Ini telah diuji dengan OpenVPN 2.3.4 Debian 8.9 Server dengan klien Win7.
Langkah 1. Buat file yang berisi default Anda (saya menyebutnya inline_client.conf) semua pengaturan harus cocok dengan nilai server.conf Anda
client
dev tun
proto udp
remote yourserver.xyz 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3
;mute 20
ca [inline]
cert [inline]
key [inline]
tls-auth [inline] 1
Langkah 2. Buat skrip berikut, sesuaikan jalur seperti yang diperlukan dan
chmod ug+x MakeInline.sh
#!/bin/bash
# Default Variable Declarations
DEFAULT="inline_client.conf"
FILEEXT=".ovpn"
CRT=".crt"
KEY=".key"
CA="ca.crt"
TA="ta.key"
kPath="./keys/"
#Ask for a Client name
echo "Please enter an existing Client Name:"
read NAME
echo "Please enter an Name for the output file"
read ovpnName
#1st Verify that client's Public Key Exists
if [ ! -f $kPath$NAME$CRT ]; then
echo "[ERROR]: Client Public Key Certificate not found: $kPath$NAME$CRT"
exit
fi
echo "Client's cert found: $kPath$NAME$CRT"
#Then, verify that there is a private key for that client
if [ ! -f $kPath$NAME$KEY ]; then
echo "[ERROR]: Client 3des Private Key not found: $kPath$NAME$KEY"
exit
fi
echo "Client's Private Key found: $kPath$NAME$KEY"
#Confirm the CA public key exists
if [ ! -f $kPath$CA ]; then
echo "[ERROR]: CA Public Key not found: $kPath$CA"
exit
fi
echo "CA public Key found: $kPath$CA"
#Confirm the tls-auth ta key file exists
if [ ! -f $kPath$TA ]; then
echo "[ERROR]: tls-auth Key not found: $kPath$TA"
exit
fi
echo "tls-auth Private Key found: $kPath$TA"
#Ready to make a new .opvn file - Start by populating with the
cat $DEFAULT > $ovpnName$FILEEXT
#Now, append the CA Public Cert
echo "<ca>" >> $ovpnName$FILEEXT
cat $kPath$CA | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >> $ovpnName$FILEEXT
echo "</ca>" >> $ovpnName$FILEEXT
#Next append the client Public Cert
echo "<cert>" >> $ovpnName$FILEEXT
cat $kPath$NAME$CRT | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' >> $ovpnName$FILEEXT
echo "</cert>" >> $ovpnName$FILEEXT
#Then, append the client Private Key
echo "<key>" >> $ovpnName$FILEEXT
cat $kPath$NAME$KEY >> $ovpnName$FILEEXT
echo "</key>" >> $ovpnName$FILEEXT
#Finally, append the TA Private Key
echo "<tls-auth>" >> $ovpnName$FILEEXT
cat $kPath$TA >> $ovpnName$FILEEXT
echo "</tls-auth>" >> $ovpnName$FILEEXT
echo "Done! $ovpnName$FILEEXT Successfully Created."
#Script written by Eric Jodoin
#Update by Eric Maasdorp 2017-12-16
Langkah 3. Jalankan MakeInline.sh
itu akan meminta nama klien yang Anda harus sudah dibuat dengan build-key or build-key-pass
. Itu akan meminta nama untuk file ovpn. Standar saya adalah ServerToConnectTo.ClientName yang akan menghasilkan
ServerToConnectTo.ClientName.ovpn
Catatan: jika Anda menggunakan build-key
alih-alih build-key-pass
maka siapa pun yang memegang *.ovpn
akan memiliki akses ke server Anda tanpa kata sandi!
Could not read file C:\\...\[inline]
sehingga tampaknya klien tidak mengetahui tentang sertifikat sebaris (belum).