Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added optional passphrase for client certificates

Browse Source
This commit is contained in:
abn0mad 2023-03-07 11:14:10 +08:00
parent d4ae10ec25
commit 5b845760e3
1 changed files with 16 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
openvpn-install.sh
View File

@ -4,7 +4,6 @@
# #
# Copyright (c) 2013 Nyr. Released under the MIT License. # Copyright (c) 2013 Nyr. Released under the MIT License.
# Detect Debian users running the script with "sh" instead of bash # Detect Debian users running the script with "sh" instead of bash
if readlink /proc/$$/exe | grep -q "dash"; then if readlink /proc/$$/exe | grep -q "dash"; then
echo 'This installer needs to be run with "bash", not "sh".' echo 'This installer needs to be run with "bash", not "sh".'
@ -245,7 +244,14 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab
./easyrsa --batch init-pki ./easyrsa --batch init-pki
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
./easyrsa --batch --days=3650 build-server-full server nopass ./easyrsa --batch --days=3650 build-server-full server nopass
echo ""
read -e -p "Require password for client certificate [Y/N]: " -i "N" PASSW
if [[ "$PASSW" != [yY] ]]; then
./easyrsa --batch --days=3650 build-client-full "$client" nopass ./easyrsa --batch --days=3650 build-client-full "$client" nopass
else
./easyrsa --batch --days=3650 build-client-full "$client"
fi
echo ""
./easyrsa --batch --days=3650 gen-crl ./easyrsa --batch --days=3650 gen-crl
# Move the stuff we need # Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
@ -461,7 +467,14 @@ else
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
done done
cd /etc/openvpn/server/easy-rsa/ cd /etc/openvpn/server/easy-rsa/
echo ""
read -e -p "Require password for client certificate [Y/N]: " -i "N" PASSW
if [[ "$PASSW" != [yY] ]]; then
./easyrsa --batch --days=3650 build-client-full "$client" nopass ./easyrsa --batch --days=3650 build-client-full "$client" nopass
else
./easyrsa --batch --days=3650 build-client-full "$client"
fi
echo ""
# Generates the custom client.ovpn # Generates the custom client.ovpn
new_client new_client
echo echo