Giving access to a new user
This page has been moved to docs.fsfe.org with the rest of the sysadmin documentation.
To allow a client to access the VPN server, you just have to create a client certificate following the procedure below; no configuration changes are needed on the server (the server automatically allows client certificates signed with our master certificate).
- Log into vpn.fsfe.org:/root/wrk/vpn/easy-rsa
- Source the ./vars file
. ./vars
- Choose a nickname for the certificate (CERTNAME in the example below); we usually choose the surname of the person requesting the certificate.
Run:
./build-key CERTNAME
- Answer all questions with the default answer, except for:
- - Common Name: if it's a certificate for a host, enter its FQDN; if it's a person, enter his Name and Surname - Email: you can leave the default value, or enter the real email address, if the certificate is for a real person (this field is informational only,
- it has no role in the authentication)
- - Answer "yes" to the last two questions (confirmation of certificate creation and signature)
- In the ./keys directory, you'll find the CERTNAME.crt and CERTNAME.key files.
- Send a GPG-encrypted mail message to the user:
- Use the message template: ./newuser_message.txt
- Attach the certificates: ca, CERTNAME, CERTNAME.key
- Attach the sample configuration files contained in ./conf/client
WARNING: make sure to encrypt the message, since the client certificate and key are sensitive material!!!
- Update the SVN mirror of the server PKI in ./conf/ca
Run the ./conf/ca/getconf.sh script
Creating a server certificate
Use the same procedure to create a client cert, except, run the ./build-key-server script