Support for easy-rsa version 3

[ivanfetch]

This module should detect version 3 of easy-rsa, and use the updated vars file and no longer source the vars file before running easyrsa.

FreeBSD uses easy-rsa 3 as a dependency to OpenVPN.

[TeunRoefs]

Any progress with this? Seems the epel-release has been updated with easy-rsa 3.0.3 instead of 2.0 and this module will now always fail on Red Hat Enterprise Linux 7.4.

[bastelfreak]

@TeunRoefs are you able to provide a PR for this?

[TeunRoefs]

@bastelfreak I thought it would be as easy as changing 2.0 to 3.0.3 wherever applicable, but I keep getting the following error when running Puppet.

./vars: line 29: /etc/openvpn/aws/easy-rsa/whichopensslcnf: No such file or directory

Is this familiar to you? If you know how to fix it, I can make a PR to update the module to use easy-rsa 3.0.3.

Update: Apparently Easy-RSA 3.0 is a complete rewrite and the whole module needs a rewrite in order to use it.

[jameskirsop]

I've started trying to get something working with v3, but the biggest problem I'm facing is that running ./easyrsa build-ca nopass requires you to enter a Common Name and there's no flag for that variable or a way of automating the entry of that, when prompted, via the puppet manifest.

Unless I'm missing something obvious, I can't see a place to enter this in the ./vars file for easyrsa - so I'm not sure how we'll work around that.

[monkey670]

For what I was doing the files that need changing are the params.pp to use version 3, the template vars file for the newer variables, server.erb to use the default paths and the client.pp/ca.pp to use the newer commands whilst removing the ./vars call. I've managed to stand up a working openvpn server with these changes on RHEL 7.4 using easy-rsa 3.0.3.

I might be wrong but is this the variable EASYRSA_REQ_CN="ChangeMe" you can use to set the Common Name in the ./vars file or at command runtime?

[ElvenSpellmaker]

@jameskirsop You can echo a Common Name and pipe it in, the newline from echo will act like you've hit enter.

So, echo foo | ./easyrsa build-ca nopass will work.
When I had a brief look at this I couldn't work out what CN was needed here...

[ElvenSpellmaker]

As mentioned in #269, Epel has now replaced easy-rsa with version 3.x and so this module is now broken for anyone using CentOS (at least EL7).

[jameskirsop]

After a fair bit of hacking around I've got something that creates working server and client configs, but the changes are pretty dirty and will need cleanup before I commit them to my fork and create a PR. I'll try and do this over the next week or so.

I ended up adding a clause specifically for CentOS 7 that uses a different params file so that anything using the pre 3.x easy-rsa still works OK.

I'm not able to get the client to auto deploy config successfully though... but that's probably outside the scope of this thread.

[barrypitman]

I was able to work around this by manually uninstalling easy-rsa 3 and installing easy-rsa 2 from RPM

[ElvenSpellmaker]

Odd because I can't find easy-rsa2.x in the epel repo any more...

[TeunRoefs]

@barrypitman That was also my solution for the time being, however the EPEL does not contain easy-rsa 2.0 anymore. I was lucky enough to retrieve it from another server. See my attachment for all the files in the easy-rsa 2.0 folder.

easy-rsa.zip

[jameskirsop]

I've got a branch over at my fork which has changes that fix CA certificate generation under easy-rsa 3.0 on CentOS7. It seems like I can't do a PR for this change though due to insufficient permissions.

I've got some other changes for the server template and client manifest, but I need to clean them up a little more before committing them.

[ElvenSpellmaker]

Hey @jameskirsop, I thought I'd have a brief look at the diff between yours and the master and I found this line here: https://github.com/voxpupuli/puppet-openvpn/compare/master...jameskirsop:easy-rsa-3.0?expand=1#diff-b386e10e7f4de7981ca1d52c90456a0dR257

Is it meant to have && && like that? Won't that break?

[jameskirsop]

Whoops, not at all! I must have done something between my last test and that commit. I've just committed a fix that corrects that typo. Good pickup!!

…

On Thu, Apr 5, 2018 at 9:52 PM, Jack Blower ***@***.***> wrote: Hey @jameskirsop <https://github.com/jameskirsop>, I thought I'd have a brief look at the diff between yours and the master and I found this line here: https://github.com/voxpupuli/puppet-openvpn/compare/master. ..jameskirsop:easy-rsa-3.0?expand=1#diff-b386e10e7f4de7981ca1d52c90456a 0dR257 Is it meant to have && && like that? Won't that break? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#216 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABp2S8Dzu-uLC0L0ienIDe_4uxs8B4clks5tlgV_gaJpZM4K3cvP> .

[jsnod]

Yep, this is broken in CentOS 6 now too.

[NoodlesNZ]

Have added #278 to address this

[Dan33l]

Since PR #292 is merged, this bug should be considered as closed.

Thank you @NoodlesNZ for the work proposed with PR #278 used as a basis.