Configure OpenVPN LDAP authentication for enterprise users with Active Directory integration

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m' # No Color

# Script variables
SCRIPT_NAME=$(basename "$0")
LOG_FILE="/tmp/openvpn-ldap-install.log"

# Default values
LDAP_SERVER=""
LDAP_BIND_DN=""
LDAP_PASSWORD=""
LDAP_BASE_DN=""

usage() {
    cat << EOF
Usage: $SCRIPT_NAME [OPTIONS]

Install and configure OpenVPN with LDAP authentication

OPTIONS:
    -s, --ldap-server   LDAP server URL (required)
    -b, --bind-dn       LDAP bind DN (required) 
    -p, --password      LDAP bind password (required)
    -d, --base-dn       LDAP base DN (required)
    -h, --help          Show this help

Example:
    $SCRIPT_NAME -s ldap://dc1.example.com:389 \\
                 -b "CN=vpn-service,CN=Users,DC=example,DC=com" \\
                 -p "password123" \\
                 -d "CN=Users,DC=example,DC=com"
EOF
}

error_exit() {
    echo -e "${RED}Error: $1${NC}" >&2
    exit 1
}

success_msg() {
    echo -e "${GREEN}✓ $1${NC}"
}

warn_msg() {
    echo -e "${YELLOW}⚠ $1${NC}"
}

info_msg() {
    echo -e "ℹ $1"
}

cleanup() {
    warn_msg "Installation failed. Check $LOG_FILE for details"
}

trap cleanup ERR

# Parse command line arguments
while [[ $# -gt 0 ]]; do
    case $1 in
        -s|--ldap-server)
            LDAP_SERVER="$2"
            shift 2
            ;;
        -b|--bind-dn)
            LDAP_BIND_DN="$2"
            shift 2
            ;;
        -p|--password)
            LDAP_PASSWORD="$2"
            shift 2
            ;;
        -d|--base-dn)
            LDAP_BASE_DN="$2"
            shift 2
            ;;
        -h|--help)
            usage
            exit 0
            ;;
        *)
            error_exit "Unknown option $1. Use -h for help."
            ;;
    esac
done

# Validate required arguments
if [[ -z "$LDAP_SERVER" || -z "$LDAP_BIND_DN" || -z "$LDAP_PASSWORD" || -z "$LDAP_BASE_DN" ]]; then
    error_exit "All LDAP parameters are required. Use -h for help."
fi

# Check if running as root
if [[ $EUID -ne 0 ]]; then
    error_exit "This script must be run as root"
fi

# Detect distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) 
            PKG_MGR="apt"
            PKG_UPDATE="apt update && apt upgrade -y"
            PKG_INSTALL="apt install -y"
            LDAP_PLUGIN_PATH="/usr/lib/openvpn/openvpn-auth-ldap.so"
            OPENVPN_GROUP="nogroup"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora) 
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            LDAP_PLUGIN_PATH="/usr/lib64/openvpn/plugins/openvpn-auth-ldap.so"
            OPENVPN_GROUP="nobody"
            ;;
        amzn) 
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            LDAP_PLUGIN_PATH="/usr/lib64/openvpn/plugins/openvpn-auth-ldap.so"
            OPENVPN_GROUP="nobody"
            ;;
        *) 
            error_exit "Unsupported distribution: $ID"
            ;;
    esac
else
    error_exit "Cannot detect distribution"
fi

info_msg "Installing OpenVPN with LDAP authentication on $PRETTY_NAME"

# Step 1: Update system packages
echo "[1/8] Updating system packages..."
$PKG_UPDATE >> "$LOG_FILE" 2>&1
success_msg "System packages updated"

# Step 2: Install required packages
echo "[2/8] Installing OpenVPN and dependencies..."
if [[ "$PKG_MGR" == "apt" ]]; then
    $PKG_INSTALL openvpn easy-rsa openvpn-auth-ldap libldap2-dev >> "$LOG_FILE" 2>&1
else
    $PKG_INSTALL openvpn easy-rsa openvpn-auth-ldap openldap-devel >> "$LOG_FILE" 2>&1
fi
success_msg "OpenVPN and dependencies installed"

# Step 3: Setup Easy-RSA
echo "[3/8] Setting up Certificate Authority..."
mkdir -p /etc/openvpn/easy-rsa
cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa

# Initialize PKI and create CA
./easyrsa init-pki >> "$LOG_FILE" 2>&1
EASYRSA_BATCH=1 ./easyrsa build-ca nopass >> "$LOG_FILE" 2>&1
success_msg "Certificate Authority created"

# Step 4: Generate server certificates
echo "[4/8] Generating server certificates..."
EASYRSA_BATCH=1 ./easyrsa build-server-full server nopass >> "$LOG_FILE" 2>&1
./easyrsa gen-dh >> "$LOG_FILE" 2>&1
openvpn --genkey secret pki/ta.key >> "$LOG_FILE" 2>&1
success_msg "Server certificates generated"

# Step 5: Copy certificates
echo "[5/8] Installing certificates..."
mkdir -p /etc/openvpn/server
cp pki/ca.crt pki/issued/server.crt pki/private/server.key pki/dh.pem pki/ta.key /etc/openvpn/server/
chown root:root /etc/openvpn/server/*
chmod 600 /etc/openvpn/server/server.key /etc/openvpn/server/ta.key
chmod 644 /etc/openvpn/server/ca.crt /etc/openvpn/server/server.crt /etc/openvpn/server/dh.pem

# Create log directory
mkdir -p /var/log/openvpn
chown root:root /var/log/openvpn
chmod 755 /var/log/openvpn
success_msg "Certificates installed with proper permissions"

# Step 6: Create OpenVPN server configuration
echo "[6/8] Creating OpenVPN server configuration..."
cat > /etc/openvpn/server/server.conf << EOF
port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt

push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

keepalive 10 120
tls-crypt ta.key
cipher AES-256-GCM
auth SHA256

user nobody
group $OPENVPN_GROUP

persist-key
persist-tun

status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1

plugin $LDAP_PLUGIN_PATH /etc/openvpn/auth-ldap.conf
client-cert-not-required
username-as-common-name
EOF

chmod 644 /etc/openvpn/server/server.conf
success_msg "OpenVPN server configuration created"

# Step 7: Create LDAP authentication configuration
echo "[7/8] Creating LDAP authentication configuration..."
cat > /etc/openvpn/auth-ldap.conf << EOF
<LDAP>
    URL             $LDAP_SERVER
    BindDN          "$LDAP_BIND_DN"
    Password        "$LDAP_PASSWORD"
    Timeout         15
    FollowReferrals yes
</LDAP>

<Authorization>
    BaseDN          "$LDAP_BASE_DN"
    SearchFilter    "(&(objectClass=user)(sAMAccountName=%u))"
    RequireGroup    false
</Authorization>
EOF

chmod 600 /etc/openvpn/auth-ldap.conf
chown root:root /etc/openvpn/auth-ldap.conf
success_msg "LDAP authentication configuration created"

# Step 8: Configure system services and firewall
echo "[8/8] Configuring system services..."

# Enable IP forwarding
echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-openvpn-forward.conf
sysctl --system >> "$LOG_FILE" 2>&1

# Configure firewall based on available tools
if command -v firewall-cmd &> /dev/null; then
    # RHEL-based systems with firewalld
    systemctl enable firewalld >> "$LOG_FILE" 2>&1
    systemctl start firewalld >> "$LOG_FILE" 2>&1
    firewall-cmd --permanent --add-service=openvpn >> "$LOG_FILE" 2>&1
    firewall-cmd --permanent --add-masquerade >> "$LOG_FILE" 2>&1
    firewall-cmd --reload >> "$LOG_FILE" 2>&1
elif command -v ufw &> /dev/null; then
    # Ubuntu/Debian with ufw
    ufw --force enable >> "$LOG_FILE" 2>&1
    ufw allow 1194/udp >> "$LOG_FILE" 2>&1
    ufw allow OpenSSH >> "$LOG_FILE" 2>&1
fi

# Enable and start OpenVPN
systemctl enable openvpn-server@server >> "$LOG_FILE" 2>&1
systemctl start openvpn-server@server >> "$LOG_FILE" 2>&1

success_msg "System services configured"

# Verification
echo ""
info_msg "Verifying installation..."

if systemctl is-active --quiet openvpn-server@server; then
    success_msg "OpenVPN server is running"
else
    error_exit "OpenVPN server failed to start. Check logs: journalctl -u openvpn-server@server"
fi

if ss -ulpn | grep -q ":1194"; then
    success_msg "OpenVPN is listening on port 1194/UDP"
else
    warn_msg "OpenVPN may not be listening on expected port"
fi

echo ""
success_msg "OpenVPN LDAP installation completed successfully!"
echo ""
info_msg "Next steps:"
echo "1. Test LDAP connectivity: ldapsearch -H $LDAP_SERVER -D '$LDAP_BIND_DN' -w '$LDAP_PASSWORD' -b '$LDAP_BASE_DN'"
echo "2. Create client configuration files"
echo "3. Configure client certificates if needed"
echo "4. Monitor logs: tail -f /var/log/openvpn/openvpn.log"
echo ""
info_msg "Configuration files:"
echo "- Server config: /etc/openvpn/server/server.conf"
echo "- LDAP config: /etc/openvpn/auth-ldap.conf"
echo "- Certificates: /etc/openvpn/server/"