| oas_attachments | ||
| oas_configs | ||
| oas_templates | ||
| ovpn-ad-sync.sh | ||
| README.md | ||
ovpn-ad-sync
About:
Josh North - josh.north@point808.com - 2014-12-01
Script to synchronize AD/LDAP users with OpenVPN config files and email user certificates and a setup guide to end users. This script is a very rudimentary hack to fill my purpose. It may or may not work for you. It could also be put to use with LDAP with minimal modification even though I wrote it for an Active Directory environment.
License
Free for use and modification. Credit is appreciated if you do anything with it but nothing is required.
Status:
This script is (as of today, 2014-12-03) in fully-working beta status. It currently does not delete or revoke certificates but will in the near (but unknown) future.
Theory:
Basically, the script should be run on a cron schedule. At run, it searches all users in a specified AD group. It then checks to see if subdirectories exist for the user, if not, it decides to create them. It then loops through to look for directories that do not have a corresponding user in the AD list and deletes them. It technically (at this point) does not revoke access and restart the vpn, this is IMPORTANT, because in my setup we are authenticating against AD anyway as a second layer.
This is not fully secure but like I said, it is a major work in progress.
Requirements:
- Ubuntu 14+ (will likely work with plenty of other systems, but I wrote it on and for Ubuntu server)
- sendmail (must be configured correctly - I used ssmtp and wrote this script as such)
- sharutils
- easy-rsa
- ldap-utils
- openvpn-auth-ldap
Setup Assumptions:
The below instructions make the following assumptions. If you use a different setup you will need to modify accordingly.
- We assume your vpn name will be vpn.example.com
- We asssume your LDAP bind root is example.com
- We assume your LDAP user/pass for bind is oas_user/oas_user
- We assume 192.168.5.0/24 is your VPN network range.
- We assume you want your rsa key infrastructure to live under the OpenVPN config directory in /etc
- We assume your public IP is 66.66.66.66 - obviously this needs to be changed in the template file in the clients directory.
- We assume your local network is 192.168.1.0/24 and your Active Directory or LDAP servers reside at .21 and .22 in this network.
- We assume that you will set up a group in Active Directory called "OpenVPNUsers" - any users in this group will have files generated and emailed automatically.
- You will see other variables that reference example.com - change these accordingly.
Setup Instructions:
- Install and configure all pre-requisites listed above
- Clone the repository
sudo git clone https://github.com/joshnorth/ovpn-ad-sync.git /tmp/ovpn-ad-sync - Copy RSA directory
sudo cp -R /usr/share/easy-rsa /etc/openvpn/rsa - Edit RSA variable file - IMPORTANT! Make sure you use 2048 instead of 1024!!!
sudo nano /etc/openvpn/rsa/vars - Build RSA CA
sudo -s
cd /etc/openvpn/rsa
source ./vars
./build-ca
./build-dh
./build-key-server vpn.example.com
exit
- Copy client directory to openvpn directory
sudo cp -R /tmp/ovpn-ad-sync/oas_clients /etc/openvpn - Copy user guide directory to openvpn directory
sudo cp -R /tmp/ovpn-ad-sync/oas_attachments /etc/openvpn - Copy templates directory to openvpn directory
sudo cp -R /tmp/ovpn-ad-sync/oas_templates /etc/openvpn - Edit the client template to match your IP, etc
sudo nano /etc/openvpn/oas_templates/template.ovpn - Copy server files into place
sudo cp -R /tmp/ovpn-ad-sync/oas_configs/* /etc/openvpn - Edit server file
sudo nano /etc/openvpn/vpn.example.com.conf - Edit LDAP auth file
sudo nano /etc/openvpn/vpn.example.com.ldap - Copy main program into place
sudo cp /tmp/ovpn-ad-sync/ovpn-ad-sync.sh /usr/local/bin - Edit main program variables - IMPORTANT!
sudo nano /usr/local/bin/ovpn-ad-sync.sh - Allow program to execute
sudo chmod +x /usr/local/bin/ovpn-ad-sync.sh - On your Active Directory, make sure you have created a group (by default, OpenVPNUsers).
- On your Active Directory, make sure the oas_user exists and has a proper password set.
- Check the rest of the items in the assumptions list above and double-check they are all checked before running.
- All checked? Let's add it to cron.
sudo crontab -eand add a line like this0,10,20,30,40,50 * * * * /usr/local/bin/ovpn-ad-sync.sh >/dev/null 2>&1 - Now go to Active Directory and add a new user, set a valid email address for them, and add them to the group. Within 10 minutes that email should receive a message with the config and user guide attached!