Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a centos machine and I was following https://library.linode.com/networking/openvpn/centos-5 this guide. The problem I have is I can't add multiple clients.

When I try to add multiple clients it says:

cd /etc/openvpn/easy-rsa/2.0/

[root@server]# ./build-key newclient1 Please edit the vars script to reflect your configuration, then source it with "source ./vars". Next, to start with a fresh PKI configuration and to delete any previous certificates and keys, run "./clean-all". Finally, you can run this tool (pkitool) to build certificates/keys.

[root@server]#

What am I doing wrong? How can I add another client to the VPN?

share|improve this question
add comment

3 Answers

If you've already used this directory to build your CA key & cert, your server key & cert, your Diffie-Hellman parameters, and at least one other client key & cert, then you should have a working "easy-rsa" configuration there. In that case, you can simply do this:

cd /etc/openvpn/easy-rsa/2.0/
source ./vars
./build-key newclient1

Answer the questions that build-key asks appropriately, and it should generate a new key and a corresponding certificate signed by the CA. Copy the key and cert (and the CA cert) to the client's machine over a secure channel (e.g. scp). From there, I assume you know what to do.

share|improve this answer
add comment

You need to check the configuration options in the /etc/openvpn/easy-rsa/2.0/vars script to ensure they are correct, and then run the script as the output indicates in order to set your environment settings so that key generation will work.

The guide you are working with DOES indicate in the section entitled Configure Public Key Infrastructure Variables that you should do this.

Specifically, the need_vars function that displays the text above is called from pkitool when $KEY_DIRS has not been set in the environment because the vars script wasn't run.

share|improve this answer
add comment

Here is an OpenVPN server key generations shell script I wrote built on the easy-rsa scripts:

Server Key Gen:

#! /bin/bash
# ./var_gen.sh IN MS PUNE MYCOMPANY admin@MYCOMPANY.com admin@MYCOMPANY.com MYCOMPANY-OU
# $1 = CONUTRY
# $2 = STATE
# $3 = CITY
# $4 = COMPANY
# $5 = Email
# $6 = EMAIL
# $7 = Commonname

if [ $# -lt 7 ] ; then
echo "Need Option Variables
CONUTRY
STATE
CITY
COMPANY
Email
EMAIL
Commonname

i.e

sh var_gen.sh IN MS PUNE MYCOMPANY admin@MYCOMPANY.com admin@MYCOMPANY.com MYCOMPANY-OU


"

exit 0
fi

sw_ovpn_server_setup()
{
cd /etc/openvpn/easy-rsa/2.0/
chmod +rwx *
./clean-all
source ./vars
./build-ca
./build-key-server server
cp -f /etc/openvpn/easy-rsa/2.0/keys/{ca.crt,ca.key,server.crt,server.key} /etc/openvpn/
./build-dh
cp -f /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem /etc/openvpn/
/etc/init.d/openvpn restart
}

var_gen()
{
country=$1
state=$2
city=$3
org=$4
email=$5
keycn=$6
keyou=$7
pkcpath=$8
pkcpin=$9

echo "
#! /bin/bash
export OPENSSL="/usr/bin/openssl"
export PKCS11TOOL="pkcs11-tool"
export GREP="grep"
export KEY_CONFIG="/etc/openvpn/easy-rsa/2.0/openssl-0.9.8.cnf"
export KEY_DIR="/etc/openvpn/easy-rsa/2.0/keys"
export PKCS11_MODULE_PATH="dummy"
export PKCS11_PIN="dummy"
export KEY_SIZE=1024
export CA_EXPIRE=365
export KEY_EXPIRE=365

export KEY_COUNTRY="$country"
export KEY_PROVINCE="$state"
export KEY_CITY="$city"
export KEY_ORG="$org"
export KEY_EMAIL="$email"
export KEY_CN=`od -vAn -N4 -tu4 < /dev/urandom |xargs`
export KEY_NAME="$keyou-simplewall"
export KEY_OU=$keyou
#export PKCS11_MODULE_PATH=$pkcpath
#export PKCS11_PIN=$pkcpin
"
}

var_gen $1 $2 $3 $4 $5 $6 $7 >/etc/openvpn/easy-rsa/2.0/vars
sw_ovpn_server_setup
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.