Skip to content

Instantly share code, notes, and snippets.

@piotr-dobrogost

piotr-dobrogost/\etc\openvpn\xxx.conf

Last active March 23, 2016 20:17
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save piotr-dobrogost/8e13d962604443e9f278 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save piotr-dobrogost/8e13d962604443e9f278 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Piotr Dobrogost revised this gist Mar 23, 2016. 2 changed files with 1 addition and 2 deletions.
    2 changes: 1 addition & 1 deletion commands
    View file
    Original file line number Diff line number Diff line change
    @@ -1,5 +1,5 @@
    # This works
    > sudo OPENSSL_ENABLE_MD5_VERIFY=1 openvpn --daemon --user piotr --config /etc/openvpn/xxx.conf
    > sudo OPENSSL_ENABLE_MD5_VERIFY=1 openvpn --daemon --config /etc/openvpn/xxx.conf

    # `sudo journalctl`
    (...)
    1 change: 0 additions & 1 deletion gistfile1.txt → systemctl cat openvpn@xxx
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,3 @@
    [piotr@demon system]$ systemctl cat openvpn@xxx
    # /usr/lib/systemd/system/openvpn@.service
    [Unit]
    Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
  2. Piotr Dobrogost revised this gist Mar 23, 2016. 1 changed file with 19 additions and 0 deletions.
    19 changes: 19 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    [piotr@demon system]$ systemctl cat openvpn@xxx
    # /usr/lib/systemd/system/openvpn@.service
    [Unit]
    Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
    After=network.target

    [Service]
    PrivateTmp=true
    Type=forking
    PIDFile=/var/run/openvpn/%i.pid
    Environment=OPENSSL_ENABLE_MD5_VERIFY=1
    ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf

    [Install]
    WantedBy=multi-user.target

    # /etc/systemd/system/openvpn@xxx.service.d/env.conf
    [Service]
    Environment="OPENSSL_ENABLE_MD5_VERIFY=1"
  3. Piotr Dobrogost revised this gist Mar 22, 2016. No changes.
  4. Piotr Dobrogost created this gist Mar 22, 2016.
    26 changes: 26 additions & 0 deletions \etc\openvpn\xxx.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    client
    dev tun

    proto udp
    remote x.x.x.x 1194
    remote y.y.y.y 1194

    resolv-retry infinite
    nobind

    script-security 2
    up /etc/openvpn/client.up
    plugin /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so "/etc/openvpn/client.down"

    persist-key
    persist-tun

    pkcs12 /etc/openvpn/xxx/piotr.dobrogost.xxx.vpn.p12

    cipher AES-256-CBC
    comp-lzo

    # logowanie
    mute-replay-warnings
    verb 3

    2 changes: 2 additions & 0 deletions \etc\systemd\system\openvpn@xxx.service.d\env.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,2 @@
    [Service]
    Environment=OPENSSL_ENABLE_MD5_VERIFY=1
    12 changes: 12 additions & 0 deletions \usr\lib\systemd\system\openvpn@.service
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,12 @@
    [Unit]
    Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
    After=network.target

    [Service]
    PrivateTmp=true
    Type=forking
    PIDFile=/var/run/openvpn/%i.pid
    ExecStart=/usr/sbin/openvpn --daemon --writepid /var/run/openvpn/%i.pid --cd /etc/openvpn/ --config %i.conf

    [Install]
    WantedBy=multi-user.target
    19 changes: 19 additions & 0 deletions commands
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,19 @@
    # This works
    > sudo OPENSSL_ENABLE_MD5_VERIFY=1 openvpn --daemon --user piotr --config /etc/openvpn/xxx.conf

    # `sudo journalctl`
    (...)
    Mar 22 21:45:08 demon openvpn[31225]: VERIFY OK: depth=2, (...)
    Mar 22 21:45:08 demon openvpn[31225]: VERIFY OK: depth=1, (...)
    Mar 22 21:45:08 demon openvpn[31225]: VERIFY OK: depth=0, (...)
    (...)

    # This does not work
    > sudo systemctl start openvpn@xxx

    # `sudo journalctl`
    (...)
    Mar 22 21:51:47 demon openvpn[31587]: VERIFY OK: depth=2, (...)
    Mar 22 21:51:47 demon openvpn[31587]: VERIFY ERROR: depth=1, error=certificate signature failure: (...)

    (...)