Greetings everyone, I am not sure if I am posting in the right spot but I am a newbie to this forum. I have used OpenVpn free for quite some time now. I run a Linux system with Pclinux 64 bit. I am not new to Linux but would like to attempt finally to get OpenVpn correct.
I did download thru synaptic version of OpenVpn is 2.3.8
Now I am able to run OpenVpn opening thru the term command as / with the command as
openvpn --config vpnbook-euro2-tcp80.ovpn
then put in user name which is naturally openvpn then the pass from the website that is active and it completes.
But I understand that it is not totally secure unless I generate my own key thru
easy-rsa
I do find that in my
/urs/share/openvpn
But I dont think that is revelent as of now for I read on the forum here that github had a newer version so I grabbed that version of 3.0.0 as a .tgz file, placed it in Documents for now, created a folder for it and did extract there. I have looked at the read me file
Easy-RSA 3 Quickstart README
============================
This is a quickstart guide to using Easy-RSA version 3. Detailed help on usage
and specific commands by running easyrsa with the 'help' command. Additional
documentation can be found in the doc/ directory.
If you're upgrading from the Easy-RSA 2.x series there are Upgrade-Notes
available, also under the doc/ path.
Setup and signing the first request
-----------------------------------
A quick run-though of what needs to happen to start a new PKI and sign your
first entity certificate.
1. Choose a system to act as your CA and create a new PKI and CA:
./easyrsa init-pki
./easyrsa build-ca
2. On the system that is requesting a certificate, init its own PKI and generate
a keypair/request. Note that the init-pki is used _only_ when this is done on
a separate system (or at least a separate PKI dir.) This is the recommended
procedure. If you are not using this recommended procedure, skip the next
import-req step as well.
./easyrsa init-pki
./easyrsa gen-req EntityName
3. Transport the request (.req file) to the CA system and import it. The name
given here is arbitrary and only used to name the request file.
./easyrsa import-req /tmp/path/to/import.req EntityName
4. Sign the request as the correct type. This example uses a client type:
./easyrsa sign-req client EntityName
5. Transport the newly signed certificate to the requesting entity. This entity
may also need the CA cert (ca.crt) unless it had a prior copy.
6. The entity now has its own keypair, and signed cert, and the CA.
Signing subsequent requests
---------------------------
Follow steps 2-6 above to generate subsequent keypairs and have the CA returned
signed certificates.
Revoking certs and creating CRLs
--------------------------------
This is a CA-specific task.
To permanently revoke an issued certificate, provide the short name used during
import:
./easyrsa revoke EntityName
To create an updated CRL that contains all revoked certs up to that point:
./easyrsa gen-crl
After generation, the CRL will need to be sent to systems that reference it.
Generating Diffie-Hellman (DH) params
-------------------------------------
After initializing a PKI, any entity can create DH params that needs them. This
is normally only used by a TLS server. While the CA PKI can generate this, it
makes more sense to do it on the server itself to avoid the need to send the
files to another system after generation.
DH params can be generated with:
./easyrsa gen-dh
Showing details of requests or certs
------------------------------------
To show the details of a request or certificate by referencing the short
EntityName, use one of the following commands. It is an error to call these
without a matching file.
./easyrsa show-req EntityName
./easyrsa show-cert EntityName
Changing private key passphrases
--------------------------------
RSA and EC private keys can be re-encrypted so a new passphrase can be supplied
with one of the following commands depending on the key type:
./easyrsa set-rsa-pass EntityName
./easyrsa set-ec-pass EntityName
Optionally, the passphrase can be removed completely with the 'nopass' flag.
Consult the command help for details.
I did the first 2 commands listed in 1. and have stopped. Here I will post my results
[root@localhost EasyRSA-3.0.0]# ./easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /home/david1/Documents/easy_rsa3.0.o/EasyRSA-3.0.0/pki
[root@localhost EasyRSA-3.0.0]# ./easyrsa build-ca
Generating a 2048 bit RSA private key
........+++
.........................+++
writing new private key to '/home/david1/Documents/easy_rsa3.0.o/EasyRSA-3.0.0/pki/private/ca.key.Cpcol749Bh'
Enter PEM pass phrase:
Verifying - Enter PEM pass phrase:
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:
So cans someone take me by the hand and lead me from here. My goal is to be totally encrypted and secure for what I have read is the out of box setup is not totally secure unless you generate you own key yourself.
Then once I get help on this then I will be asking about the OpenVpn connection setup to add the keys. I will show a snap-shot of what I am talking about here.
Easy on me now community. I am a "recovering addict" of 18 yrs now so some of the brain is like swiss cheese :lol: at time but have been pretty suscessful in linux for the past 9 yrs, but PClinux had to have patience and work with me to get me to where I am today. Hope this is not too long or too much info but I found it is best to be through so people know just where I am at on the setup.
again hello everyone and I will await a response.
-db-
