Build OpenVPN .ovpn file

build-ovpn.sh

#!/bin/bash
#
# Tool to build ovpn file sutable for distribution to client machines.
#
# Install:
#     Put inside /etc/openvpn/clients
#
# Usage:
#     build-ovpn.sh name_of_ovpn_file
#
#     e.g.:
#         build-ovpn.sh macbookpro
#
#     Above will generate a file called macbookpro.ovpn in the same directory
#
# Note:
#    build-key will be executed if public key (./certs/keys/name_of_ovpn_file.crt) is not found.
#    Normally, root is not required except when build-key is needed
#
#
# No user servicable parts below
# ==============================

# Default Variable Declarations

DEFAULT="inline_client.conf"
FILEEXT=".ovpn"
CRT=".crt"
KEY=".key"
CA="ca.crt"
TA="ta.key"
kPath="../certs/keys/"

if [ "$1" ]; then
    NAME=$1
else
#Ask for a Client name
echo -n  "Please enter an existing Client Name: "
read NAME
fi

echo -n "Please enter an Name for the output file [$NAME]$FILEEXT: "
read i
if [ -z "$i" ]; then
    ovpnName=$NAME$FILEEXT
else
    ovpnName=$i$FILEEXT
fi
if [ -f $ovpnName ]; then
    echo -n "${ovpnName} already exists, overwrite? [Y/n]"
    read a
    if [ -z "$a" ]; then
        a = 'Y'
    fi
    if [ "$a" != "Y" ]; then
        echo "Aborted due to duplicated filename ${ovpnName}!"
        exit 255
    fi
fi

#1st Verify that client's Public Key Exists
while [ ! -f $kPath$NAME$CRT ]; do 
   echo "[ERROR]: Client Public Key Certificate not found: $kPath$NAME$CRT"
   echo "Executing build-key. Control-C to exit"
   (cd ../certs/; . vars; ./build-key ${NAME})
done
CCRT=$kPath$NAME$CRT
echo "Client's cert found: $CCRT"

#Then, verify that there is a private key for that client
if [ ! -f $kPath$NAME$KEY ]; then
   echo "[ERROR]: Client 3des Private Key not found: $kPath$NAME$KEY"
   exit
fi
CKEY=$kPath$NAME$KEY
echo "Client's Private Key found: $CKEY"

#Confirm the CA public key exists
if [ ! -f $kPath$CA ]; then
   echo "[ERROR]: CA Public Key not found: $kPath$CA"
   exit
fi
CCA=$kPath$CA
echo "CA public Key found: $CCA"

#Confirm the tls-auth ta key file exists
if [ ! -f $kPath$TA ]; then
   echo "[ERROR]: tls-auth Key not found: $kPath$TA"
   exit
fi
CTA=$kPath$TA
echo "tls-auth Private Key found: $CTA"

#Ready to make a new .opvn file - Start by populating with the

sed "
/ca ca.crt/{
s//<ca>/
r $CCA
a\
</ca>
}
/cert client.crt/{
s//<cert>/
r $CCRT
a\
</cert>
}
/key client.key/{
s//<key>/
r $CKEY
a\
</key>
}
/ta ta.key/{
s//<tls-auth>/
r $CTA
a\
</tls-auth>
}
" client-template.ovpn > ${ovpnName}

client-template.ovpn

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
remote jp02.iostation.com 1194
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
;remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nogroup

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt

cert client.crt

key client.key

ta ta.key

# Verify server certificate by checking that the
# certicate has the correct key usage set.
# This is an important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the keyUsage set to
#   digitalSignature, keyEncipherment
# and the extendedKeyUsage to
#   serverAuth
# EasyRSA can do this for you.
remote-cert-tls server

# If a tls-auth key is used on the server
# then every client must also have the key.
key-direction 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x
cipher AES-256-CBC

# Authentication Digest
auth SHA512

# Cipher Restrictions
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
;comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20