OpenVPN（2）OpenVPN 用户管理

介绍

OpenVPN安装参考 OpenVPN（1）OpenVPN安装，OpenVPN安装完成后管理 OpenVPN 用户相对来说是一件比较麻烦的事情，我们可以参考官方的脚本编写一个用户管理脚本，以降低管理成本

1. 创建 OpenVPN 工作目录

$ mkdir -p /data/openvpn && cd /data/openvpn

2. 创建管理用户脚本

$ vim edit_user.sh

#!/bin/bash
### OpenVPN用户管理脚本 v1.1 ###
# 作者：Hzbb                   #
# 时间：2023-08-16             #
################################

WORK_DIR="$(cd `dirname $0`;pwd)"
mkdir ${WORK_DIR}/client
new_client () {
	{
	cat /etc/openvpn/server/client-common.txt
	echo "<ca>"
	cat /etc/openvpn/server/easy-rsa/pki/ca.crt
	echo "</ca>"
	echo "<cert>"
	sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
	echo "</cert>"
	echo "<key>"
	cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
	echo "</key>"
	echo "<tls-crypt>"
	sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
	echo "</tls-crypt>"
	} > ${WORK_DIR}/client/"$client".ovpn
}

if [[ ! -e /etc/openvpn/server/server.conf ]]; then
	echo "OpenVPN未安装，请先安装."
else
	clear
	echo "### OpenVPN用户管理脚本 v1.1 ###"
	echo
	echo "请输入以下选项编号:"
	echo "   1) 创建用户"
	echo "   2) 删除用户"
	echo "   3) 退出"
	read -p "选项: " option
	until [[ "$option" =~ ^[1-3]$ ]]; do
		echo "$option: 无效的选择。"
		read -p "选项: " option
	done
	case "$option" in
		1)
			echo
			echo "请输入新用户名(字母大小写、数字、符号-_):"
			read -p "用户名: " unsanitized_client
			client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
			while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
				echo "$client: 用户名无效."
				read -p "用户名: " unsanitized_client
				client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
			done
			cd /etc/openvpn/server/easy-rsa/
			./easyrsa --batch --days=3650 build-client-full "$client" nopass
			new_client
			echo "$client 用户创建成功"
			echo "配置文件位于: $WORK_DIR"/client/"$client.ovpn"
			echo
			exit
		;;
		2)
			number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
			if [[ "$number_of_clients" = 0 ]]; then
				echo
				echo "用户为空!"
				exit
			fi
			echo
			echo "选择要删除的用户:"
			tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
			read -p "选项('q'退出): " client_number

			if [[ "$client_number" = 'q' ]]; then
				exit
			fi

			until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
				echo "$client_number: 无效的选择。"
				read -p "选项('q'退出): " client_number
				if [[ "$client_number" = 'q' ]]; then
					exit
				fi
			done
			client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
			echo
			read -p "是否删除 $client 用户? [y/N]: " revoke
			until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
				echo "$revoke: 无效的选择。"
				read -p "是否删除 $client 用户? [y/N]: " revoke
			done
			if [[ "$revoke" =~ ^[yY]$ ]]; then
				cd /etc/openvpn/server/easy-rsa/
				./easyrsa --batch revoke "$client"
				./easyrsa --batch --days=3650 gen-crl
				rm -f /etc/openvpn/server/crl.pem
				cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
				chown nobody:"$group_name" /etc/openvpn/server/crl.pem
				rm -f $WORK_DIR/client/$client.ovpn 
				echo
				echo "$client 用户已删除!"
				echo
			else
				echo
				echo "$client 用户取消删除!"
				echo
			fi
			exit
		;;
		3)
			exit
		;;
	esac
fi