Skip to content

Devops OpenVPN Installation process

This is likely going to be already deprecated as we're on talks to move to Hetzner Teleport instead.

Not sure if Ansible scripts are going to be necessary, read above 👆 TO DO: Ansible scripts. Below is summary of the installation process to help with creating ansible scripts.

https://www.digitalocean.com/community/tutorials/how-to-set-up-and-configure-an-openvpn-server-on-ubuntu-20-04

CA

  1. Update package repositories and install openvpn and easy-rsa
sudo apt update
sudo apt install openvpn easy-rsa
  1. Create ca user:
sudo adduser ca
  1. Switch to ca-user:
sudo su ca
  1. Change directories to home:
cd
  1. Create easy-rsa directory:
mkdir ~/easy-rsa
  1. Symlink easy-rsa scripts to our home's easy-rsa directory so when updating easy-rsa, updates are "applied" to our easy-rsa directory as well.
ln -s /usr/share/easy-rsa/* ~/easy-rsa/
  1. Ensure that only the ca user is allowed to access the easy-rsa directory in their home:
chmod 700 ~/easy-rsa
  1. Add configurations to vars file:
set_var EASYRSA_REQ_COUNTRY    "FI"
set_var EASYRSA_REQ_PROVINCE   "Keski-Pohjanmaa"
set_var EASYRSA_REQ_CITY       "Kokkola"
set_var EASYRSA_REQ_ORG        "Ahola Digital"
set_var EASYRSA_REQ_EMAIL      "miro.salo@aholadigital.com"
set_var EASYRSA_REQ_OU         "aholadigital"
set_var EASYRSA_ALGO           "ec"
set_var EASYRSA_DIGEST         "sha512"
  1. Run the build-ca script:
./easyrsa build-ca
  1. Create SSH keys for both ovpn and ca user accounts:
ssh-keygen -t ed25519
  1. Create authorized_keys file for both user accounts under /home/<USERNAME>/.ssh/
  2. As the relevant user (ovpn and ca), give it proper permissions so that it doesn't error out:
chmod 644 authorized_keys
  1. Add the contents of ovpn's .pub public key to ca-user's authorized_keys file located in /home/ca/.ssh/authorized_keys
  2. Add the contents of ca's .pub public key to ovpn-user's authorized_keys file located in /home/ovpn/.ssh/authorized_keys
  3. As the ovpn-user, copy the ca.crt file from the ca-user's home:
rsync -v ca@192.168.1.3:~/easy-rsa/pki/ca.crt ~
  1. Log out from the ovpn-user and move the certificate file:
exit
sudo mv /home/ovpn/ca.crt /usr/local/share/ca-certificates/
  1. As yourself, run the certificate update command:
sudo update-ca-certificates

VPN

  1. Update package repositories and install openvpn and easy-rsa
sudo apt update
sudo apt install openvpn easy-rsa
  1. Create ovpn user:
sudo adduser ovpn
  1. Switch to ovpn-user:
sudo su ovpn
  1. Change directories to home:
cd
  1. Create easy-rsa directory:
mkdir ~/easy-rsa
  1. Symlink easy-rsa scripts to our home's easy-rsa directory so when updating easy-rsa, updates are "applied" to our easy-rsa directory as well.
 ln -s /usr/share/easy-rsa/* ~/easy-rsa/
  1. Ensure that only the ovpn user is allowed to access the easy-rsa directory in their home:
chmod 700 ~/easy-rsa
  1. Add configurations to vars file:
cd ~/easy-rsa
nano vars

set_var EASYRSA_ALGO "ec"
set_var EASYRSA_DIGEST "sha512"
  1. ./easyrsa init-pki

TODO continue this?