shadowsocks-all.sh

fudyou

1 T1 Z/ O/ ~& G9 V$ U

1. #!/bin/bash
   / @  b! O7 g: t  U5 F( k& t
2. #
   
3. # https://github.com/Nyr/openvpn-install
   
4. #
   
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   ( J5 H4 |& i$ p9 m8 Y  p) w
6. 
   & x9 r* [' Q6 C& ~$ H# G$ e; W
7. 
   
8. # Detect Debian users running the script with "sh" instead of bash
   0 y7 L1 c2 l7 o3 T9 V" P4 N) b
9. if readlink /proc/$$/exe | grep -q "dash"; then
   % w8 j4 E: P5 _) F# g- n% \
10.         echo 'This installer needs to be run with "bash", not "sh".'
    : X  ~% V) i; H" _4 T
11.         exit
    " h$ R7 Y$ K/ R7 A3 F; K, C8 V
12. fi
    - M. c! W0 ?6 m2 ?0 ~- B
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    
15. read -N 999999 -t 0.001
    9 R2 L! v/ ]& m% H* }
16. 
    9 g- z8 Q( ~" O1 K
17. # Detect OpenVZ 6
    
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    9 U% F9 Q" g/ I% h& ^/ p6 Q- e
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    ) i$ O4 S: a: X- f6 `3 @
20.         exit
      v6 Z, [+ g" }, p% {' R
21. fi
    
22. 
    
23. # Detect OS
    
24. # $os_version variables aren't always in use, but are kept here for convenience
    
25. if grep -qs "ubuntu" /etc/os-release; then
    2 D' v1 a4 ~$ p) f8 j0 `
26.         os="ubuntu"
    . F1 u2 m# `, I6 p: x1 `+ y0 A+ V
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    " @" G  L5 |1 n- d0 k0 r
28.         group_name="nogroup"
    8 N/ T9 ~: e3 \  Z' x# Q
29. elif [[ -e /etc/debian_version ]]; then
    / I3 j+ W7 ?- r& G2 @* O' @
30.         os="debian"
    ; S7 j7 P$ n! l4 e
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    & u! k; K3 E% v# e: E/ {- r/ j
32.         group_name="nogroup"
    
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    ! x, |+ t! A  u7 @
34.         os="centos"
    
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    
36.         group_name="nobody"
    
37. elif [[ -e /etc/fedora-release ]]; then
    % Q6 p7 D0 g! q
38.         os="fedora"
    2 j" h1 }# H  e* ]$ N0 ~
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    
40.         group_name="nobody"
    
41. else
    / y$ O/ F) ~5 K  O
42.         echo "This installer seems to be running on an unsupported distribution.
    
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    
45. fi
    
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    $ P4 Q& Z4 O8 ?  @! ~; J$ K
50.         exit
    
51. fi
    
52. 
    ; R" Q5 H  H5 D- q
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    
54.         echo "Debian 9 or higher is required to use this installer.
    
55. This version of Debian is too old and unsupported."
    
56.         exit
    $ z1 {8 z* z& D2 i  G
57. fi
    
58. 
    , F6 p. W- h- r
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    
60.         echo "CentOS 7 or higher is required to use this installer.
    
61. This version of CentOS is too old and unsupported."
    % g! e2 C5 T  H1 r& ^. x# S1 B: N
62.         exit
    
63. fi
    
64. 
    0 D3 U! Y4 E4 p8 \; e1 i" Y7 u: n( @' z
65. # Detect environments where $PATH does not include the sbin directories
    9 h2 q. p" L" M. g4 z. Y5 k2 {
66. if ! grep -q sbin <<< "$PATH"; then
    
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    
68.         exit
    
69. fi
    # F. B2 M6 Z/ a8 [
70. 
    
71. if [[ "$EUID" -ne 0 ]]; then
    ( W' h( r2 a* v! V! Y/ G
72.         echo "This installer needs to be run with superuser privileges."
    
73.         exit
    * t+ K5 \' _! T6 b
74. fi
    
75. 
    9 P$ s. `% x: V- L  B
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
      P& g; k) Y. J
78. TUN needs to be enabled before running this installer."
    
79.         exit
    . V* A5 h1 @$ a9 l/ B" r& c" U
80. fi
    * u2 g5 l2 Q* O4 k* r
81. 
    
82. new_client () {
    2 ?) D. }/ D/ m( k+ y( b' k0 s
83.         # Generates the custom client.ovpn
    3 P2 u5 A) r3 y- s" N3 Y
84.         {
    " s  k# X. B$ y5 s# H& G( |% }
85.         cat /etc/openvpn/server/client-common.txt
    
86.         echo "<ca>"
    
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    
88.         echo "</ca>"
    ' r. c" f# I; a
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    8 a% t0 ]! [; `6 m; A
91.         echo "</cert>"
      n& `, K, Y8 L" _/ [8 g
92.         echo "<key>"
    $ C8 x0 M3 E1 e
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    1 D0 u) |, w+ w; ~( O
94.         echo "</key>"
    & c  k- v$ {& k; g0 S7 \, \
95.         echo "<tls-crypt>"
    
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    6 R0 ^: g( J5 b
97.         echo "</tls-crypt>"
    ; O# F4 h- h6 u  [; d
98.         } > ~/"$client".ovpn
    
99. }
    8 @9 W% u% x* |; O
100. 
     3 b; P- g/ @' L) D6 S5 c% f
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     " w0 ?- y; F5 M0 I
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     # B0 @* c/ M' q# R
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     5 [7 D! j( ?1 C/ c5 G
104.                 echo "Wget is required to use this installer."
     
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     - [8 Z2 I0 S5 K+ ^
106.                 apt-get update
     
107.                 apt-get install -y wget
     
108.         fi
     
109.         clear
       r) R; L; D8 x2 F/ S
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     4 Z, y  W+ }% _0 ]+ v; f: q  f
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     : |: t4 I* @. H$ @/ Y! `- {# W
114.         else
     
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     : G2 u$ q$ Q: I
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     # E3 v- `( f! L7 L$ k. k
119.                 read -p "IPv4 address [1]: " ip_number
     8 i4 q  l* O$ o+ Z
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     
121.                         echo "$ip_number: invalid selection."
     : D6 C- a% ]" |7 R
122.                         read -p "IPv4 address [1]: " ip_number
     
123.                 done
     
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     
126.         fi
     8 B# n  X1 J6 A+ a' ?2 y! F$ H
127.         # If $ip is a private IP address, the server must be behind NAT
     
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     
129.                 echo
     0 C) I. m7 {2 J/ z
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     
131.                 # Get public IP and sanitize with grep
     * B5 c% q1 ]' J0 p! i/ K
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     ; g: ]/ h+ p' U2 w; P
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     + }$ v* @3 j& B) u. N* I/ ?+ d& Y
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     - B( F' ]8 a) Y2 Q) s
138.                 done
     3 F0 F2 u* U; x+ Y9 T0 T0 `
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     
140.         fi
     
141.         # If system has a single IPv6, it is selected automatically
     * z/ ~  T9 q$ m! ]4 J/ V# K) d
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     & \- l! b+ Q6 f, k0 i* V1 z. P
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     , L9 m- ]6 y, Q# e# r
144.         fi
     
145.         # If system has multiple IPv6, ask the user to select one
     / C% J, e! h6 I  r
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     ) V+ j4 h3 q2 d- c. t! U5 G( O
148.                 echo
     
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     
151.                 read -p "IPv6 address [1]: " ip6_number
     0 \6 a" e. z& h( K, u( B" {& p
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     
153.                         echo "$ip6_number: invalid selection."
     . f, U  J. u. L% x& H9 ?! Z
154.                         read -p "IPv6 address [1]: " ip6_number
     1 ~* j3 B! @8 R
155.                 done
     
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     5 U! G% y& M& c! D% t0 Z
158.         fi
     
159.         echo
     
160.         echo "Which protocol should OpenVPN use?"
     
161.         echo "   1) UDP (recommended)"
     2 j2 x' z: f1 L' D5 i& l  t8 z
162.         echo "   2) TCP"
     1 K- Q8 Q! {6 {3 ~' ?! W7 x
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     
165.                 echo "$protocol: invalid selection."
     , p5 }6 T, v1 u$ u
166.                 read -p "Protocol [1]: " protocol
     ; i; u6 X) q1 Q
167.         done
     
168.         case "$protocol" in
     
169.                 1|"")
     - c- D- I% c. t% I; B
170.                 protocol=udp
     
171.                 ;;
     ) ~0 R' `: u6 @2 |  B; s5 c
172.                 2)
     * k) A- U/ A% E8 {2 I8 v$ Y4 a
173.                 protocol=tcp
     
174.                 ;;
     ) D) p% ^0 d: j- U; H
175.         esac
     2 h% ~$ n1 [. z
176.         echo
     / u- _4 O2 O6 T# }
177.         echo "What port should OpenVPN listen to?"
     
178.         read -p "Port [1194]: " port
     2 ~5 s5 _4 [. H4 w5 u% B
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     3 M1 P  E, \, t( `8 f% ?8 {
180.                 echo "$port: invalid port."
     # g' n1 `" X. }) Q8 g
181.                 read -p "Port [1194]: " port
     
182.         done
     ( v' H' _# d; l" @% f
183.         [[ -z "$port" ]] && port="1194"
     ' n: |. F# B- Z" T
184.         echo
     ; _7 _4 o$ G% Y
185.         echo "Select a DNS server for the clients:"
     ( K! J7 y7 s% M) A
186.         echo "   1) Current system resolvers"
     
187.         echo "   2) Google"
     
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     9 K7 Q" r8 w, N/ U& a3 r0 N! ?
190.         echo "   5) Quad9"
     4 \1 I" T. ]6 _
191.         echo "   6) AdGuard"
     2 s$ q1 J, H8 M' Z/ v; t
192.         read -p "DNS server [1]: " dns
     # L) Z" m! j7 t$ x( @7 M
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     
194.                 echo "$dns: invalid selection."
     9 }  H! Y/ B: V0 K" B) ^
195.                 read -p "DNS server [1]: " dns
     
196.         done
     
197.         echo
     
198.         echo "Enter a name for the first client:"
     
199.         read -p "Name [client]: " unsanitized_client
     6 k4 f8 r2 r/ r
200.         # Allow a limited set of characters to avoid conflicts
     0 k& V4 s' H& y1 K) X
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     * z$ P- a/ ~4 G- [0 d
202.         [[ -z "$client" ]] && client="client"
     / t$ }, E1 o6 M1 f) e
203.         echo
     
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
       D, w/ d: P4 Q+ D
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     ( B* f0 a& l2 m* b, ~( l" V5 i
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     
208.                         firewall="firewalld"
     
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     " s7 W! Y1 {9 ^/ F# R( B
210.                         # If the user continues, firewalld will be installed and enabled during setup
     
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     8 p  \- U+ y1 |: U& A' r' X2 y7 d
213.                         # iptables is way less invasive than firewalld so no warning is given
     
214.                         firewall="iptables"
     : s2 L2 e! [) X8 P+ o4 v
215.                 fi
     
216.         fi
     
217.         read -n1 -r -p "Press any key to continue..."
     
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     $ }* d1 s" e3 Q6 M" {& X
219.         if systemd-detect-virt -cq; then
     6 \# L/ K$ r5 T2 P1 L/ u6 f
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     ' v! D: f6 f* X- G  x
221.                 echo "[Service]
     
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     2 Y9 \) ?' m+ p5 n0 `3 Y
223.         fi
     # R) P3 h5 q, t: k
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
225.                 apt-get update
     
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     % {4 s  l1 m& |  u( z
227.         elif [[ "$os" = "centos" ]]; then
     
228.                 yum install -y epel-release
     $ V0 u. ^- x1 b7 B; o4 a, A4 }
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     
230.         else
     " \+ r+ P; b' A' C8 [) \
231.                 # Else, OS must be Fedora
     
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     7 T/ e" h  l. w4 J/ v  r) J9 @4 c
233.         fi
       K, S7 ^8 r# |% Y/ m
234.         # If firewalld was just installed, enable it
     
235.         if [[ "$firewall" == "firewalld" ]]; then
     % v! }  W' M, |! M* I: s3 A. I
236.                 systemctl enable --now firewalld.service
     
237.         fi
     
238.         # Get easy-rsa
     0 Z! g* y2 a' E3 R5 W
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     ; _  ^0 v( e, M+ t* K4 {! J: [
244.         # Create the PKI, set up the CA and the server and client certificates
     
245.         ./easyrsa init-pki
     " m7 l+ d- X' O- a. w8 {
246.         ./easyrsa --batch build-ca nopass
     " Y8 N. t6 M' G, I! }
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     ! s1 Q4 ~* m) i% Y" w
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     5 Y0 {& ]+ U: _/ {1 m% E
250.         # Move the stuff we need
     8 `$ x9 K/ \9 @: f- y$ w8 B1 t! X
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     % T5 D: |* T$ i
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
       O; S& y2 y" N5 A4 L( Z& a
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     
255.         chmod o+x /etc/openvpn/server/
     + @/ P; M+ b9 l5 K, d
256.         # Generate key for tls-crypt
     6 }/ L- M" x; e7 [
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     
259.         echo '-----BEGIN DH PARAMETERS-----
     " W3 _$ a. F, N$ J. m
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     3 R4 p- l8 ~* e* f
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     + s8 v+ G* R+ F
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     + B% @- x/ R6 I! Z& a
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     6 t) a: U- q9 H: g
267.         # Generate server.conf
     & w7 K; D5 Q# F
268.         echo "local $ip
     ' u& D: [( {% n7 [
269. port $port
     / t" F8 F5 u; A. ]) @7 R
270. proto $protocol
     
271. dev tun
     4 v: i3 C( h' O" D! Y+ l* w
272. ca ca.crt
     , d8 t: e# O6 P, S! A- E3 A
273. cert server.crt
     ! c6 S- J! L  c4 x) w$ y
274. key server.key
     8 D7 Q% m" d' {" l# k) e3 K! @* {
275. dh dh.pem
     # F2 _6 n$ M; H
276. auth SHA512
     % h4 R4 Z4 @2 |0 O& R  P
277. tls-crypt tc.key
     & p+ J; U/ K' w, y' S$ k- H* E' r
278. topology subnet
       k, @, B" v& L3 n6 v
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     8 `3 `6 }9 E3 M8 X, A
280.         # IPv6
     $ v1 c) q3 [/ ^$ E$ j: Q* L
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
283.         else
     
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     ; A: U. ~; G0 |. T$ N
286.         fi
     
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     
288.         # DNS
     0 _4 U. e. I1 t2 m, r- d
289.         case "$dns" in
     
290.                 1|"")
     ! l0 p" y1 M3 D, p7 v& _" a4 s; y
291.                         # Locate the proper resolv.conf
     ) B. u. u" C6 L2 T7 i& t9 W1 t" }
292.                         # Needed for systems running systemd-resolved
     
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     & g1 w' s( j1 K0 ]
295.                         else
     % i) I( p6 K& l7 o- G, m
296.                                 resolv_conf="/etc/resolv.conf"
     " X& p$ C3 a% z* B2 _9 i
297.                         fi
     / _  C3 m. C7 F9 n* o
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     . B+ u4 b) ?# L6 N
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     / Q8 w' i2 Q! W5 O
301.                         done
     
302.                 ;;
     
303.                 2)
     7 h4 \; X/ S1 N& @1 T. ~: r
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     2 J9 P! d. D" n
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     : D7 X. |5 {, |2 u1 [
306.                 ;;
     
307.                 3)
     ) l# u* c* ^( i3 g! W# l) ^. j
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     ; W" b" t; X- P  d; C, S
310.                 ;;
     
311.                 4)
     : N; S: t. E4 t! o0 o5 |
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     
314.                 ;;
     
315.                 5)
     
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     $ F$ @5 F8 A  |
318.                 ;;
     
319.                 6)
     / _  q+ t( v7 ]. g- k
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     + ?( R) f9 J: Y6 Q
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     
322.                 ;;
     
323.         esac
     7 t! D/ |# x9 |7 f  b1 J7 m7 y2 J9 a
324.         echo "keepalive 10 120
     
325. cipher AES-256-CBC
     : \; g& S; \" R: E2 a4 H9 s
326. user nobody
     
327. group $group_name
     8 `0 D( R) O4 y% m6 d
328. persist-key
     
329. persist-tun
     # ^* N/ T$ j4 g) R
330. verb 3
     9 h8 W% E' \2 V( E9 e7 h, U+ B
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     $ h( @# T! R3 g+ |& i( y
332.         if [[ "$protocol" = "udp" ]]; then
     
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     ) E, r2 Q4 c) b5 a4 X
334.         fi
     / N) C& \: F0 i* x: ]. r
335.         # Enable net.ipv4.ip_forward for the system
     
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     
337.         # Enable without waiting for a reboot or service restart
     4 X3 y, T" [8 r  @+ w+ \' u$ c
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     4 ?2 v- T* C% o, G, R' j- L* Y( H& t( k
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     1 B# z' Y; L) Y; ]% ]3 K4 G- R
342.                 # Enable without waiting for a reboot or service restart
     
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     & Z9 i+ R: O+ B, G. [0 A
344.         fi
     # @, L- |! \" e
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     7 ?# e% R" N" X( u! X# F
347.                 # reload.
     
348.                 # We don't use --add-service=openvpn because that would only work with
     ( |" n! i4 K" B) R/ `4 g
349.                 # the default port and protocol.
     + o' L8 V( {- N% v
350.                 firewall-cmd --add-port="$port"/"$protocol"
     
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     0 l. ?" F& {5 n
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     
354.                 # Set NAT for the VPN subnet
     ( s9 A( z5 w$ z1 N, L/ L4 R
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     % g3 x* A! k: ^! ~( [8 R. x3 B
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     1 j3 l% d. Z( X; w+ F& }
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     % C$ l2 [. s! D0 M' |
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     ; s' {' L% j+ y. D7 ?
362.                 fi
     
363.         else
     : D$ J5 c7 f% I+ {) Q
364.                 # Create a service to set up persistent iptables rules
     
365.                 iptables_path=$(command -v iptables)
     7 o" G* c! s5 l: ^
366.                 ip6tables_path=$(command -v ip6tables)
     & [% E0 N* P& q+ ~7 d4 c; I
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     ! i' Y" `, {3 o* q$ |4 e
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     
370.                         iptables_path=$(command -v iptables-legacy)
     
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     / x+ S# V4 U) \& \5 B! K  Z  m
372.                 fi
     3 @+ ?6 X7 \. x# N
373.                 echo "[Unit]
     
374. Before=network.target
     0 `3 h5 `1 h7 M! L
375. [Service]
     
376. Type=oneshot
     
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     , h; I, L( t+ y) a$ M3 m; u  Q6 r2 s
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     + w( c0 ~3 R# z
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     % B1 M$ k$ o+ p6 K# A
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     1 j4 i" T5 Z4 [/ |
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     " F) Z; T) K3 R# e9 l( \6 p% T! {" c- Q
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     # ^- {+ D6 ?( S. p7 `8 m
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     - @, X/ s5 {# `# d; i/ B
385.                 if [[ -n "$ip6" ]]; then
     
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     3 a, R' N3 _0 [0 n; c
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     / `- y  P  H( s1 Y
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     
392.                 fi
     
393.                 echo "RemainAfterExit=yes
     - J+ D7 [' @8 Y5 h
394. [Install]
     
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     / K6 t  p- _; j" t
396.                 systemctl enable --now openvpn-iptables.service
     $ }- U. Y6 u# {9 D
397.         fi
     
398.         # If SELinux is enabled and a custom port was selected, we need this
     . i0 Q. z, b# B
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     5 K. D/ M* M  ^3 A! ?7 E9 g
400.                 # Install semanage if not already present
     
401.                 if ! hash semanage 2>/dev/null; then
     
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
     
404.                                 yum install -y policycoreutils-python
     + v: W* S( Z" b/ E; S* ?' F$ f
405.                         else
     
406.                                 # CentOS 8 or Fedora
     
407.                                 dnf install -y policycoreutils-python-utils
     
408.                         fi
     % U4 d! w9 w; M7 s- u! H# D8 w
409.                 fi
     * R( Y4 L9 j6 ?
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     5 Q7 G: F+ r( O5 ~4 q2 g6 [+ N3 P
411.         fi
     
412.         # If the server is behind NAT, use the correct IP address
     9 k- \' f3 A! |0 i+ W  @: K: {
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     
414.         # client-common.txt is created so we have a template to add further users later
     
415.         echo "client
     3 \/ b. N% ]8 [# s5 E
416. dev tun
     
417. proto $protocol
     
418. remote $ip $port
     2 x. e" O+ _3 m
419. resolv-retry infinite
     
420. nobind
     
421. persist-key
     
422. persist-tun
     
423. remote-cert-tls server
     
424. auth SHA512
     - [5 l5 E  x, E3 [% x
425. cipher AES-256-CBC
     1 D! Q" J( K6 y$ }0 }9 z. C
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     
428. verb 3" > /etc/openvpn/server/client-common.txt
     / \7 P& E  _2 Z6 ~1 A
429.         # Enable and start the OpenVPN service
     
430.         systemctl enable --now openvpn-server@server.service
     
431.         # Generates the custom client.ovpn
     
432.         new_client
     
433.         echo
     & R! _. X" A0 V- ?* y+ z
434.         echo "Finished!"
     
435.         echo
     & ^2 B' K6 e% H1 Z. H
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     
437.         echo "New clients can be added by running this script again."
     % e% z- U- i/ i" D' t, i: W
438. else
     
439.         clear
     
440.         echo "OpenVPN is already installed."
     
441.         echo
     7 M7 ?6 f  H# ~
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     
444.         echo "   2) Revoke an existing client"
     
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     / H- u( \* p5 u' q  f, L" V
449.                 echo "$option: invalid selection."
     
450.                 read -p "Option: " option
     
451.         done
     
452.         case "$option" in
     # @! M! y& d" {
453.                 1)
     2 |& I# [" Y' E  p/ Z# P# e
454.                         echo
     
455.                         echo "Provide a name for the client:"
     9 d4 e9 \6 ?9 U
456.                         read -p "Name: " unsanitized_client
     
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     ) x5 n/ F3 T8 H  D3 H
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     ( Y% p: c- Y0 g+ j6 j
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     6 d8 `& I# g  c* I) U- J, Y
462.                         done
     2 ~5 W& f* J3 A( k: J4 e
463.                         cd /etc/openvpn/server/easy-rsa/
     
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     , N" _2 o/ M, X/ X
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     
467.                         echo
     
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     
469.                         exit
     
470.                 ;;
     - `1 F. }! k" g, C# N' L
471.                 2)
     . [& o& o; K! A" c! Z
472.                         # This option could be documented a bit better and maybe even be simplified
     
473.                         # ...but what can I say, I want some sleep too
     + c5 V3 L3 F; H2 y
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     
475.                         if [[ "$number_of_clients" = 0 ]]; then
     
476.                                 echo
     
477.                                 echo "There are no existing clients!"
     
478.                                 exit
     
479.                         fi
     0 y4 g% F6 B7 M) i. ^2 b
480.                         echo
     
481.                         echo "Select the client to revoke:"
     3 V1 K5 }; p1 X' u, e7 e
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     
483.                         read -p "Client: " client_number
     
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     
487.                         done
     
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     3 Y- F) D3 Q) y( M! T, G- |1 y: w! g
489.                         echo
     
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     ! X8 P% A& A1 O0 ^6 q( ~( ~
492.                                 echo "$revoke: invalid selection."
     
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
       R+ S  L; f6 N6 N: y# f+ G; h
494.                         done
     , ~, H6 Z, ^) v' B) j( c0 G3 N5 y
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     9 q2 t, c+ f/ Y; D* l5 b1 I. U% d- B
496.                                 cd /etc/openvpn/server/easy-rsa/
     8 _0 y& V/ j, O
497.                                 ./easyrsa --batch revoke "$client"
     & x# u* K* w) A% r
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     - i6 V4 J$ g9 m2 Q" P
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     % f7 U' X, {; l% e; B6 F8 d
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
503.                                 echo
     
504.                                 echo "$client revoked!"
     
505.                         else
     7 P6 ~; Z. J6 _8 e
506.                                 echo
     : B/ A+ b1 Q3 J8 x% X: m# a
507.                                 echo "$client revocation aborted!"
     
508.                         fi
     $ t9 T; s* I9 `& N0 j7 F
509.                         exit
     3 R" f0 q+ O  }7 s
510.                 ;;
     ( _$ T5 }# E- v4 q
511.                 3)
     
512.                         echo
     - G+ P  O$ k5 V& E( x, f! I
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     
515.                                 echo "$remove: invalid selection."
     
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     
517.                         done
     - M( N# @" h4 H! P& Z
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     - K7 J: C  F# e" S3 k
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     # U. F" R: M$ C
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
521.                                 if systemctl is-active --quiet firewalld.service; then
     
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     1 m% b9 {3 V( t8 R
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     * O/ }+ Q& [4 ^1 L, Q# r+ F4 g
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     3 j& N0 Y* s8 w9 U7 ~2 Z9 E- O( g
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     8 Z  c' @5 ^3 K1 N  S3 K: E
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
536.                                         fi
     
537.                                 else
     ! ]; D' U2 [6 G
538.                                         systemctl disable --now openvpn-iptables.service
     6 s7 `# t, G* y- E
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     % A9 U# [. b/ N8 _% T, u6 W
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     " q$ h+ \! U. H5 C" N: P
544.                                 systemctl disable --now openvpn-server@server.service
     5 B0 n5 V2 j  W7 w( }$ c
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     7 U: {, L1 O  _  u9 g  B
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     ( i: }, O' V; [* }) f% i. \. @
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     - [- X  }% u5 F3 N
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     
550.                                 else
     
551.                                         # Else, OS must be CentOS or Fedora
     
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
     8 L, t6 p! g# A- w
554.                                 fi
     ( l  P8 ?$ w0 \9 c# _
555.                                 echo
     & y" y* R. |4 W' d8 x; |5 [! q& N
556.                                 echo "OpenVPN removed!"
     3 V3 F9 W7 n: k. f' \6 \- |: I/ b
557.                         else
     
558.                                 echo
     - p5 v5 z3 ~3 F7 W, x
559.                                 echo "OpenVPN removal aborted!"
     1 Y8 |+ h5 I8 Z' Z
560.                         fi
     & k$ X  U" z4 \9 n4 n
561.                         exit
     
562.                 ;;
     
563.                 4)
     
564.                         exit
     
565.                 ;;
     
566.         esac
     
567. fi
     

复制代码

  E2 o! _2 P) S( z
) Q5 ^# A3 u8 B( @7 f9 J) e

6 I. M) S* N3 [$ ^, n