ops.point808.com/ovpn-ad-sync
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update ovpn-ad-sync.sh

Browse Source
This commit is contained in:
Josh North 2014-12-03 14:45:54 -05:00
parent 14bad98fbb
commit e00cc20e93
1 changed files with 30 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
ovpn-ad-sync.sh
View File

@ -1,46 +1,37 @@
#!/bin/bash #!/bin/bash
# 2014-12-01
# Josh North - josh.north@point808.com
#
# ovpn-ad-sync.sh
#
# This script is a very rudimentary hack to fill my purpose. It may or may not
# work for you. It could also be put to use with LDAP with minimal
# modification.
# Theory: basically, the script should be run on a cron schedule. At run, it
# searches all users in a specified AD group. It then checks to see if
# subdirectories exist for the user, if not, it decides to create them. It
# then loops through to look for directories that do not have a corresponding
# user in the AD list and deletes them. It technically (at this point) does
# not revoke access and restart the vpn, this is IMPORTANT, because in my setup
# we are authenticating against AD anyway as a second layer. This is not fully
# secure but like I said, it is a major work in progress.
#
# requirements:
# sendmail (written for ssmtp version) uuencode (part of sharutils) ldap-client, etc
# THE FOLLOWING VARIABLES MUST BE MODIFIED TO MATCH YOUR ENVIRONMENT OR BAD # ovpn-ad-sync
# THINGS WILL HAPPEN!!! #
OAS_ADUSR="oas_user@EXAMPLE.COM" # user@domain.tld or full DN # Description:
OAS_ADPWD="oas_user" # we will change this later # Script to synchronize AD/LDAP users with OpenVPN config files and email user certificates and a setup guide to end users. This script is a very rudimentary hack to fill my purpose. It may or may not work for you. It could also be put to use with LDAP with minimal modification even though I wrote it for an Active Directory environment.
OAS_ADBASE="dc=example,dc=com" # search base # Author:
OAS_ADURI="ldap://192.168.1.21" # full URI required # Josh North 2014-12-01
OAS_VPNGRP="cn=OpenVPNUsers,cn=Users,dc=example,dc=com" # full group DN # josh.north@point808.com
OAS_USERDIR="/etc/openvpn/oas_clients" # full path to user configs # Free for use and modification. Credit is appreciated if you do anything with it but nothing is required.
OAS_RSADIR="/etc/openvpn/rsa" # full path to easy-rsa root # Theory:
OAS_LOGFILE="/var/log/oas.log" # log file # Basically, the script should be run on a cron schedule. At run, it searches all users in a specified AD group. It then checks to see if subdirectories exist for the user, if not, it decides to create them. It then loops through to look for directories that do not have a corresponding user in the AD list and deletes them. It technically (at this point) does not revoke access and restart the vpn, this is IMPORTANT, because in my setup we are authenticating against AD anyway as a second layer. This is not fully secure but like I said, it is a major work in progress.
OAS_LOGRET=10 # lines of old log to keep #
OAS_OVPNTPL="${OAS_USERDIR}/template.ovpn" # template file to use for clients # Instructions:
OAS_MAILSUBJ="Example Company - VPN Information" # subject line of email # Please see README.md in the root of this github project or your cloned directory
OAS_MAILFROM="admin@example.com" # email from appearance
OAS_MAILADMIN="admin@example.com" # email to send errors and config cc
OAS_USERGUIDE="${OAS_USERDIR}/VPN_SETUP_GUIDE.pdf" # pdf or other common file guide for users
OAS_ORGNAME="Example Company, Inc."
# END OF VARIABLES # VARIABLES
# READ, BUT DON'T TOUCH THE FOLLOWING UNLESS YOU KNOW WHAT YOU ARE DOING OAS_ADUSR="oas_user@EXAMPLE.COM" # User@domain.tld or full DN
# AND IF YOU DON'T KNOW WHAT YOU ARE DOING YOU PROBABLY SHOULDN'T BE USING THIS!!! OAS_ADPWD="oas_user" # We will change this later
OAS_ADBASE="dc=example,dc=com" # Search base
OAS_ADURI="ldap://192.168.1.21" # Full URI required
OAS_VPNGRP="cn=OpenVPNUsers,cn=Users,dc=example,dc=com" # Full group DN
OAS_USERDIR="/etc/openvpn/oas_clients" # Full path to user configs
OAS_RSADIR="/etc/openvpn/rsa" # Full path to easy-rsa root
OAS_LOGFILE="/var/log/oas.log" # Log file
OAS_LOGRET=10 # Lines of old log to keep
OAS_OVPNTPL="${OAS_USERDIR}/template.ovpn" # Template file to use for clients
OAS_MAILSUBJ="Example Company - VPN Information" # Subject line of email
OAS_MAILFROM="admin@example.com" # This will appear as the "From" address
OAS_MAILADMIN="admin@example.com" # Email to copy all configs and errors to
OAS_USERGUIDE="${OAS_USERDIR}/VPN_SETUP_GUIDE.pdf" # File guide to attach
OAS_ORGNAME="Example Company, Inc." # Company name
# MAIN SCRIPT
# easy logger function from http://mostlyunixish.franzoni.eu/ # easy logger function from http://mostlyunixish.franzoni.eu/
function logsetup { function logsetup {
TMP=$(tail -n $OAS_LOGRET $OAS_LOGFILE 2>/dev/null) && echo "${TMP}" > $OAS_LOGFILE TMP=$(tail -n $OAS_LOGRET $OAS_LOGFILE 2>/dev/null) && echo "${TMP}" > $OAS_LOGFILE