Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-07-13 09:54:21 +02:00
Code Issues Projects Releases Wiki Activity

Replace tls-auth with tls-crypt

Browse Source
This commit is contained in:
Angristan 2017-02-16 22:32:09 +01:00 committed by GitHub
parent afa0162c4c
commit 5fe4bf62d6
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
openvpn-install.sh
View File

@ -58,6 +58,7 @@ fi
newclient () { newclient () {
# Generates the custom client.ovpn # Generates the custom client.ovpn
# We put everything in the client file
cp /etc/openvpn/client-template.txt ~/$1.ovpn cp /etc/openvpn/client-template.txt ~/$1.ovpn
echo "<ca>" >> ~/$1.ovpn echo "<ca>" >> ~/$1.ovpn
cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn
@ -68,10 +69,9 @@ newclient () {
echo "<key>" >> ~/$1.ovpn echo "<key>" >> ~/$1.ovpn
cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn
echo "</key>" >> ~/$1.ovpn echo "</key>" >> ~/$1.ovpn
echo "key-direction 1" >> ~/$1.ovpn echo "<tls-crypt>" >> ~/$1.ovpn
echo "<tls-auth>" >> ~/$1.ovpn cat /etc/openvpn/tls-crypt.key >> ~/$1.ovpn
cat /etc/openvpn/tls-auth.key >> ~/$1.ovpn echo "</tls-crypt>" >> ~/$1.ovpn
echo "</tls-auth>" >> ~/$1.ovpn
} }
# Try to get our IP from the system and fallback to the Internet. # Try to get our IP from the system and fallback to the Internet.
@ -352,8 +352,8 @@ set_var EASYRSA_CURVE secp384r1" > vars
./easyrsa build-server-full server nopass ./easyrsa build-server-full server nopass
./easyrsa build-client-full $CLIENT nopass ./easyrsa build-client-full $CLIENT nopass
./easyrsa gen-crl ./easyrsa gen-crl
# generate tls-auth key # Generate tls-crypt key
openvpn --genkey --secret /etc/openvpn/tls-auth.key openvpn --genkey --secret /etc/openvpn/tls-crypt.key
# Move all the generated files # Move all the generated files
cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
# Make cert revocation list readable for non-root # Make cert revocation list readable for non-root
@ -405,7 +405,7 @@ echo "crl-verify crl.pem
ca ca.crt ca ca.crt
cert server.crt cert server.crt
key server.key key server.key
tls-auth tls-auth.key 0 tls-crypt tls-crypt.key 0
dh none dh none
ecdh-curve secp256k1 ecdh-curve secp256k1
auth SHA256 auth SHA256