ops.point808.com/ovpn-ad-sync
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Josh North 2014-12-03 14:12:43 -05:00
parent b7be39135c
commit 63ddc15103
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
README.md
View File

@ -1,26 +1,26 @@
#ovpn-ad-sync #ovpn-ad-sync
============ ============
##Description: ###Description:
Script to synchronize AD/LDAP users with OpenVPN config files and email user certificates and a setup guide to end users. This script is a very rudimentary hack to fill my purpose. It may or may not work for you. It could also be put to use with LDAP with minimal modification even though I wrote it for an Active Directory environment. Script to synchronize AD/LDAP users with OpenVPN config files and email user certificates and a setup guide to end users. This script is a very rudimentary hack to fill my purpose. It may or may not work for you. It could also be put to use with LDAP with minimal modification even though I wrote it for an Active Directory environment.
##Author: ###Author:
Josh North 2014-12-01 Josh North 2014-12-01
josh.north@point808.com josh.north@point808.com
Free for use and modification. Credit is appreciated if you do anything with it but nothing is required. Free for use and modification. Credit is appreciated if you do anything with it but nothing is required.
##Theory: ###Theory:
Basically, the script should be run on a cron schedule. At run, it searches all users in a specified AD group. It then checks to see if subdirectories exist for the user, if not, it decides to create them. It then loops through to look for directories that do not have a corresponding user in the AD list and deletes them. It technically (at this point) does not revoke access and restart the vpn, this is IMPORTANT, because in my setup we are authenticating against AD anyway as a second layer. This is not fully secure but like I said, it is a major work in progress. Basically, the script should be run on a cron schedule. At run, it searches all users in a specified AD group. It then checks to see if subdirectories exist for the user, if not, it decides to create them. It then loops through to look for directories that do not have a corresponding user in the AD list and deletes them. It technically (at this point) does not revoke access and restart the vpn, this is IMPORTANT, because in my setup we are authenticating against AD anyway as a second layer. This is not fully secure but like I said, it is a major work in progress.
##Requirements: ###Requirements:
Ubuntu 14+ (will likely work with plenty of other systems, but I wrote it on and for Ubuntu server) *Ubuntu 14+ (will likely work with plenty of other systems, but I wrote it on and for Ubuntu server)
sendmail (must be configured correctly - I used ssmtp and wrote this script as such) *sendmail (must be configured correctly - I used ssmtp and wrote this script as such)
sharutils *sharutils
easy-rsa *easy-rsa
ldap-utils *ldap-utils
openvpn-auth-ldap *openvpn-auth-ldap
##Setup Assumptions: ###Setup Assumptions:
The below instructions make the following assumptions. If you use a different setup you will need to modify accordingly. The below instructions make the following assumptions. If you use a different setup you will need to modify accordingly.
1. We assume your vpn name will be vpn.example.com 1. We assume your vpn name will be vpn.example.com
2. We asssume your LDAP bind root is example.com 2. We asssume your LDAP bind root is example.com
@ -32,7 +32,7 @@ The below instructions make the following assumptions. If you use a different s
8. We assume that you will set up a group in Active Directory called "OpenVPNUsers" - any users in this group will have files generated and emailed automatically. 8. We assume that you will set up a group in Active Directory called "OpenVPNUsers" - any users in this group will have files generated and emailed automatically.
9. You will see other variables that reference example.com - change these accordingly 9. You will see other variables that reference example.com - change these accordingly
##Setup Instructions: ###Setup Instructions:
1. Install and configure all pre-requisites listed above 1. Install and configure all pre-requisites listed above
2. sudo git clone https://github.com/joshnorth/ovpn-ad-sync.git /tmp/ovpn-ad-sync 2. sudo git clone https://github.com/joshnorth/ovpn-ad-sync.git /tmp/ovpn-ad-sync
3. sudo cp -R /usr/share/easy-rsa /etc/openvpn/rsa 3. sudo cp -R /usr/share/easy-rsa /etc/openvpn/rsa