37 lines
1014 B
Bash
Executable File
37 lines
1014 B
Bash
Executable File
#!/bin/bash
|
|
|
|
# NOTA(vasco): feito para correr como root
|
|
if [[ "$USER" != "root" ]]; then
|
|
echo "corre o script como root"
|
|
exit 1
|
|
fi
|
|
|
|
yum install -y epel-release
|
|
yum install -y openvpn iptables-services dhcp-client
|
|
systemctl stop firewalld
|
|
systemctl disable firewalld
|
|
systemctl mask firewalld
|
|
systemctl enable iptables
|
|
iptables -F
|
|
|
|
CA_DIR="/etc/pki/CA"
|
|
mkdir -p "${CA_DIR}/newcerts"
|
|
mkdir -p "${CA_DIR}/private"
|
|
touch "${CA_DIR}/index.txt"
|
|
cp ca/serial "${CA_DIR}/serial"
|
|
|
|
mkdir -p /etc/openvpn/server
|
|
mkdir -p /etc/openvpn/client
|
|
|
|
# NOTE(vasco): tive problemas com a sincronização de tempo
|
|
# se nao tiver sincronizado, o TOTP nao funciona
|
|
systemctl stop chronyd
|
|
ntpdate pool.ntp.org
|
|
systemctl start chronyd
|
|
|
|
# NOTE(vasco): o openvpn não consegui aceder ao home e ler os secrets
|
|
# do google authenticator, por isso fiz isto:
|
|
mkdir -p /etc/systemd/system/openvpn-server@.service.d
|
|
echo -e "[Service]\nProtectHome=false" > /etc/systemd/system/openvpn-server@.service.d/override.conf
|
|
systemctl daemon-reload
|