Код: Выделить всё
#pkg_info | grep openvpn
openvpn-2.1.1 Secure IP/Ethernet tunnel daemon
# uname -a
FreeBSD 6.1-RELEASE FreeBSD 6.1-RELEASE #0: Tue Aug 22 12:31:51 MSD 2006 root@:/usr/obj/usr/src/sys/WOLGATE i386
Код: Выделить всё
doctormedia# sh
# ls
Makefile build-key-pass inherit-inter revoke-full
README build-key-pkcs12 keys sign-req
build-ca build-key-server list-crl vars
build-dh build-req openssl-0.9.6.cnf whichopensslcnf
build-inter build-req-pass openssl.cnf
build-key clean-all pkitool
# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/share/doc/openvpn/easy-rsa/2.0/keys/server
# . ./clean-all
# . ./build-ca
Generating a 1024 bit RSA private key
..................................++++++
....................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:ru
State or Province Name (full name) [CA]:msk
Locality Name (eg, city) [SanFrancisco]:msk
Organization Name (eg, company) [Fort-Funston]:server
Organizational Unit Name (eg, section) []:server
Common Name (eg, your name or your server's hostname) [Fort-Funston CA]:server
Name []:server
Email Address [me@myhost.mydomain]:
# . ./build-key-server server
pkitool 2.0
Usage: pkitool [options...] [common-name]
Options:
--batch : batch mode (default)
--keysize : Set keysize
size : size (default=1024)
--interact : interactive mode
--server : build server cert
--initca : build root CA
--inter : build intermediate CA
--pass : encrypt private key with password
--csr : only generate a CSR, do not sign
--sign : sign an existing CSR
--pkcs12 : generate a combined PKCS#12 file
--pkcs11 : generate certificate on PKCS#11 token
lib : PKCS#11 library
slot : PKCS#11 slot
id : PKCS#11 object id (hex string)
label : PKCS#11 object label
Standalone options:
--pkcs11-slots : list PKCS#11 slots
lib : PKCS#11 library
--pkcs11-objects : list PKCS#11 token objects
lib : PKCS#11 library
slot : PKCS#11 slot
--pkcs11-init : initialize PKCS#11 token DANGEROUS!!!
lib : PKCS#11 library
slot : PKCS#11 slot
label : PKCS#11 token label
Notes:
Please edit the vars script to reflect your configuration,
then source it with "source ./vars".
Next, to start with a fresh PKI configuration and to delete any
previous certificates and keys, run "./clean-all".
Finally, you can run this tool (pkitool) to build certificates/keys.
In order to use PKCS#11 interface you must have opensc-0.10.0 or higher.
Generated files and corresponding OpenVPN directives:
(Files will be placed in the $KEY_DIR directory, defined in ./vars)
ca.crt -> root certificate (--ca)
ca.key -> root key, keep secure (not directly used by OpenVPN)
.crt files -> client/server certificates (--cert)
.key files -> private keys, keep secure (--key)
.csr files -> certificate signing request (not directly used by OpenVPN)
dh1024.pem or dh2048.pem -> Diffie Hellman parameters (--dh)
Examples:
pkitool --initca -> Build root certificate
pkitool --initca --pass -> Build root certificate with password-protected key
pkitool --server server1 -> Build "server1" certificate/key
pkitool client1 -> Build "client1" certificate/key
pkitool --pass client2 -> Build password-protected "client2" certificate/key
pkitool --pkcs12 client3 -> Build "client3" certificate/key in PKCS#12 format
pkitool --csr client4 -> Build "client4" CSR to be signed by another CA
pkitool --sign client4 -> Sign "client4" CSR
pkitool --inter interca -> Build an intermediate key-signing certificate/key
Also see ./inherit-inter script.
pkitool --pkcs11 /usr/lib/pkcs11/lib1 0 010203 "client5 id" client5
-> Build "client5" certificate/key in PKCS#11 token
Typical usage for initial PKI setup. Build myserver, client1, and client2 cert/keys.
Protect client2 key with a password. Build DH parms. Generated files in ./keys :
[edit vars with your site-specific info]
source ./vars
./clean-all
./build-dh -> takes a long time, consider backgrounding
./pkitool --initca
./pkitool --server myserver
./pkitool client1
./pkitool --pass client2
Typical usage for adding client cert to existing PKI:
source ./vars
./pkitool client-new
#
Ну собственно вот, делал по доке, все они так советуют:Burner писал(а):a source ./vars?
Код: Выделить всё
# . ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /usr/local/share/doc/openvpn/easy-rsa/2.0/keys/serverКод: Выделить всё
# source ./vars
source: not found
Код: Выделить всё
. ./vars
sh ./build-key-server server1Код: Выделить всё
chmod +x build-key-serverКод: Выделить всё
# sh ./build-key-server server
Generating a 1024 bit RSA private key
....++++++
..........................++++++
writing new private key to 'server.key'
-----