Configure OpenVPN LDAP authentication and user management with Active Directory integration

#!/usr/bin/env bash
set -euo pipefail

# OpenVPN LDAP Authentication Setup Script
# Configures OpenVPN with Active Directory LDAP authentication

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Configuration variables
OPENVPN_DIR="/etc/openvpn"
EASY_RSA_DIR="$OPENVPN_DIR/easy-rsa"
LOG_FILE="/var/log/openvpn-setup.log"

# Function to print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1" | tee -a "$LOG_FILE"
}

print_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1" | tee -a "$LOG_FILE"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1" | tee -a "$LOG_FILE"
}

# Cleanup function
cleanup() {
    print_error "Setup failed. Cleaning up..."
    systemctl stop openvpn-server@server 2>/dev/null || true
    rm -rf "$EASY_RSA_DIR" 2>/dev/null || true
}

trap cleanup ERR

# Usage information
usage() {
    echo "Usage: $0 <ldap_server> <bind_dn> <bind_password> <base_dn>"
    echo "Example: $0 dc1.example.com 'CN=openvpn-service,OU=Service Accounts,DC=example,DC=com' 'password' 'OU=Users,DC=example,DC=com'"
    exit 1
}

# Check arguments
if [ $# -ne 4 ]; then
    usage
fi

LDAP_SERVER="$1"
BIND_DN="$2"
BIND_PASSWORD="$3"
BASE_DN="$4"

# Check if running as root
if [ "$EUID" -ne 0 ]; then
    print_error "This script must be run as root"
    exit 1
fi

# Detect distribution
print_status "Detecting operating system..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            OPENVPN_PLUGIN_DIR="/usr/lib/openvpn"
            GROUP_NAME="nogroup"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            OPENVPN_PLUGIN_DIR="/usr/lib64/openvpn/plugins"
            GROUP_NAME="nobody"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            OPENVPN_PLUGIN_DIR="/usr/lib64/openvpn/plugins"
            GROUP_NAME="nobody"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    print_status "Detected: $PRETTY_NAME"
else
    print_error "Cannot detect operating system"
    exit 1
fi

# Step 1: Update system and install packages
echo "[1/8] Installing OpenVPN and dependencies..."
$PKG_UPDATE

if [ "$PKG_MGR" = "apt" ]; then
    $PKG_INSTALL openvpn easy-rsa openvpn-auth-ldap
else
    $PKG_INSTALL epel-release
    $PKG_INSTALL openvpn easy-rsa openvpn-auth-ldap
fi

# Step 2: Set up Easy-RSA
echo "[2/8] Setting up PKI infrastructure..."
mkdir -p "$EASY_RSA_DIR"
cp -r /usr/share/easy-rsa/* "$EASY_RSA_DIR/"
cd "$EASY_RSA_DIR"

# Initialize PKI
./easyrsa init-pki

# Create CA
print_status "Creating Certificate Authority..."
echo -e "\n\n\n\n\n\nOpenVPN-CA\n" | ./easyrsa build-ca nopass

# Step 3: Generate server certificates
echo "[3/8] Generating server certificates..."
echo -e "\n\n\n\n\n\nserver\n" | ./easyrsa gen-req server nopass
echo "yes" | ./easyrsa sign-req server server

# Generate DH parameters
print_status "Generating Diffie-Hellman parameters (this may take a while)..."
./easyrsa gen-dh

# Generate TLS auth key
openvpn --genkey secret "$OPENVPN_DIR/ta.key"

# Step 4: Copy certificates
echo "[4/8] Copying certificates..."
cp "$EASY_RSA_DIR/pki/ca.crt" "$OPENVPN_DIR/"
cp "$EASY_RSA_DIR/pki/issued/server.crt" "$OPENVPN_DIR/"
cp "$EASY_RSA_DIR/pki/private/server.key" "$OPENVPN_DIR/"
cp "$EASY_RSA_DIR/pki/dh.pem" "$OPENVPN_DIR/dh2048.pem"

# Set secure permissions
chmod 644 "$OPENVPN_DIR/ca.crt"
chmod 644 "$OPENVPN_DIR/server.crt"
chmod 600 "$OPENVPN_DIR/server.key"
chmod 644 "$OPENVPN_DIR/dh2048.pem"
chmod 600 "$OPENVPN_DIR/ta.key"
chown root:root "$OPENVPN_DIR"/*

# Step 5: Configure LDAP authentication
echo "[5/8] Configuring LDAP authentication..."
cat > "$OPENVPN_DIR/auth-ldap.conf" << EOF
<LDAP>
    URL             ldaps://$LDAP_SERVER:636
    BindDN          "$BIND_DN"
    BindPW          "$BIND_PASSWORD"
    Timeout         15
    TLSEnable       yes
    TLSCACertFile   /etc/ssl/certs/ca-certificates.crt
    FollowReferrals yes
</LDAP>

<Authorization>
    BaseDN          "$BASE_DN"
    SearchFilter    "(&(sAMAccountName=%u)(memberOf=CN=VPN-Users,OU=Groups,DC=example,DC=com))"
    RequireGroup    true
    
    <Group>
        BaseDN      "OU=Groups,DC=example,DC=com"
        SearchFilter "(&(objectClass=group)(member=%D))"
        MemberAttribute member
    </Group>
</Authorization>
EOF

chmod 600 "$OPENVPN_DIR/auth-ldap.conf"
chown root:root "$OPENVPN_DIR/auth-ldap.conf"

# Step 6: Create OpenVPN server configuration
echo "[6/8] Creating OpenVPN server configuration..."
cat > "$OPENVPN_DIR/server.conf" << EOF
port 1194
proto udp
dev tun

ca $OPENVPN_DIR/ca.crt
cert $OPENVPN_DIR/server.crt
key $OPENVPN_DIR/server.key
dh $OPENVPN_DIR/dh2048.pem
tls-auth $OPENVPN_DIR/ta.key 0

# Network configuration
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

# LDAP Authentication
plugin $OPENVPN_PLUGIN_DIR/openvpn-auth-ldap.so $OPENVPN_DIR/auth-ldap.conf
client-cert-not-required
username-as-common-name

# Security settings
cipher AES-256-GCM
auth SHA256
tls-version-min 1.2

# Connection settings
keepalive 10 120
user nobody
group $GROUP_NAME
persist-key
persist-tun

# Logging
status /var/log/openvpn-status.log
log-append /var/log/openvpn.log
verb 3
mute 20

# Client management
max-clients 50
duplicate-cn
EOF

chmod 644 "$OPENVPN_DIR/server.conf"
chown root:root "$OPENVPN_DIR/server.conf"

# Step 7: Configure firewall and enable IP forwarding
echo "[7/8] Configuring firewall and IP forwarding..."

# Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-openvpn-forward.conf
sysctl -p /etc/sysctl.d/99-openvpn-forward.conf

# Configure firewall based on distribution
if command -v ufw >/dev/null 2>&1; then
    ufw allow 1194/udp
    ufw --force enable
elif command -v firewall-cmd >/dev/null 2>&1; then
    firewall-cmd --permanent --add-service=openvpn
    firewall-cmd --permanent --add-masquerade
    firewall-cmd --reload
fi

# Step 8: Enable and start OpenVPN service
echo "[8/8] Starting OpenVPN service..."

if [ "$PKG_MGR" = "apt" ]; then
    systemctl enable openvpn@server
    systemctl start openvpn@server
else
    systemctl enable openvpn-server@server
    systemctl start openvpn-server@server
fi

# Verification
echo "Verifying installation..."
sleep 5

if [ "$PKG_MGR" = "apt" ]; then
    SERVICE_NAME="openvpn@server"
else
    SERVICE_NAME="openvpn-server@server"
fi

if systemctl is-active --quiet "$SERVICE_NAME"; then
    print_status "OpenVPN service is running"
else
    print_error "OpenVPN service failed to start"
    systemctl status "$SERVICE_NAME"
    exit 1
fi

if ss -tulpn | grep -q ":1194"; then
    print_status "OpenVPN is listening on port 1194"
else
    print_warning "OpenVPN may not be listening on port 1194"
fi

print_status "OpenVPN LDAP setup completed successfully!"
print_warning "Remember to:"
print_warning "1. Configure your Active Directory with VPN-Users group"
print_warning "2. Create service account with appropriate permissions"
print_warning "3. Test LDAP connectivity before client connections"
print_warning "4. Distribute client configuration files"