Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Advanced client management #36

Merged
merged 4 commits into from
Mar 21, 2015
Merged

Advanced client management #36

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e6e2221
Allow to export separated client config and wrote ovpn_getclient_all.
ypid Mar 12, 2015
fd4a5dc
EASYRSA_PKI might not be defined.
ypid Mar 12, 2015
f431d17
Fixed spelling.
ypid Mar 13, 2015
47cc0e3
Fixed based on the review by @kylemanna. Thanks.
ypid Mar 14, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Fixed based on the review by @kylemanna. Thanks.
  • Loading branch information
@ypid
ypid committed Mar 14, 2015
commit 47cc0e3ae6b295a01f03516c3902b5ff081ec27c
4 changes: 2 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ Upstream links:

* Retrieve the client configuration with embedded certificates

docker run --volumes-from $OVPN_DATA --rm kylemanna/openvpn ovpn_getclient CLIENTNAME combined > CLIENTNAME.ovpn
docker run --volumes-from $OVPN_DATA --rm kylemanna/openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn

* Create an environment variable with the name DEBUG and value of 1 to enable debug output (using "docker -e").

Expand Down Expand Up @@ -105,7 +105,7 @@ packets, etc).
simplicity. It's highly recommended to secure the CA key with some
passphrase to protect against a filesystem compromise. A more secure system
would put the EasyRSA PKI CA on an offline system (can use the same Docker
image and the script ovpn_copy_server_files to accomplish this).
image and the script [`ovpn_copy_server_files`](/docs/clients.md) to accomplish this).
* It would be impossible for an adversary to sign bad or forged certificates
without first cracking the key's passphase should the adversary have root
access to the filesystem.
Expand Down
34 changes: 17 additions & 17 deletions bin/ovpn_getclient
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,7 @@ cn="$1"
parm="$2"

if [ ! -f "$EASYRSA_PKI/private/${cn}.key" ]; then
>&2 "Unable to find \"${cn}\", please try again or generate the key first" 1>&2
echo "Unable to find \"${cn}\", please try again or generate the key first" >&2
exit 1
fi

Expand All @@ -39,8 +39,8 @@ remote-cert-tls server

remote $OVPN_CN $OVPN_PORT $OVPN_PROTO
"
if [ "$mode" == "combined" ]; then
echo "
if [ "$mode" == "combined" ]; then
echo "
<key>
$(cat $EASYRSA_PKI/private/${cn}.key)
</key>
Expand All @@ -58,23 +58,23 @@ $(cat $EASYRSA_PKI/ta.key)
</tls-auth>
key-direction 1
"
else
echo "
elif [ "$mode" == "separated" ]; then
echo "
key ${cn}.key
ca ca.crt
cert ${cn}.crt
dh dh.pem
tls-auth ta.key 1
"
fi
fi

if [ "$OVPN_DEFROUTE" != "0" ];then
echo "redirect-gateway def1"
fi
if [ "$OVPN_DEFROUTE" != "0" ];then
echo "redirect-gateway def1"
fi

if [ -n "$OVPN_MTU" ]; then
echo "tun-mtu $OVPN_MTU"
fi
if [ -n "$OVPN_MTU" ]; then
echo "tun-mtu $OVPN_MTU"
fi
}

dir="$OPENVPN/clients/$cn"
Expand All @@ -88,16 +88,16 @@ case "$parm" in
cp "$EASYRSA_PKI/dh.pem" "$dir/dh.pem"
cp "$EASYRSA_PKI/ta.key" "$dir/ta.key"
;;
"combined")
"" | "combined")
get_client_config "combined"
;;
"combined-save")
get_client_config "combined" > "$dir/${cn}-combined.ovpn"
;;
*)
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Default case should be combined as mentioned above to not break existing tutorials.

>&2 echo "This script can produce the client configuration in to formats."
>&2 echo " 1. combined: All needed configuration and cryptographic material is in one file (Use \"combined-save\" to write the configuration file in the same path as the separated parameter does)."
>&2 echo " 2. separated: Separated files."
>&2 echo "Please specific one of those options as second parameter."
echo "This script can produce the client configuration in to formats:" >&2
echo " 1. combined (default): All needed configuration and cryptographic material is in one file (Use \"combined-save\" to write the configuration file in the same path as the separated parameter does)." >&2
echo " 2. separated: Separated files." >&2
echo "Please specific one of those options as second parameter." >&2
;;
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with redirecting stderr, but putting the redirection at the beginning of the line feels strange. Most people expect IO redirection at the end of lines by convention. Approach of least astonishment is preferred here.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are right, redirection at the end of the line is probably more common. Changed it.

esac
5 changes: 2 additions & 3 deletions docs/advanced.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Advanced Configurations

The ovpn_genconfig script is intended for simple configurations that apply to the majority of the users. If your use case isn't general, it likely won't be supported. This document aims to explain how to work around that.
The [`ovpn_genconfig`](/bin/ovpn_genconfig) script is intended for simple configurations that apply to the majority of the users. If your use case isn't general, it likely won't be supported. This document aims to explain how to work around that.

## Create host volume mounts rather than data volumes

Expand All @@ -13,9 +13,8 @@ The ovpn_genconfig script is intended for simple configurations that apply to th
docker run --rm -v $PWD:/etc/openvpn -it kylemanna/openvpn ovpn_initpki
vim openvpn.conf
docker run --rm -v $PWD:/etc/openvpn -it kylemanna/openvpn easyrsa build-client-full CLIENTNAME nopass
docker run --rm -v $PWD:/etc/openvpn kylemanna/openvpn ovpn_getclient CLIENTNAME combined > CLIENTNAME.ovpn
docker run --rm -v $PWD:/etc/openvpn kylemanna/openvpn ovpn_getclient CLIENTNAME > CLIENTNAME.ovpn

* Start the server with:

docker run -v $PWD:/etc/openvpn -d -p 1194:1194/udp --privileged kylemanna/openvpn

8 changes: 4 additions & 4 deletions docs/clients.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,16 @@

## Client configuration mode

The `ovpn_getclient` can produce two different versions of the configuration.
The [`ovpn_getclient`](/bin/ovpn_getclient) can produce two different versions of the configuration.

1. combined: All needed configuration and cryptographic material is in one file (Use "combined-save" to write the configuration file in the same path as the separated parameter does).
1. combined (default): All needed configuration and cryptographic material is in one file (Use "combined-save" to write the configuration file in the same path as the separated parameter does).
2. separated: Separated files.

Note that some client software might be picky about which configuration format it accepts.

## Batch mode

If you have more than a few clients, you will want to generate and update your client configuration in batch. For this task the script `ovpn_getclient_all` was written, which writes out the configuration for each client to a separate directory called `clients/$cn`.
If you have more than a few clients, you will want to generate and update your client configuration in batch. For this task the script [`ovpn_getclient_all`](/bin/ovpn_getclient_all) was written, which writes out the configuration for each client to a separate directory called `clients/$cn`.

Execute the following to generate the configuration for all clients:

Expand All @@ -21,7 +21,7 @@ After doing so, you will find the following files in each of the `$cn` directori

ca.crt
dh.pem
$cn-combined.ovpn # Combined configuration file format, you your client recognices this file then only this file is needed.
$cn-combined.ovpn # Combined configuration file format. If your client recognices this file then only this file is needed.
$cn.ovpn # Separated configuration. This configuration file requires the other files ca.crt dh.pem $cn.crt $cn.key ta.key
$cn.crt
$cn.key
Expand Down