Ajout de 'create-client.sh'

create-client.sh

@@ -0,0 +1,95 @@
+#!/bin/bash
+
+set -euo pipefail
+
+NAME="${1:?Usage: create-client.sh CLIENT_NAME VPN_HOST [PORT]}"
+HOST="${2:?Usage: create-client.sh CLIENT_NAME VPN_HOST [PORT]}"
+PORT="${3:-1194}"
+
+export EASYRSA_PKI=/openvpn/pki
+
+EASYRSA=/usr/share/easy-rsa/3/easyrsa
+
+# --------------------------------------------------------
+# Certificat client
+# --------------------------------------------------------
+
+if [ ! -f "${EASYRSA_PKI}/issued/${NAME}.crt" ]; then
+
+  echo "Generating certificate for ${NAME}..." >&2
+
+  "${EASYRSA}" \
+    --batch \
+    build-client-full \
+    "${NAME}" \
+    nopass \
+    >&2
+
+fi
+
+# --------------------------------------------------------
+# Profil .ovpn autonome
+# --------------------------------------------------------
+
+cat <<EOF
+client
+
+dev tun
+proto udp4
+
+remote ${HOST} ${PORT}
+
+resolv-retry infinite
+nobind
+
+persist-key
+persist-tun
+
+remote-cert-tls server
+verify-x509-name server name
+
+auth-nocache
+
+tls-version-min 1.2
+
+data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
+data-ciphers-fallback AES-256-GCM
+
+auth SHA256
+
+verb 3
+
+<ca>
+EOF
+
+awk '/-----BEGIN CERTIFICATE-----/{p=1} p' \
+  "${EASYRSA_PKI}/ca.crt"
+
+cat <<EOF
+</ca>
+
+<cert>
+EOF
+
+awk '/-----BEGIN CERTIFICATE-----/{p=1} p' \
+  "${EASYRSA_PKI}/issued/${NAME}.crt"
+
+cat <<EOF
+</cert>
+
+<key>
+EOF
+
+cat "${EASYRSA_PKI}/private/${NAME}.key"
+
+cat <<EOF
+</key>
+
+<tls-crypt>
+EOF
+
+cat "${EASYRSA_PKI}/tls-crypt.key"
+
+cat <<EOF
+</tls-crypt>
+EOF