Moving server config and keys to new install

[deleted]

I have had OpenVPN running nicely on Ubuntu 20.04 but for reasons unrelated to OpenVPN this server now wont boot.

I can get the data off the server, and I want to move it to a new installation.

Is this possible and what would the steps be?

I assume reinstall openvpn and copy the server.conf and keys back to same locations as previously.

Is there a step in there somewhere for installing the keys or certs?

Thanks

TinCanTech

bigAlNZ wrote for reasons unrelated to OpenVPN this server now wont boot

for reasons unrelated to OpenVPN .. :?:

Take a backup and then low level format it.

[deleted]

It's not booting. So I will copy the files from etc/OpenVPN and back those files up

But the question is what steps are required beyond just copying then back to where they came from.

cwjs

Did you ever find the answer to this ?, I want to move my openvpn server installation from my ubuntu 18 to a new ubuntu 20

cwjs

I have installed openvpn on my new server, I have copied the ufw firewall files, the /etc/openvpn folders and files, the client-configs and openvpn-ca folders and files.

when I try to start open vpn I get an fail when I run status I get
● openvpn@mserver.service - OpenVPN connection to mserver
Loaded: loaded (/lib/systemd/system/openvpn@.service; disabled; vendor pre>
Active: activating (auto-restart) (Result: exit-code) since Fri 2022-05-13>
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Process: 6030 ExecStart=/usr/sbin/openvpn --daemon ovpn-server --stat>
Main PID: 6030 (code=exited, status=1/FAILURE)

May 13 11:45:04 server systemd[1]: Failed to start OpenVPN con>

I have looked at the manual pages but I dont understand what I am missing.
Can anyone hlep please

cwjs

I am moving from version Version: 2.3.10-1ubuntu2.1
to version 2.4.7-1ubuntu2.20.04.4

cwjs

OK I have sorted it !! I copied the old server /usr/share/easy-rsa to the new one.
the openvpn now starts and status says it is active

openvpn_inc

cwjs wrote OK I have sorted it !! I copied the old server /usr/share/easy-rsa to the new one.
the openvpn now starts and status says it is active

Hi cwjs,

It was never required nor even recommended to have your CA PKI files on the server machine. If that worked you misconfigured the server.

Your easy-rsa files should be on a non-VPN connected physical machine, owned by a non-privileged user, and not referenced in the server's config.

regards, rob0

TinCanTech

openvpn_inc wrote Your easy-rsa files should be on a non-VPN connected physical machine, owned by a non-privileged user, and not referenced in the server's config.

The only serious risk is disclosure of the CA private key. :mrgreen: