Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2024-11-22 08:49:03 +01:00
Code Issues Projects Releases Wiki Activity

Make encryption customization optional

Browse Source 
A lot of people don't know much about cryptography.
Since the script already overwrite OpenVPN's default settings, there is no need for most people to modify them.
This commit is contained in:
angristan 2018-09-21 17:17:41 +02:00
parent 0f67214490
commit 4144fa9dff
1 changed files with 71 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

131
openvpn-install.sh
View File

@ -250,69 +250,80 @@ function installOpenVPN () {
fi fi
done done
echo "" echo ""
echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " echo "Do you want to customize encryption settings?"
echo "the encryption in OpenVPN and the choices I made in this script." echo "Unless you know what you're doing, you should stick with the default parameters provided by the script."
echo "Please note that all the choices proposed are secure (to a different degree)" echo "Note that whatever you choose, all the choices presented in the script are safe. (Unlike OpenVPN's defaults)"
echo "and are still viable to date, unlike some default OpenVPN options" echo "See https://github.com/angristan/openvpn-install#encryption to learn more."
echo "" echo ""
echo "Choose which cipher you want to use for the data channel:" until [[ $CUSTOMIZE_ENC =~ (y|n) ]]; do
echo " 1) AES-128-CBC (recommended)" read -rp "Customize encryption settings? [y/n]: " -e -i n CUSTOMIZE_ENC
echo " 2) AES-192-CBC"
echo " 3) AES-256-CBC"
until [[ "$CIPHER_CHOICE" =~ ^[0-9]+$ ]] && [ "$CIPHER_CHOICE" -ge 1 -a "$CIPHER_CHOICE" -le 3 ]; do
read -rp "CIPHER_CHOICE [1-7]: " -e -i 1 CIPHER_CHOICE
done done
case $CIPHER_CHOICE in if [[ $CUSTOMIZE_ENC == "n" ]];then
1) # Use default, sane and fast paramters
CIPHER="cipher AES-128-CBC" CIPHER="cipher AES-128-CBC"
;; DH_KEY_SIZE="2048"
2) RSA_KEY_SIZE="2048"
CIPHER="cipher AES-192-CBC" else
;; echo ""
3) echo "Choose which cipher you want to use for the data channel:"
CIPHER="cipher AES-256-CBC" echo " 1) AES-128-CBC (recommended)"
;; echo " 2) AES-192-CBC"
esac echo " 3) AES-256-CBC"
until [[ "$CIPHER_CHOICE" =~ ^[0-9]+$ ]] && [ "$CIPHER_CHOICE" -ge 1 -a "$CIPHER_CHOICE" -le 3 ]; do
read -rp "Cipher [1-7]: " -e -i 1 CIPHER_CHOICE
done
case $CIPHER_CHOICE in
1)
CIPHER="cipher AES-128-CBC"
;;
2)
CIPHER="cipher AES-192-CBC"
;;
3)
CIPHER="cipher AES-256-CBC"
;;
esac
echo ""
echo "Choose what size of Diffie-Hellman key you want to use:"
echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)"
until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE_CHOICE" -ge 1 -a "$DH_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE_CHOICE
done
case $DH_KEY_SIZE_CHOICE in
1)
DH_KEY_SIZE="2048"
;;
2)
DH_KEY_SIZE="3072"
;;
3)
DH_KEY_SIZE="4096"
;;
esac
echo ""
echo "Choose what size of RSA key you want to use for the certificate:"
echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)"
until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE_CHOICE" -ge 1 -a "$RSA_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE_CHOICE
done
case $RSA_KEY_SIZE_CHOICE in
1)
RSA_KEY_SIZE="2048"
;;
2)
RSA_KEY_SIZE="3072"
;;
3)
RSA_KEY_SIZE="4096"
;;
esac
fi
echo "" echo ""
echo "Choose what size of Diffie-Hellman key you want to use:" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now."
echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)"
until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE_CHOICE" -ge 1 -a "$DH_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE_CHOICE
done
case $DH_KEY_SIZE_CHOICE in
1)
DH_KEY_SIZE="2048"
;;
2)
DH_KEY_SIZE="3072"
;;
3)
DH_KEY_SIZE="4096"
;;
esac
echo ""
echo "Choose what size of RSA key you want to use for the certificate:"
echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)"
until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE_CHOICE" -ge 1 -a "$RSA_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE_CHOICE
done
case $RSA_KEY_SIZE_CHOICE in
1)
RSA_KEY_SIZE="2048"
;;
2)
RSA_KEY_SIZE="3072"
;;
3)
RSA_KEY_SIZE="4096"
;;
esac
echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
echo "You will be able to generate a client at the end of the installtion." echo "You will be able to generate a client at the end of the installtion."
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."