upday/vpn-manager repository overview

⁠VPN Manager

This is a set of tools useful for all the task related to the VPN.

⁠Quick Start

Make sure Docker is installed on your machine, then spin up a container using the Dockerfile provided with Ruby and OpenSSL preinstalled, based on lightweight Alpine Linux.

To build the container, use docker build plus your preferred options or use the Makefile:

$ make build

Executing make run will print the commands available to the the VPN Manager. Pass the CMD variable to make to run any of these commands.

⁠Generate a Certificate Signing Request

$ make run CMD='csr --email=<your upday email> <target folder>'

This will generate your .key and .csr files in the current directory. Send the .csr file to [email protected] and wait. In return you will receive a .crt file needed for the next step.

⁠Generate Tunnelblick configuration

Once you receive your certificate (.crt), you need to mount the path of folder in to the container as an example: docker run -it --rm -v <path to the vpn-manager>:/vpn-manager vpn-manager config <output folder> --cert=<.crt file> --key=<.key file>

As an example: docker run -it --rm -v /Users/pk/development/vpn-manager:/vpn-manager vpn-manager config tunnel --cert=certs/peter.krauss.crt --key=certs/peter.krauss.key

This will generate the .tblk configuration file for Tunnelblick⁠. After making sure Tunnelblick is installed, you can double click the .tblk file to import it.

⁠Known Issues: Tunnelblick is constantly reconnecting

check chertificate:

openssl x509 -in certificate.crt -text -noout

⁠For the Admin

⁠Requirements

As an admin, you need your AWS credentials exported in your environment, in the following format:

AWS_ACCESS_KEY_ID=****
AWS_SECRET_ACCESS_KEY=****
AWS_DEFAULT_REGION=eu-west-1
AWS_KEY_NAME=Ford Prefect

⁠Sign a Certificate Signing Request

As an admin you will receive .csr from users that require VPN access. First thing to do is to verify the user identity. Then, in order to sign the request and create a certificate for the user, run:

$ vpn-manager sign --ca-key-path=<.key of the root CA> --csr-path=<.csr of the user>

The .key of the root CA can be found on Lastpass (if you have permissions for it). Once the .crt file is generated, please send it to the requesting user.

⁠Revoking access for an user

As an admin, you can revoke to the users the access. You only need to add them into the revokation list aka .crl file. For this, the admin need to run:

$ vpn-manager crl <destination path> --ca-key-path=CA_KEY_PATH --cert-user=CERT_USER>

⁠Prolongue Root CA certificate

openssl x509 -in old_ca.crt -days 36500 -out new_ca.crt -signkey keymaker.key