" >> $RCLOCAL
|
||||
echo "exit 0" >> $RCLOCAL
|
||||
else
|
||||
echo "Cannot save iptables-restore from $IPTABLES to $RCLOCAL."
|
||||
fi
|
||||
|
||||
echo
|
||||
echo "Installation script completed!"
|
||||
|
||||
71
pptp/iptables-setup.sh
Executable file
71
pptp/iptables-setup.sh
Executable file
@ -0,0 +1,71 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $IPTABLES ]]; then
|
||||
touch $IPTABLES
|
||||
fi
|
||||
|
||||
if [[ ! -e $IPTABLES ]] || [[ ! -r $IPTABLES ]] || [[ ! -w $IPTABLES ]]; then
|
||||
echo "$IPTABLES is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
|
||||
if [[ "$IP" = "" ]]; then
|
||||
IP=$(wget -4qO- "http://whatismyip.akamai.com/")
|
||||
fi
|
||||
|
||||
# backup and remove rules with $LOCALIP
|
||||
iptables-save | uniq -u > $IPTABLES.backup
|
||||
|
||||
IFS=$'\n'
|
||||
|
||||
iptablesclear=$(iptables -S -t nat | sed -n -e '/$LOCALPREFIX/p' | sed -e 's/-A/-D/g')
|
||||
for line in $iptablesclear
|
||||
do
|
||||
cmd="iptables -t nat $line"
|
||||
eval $cmd
|
||||
done
|
||||
|
||||
# detect default gateway interface
|
||||
echo "Found next network interfaces:"
|
||||
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d'
|
||||
echo
|
||||
GATE=$(route | grep '^default' | grep -o '[^ ]*$')
|
||||
read -p "Enter your external network interface: " -i $GATE -e GATE
|
||||
|
||||
STATIC="yes"
|
||||
read -p "Your external IP is $IP. Is this IP static? [yes] " ANSIP
|
||||
: ${ANSIP:=$STATIC}
|
||||
|
||||
if [ "$STATIC" == "$ANSIP" ]; then
|
||||
# SNAT
|
||||
iptables -t nat -A POSTROUTING -s $LOCALIPMASK -o $GATE -j SNAT --to-source $IP
|
||||
else
|
||||
# MASQUERADE
|
||||
iptables -t nat -A POSTROUTING -o $GATE -j MASQUERADE
|
||||
fi
|
||||
|
||||
DROP="yes"
|
||||
read -p "Would you want to disable client-to-client routing? [yes] " ANSDROP
|
||||
: ${ANSDROP:=$DROP}
|
||||
|
||||
if [ "$DROP" == "$ANSDROP" ]; then
|
||||
# disable forwarding
|
||||
iptables -I FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP
|
||||
fi
|
||||
|
||||
# PPP
|
||||
iptables -A INPUT -i ppp+ -j ACCEPT
|
||||
iptables -A OUTPUT -o ppp+ -j ACCEPT
|
||||
|
||||
# PPTP
|
||||
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
|
||||
|
||||
# GRE
|
||||
iptables -A INPUT -p 47 -j ACCEPT
|
||||
iptables -A OUTPUT -p 47 -j ACCEPT
|
||||
|
||||
iptables-save > $IPTABLES
|
||||
34
pptp/options.pptp.dist
Normal file
34
pptp/options.pptp.dist
Normal file
@ -0,0 +1,34 @@
|
||||
# The name of the local system for authentication purposes
|
||||
name pptpd
|
||||
|
||||
# Refuse EAP, PAP, CHAP or MS-CHAP connections
|
||||
# Accept ONLY MS-CHAPv2 or MPPE with 128-bit encryption
|
||||
refuse-eap
|
||||
refuse-pap
|
||||
refuse-chap
|
||||
refuse-mschap
|
||||
require-mschap-v2
|
||||
require-mppe
|
||||
require-mppe-128
|
||||
|
||||
# Require authorization
|
||||
auth
|
||||
|
||||
# Add entry to the ARP system table
|
||||
proxyarp
|
||||
|
||||
# For the serial device to ensure exclusive access to the device
|
||||
lock
|
||||
|
||||
# Disable BSD-Compress and Van Jacobson TCP/IP header compression
|
||||
nobsdcomp
|
||||
novj
|
||||
novjccomp
|
||||
|
||||
# Disable logging
|
||||
nolog
|
||||
nologfd
|
||||
|
||||
# DNS options for Windows clients
|
||||
ms-dns 8.8.8.8
|
||||
ms-dns 8.8.4.4
|
||||
3
pptp/pptpd.conf.dist
Normal file
3
pptp/pptpd.conf.dist
Normal file
@ -0,0 +1,3 @@
|
||||
option PPTPOPTIONS
|
||||
localip LOCALPREFIX.0.1
|
||||
remoteip LOCALPREFIX.0.10-100
|
||||
33
pptp/sysctl.sh
Executable file
33
pptp/sysctl.sh
Executable file
@ -0,0 +1,33 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
source $DIR/env.sh
|
||||
|
||||
if [[ ! -e $SYSCTLCONFIG ]] || [[ ! -r $SYSCTLCONFIG ]] || [[ ! -w $SYSCTLCONFIG ]]; then
|
||||
echo "$SYSCTLCONFIG is not exist or not accessible (are you root?)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sed -i -e "/net.ipv4.ip_forward/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.ip_forward=1" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.conf.all.accept_redirects/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.conf.all.accept_redirects=0" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.conf.all.send_redirects/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.conf.all.send_redirects=0" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.conf.default.rp_filter/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.conf.default.rp_filter=0" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.conf.default.accept_source_route/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.conf.default.accept_source_route=0" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.conf.default.send_redirects/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.conf.default.send_redirects=0" >> $SYSCTLCONFIG
|
||||
|
||||
sed -i -e "/net.ipv4.icmp_ignore_bogus_error_responses/d" $SYSCTLCONFIG
|
||||
echo "net.ipv4.icmp_ignore_bogus_error_responses=1" >> $SYSCTLCONFIG
|
||||
|
||||
sysctl -p
|
||||
service procps restart
|
||||
Loading…
x
Reference in New Issue
Block a user