(Request) Step-by-step guide on how to set up an OpenVPN Server?

Xi0N · 2017-09-02 23:55:39

I swear I have been following the wiki but there are too many things that fail. For example, the openssl cnf file is not where it is supposed to be and you have to manyally symlink it to the directory it's supposed to be.

Then, I've reached the point where I was about to sign the server cert on the OpenVPN machine and I get more openssl errors.

Using configuration from ./openssl-1.0.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Can't open /etc/easy-rsa/pki/index.txt.attr for reading, No such file or directory
1996005392:error:02001002:system library:fopen:No such file or directory:crypto/bio/bss_file.c:74:fopen('/etc/easy-rsa/pki/index.txt.attr','r')
1996005392:error:2006D080:BIO routines:BIO_new_file:no such file:crypto/bio/bss_file.c:81:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'REDACTED'
organizationName      :ASN.1 12:'REDACTED'
organizationalUnitName:ASN.1 12:'REDACTED'
The commonName field needed to be supplied and was missing

Easy-RSA error:

signing failed (openssl output above may have more detail)

I really am clueless at this point. It seems way too difficult and the wiki, instead of guiding you on how to do the certificates part, just refers you to the easy-rsa article,which is even more tedious and doesn't contemplate the caveats and other obstacles you might encounter.

Any help would be really appreciatred.

Alad · 2017-09-03 00:29:45

https://wiki.archlinux.org/index.php/Ta … tructuring

Really there's not much point discussing this here, in a thread the wiki contributors may not read.

seth · 2017-09-03 06:38:46

OpenSSL version incompatibility.
https://github.com/OpenVPN/easy-rsa/issues/132
https://github.com/OpenVPN/easy-rsa/issues/138

I btw. figured that within a minute by asking the oracle of mountain view for "Can't open /etc/easy-rsa/pki/index.txt.attr for reading, No such file or directory" ...

Xi0N · 2017-09-03 08:09:24

seth wrote:

OpenSSL version incompatibility.
https://github.com/OpenVPN/easy-rsa/issues/132
https://github.com/OpenVPN/easy-rsa/issues/138
I btw. figured that within a minute by asking the oracle of mountain view for "Can't open /etc/easy-rsa/pki/index.txt.attr for reading, No such file or directory" ...

Ok, so, there's not much option here: Basically OpenVPN is broken in arch ATM?

Thanks for your help-

brebs · 2017-09-03 10:07:48

No, it is easy-rsa which is broken.

Certificates can be created *without* using easy-rsa, so you are fine to continue.

Xi0N · 2017-09-03 10:31:15

brebs wrote:

No, it is easy-rsa which is broken.
Certificates can be created *without* using easy-rsa, so you are fine to continue.

All the wikis use easy-rsa. Would you mind pointing me in the right direction? I really don't know how to create certificates if not with easy-rsa.

Much appreciated

Last edited by Xi0N (2017-09-03 10:33:37)

loqs · 2017-09-03 11:25:23

Xi0N have you tried installing openssl-1.0 and setting the following in /etc/easy-rsa/vars.conf?

set_var EASYRSA_OPENSSL "openssl-1.0"

Xi0N · 2017-09-03 12:03:28

loqs wrote:

Xi0N have you tried installing openssl-1.0 and setting the following in /etc/easy-rsa/vars.conf?
set_var EASYRSA_OPENSSL "openssl-1.0"

Will try later and report. I assume this is an outdated version but newer versions must be problematic if they are keeping both versions in the core repo!

graysky · 2017-09-03 12:59:53

I used easy-rsa as recently as a few months ago in the role, and although warnings were thrown, the certs worked fine with openvpn. Perhaps the bug has worsened. Mine was not a hard stop.

Last edited by graysky (2017-09-03 13:02:33)

loqs · 2017-09-03 15:26:49

Changing all occurrences of

easyrsa

to

EASYRSA=/etc/easy-rsa EASYRSA_OPENSSL=openssl-1.0 easyrsa

Seems to work around the current issues no warnings are generated or errors produced.

Xi0N · 2017-09-03 18:55:19

loqs wrote:

Changing all occurrences of
easyrsa
to
EASYRSA=/etc/easy-rsa EASYRSA_OPENSSL=openssl-1.0 easyrsa
Seems to work around the current issues no warnings are generated or errors produced.

This worked, except for the step where you have to sign the cert "easyrsa sign-req client client1" easyrsa needs to have "/etc/easyrsa/x509" folder in the same dir, so I symlinked /etc/easyrsa/easyrsa -> /usr/bin/easyrsa

Now, the connection works.

only two things left:

1: Enable password protection for the clients, so they have to input a password when connecting (shouldn't take long to google this)

2: Be able to route all the clients traffic through my network's router, using an internal manchine as dns server.

loqs · 2017-09-03 19:48:48

Xi0N wrote:

This worked, except for the step where you have to sign the cert "easyrsa sign-req client client1" easyrsa needs to have "/etc/easyrsa/x509" folder in the same dir, so I symlinked /etc/easyrsa/easyrsa -> /usr/bin/easyrsa

What was the error/output when you ran the command without the symlink to /usr/bin/easyrsa?

EASYRSA=/etc/easy-rsa EASYRSA_OPENSSL=openssl-1.0 easyrsa sign-req client client1

Also the output of

ls -la /etc/easy-rsa

Xi0N · 2017-09-03 20:07:05

loqs wrote:

Xi0N wrote:
This worked, except for the step where you have to sign the cert "easyrsa sign-req client client1" easyrsa needs to have "/etc/easyrsa/x509" folder in the same dir, so I symlinked /etc/easyrsa/easyrsa -> /usr/bin/easyrsa
What was the error/output when you ran the command without the symlink to /usr/bin/easyrsa?
EASYRSA=/etc/easy-rsa EASYRSA_OPENSSL=openssl-1.0 easyrsa sign-req client client1
Also the output of
ls -la /etc/easy-rsa

Let me try again and report, since I was testing and I'm planning to redo the whole process, write it down and include it in the wiki. I created an alias in my bashrc file whenever I called easyrsa , including the prefix you suggested but i think I screwed up since sometimes I ran commands with sudo and sometimes just from the root account, the easy-rsa wiki is a mess, as stated, and includes useless steps like how to copy files between machines in the middle of other processes and confused the hell out of me.

As said, in the next days, I'll try again and report back.

Thanks!

graysky · 2017-09-03 23:46:09

Xi0N wrote:

the easy-rsa wiki is a mess, as stated, and includes useless steps like how to copy files between machines in the middle of other processes and confused the hell out of me.
As said, in the next days, I'll try again and report back.
Thanks!

I disagree with you that the article is a mess and that is contain extra steps. Kindly use the discussion page on the wiki and draft the section on your personal wiki page before you make global edits to the work I and others have already put into place.

Xi0N · 2017-09-04 03:39:58

graysky wrote:

Xi0N wrote:
the easy-rsa wiki is a mess, as stated, and includes useless steps like how to copy files between machines in the middle of other processes and confused the hell out of me.
As said, in the next days, I'll try again and report back.
Thanks!
I disagree with you that the article is a mess and that is contain extra steps. Kindly use the discussion page on the wiki and draft the section on your personal wiki page before you make global edits to the work I and others have already put into place.

Sorry, I mean no disrespect and appreciate the contribuitions to the wiki, hell, I wish I could be that helpful some day. But the wiki is a bit confusing: At least for me. I won't modify anything since I'm not really that used to contribute to wikis and don't want to mess up other people's job.

I'm going to try now to generate everything from scratch and report back

Thanks!

EDIT: I can't seem to find the way to generate the client keys enabling password protection: in the past, you would issue a command like "build-key-pass client", but I don't know how to do the equivalent now.

EDIT2: easyrsa gen-req client1 nopass -> Removing the nopass part did the trick. Now everything is working!!!!

Last edited by Xi0N (2017-09-04 05:20:41)

Arch Linux

#1 2017-09-02 23:55:39

(Request) Step-by-step guide on how to set up an OpenVPN Server?

#2 2017-09-03 00:29:45

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#3 2017-09-03 06:38:46

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#4 2017-09-03 08:09:24

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#5 2017-09-03 10:07:48

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#6 2017-09-03 10:31:15

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#7 2017-09-03 11:25:23

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#8 2017-09-03 12:03:28

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#9 2017-09-03 12:59:53

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#10 2017-09-03 15:26:49

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#11 2017-09-03 18:55:19

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#12 2017-09-03 19:48:48

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#13 2017-09-03 20:07:05

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#14 2017-09-03 23:46:09

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

#15 2017-09-04 03:39:58

Re: (Request) Step-by-step guide on how to set up an OpenVPN Server?

Board footer