initial commit of file from CVS for smeserver-openvpn-routed on Thu 6 Mar 14:40:52 GMT 2025
This commit is contained in:
parent
08020c8369
commit
73d65d729e
4
.gitignore
vendored
Normal file
4
.gitignore
vendored
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
*.rpm
|
||||||
|
*.log
|
||||||
|
*spec-20*
|
||||||
|
*.tar.gz
|
||||||
21
Makefile
Normal file
21
Makefile
Normal file
@ -0,0 +1,21 @@
|
|||||||
|
# Makefile for source rpm: smeserver-openvpn-routed
|
||||||
|
# $Id: Makefile,v 1.1 2021/02/04 16:20:21 brianr Exp $
|
||||||
|
NAME := smeserver-openvpn-routed
|
||||||
|
SPECFILE = $(firstword $(wildcard *.spec))
|
||||||
|
|
||||||
|
define find-makefile-common
|
||||||
|
for d in common ../common ../../common ; do if [ -f $$d/Makefile.common ] ; then if [ -f $$d/CVS/Root -a -w $$/Makefile.common ] ; then cd $$d ; cvs -Q update ; fi ; echo "$$d/Makefile.common" ; break ; fi ; done
|
||||||
|
endef
|
||||||
|
|
||||||
|
MAKEFILE_COMMON := $(shell $(find-makefile-common))
|
||||||
|
|
||||||
|
ifeq ($(MAKEFILE_COMMON),)
|
||||||
|
# attept a checkout
|
||||||
|
define checkout-makefile-common
|
||||||
|
test -f CVS/Root && { cvs -Q -d $$(cat CVS/Root) checkout common && echo "common/Makefile.common" ; } || { echo "ERROR: I can't figure out how to checkout the 'common' module." ; exit -1 ; } >&2
|
||||||
|
endef
|
||||||
|
|
||||||
|
MAKEFILE_COMMON := $(shell $(checkout-makefile-common))
|
||||||
|
endif
|
||||||
|
|
||||||
|
include $(MAKEFILE_COMMON)
|
||||||
14
README.md
14
README.md
@ -1,3 +1,15 @@
|
|||||||
# smeserver-openvpn-routed
|
# <img src="https://www.koozali.org/images/koozali/Logo/Png/Koozali_logo_2016.png" width="25%" vertical="auto" style="vertical-align:bottom"> smeserver-openvpn-routed
|
||||||
|
|
||||||
SMEServer Koozali developed git repo for smeserver-openvpn-routed smecontribs
|
SMEServer Koozali developed git repo for smeserver-openvpn-routed smecontribs
|
||||||
|
|
||||||
|
## Wiki
|
||||||
|
<br />https://wiki.koozali.org/
|
||||||
|
|
||||||
|
## Bugzilla
|
||||||
|
Show list of outstanding bugs: [here](https://bugs.koozali.org/buglist.cgi?component=smeserver-openvpn-routed&product=SME%20Contribs&query_format=advanced&limit=0&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=CONFIRMED)
|
||||||
|
|
||||||
|
## Description
|
||||||
|
|
||||||
|
<br />*This description has been generated by an LLM AI system and cannot be relied on to be fully correct.*
|
||||||
|
*Once it has been checked, then this comment will be deleted*
|
||||||
|
<br />
|
||||||
|
|||||||
155
additional/CHANGELOG.git
Normal file
155
additional/CHANGELOG.git
Normal file
@ -0,0 +1,155 @@
|
|||||||
|
commit 66557c7d543573cdd5e3eb332bb54ba2517a3d60
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Mon Apr 10 11:18:17 2017 +0200
|
||||||
|
|
||||||
|
Update pam plugin path
|
||||||
|
|
||||||
|
commit 848752010a3a37d1bd75d38b4f0c0e3011109884
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Mon Feb 8 10:59:41 2016 +0100
|
||||||
|
|
||||||
|
Create urandom in chroot
|
||||||
|
|
||||||
|
commit 5e590ef5b9bda1aa62264b104fed5a8aa8d8f099
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Tue Sep 29 12:02:31 2015 +0200
|
||||||
|
|
||||||
|
Spec file update
|
||||||
|
|
||||||
|
commit c595fbe31a78521383074be878e6afe810b11d0a
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Tue Sep 29 11:42:30 2015 +0200
|
||||||
|
|
||||||
|
Make crl verification optional
|
||||||
|
|
||||||
|
commit 36f5d2b782c5cfdf1717dc73dfeff5d7867cdf85
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Tue Sep 29 11:23:44 2015 +0200
|
||||||
|
|
||||||
|
Restrict access to the management-pass.txt file
|
||||||
|
|
||||||
|
commit d66b9396e182fda414eaf994884b6244caa00204
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Tue Sep 29 11:21:01 2015 +0200
|
||||||
|
|
||||||
|
Set default network in the up script
|
||||||
|
|
||||||
|
commit 019d0e2d50184ca5822b7ce6736c4ba3ad0f0fd5
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Wed Dec 3 22:25:19 2014 +0100
|
||||||
|
|
||||||
|
Spec file update
|
||||||
|
|
||||||
|
commit 6a3d60d9a8ab6a33b04aad4bf059eab45eac438b
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Wed Dec 3 21:54:49 2014 +0100
|
||||||
|
|
||||||
|
Correctly push route for local network
|
||||||
|
|
||||||
|
commit 496a2b678f383f2980f6a7c9677b2166dd5b7835
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Mon Jun 23 18:26:42 2014 +0200
|
||||||
|
|
||||||
|
Spec file update
|
||||||
|
|
||||||
|
commit 5534d9a3cb739d20b202f92b755e66a0c5a3a56b
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Mon Jun 23 18:25:55 2014 +0200
|
||||||
|
|
||||||
|
Fix plugin path on x86_64
|
||||||
|
|
||||||
|
commit 890a6c2e09bcaccfe7c9a2b2f9a88e6dadc3ae0d
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Wed Aug 21 16:06:26 2013 +0200
|
||||||
|
|
||||||
|
update spec file
|
||||||
|
|
||||||
|
commit b89fdff8d3018f849456d4b408dba274e5e7f955
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Wed Aug 21 16:05:48 2013 +0200
|
||||||
|
|
||||||
|
Use full path the the up script
|
||||||
|
|
||||||
|
commit d31a088f194a3d8d1ca9ecf51b2f37aaf64d42e4
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Tue Jun 11 10:58:01 2013 +0200
|
||||||
|
|
||||||
|
update spec file
|
||||||
|
|
||||||
|
commit 2d0c9d80dde1ccc7f99deb0720db5ad0d252c568
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Wed May 29 14:45:14 2013 +0200
|
||||||
|
|
||||||
|
Use different name for the crl to prevent race conditions with openvpn-bridge
|
||||||
|
|
||||||
|
commit 9d0d164b4d8d589d62343dd9e9a1f8f1b8f912fe
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Mon May 27 09:44:28 2013 +0200
|
||||||
|
|
||||||
|
Fix update CRL script, refers to Routed mode, not bridged one
|
||||||
|
|
||||||
|
commit 7b7d1f9e50435deb3608c370dedf75b056fed561
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:59:45 2013 +0200
|
||||||
|
|
||||||
|
Do not try to update the CRL if its URL is not set
|
||||||
|
|
||||||
|
commit 322061737010908e87e582e54af86219dc84d60d
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:36:12 2013 +0200
|
||||||
|
|
||||||
|
Comment unused reload-ccd event
|
||||||
|
|
||||||
|
commit 655898a494ffb6323d3876058dc2eb3077540252
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:35:23 2013 +0200
|
||||||
|
|
||||||
|
Remove copyright notice in up script
|
||||||
|
|
||||||
|
commit 2995895c2005c0a764b67230c67045e6fe7ca6f5
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:35:03 2013 +0200
|
||||||
|
|
||||||
|
Fix up script
|
||||||
|
|
||||||
|
commit 69aa3d3988a0b08196a19374746c6c7f28ccaa84
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:34:29 2013 +0200
|
||||||
|
|
||||||
|
Add script-security 2, as required to execute external scripts
|
||||||
|
|
||||||
|
commit 5230402365b0758c764da2acfb1d5677be7cb00d
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:29:49 2013 +0200
|
||||||
|
|
||||||
|
Call the up script during service startup
|
||||||
|
|
||||||
|
commit 6378427fdf9590f69117997c83ce6023e377c48e
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:29:15 2013 +0200
|
||||||
|
|
||||||
|
Fix permission of the up script
|
||||||
|
|
||||||
|
commit 42036e42ee291404c96db59f07e667e0d6688a75
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:26:57 2013 +0200
|
||||||
|
|
||||||
|
Fix openvpn-routed-delete-net script and remove copyright notice
|
||||||
|
|
||||||
|
commit 74bfd5d71beb9a094a1011a621135308f3cea761
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:06:42 2013 +0200
|
||||||
|
|
||||||
|
Don't add template header in management-pass file
|
||||||
|
|
||||||
|
commit bc7246dd740f47b6c9f5aa619fc59ddf5228753c
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 16:05:29 2013 +0200
|
||||||
|
|
||||||
|
Fixes in templates for openvpn.conf
|
||||||
|
|
||||||
|
commit e201d0a9b0c059f23eb9750f383fc2a5f331663e
|
||||||
|
Author: Daniel Berteaud <daniel@firewall-services.com>
|
||||||
|
Date: Fri May 24 15:38:55 2013 +0200
|
||||||
|
|
||||||
|
FIrst commit
|
||||||
90
additional/smeserver-openvpn-routed.spec
Normal file
90
additional/smeserver-openvpn-routed.spec
Normal file
@ -0,0 +1,90 @@
|
|||||||
|
# Authority: vip-ire
|
||||||
|
# Name: Daniel Berteaud
|
||||||
|
|
||||||
|
Summary: OpenVPN, a strong VPN solution build over SSL, pre-configured for routed mode
|
||||||
|
Name: smeserver-openvpn-routed
|
||||||
|
%define version 0.1.5
|
||||||
|
%define release 1
|
||||||
|
Version: %{version}
|
||||||
|
Release: %{release}%{?dist}
|
||||||
|
License: GPL
|
||||||
|
Group: Networking/Remote access
|
||||||
|
Source: %{name}-%{version}.tar.gz
|
||||||
|
|
||||||
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
|
||||||
|
BuildArchitectures: noarch
|
||||||
|
|
||||||
|
BuildRequires: e-smith-devtools
|
||||||
|
|
||||||
|
Requires: e-smith-base
|
||||||
|
Requires: openvpn
|
||||||
|
#Requires: perl(Net::OpenVPN::Manage)
|
||||||
|
|
||||||
|
%description
|
||||||
|
This package contains all the needed scripts and templates
|
||||||
|
to have a full working openvpn server running in routed mode.
|
||||||
|
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Mon Feb 8 2016 Daniel Berteaud <daniel@firewall-services.com> 0.1.5-1
|
||||||
|
- Create /etc/openvpn/routed/dev/urandom [SME: 9238]
|
||||||
|
|
||||||
|
* Tue Sep 29 2015 Daniel Berteaud <daniel@firewall-services.com> 0.1.4-1
|
||||||
|
- Make crl verification optional
|
||||||
|
- Set a default Network if none is set
|
||||||
|
- restrict permission on the management-pass.txt file
|
||||||
|
|
||||||
|
* Wed Dec 3 2014 Daniel Berteaud <daniel@firewall-services.com> 0.1.3-1
|
||||||
|
- Correctly push route to local network when not redirecting gw
|
||||||
|
|
||||||
|
* Mon Jun 23 2014 Daniel Berteaud <daniel@firewall-services.com> 0.1.2-1
|
||||||
|
- Fix plugin path on x86_64
|
||||||
|
|
||||||
|
* Wed Aug 21 2013 Daniel Berteaud <daniel@firewall-services.com> 0.1.1-1
|
||||||
|
- Use full path to the up script
|
||||||
|
|
||||||
|
* Tue Jun 11 2013 Daniel Berteaud <daniel@firewall-services.com> 0.1.0-1
|
||||||
|
- initial release
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -q -n %{name}-%{version}
|
||||||
|
|
||||||
|
%build
|
||||||
|
perl createlinks
|
||||||
|
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/ccd
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/priv
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/pub
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/tmp
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/dev
|
||||||
|
%{__mkdir_p} root/var/log/openvpn-routed
|
||||||
|
|
||||||
|
%install
|
||||||
|
/bin/rm -rf $RPM_BUILD_ROOT
|
||||||
|
(cd root ; /usr/bin/find . -depth -print | /bin/cpio -dump $RPM_BUILD_ROOT)
|
||||||
|
/bin/rm -f %{name}-%{version}-filelist
|
||||||
|
/sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
|
||||||
|
--file /var/service/openvpn-routed/run 'attr(0755,root,root)' \
|
||||||
|
--file /var/service/openvpn-routed/log/run 'attr(0755,root,root)' \
|
||||||
|
--dir /var/log/openvpn-routed 'attr(0750,smelog,smelog)' \
|
||||||
|
--dir /etc/openvpn/routed/pub 'attr(0755,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/priv 'attr(0750,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/ccd 'attr(0755,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/tmp 'attr(0770,root,openvpn)' \
|
||||||
|
--file /usr/bin/ovpn-routed-update-crl 'attr(0750,root,root)' \
|
||||||
|
--file /etc/openvpn/routed/bin/up 'attr(755,root,root)' \
|
||||||
|
> %{name}-%{version}-filelist
|
||||||
|
|
||||||
|
%files -f %{name}-%{version}-filelist
|
||||||
|
%defattr(-,root,root)
|
||||||
|
|
||||||
|
%clean
|
||||||
|
rm -rf $RPM_BUILD_ROOT
|
||||||
|
|
||||||
|
%post
|
||||||
|
if [ \! -c /etc/openvpn/routed/dev/urandom ]; then
|
||||||
|
mknod -m 0444 /etc/openvpn/routed/dev/urandom c 1 9
|
||||||
|
fi
|
||||||
|
|
||||||
|
%preun
|
||||||
|
|
||||||
1
contriborbase
Normal file
1
contriborbase
Normal file
@ -0,0 +1 @@
|
|||||||
|
contribs10
|
||||||
69
createlinks
Normal file
69
createlinks
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
#!/usr/bin/perl -w
|
||||||
|
|
||||||
|
use esmith::Build::CreateLinks qw(:all);
|
||||||
|
|
||||||
|
safe_symlink("restart", "root/etc/e-smith/events/openvpn-routed-update/services2adjust/openvpn-routed");
|
||||||
|
safe_symlink("restart", "root/etc/e-smith/events/network-create/services2adjust/openvpn-routed");
|
||||||
|
safe_symlink("restart", "root/etc/e-smith/events/network-delete/services2adjust/openvpn-routed");
|
||||||
|
|
||||||
|
#service_link_enhanced("openvpn-routed", "S80", "7");
|
||||||
|
#service_link_enhanced("openvpn-routed", "K25", "6");
|
||||||
|
#service_link_enhanced("openvpn-routed", "K25", "0");
|
||||||
|
|
||||||
|
#safe_symlink("../daemontools" , 'root/etc/rc.d/init.d/supervise/openvpn-routed');
|
||||||
|
safe_symlink("/var/service/openvpn-routed" , 'root/service/openvpn-routed');
|
||||||
|
|
||||||
|
safe_touch("root/var/service/openvpn-routed/down");
|
||||||
|
|
||||||
|
safe_touch("root/etc/e-smith/templates/etc/openvpn/routed/management-pass.txt/template-begin");
|
||||||
|
safe_touch("root/etc/e-smith/templates/etc/openvpn/routed/management-pass.txt/template-end");
|
||||||
|
|
||||||
|
#panel_link("openvpnrouted", 'manager');
|
||||||
|
|
||||||
|
templates2events("/etc/openvpn/routed/openvpn.conf", "openvpn-routed-update");
|
||||||
|
|
||||||
|
templates2events("/etc/openvpn/routed/management-pass.txt", qw(openvpn-routed-update bootstrap-console-save));
|
||||||
|
templates2events("/etc/openvpn/routed/openvpn.conf", qw(openvpn-routed-update bootstrap-console-save network-create network-delete));
|
||||||
|
templates2events("/etc/crontab", qw(openvpn-routed-update));
|
||||||
|
|
||||||
|
#event_link("openvpn-routed-reload-ccd", "openvpn-routed-update", "20");
|
||||||
|
event_link("openvpn-routed-update-crl", "openvpn-routed-update", "30");
|
||||||
|
event_link("openvpn-routed-delete-net", "openvpn-routed-update", "40");
|
||||||
|
event_link("openvpn-bridge-jail", "openvpn-routed-update", "03");
|
||||||
|
event_link("openvpn-bridge-jail", "bootstrap-console-save", "03");
|
||||||
|
#event_link("openvpn-routed-reload-ccd", "openvpn-routed-reload-ccd", "20");
|
||||||
|
#event_link("openvpn-routed-update-crl", "openvpn-routed-reload-ccd", "30");
|
||||||
|
|
||||||
|
# our event specific for updating with yum without reboot
|
||||||
|
$event = "smeserver-openvpn-routed-update";
|
||||||
|
#add here the path to your templates needed to expand
|
||||||
|
#see the /etc/systemd/system-preset/49-koozali.preset should be present for systemd integration on all you yum update event
|
||||||
|
|
||||||
|
foreach my $file (qw(
|
||||||
|
/etc/systemd/system-preset/49-koozali.preset
|
||||||
|
/etc/crontab
|
||||||
|
/etc/openvpn/routed/management-pass.txt
|
||||||
|
/etc/openvpn/routed/openvpn.conf
|
||||||
|
|
||||||
|
))
|
||||||
|
{
|
||||||
|
templates2events( $file, $event );
|
||||||
|
}
|
||||||
|
|
||||||
|
#action needed in case we have a systemd unit
|
||||||
|
event_link("systemd-default", $event, "10");
|
||||||
|
event_link("systemd-reload", $event, "50");
|
||||||
|
|
||||||
|
#action specific to this package
|
||||||
|
event_link("openvpn-routed-update", $event, "60");
|
||||||
|
event_link("openvpn-bridge-jail", $event, "03");
|
||||||
|
#services we need to restart
|
||||||
|
safe_symlink("restart", "root/etc/e-smith/events/$event/services2adjust/openvpn-routed");
|
||||||
|
|
||||||
|
|
||||||
|
use esmith::Build::Backup qw(:all);
|
||||||
|
backup_includes("smeserver-openvpn-routed", qw(
|
||||||
|
/etc/openvpn/routed/priv
|
||||||
|
/etc/openvpn/routed/pub
|
||||||
|
/var/log/openvpn-routed
|
||||||
|
));
|
||||||
@ -0,0 +1 @@
|
|||||||
|
AES-128-CBC
|
||||||
@ -0,0 +1 @@
|
|||||||
|
SHA256
|
||||||
@ -0,0 +1 @@
|
|||||||
|
1194
|
||||||
@ -0,0 +1 @@
|
|||||||
|
public
|
||||||
@ -0,0 +1 @@
|
|||||||
|
enabled
|
||||||
@ -0,0 +1 @@
|
|||||||
|
service
|
||||||
@ -0,0 +1,9 @@
|
|||||||
|
{
|
||||||
|
my $openvpn = $DB->get('openvpn-routed') || $DB->new_record('openvpn-routed', {type => 'service'});
|
||||||
|
my $management = $openvpn->prop('ManagementPassword') || '';
|
||||||
|
return "" if ($management ne '');
|
||||||
|
|
||||||
|
# Generate a random password
|
||||||
|
$pass=`/usr/bin/openssl rand -base64 20 | tr -c -d '[:alnum:]'`;
|
||||||
|
$openvpn->set_prop('ManagementPassword',"$pass");
|
||||||
|
}
|
||||||
25
root/etc/e-smith/events/actions/openvpn-routed-delete-net
Normal file
25
root/etc/e-smith/events/actions/openvpn-routed-delete-net
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
#!/usr/bin/perl -w
|
||||||
|
use strict;
|
||||||
|
use esmith::ConfigDB;
|
||||||
|
use esmith::NetworksDB;
|
||||||
|
use esmith::event;
|
||||||
|
|
||||||
|
my $c = esmith::ConfigDB->open_ro || die "Couldn't open config db\n";
|
||||||
|
my $n = esmith::NetworksDB->open || die "Couldn't open netwoks db\n";
|
||||||
|
my @nets = $n->networks;
|
||||||
|
my $ovpn = $c->get('openvpn-routed');
|
||||||
|
my $net = $ovpn->prop('Network') || '192.168.29.0/255.255.255.0';
|
||||||
|
my ($vpnnet,$mask) = split /\//, $net;
|
||||||
|
|
||||||
|
foreach my $net (@nets){
|
||||||
|
my $key = $net->key;
|
||||||
|
my $vpn = $n->get_prop($key,"VPNRouted") || '';
|
||||||
|
|
||||||
|
if ($vpn eq 'yes'){
|
||||||
|
unless ($key eq $vpnnet){
|
||||||
|
$n->set_prop($key, type=>'network-deleted');
|
||||||
|
event_signal("network-delete","$key");
|
||||||
|
$n->get($key)->delete;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
7
root/etc/e-smith/events/actions/openvpn-routed-jail
Normal file
7
root/etc/e-smith/events/actions/openvpn-routed-jail
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
#copy any files needed for the jail
|
||||||
|
|
||||||
|
#be sure we have the needed timezone
|
||||||
|
/bin/cp -L /etc/localtime /etc/openvpn/routed/etc
|
||||||
|
|
||||||
32
root/etc/e-smith/events/actions/openvpn-routed-update-crl
Normal file
32
root/etc/e-smith/events/actions/openvpn-routed-update-crl
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
URL=$(/sbin/e-smith/db configuration getprop openvpn-routed CrlUrl)
|
||||||
|
DOMAIN=$(/sbin/e-smith/db configuration get DomainName)
|
||||||
|
|
||||||
|
if [ -z $URL ]; then
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
/usr/bin/wget $URL -O /tmp/cacrl_routed.pem > /dev/null 2>&1
|
||||||
|
|
||||||
|
/usr/bin/openssl crl -inform PEM -in /tmp/cacrl_routed.pem -text > /dev/null 2>&1
|
||||||
|
|
||||||
|
if [ "$?" -eq "0" ]; then
|
||||||
|
/bin/mv -f /tmp/cacrl_routed.pem /etc/openvpn/routed/pub/cacrl.pem > /dev/null 2>&1
|
||||||
|
else
|
||||||
|
cat > /tmp/crlmail_routed <<END
|
||||||
|
|
||||||
|
An error occured while updating the CRL for OpenVPN-Routed
|
||||||
|
because openssl didn't recognize the file as a valid CRL.
|
||||||
|
Below is the copy of the latest CRL downloaded from
|
||||||
|
$URL
|
||||||
|
|
||||||
|
|
||||||
|
END
|
||||||
|
|
||||||
|
cat /tmp/cacrl_routed.pem >> /tmp/crlmail_routed
|
||||||
|
mail -s 'CRL update failed' admin@$DOMAIN < /tmp/crlmail_routed
|
||||||
|
fi
|
||||||
|
|
||||||
|
rm -f /tmp/cacrl_routed.pem
|
||||||
|
rm -f /tmp/crlmail_routed
|
||||||
@ -0,0 +1,3 @@
|
|||||||
|
PERMS=0600
|
||||||
|
UID="root"
|
||||||
|
GID="root"
|
||||||
@ -0,0 +1,7 @@
|
|||||||
|
{
|
||||||
|
my $url = ${'openvpn-routed'}{'CrlUrl'} || '';
|
||||||
|
if ($url =~ /^http(s)?:\/\/.*$/){
|
||||||
|
$OUT .= "# Update OpenVPN routed CRL\n";
|
||||||
|
$OUT .= "5 * * * * root /etc/e-smith/events/actions/openvpn-routed-update-crl 2>&1 /dev/null\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
my $pass = ${'openvpn-routed'}{'ManagementPassword'} || 'secret';
|
||||||
|
$OUT = "$pass";
|
||||||
|
}
|
||||||
@ -0,0 +1,21 @@
|
|||||||
|
{
|
||||||
|
my $OUT='';
|
||||||
|
my $protocol = ${'openvpn-routed'}{Protocol} || 'udp';
|
||||||
|
my $port='';
|
||||||
|
if ($protocol eq 'udp'){
|
||||||
|
$port = ${'openvpn-routed'}{UDPPort} || '1194';
|
||||||
|
}
|
||||||
|
if ($protocol eq 'tcp'){
|
||||||
|
$port = ${'openvpn-routed'}{TCPPort} || '1194';
|
||||||
|
$protocol = 'tcp-server';
|
||||||
|
}
|
||||||
|
|
||||||
|
$OUT .=<<"HERE";
|
||||||
|
|
||||||
|
port $port
|
||||||
|
proto $protocol
|
||||||
|
dev tunvpn0
|
||||||
|
|
||||||
|
HERE
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,5 @@
|
|||||||
|
user openvpn
|
||||||
|
group openvpn
|
||||||
|
chroot /etc/openvpn/routed
|
||||||
|
persist-key
|
||||||
|
persist-tun
|
||||||
@ -0,0 +1,20 @@
|
|||||||
|
# Certificates config
|
||||||
|
dh pub/dh.pem
|
||||||
|
ca pub/cacert.pem
|
||||||
|
cert pub/cert.pem
|
||||||
|
key priv/key.pem
|
||||||
|
tls-server
|
||||||
|
|
||||||
|
{
|
||||||
|
|
||||||
|
if (-e "/etc/openvpn/routed/priv/takey.pem" &&
|
||||||
|
!-z "/etc/openvpn/routed/priv/takey.pem"){
|
||||||
|
$OUT .= "tls-auth priv/takey.pem 0\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
if (-e '/etc/openvpn/routed/pub/cacrl.pem' &&
|
||||||
|
!-z '/etc/openvpn/routed/pub/cacrl.pem'){
|
||||||
|
$OUT .= "crl-verify pub/cacrl.pem\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,33 @@
|
|||||||
|
{
|
||||||
|
#HMAC default is SHA1 if empty, we really want higher on new setup, but keep empty for default on existing one...
|
||||||
|
# need to be changed on both side
|
||||||
|
my $HMAC = ( ${'openvpn-routed'}{'HMAC'} ) ? ${'openvpn-routed'}{'HMAC'} : undef;
|
||||||
|
# cipher default to BF if empty, we really want higher on new setup, but keep empty for default on existing one...
|
||||||
|
# # here openvpn uses encrypt-then-mc so no issue using CBC rather than GCM, and GCM not implemented before openvpn 2.4 for data channel
|
||||||
|
my $cipher = ( ${'openvpn-routed'}{'Cipher'} && ${'openvpn-routed'}{'Cipher'} ne 'auto')? ${'openvpn-routed'}{'Cipher'} : undef;
|
||||||
|
|
||||||
|
## we do not want any tls 1.1 or lower, this does not break anything to force, unless the client is very old and limited to 1.1 or lower
|
||||||
|
my $tlsVmin = ( ${'openvpn-routed'}{'tlsVmin'} && ( ${'openvpn-routed'}{'tlsVmin'} =~ /^1\.[0-9]{1}$/ ) ) ? ${'openvpn-routed'}{'tlsVmin'} : "1.2";
|
||||||
|
# TLS 1.3 encryption settings
|
||||||
|
my $tlsCipherSuites13 = ( ${'openvpn-routed'}{'tlsCipherSuites13'} ) ? ${'openvpn-routed'}{'tlsCipherSuites13'} : "TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256";
|
||||||
|
# # TLS 1.2 encryption settings
|
||||||
|
my $tlsCipher12 = ( ${'openvpn-routed'}{'tlsCipher12'} ) ? ${'openvpn-routed'}{'tlsCipher12'} : "TLS-ECDHE-ECDSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-RSA-WITH-CHACHA20-POLY1305-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256";
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
$OUT .= "#securing control channel\n";
|
||||||
|
$OUT .= "tls-version-min $tlsVmin\n";
|
||||||
|
$OUT .= "tls-cipher $tlsCipher12\n" if defined $tlsCipher12;
|
||||||
|
$OUT .= "tls-ciphersuites $tlsCipherSuites13\n" if defined $tlsCipherSuites13;
|
||||||
|
#$OUT .= "# we might be able to disable dh param with this one, NSA-'s recommended curve\n";
|
||||||
|
#$OUT .= "ecdh-curve secp384r1\n";
|
||||||
|
|
||||||
|
# data channel
|
||||||
|
$OUT .= "#securing data channel\n";
|
||||||
|
$OUT .= (defined $cipher) ? "cipher $cipher\n" : "# no cipher defined default to Blowfish, this is INSECURE, please consider AES-128-CBC or higher on both client and server\n";
|
||||||
|
#auth SHA512
|
||||||
|
$OUT .= (defined $HMAC )? "auth $HMAC\n" : "# no HMAC defined, default to SHA1, please consider SHA256 or higher on both client and server\n";
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,8 @@
|
|||||||
|
{
|
||||||
|
my $userAuth = ${'openvpn-routed'}{Authentication} || 'CrtWithPass';
|
||||||
|
if ($userAuth eq 'CrtWithPass'){
|
||||||
|
my $libdir = (-d "/usr/lib64/") ? '/usr/lib64' : '/usr/lib';
|
||||||
|
$OUT .= "plugin " . $libdir . "/openvpn/plugins/openvpn-plugin-auth-pam.so login\n";
|
||||||
|
}
|
||||||
|
$OUT .= '';
|
||||||
|
}
|
||||||
@ -0,0 +1,9 @@
|
|||||||
|
{
|
||||||
|
my $net = ${'openvpn-routed'}{'Network'} || '192.168.29.0/255.255.255.0';
|
||||||
|
my ($addr,$mask) = split /\//, $net;
|
||||||
|
$OUT = "server $addr $mask\n";
|
||||||
|
}
|
||||||
|
topology subnet
|
||||||
|
|
||||||
|
up /etc/openvpn/routed/bin/up
|
||||||
|
script-security 2
|
||||||
@ -0,0 +1,55 @@
|
|||||||
|
# Options
|
||||||
|
{
|
||||||
|
|
||||||
|
my $tunMtu = ${'openvpn-routed'}{Mtu} || '';
|
||||||
|
my $fragment = ${'openvpn-routed'}{Fragment} || '';
|
||||||
|
my $redirectGW = ${'openvpn-routed'}{RedirectGateway} || '';
|
||||||
|
my $proto = ${'openvpn-routed'}{Protocol} || 'udp';
|
||||||
|
my $duplicate = ${'openvpn-routed'}{DuplicateCN} || 'disabled';
|
||||||
|
my $passtos = ${'openvpn-routed'}{PassTOS} || 'enabled';
|
||||||
|
my $compress = ${'openvpn-routed'}{Compression} || 'enabled';
|
||||||
|
|
||||||
|
if ($proto eq 'tcp'){
|
||||||
|
$mtuTest = 'disabled';
|
||||||
|
$fragment = '';
|
||||||
|
}
|
||||||
|
|
||||||
|
$OUT .=<<"HERE";
|
||||||
|
keepalive 40 180
|
||||||
|
push "dhcp-option DOMAIN $DomainName"
|
||||||
|
push "dhcp-option DNS $LocalIP"
|
||||||
|
push "dhcp-option WINS $LocalIP"
|
||||||
|
|
||||||
|
HERE
|
||||||
|
|
||||||
|
if ($tunMtu !~ /^\d+$/){
|
||||||
|
$OUT .= "mtu-test\n";
|
||||||
|
}
|
||||||
|
else{
|
||||||
|
if ($tunMtu ne ''){
|
||||||
|
$OUT .= "tun-mtu $tunMtu\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if (($proto eq 'udp') && ($fragment =~ /^\d+$/)){
|
||||||
|
$OUT .= "fragment $fragment\n";
|
||||||
|
}
|
||||||
|
$OUT .= "mssfix\n";
|
||||||
|
|
||||||
|
if ($duplicate eq 'enabled'){
|
||||||
|
$OUT .= "duplicate-cn\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($passtos eq 'enabled'){
|
||||||
|
$OUT .= "passtos\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($compress eq 'enabled'){
|
||||||
|
$OUT .= "comp-lzo adaptive\n";
|
||||||
|
$OUT .= "push \"comp-lzo adaptive\"\n";
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
nice 5
|
||||||
|
|
||||||
@ -0,0 +1,29 @@
|
|||||||
|
{
|
||||||
|
|
||||||
|
my $pushRoutes = ${'openvpn-routed'}{PushLocalNetworks} || 'enabled';
|
||||||
|
my $redirectGW = ${'openvpn-routed'}{RedirectGateway} || 'disabled';
|
||||||
|
|
||||||
|
use esmith::NetworksDB;
|
||||||
|
my $ndb = esmith::NetworksDB->open_ro() ||
|
||||||
|
die('Can not open Networks DB');
|
||||||
|
|
||||||
|
my @networks = $ndb->networks();
|
||||||
|
|
||||||
|
if ($redirectGW eq 'enabled'){
|
||||||
|
$OUT .= "push \"redirect-gateway def1\"\n";
|
||||||
|
}
|
||||||
|
elsif ($pushRoutes eq 'enabled'){
|
||||||
|
foreach my $network (@networks) {
|
||||||
|
my $route = '';
|
||||||
|
my $addr = $network->key;
|
||||||
|
my $mask = $network->prop('Mask');
|
||||||
|
my $gw = $network->prop('Router') || '';
|
||||||
|
my $vpn = $network->prop('VPN') || '';
|
||||||
|
next if (($network->prop('PushRoute') || 'enabled') eq 'disabled');
|
||||||
|
next if (($network->prop('VPNRouted') || 'no') eq 'yes');
|
||||||
|
$route .= "push \"route $addr $mask";
|
||||||
|
$route .= " $gw" if ($vpn eq '' && $gw ne '');
|
||||||
|
$OUT .= "$route\"\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,5 @@
|
|||||||
|
{
|
||||||
|
my $pass = ${'openvpn-routed'}{'ManagementPassword'} || 'secret';
|
||||||
|
$OUT ="management 127.0.0.1 11195 management-pass.txt\n";
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,13 @@
|
|||||||
|
{
|
||||||
|
my $OUT = '';
|
||||||
|
my $maxClient = ${'openvpn-routed'}{MaxClients} || '';
|
||||||
|
my $configRequired = ${'openvpn-routed'}{ConfigRequired} || 'disabled';
|
||||||
|
|
||||||
|
if ($configRequired eq 'enabled'){
|
||||||
|
$OUT .= 'ccd-exclusive\n';
|
||||||
|
}
|
||||||
|
if ($maxClient =~ /^\d+$/){
|
||||||
|
$OUT .= "max-clients $maxClient\n";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
client-config-dir ccd
|
||||||
@ -0,0 +1,10 @@
|
|||||||
|
status-version 2
|
||||||
|
status bridge-status.txt
|
||||||
|
{
|
||||||
|
#suppress-timestamps
|
||||||
|
my $OUT = '';
|
||||||
|
my $verb = ${'openvpn-routed'}{Verbose} || '3';
|
||||||
|
$OUT .= "verb $verb\n";
|
||||||
|
}
|
||||||
|
log-append /var/log/openvpn-routed/openvpn-routed.log
|
||||||
|
|
||||||
8
root/etc/logrotate.d/openvpn-routed
Normal file
8
root/etc/logrotate.d/openvpn-routed
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
/var/log/openvpn-routed/*.log{
|
||||||
|
monthly
|
||||||
|
rotate 6
|
||||||
|
compress
|
||||||
|
copytruncate
|
||||||
|
missingok
|
||||||
|
}
|
||||||
|
|
||||||
12
root/etc/openvpn/routed/bin/up
Normal file
12
root/etc/openvpn/routed/bin/up
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
net=$(/sbin/e-smith/db configuration getprop openvpn-routed Network || echo '192.168.29.0/255.255.255.0')
|
||||||
|
addr=${net%%/*}
|
||||||
|
mask=${net#*/}
|
||||||
|
|
||||||
|
db=$(/sbin/e-smith/db networks getprop $addr VPNRouted)
|
||||||
|
if [ -z $db ]; then
|
||||||
|
/sbin/e-smith/db networks set $addr network Mask $mask VPNRouted yes Removable no
|
||||||
|
/sbin/e-smith/signal-event network-create $addr
|
||||||
|
fi
|
||||||
|
exit 0
|
||||||
30
root/sbin/e-smith/systemd/openvpn-routed
Normal file
30
root/sbin/e-smith/systemd/openvpn-routed
Normal file
@ -0,0 +1,30 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
|
||||||
|
[[ ! -f /etc/openvpn/routed/pub/cert.pem && -f /etc/openvpn/bridge/pub/cert.pem ]] && cp -a /etc/openvpn/bridge/pub/cert.pem /etc/openvpn/routed/pub/cert.pem
|
||||||
|
[[ ! -f /etc/openvpn/routed/pub/cacert.pem && -f /etc/openvpn/bridge/pub/cacert.pem ]] && cp -a /etc/openvpn/bridge/pub/cacert.pem /etc/openvpn/routed/pub/cacert.pem
|
||||||
|
[[ ! -f /etc/openvpn/routed/pub/dh.pem && -f /etc/openvpn/bridge/pub/dh.pem ]] && cp -a /etc/openvpn/bridge/pub/dh.pem /etc/openvpn/routed/pub/dh.pem
|
||||||
|
[[ ! -f /etc/openvpn/routed/priv/key.pem && -f /etc/openvpn/bridge/priv/key.pem ]] && cp -a /etc/openvpn/bridge/priv/key.pem /etc/openvpn/routed/priv/key.pem
|
||||||
|
[[ ! -f /etc/openvpn/routed/priv/takey.pem && -f /etc/openvpn/bridge/priv/takey.pem ]] && cp -a /etc/openvpn/bridge/priv/takey.pem /etc/openvpn/routed/priv/takey.pem
|
||||||
|
if [[ ! -f /etc/openvpn/routed/pub/cacrl.pem && -f /etc/openvpn/bridge/pub/cacrl.pem ]] ; then
|
||||||
|
cp -a /etc/openvpn/bridge/pub/cacrl.pem /etc/openvpn/routed/pub/cacrl.pem
|
||||||
|
CrlUrl=`/sbin/e-smith/config getprop openvpn-bridge CrlUrl`
|
||||||
|
/sbin/e-smith/config setprop openvpn-routed CrlUrl "$CrlUrl="
|
||||||
|
|
||||||
|
myport=`/sbin/e-smith/config getprop openvpn-routed UDPPort`
|
||||||
|
oriport="$myiport"
|
||||||
|
bridgeport=`/sbin/e-smith/config getprop openvpn-bridge UDPPort`
|
||||||
|
s2sports=`/sbin/e-smith/db openvpn-s2s print |sed -re 's/.*Port\|([0-9]+).*/\1/'|sort|uniq`
|
||||||
|
while [[ $s2sports =~ $myport || $myport == $bridgeport ]]
|
||||||
|
do
|
||||||
|
myport=$[$myport+1]
|
||||||
|
done
|
||||||
|
if [[ $myport != $oriport ]]; then
|
||||||
|
echo "set UDPPort to $myport as $oriport was already taken"
|
||||||
|
/sbin/e-smith/db configuration setprop openvpn-routed UDPPort $myport
|
||||||
|
/sbin/e-smith/expand-template /etc/openvpn/routed/openvpn.conf
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
chmod 0600 /etc/openvpn/routed/priv/*
|
||||||
|
chmod 0644 /etc/openvpn/routed/pub/*
|
||||||
|
chown root:admin /etc/openvpn/routed/priv/*
|
||||||
|
chown root:admin /etc/openvpn/routed/pub/*
|
||||||
26
root/usr/lib/systemd/system/openvpn-routed.service
Normal file
26
root/usr/lib/systemd/system/openvpn-routed.service
Normal file
@ -0,0 +1,26 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=OpenVPN Server routed for Roadwariors
|
||||||
|
After=network.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=notify
|
||||||
|
PrivateTmp=true
|
||||||
|
WorkingDirectory=/etc/openvpn/routed
|
||||||
|
|
||||||
|
ExecStartPre=-/sbin/e-smith/service-status 'openvpn-routed'
|
||||||
|
ExecStartPre=-/sbin/e-smith/systemd/openvpn-routed
|
||||||
|
ExecStart=/usr/sbin/openvpn --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC --config /etc/openvpn/routed/openvpn.conf --cd /etc/openvpn/routed
|
||||||
|
|
||||||
|
PrivateTmp=true
|
||||||
|
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
|
||||||
|
LimitNPROC=10
|
||||||
|
DeviceAllow=/dev/null rw
|
||||||
|
DeviceAllow=/dev/net/tun rw
|
||||||
|
KillMode=process
|
||||||
|
RestartSec=5s
|
||||||
|
Restart=on-failure
|
||||||
|
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
WantedBy=sme-server.target
|
||||||
|
|
||||||
6
root/var/service/openvpn-routed/log/run
Normal file
6
root/var/service/openvpn-routed/log/run
Normal file
@ -0,0 +1,6 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
exec \
|
||||||
|
/usr/local/bin/setuidgid smelog \
|
||||||
|
/usr/local/bin/multilog t s5000000 \
|
||||||
|
/var/log/openvpn-routed
|
||||||
5
root/var/service/openvpn-routed/run
Normal file
5
root/var/service/openvpn-routed/run
Normal file
@ -0,0 +1,5 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
exec 2>&1
|
||||||
|
|
||||||
|
exec /usr/sbin/openvpn --config /etc/openvpn/routed/openvpn.conf --cd /etc/openvpn/routed
|
||||||
124
smeserver-openvpn-routed.spec
Normal file
124
smeserver-openvpn-routed.spec
Normal file
@ -0,0 +1,124 @@
|
|||||||
|
# Authority: vip-ire
|
||||||
|
# Name: Daniel Berteaud
|
||||||
|
|
||||||
|
Summary: OpenVPN, a strong VPN solution build over SSL, pre-configured for routed mode
|
||||||
|
Name: smeserver-openvpn-routed
|
||||||
|
%define version 0.1.6
|
||||||
|
%define release 8
|
||||||
|
Version: %{version}
|
||||||
|
Release: %{release}%{?dist}
|
||||||
|
License: GPL
|
||||||
|
Group: Networking/Remote access
|
||||||
|
Source: %{name}-%{version}.tar.xz
|
||||||
|
|
||||||
|
BuildRoot: /var/tmp/%{name}-%{version}-%{release}-buildroot
|
||||||
|
BuildArchitectures: noarch
|
||||||
|
|
||||||
|
BuildRequires: e-smith-devtools
|
||||||
|
|
||||||
|
Requires: e-smith-base
|
||||||
|
Requires: openvpn
|
||||||
|
#Requires: perl(Net::OpenVPN::Manage)
|
||||||
|
|
||||||
|
%description
|
||||||
|
This package contains all the needed scripts and templates
|
||||||
|
to have a full working openvpn server running in routed mode.
|
||||||
|
|
||||||
|
|
||||||
|
%changelog
|
||||||
|
* Thu Mar 06 2025 cvs2git.sh aka Brian Read <brianr@koozali.org> 0.1.6-8.sme
|
||||||
|
- Roll up patches and move to git repo [SME: 12338]
|
||||||
|
|
||||||
|
* Thu Mar 06 2025 BogusDateBot
|
||||||
|
- Eliminated rpmbuild "bogus date" warnings due to inconsistent weekday,
|
||||||
|
by assuming the date is correct and changing the weekday.
|
||||||
|
|
||||||
|
* Wed Nov 23 2022 Jean-Philippe Pialasse <tests@pialasse.com> 0.1.6-7.sme
|
||||||
|
- log to a dedicated file [SME: 12243]
|
||||||
|
use locale timestamp
|
||||||
|
|
||||||
|
* Sat Jul 30 2022 Brian Read <brianr@bjsystems.co.uk> 0.1.6-6.sme
|
||||||
|
- Re-build and link to latest devtools [SME: 11997]
|
||||||
|
|
||||||
|
* Sat Jul 23 2022 Jean-Philippe Pialasse <tests@pialasse.com> 0.1.6-5.sme
|
||||||
|
- add to core backup [SME: 11997]
|
||||||
|
|
||||||
|
* Thu Apr 01 2021 Jean-Philippe Pialasse <tests@pialasse.com> 0.1.6-4.sme
|
||||||
|
- autoconfiguration if openvpn-bridge is isntalled and configured [SME: 11336]
|
||||||
|
- reworked systemd unit and scripts
|
||||||
|
- new property HMAC forced to SHA256, instead of insecure default SHA1 [SME: 9925]
|
||||||
|
- Cipher now enforced to AES-128-CBC, instead of insecure default Blowfish [SME: 9919]
|
||||||
|
- possibility to exclude networks to push [SME: 10548]
|
||||||
|
|
||||||
|
* Thu Feb 04 2021 Brian Read <brianr@bjsystems.co.uk> 0.1.6-2.sme
|
||||||
|
- Initial import to SME10 [SME: 11336]
|
||||||
|
- Add-in-systemd-startup
|
||||||
|
|
||||||
|
* Mon Apr 10 2017 Daniel Berteaud <daniel@firewall-services.com> 0.1.6-1
|
||||||
|
- Update pam plugin path [SME: 10220]
|
||||||
|
|
||||||
|
* Mon Feb 8 2016 Daniel Berteaud <daniel@firewall-services.com> 0.1.5-1
|
||||||
|
- Create /etc/openvpn/routed/dev/urandom [SME: 9238]
|
||||||
|
|
||||||
|
* Tue Sep 29 2015 Daniel Berteaud <daniel@firewall-services.com> 0.1.4-1
|
||||||
|
- Make crl verification optional
|
||||||
|
- Set a default Network if none is set
|
||||||
|
- restrict permission on the management-pass.txt file
|
||||||
|
|
||||||
|
* Wed Dec 3 2014 Daniel Berteaud <daniel@firewall-services.com> 0.1.3-1
|
||||||
|
- Correctly push route to local network when not redirecting gw
|
||||||
|
|
||||||
|
* Mon Jun 23 2014 Daniel Berteaud <daniel@firewall-services.com> 0.1.2-1
|
||||||
|
- Fix plugin path on x86_64
|
||||||
|
|
||||||
|
* Wed Aug 21 2013 Daniel Berteaud <daniel@firewall-services.com> 0.1.1-1
|
||||||
|
- Use full path to the up script
|
||||||
|
|
||||||
|
* Tue Jun 11 2013 Daniel Berteaud <daniel@firewall-services.com> 0.1.0-1
|
||||||
|
- initial release
|
||||||
|
|
||||||
|
%prep
|
||||||
|
%setup -q -n %{name}-%{version}
|
||||||
|
|
||||||
|
%build
|
||||||
|
perl createlinks
|
||||||
|
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/ccd
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/priv
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/pub
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/etc
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/tmp
|
||||||
|
%{__mkdir_p} root/etc/openvpn/routed/dev
|
||||||
|
%{__mkdir_p} root/var/log/openvpn-routed
|
||||||
|
|
||||||
|
%install
|
||||||
|
/bin/rm -rf $RPM_BUILD_ROOT
|
||||||
|
(cd root ; /usr/bin/find . -depth -print | /bin/cpio -dump $RPM_BUILD_ROOT)
|
||||||
|
/bin/rm -f %{name}-%{version}-filelist
|
||||||
|
/sbin/e-smith/genfilelist $RPM_BUILD_ROOT \
|
||||||
|
--file /sbin/e-smith/systemd/openvpn-routed 'attr(0755,root,root)' \
|
||||||
|
--file /var/service/openvpn-routed/run 'attr(0755,root,root)' \
|
||||||
|
--file /var/service/openvpn-routed/log/run 'attr(0755,root,root)' \
|
||||||
|
--dir /var/log/openvpn-routed 'attr(0750,smelog,smelog)' \
|
||||||
|
--dir /etc/openvpn/routed/pub 'attr(0755,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/priv 'attr(0750,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/ccd 'attr(0755,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/etc 'attr(0755,root,root)' \
|
||||||
|
--dir /etc/openvpn/routed/tmp 'attr(0770,root,openvpn)' \
|
||||||
|
--file /usr/bin/ovpn-routed-update-crl 'attr(0750,root,root)' \
|
||||||
|
--file /etc/openvpn/routed/bin/up 'attr(755,root,root)' \
|
||||||
|
> %{name}-%{version}-filelist
|
||||||
|
|
||||||
|
%files -f %{name}-%{version}-filelist
|
||||||
|
%defattr(-,root,root)
|
||||||
|
|
||||||
|
%clean
|
||||||
|
rm -rf $RPM_BUILD_ROOT
|
||||||
|
|
||||||
|
%post
|
||||||
|
if [ \! -c /etc/openvpn/routed/dev/urandom ]; then
|
||||||
|
mknod -m 0444 /etc/openvpn/routed/dev/urandom c 1 9
|
||||||
|
fi
|
||||||
|
|
||||||
|
%preun
|
||||||
|
|
||||||
Loading…
x
Reference in New Issue
Block a user