From 5b5912cbbd42f8a54503dfb90da4dcd2e3bcbc68 Mon Sep 17 00:00:00 2001
From: Damiano Renfer <damiano.renfer@gmail.com>
Date: Sat, 12 Mar 2016 20:27:54 +0100
Subject: [PATCH 1/2] Security improvement, change password hash algorithm from
 MD5 to SHA-256 using OpenSSL

---
 openvpn/README.md       | 2 +-
 openvpn/openvpn-auth.sh | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/openvpn/README.md b/openvpn/README.md
index 9c1c42bc43..918799c562 100644
--- a/openvpn/README.md
+++ b/openvpn/README.md
@@ -21,7 +21,7 @@ Example /etc/openvpn/auth
 ```
 Use command below to easy append to file /etc/openvpn/auth
 ```shell
-read -p "Login:" Login;read -p "Password:" Password;[ -n "$Login" ] && [ -n "$Password" ] && echo -e "$Login\t$(echo $Password|md5sum|cut -f 1 -d ' ')">>/etc/openvpn/auth
+read -p "Login:" Login;read -p "Password:" Password;[ -n "$Login" ] && [ -n "$Password" ] && echo -e "$Login\t$(echo $Password|openssl dgst -sha256|cut -f 2 -d ' ')">>/etc/openvpn/auth
 ```
 
 * Change OpenVPN server configuration. You can use two method to pass credentials to script. First via file ad second via environment variable.
diff --git a/openvpn/openvpn-auth.sh b/openvpn/openvpn-auth.sh
index 330a059b86..05474d08be 100644
--- a/openvpn/openvpn-auth.sh
+++ b/openvpn/openvpn-auth.sh
@@ -48,7 +48,7 @@ if [ "$script_type" == "user-pass-verify" ]; then
 		logger -p user.error -t $PNAME "$PEER Password isn't set"
 		exit 1
 	fi
-	local hashinput=$(echo "$password" | md5sum | cut -d " " -f 1)
+	local hashinput=$(echo "$password" | openssl dgst -sha256 | cut -d " " -f 2)
 	if [ "$hashinput" == "" ]; then
 		logger -p user.error -t $PNAME "$PEER Hash from password isn't set"
 		exit 1
@@ -71,4 +71,4 @@ elif [ "$script_type" != "" ]; then
 else
 	exit 1
 fi
-# Done
\ No newline at end of file
+# Done

From 4638ab8672d80a176031ca48403a5a47f3e321c3 Mon Sep 17 00:00:00 2001
From: Damiano Renfer <damiano.renfer@gmail.com>
Date: Sat, 12 Mar 2016 20:32:05 +0100
Subject: [PATCH 2/2] Update auth file password examples to SHA-256 hashes

---
 openvpn/README.md | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/openvpn/README.md b/openvpn/README.md
index 918799c562..2314eb957f 100644
--- a/openvpn/README.md
+++ b/openvpn/README.md
@@ -15,9 +15,9 @@ How do it
 * Make client credentials list in file /etc/openvpn/auth. Each line contains login name and hash from password.
 Example /etc/openvpn/auth
 ```
-	Client1 d577273ff885c3f84dadb8578bb41399
-	Client2 f5ac8127b3b6b85cdc13f237c6005d80
-	Smith   9954987819a9e85b2aae8c04803f6b26
+	Client1 948fe603f61dc036b5c596dc09fe3ce3f3d30dc90f024c85f3c82db2ccab679d
+	Client2 3f455143e75d1e7fd659dea57023496da3bd9f2f8908d1e2ac32641cd819d3e3
+	Smith   3f455143e75d1e7fd659dea57023496da3bd9f2f8908d1e2ac32641cd819d3e3
 ```
 Use command below to easy append to file /etc/openvpn/auth
 ```shell