ops.point808.com/ovpn-ad-sync
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
c2c6fb357a
ovpn-ad-sync/README.md
Josh North a75671698d Update README.md
2014-12-03 13:48:51 -05:00

2.1 KiB
Raw Blame History

ovpn-ad-sync

Script to synchronize AD/LDAP users with OpenVPN config files and email user certificates and a setup guide to end users. This script is a very rudimentary hack to fill my purpose. It may or may not work for you. It could also be put to use with LDAP with minimal modification even though I wrote it for an Active Directory environment.

Theory: Basically, the script should be run on a cron schedule. At run, it searches all users in a specified AD group. It then checks to see if subdirectories exist for the user, if not, it decides to create them. It then loops through to look for directories that do not have a corresponding user in the AD list and deletes them. It technically (at this point) does not revoke access and restart the vpn, this is IMPORTANT, because in my setup we are authenticating against AD anyway as a second layer. This is not fully secure but like I said, it is a major work in progress.

Requirements: Ubuntu 14+ (will likely work with plenty of other systems, but I wrote it on and for Ubuntu server) sendmail (must be configured correctly - I used ssmtp and wrote this script as such) sharutils easy-rsa ldap-utils openvpn-auth-ldap

Setup: The below instructions make the following assumptions. If you use a different setup you will need to modify accordingly.

  1. Install and configure all pre-requisites listed above
  2. sudo git clone https://github.com/joshnorth/ovpn-ad-sync.git /tmp/ovpn-ad-sync
  3. sudo cp -R /usr/share/easy-rsa /etc/openvpn/rsa
  4. sudo cp -R /tmp/ovpn-ad-sync/
  5. Create openvpn server config file make ldap config file edit /etc/openvpn/rsa/vars correctly in rsa dir do source ./vars, build-ca, build-dh, and build-key-server MAKE SURE you use 2048 not 1024 it will break script and i don;t care becuase it's more secure anyway copy script file to /usr/local/bin/oas.sh ansd chmod +x make directory for client files (/etc/openvpn/oas_clients) copy template file for clients into client directory edit oas.sh to iproper parameters copy user guide to client directory add to cron every 15 minutes or whatever