Skip to content

Security improvement #2

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
damianorenfer wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Security improvement #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5b5912c
Security improvement, change password hash algorithm from MD5 to SHA-…
Mar 12, 2016
4638ab8
Update auth file password examples to SHA-256 hashes
Mar 12, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions openvpn/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,13 +15,13 @@ How do it
* Make client credentials list in file /etc/openvpn/auth. Each line contains login name and hash from password.
Example /etc/openvpn/auth
```
Client1 d577273ff885c3f84dadb8578bb41399
Client2 f5ac8127b3b6b85cdc13f237c6005d80
Smith 9954987819a9e85b2aae8c04803f6b26
Client1 948fe603f61dc036b5c596dc09fe3ce3f3d30dc90f024c85f3c82db2ccab679d
Client2 3f455143e75d1e7fd659dea57023496da3bd9f2f8908d1e2ac32641cd819d3e3
Smith 3f455143e75d1e7fd659dea57023496da3bd9f2f8908d1e2ac32641cd819d3e3
```
Use command below to easy append to file /etc/openvpn/auth
```shell
read -p "Login:" Login;read -p "Password:" Password;[ -n "$Login" ] && [ -n "$Password" ] && echo -e "$Login\t$(echo $Password|md5sum|cut -f 1 -d ' ')">>/etc/openvpn/auth
read -p "Login:" Login;read -p "Password:" Password;[ -n "$Login" ] && [ -n "$Password" ] && echo -e "$Login\t$(echo $Password|openssl dgst -sha256|cut -f 2 -d ' ')">>/etc/openvpn/auth
```

* Change OpenVPN server configuration. You can use two method to pass credentials to script. First via file ad second via environment variable.
Expand Down
4 changes: 2 additions & 2 deletions openvpn/openvpn-auth.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ if [ "$script_type" == "user-pass-verify" ]; then
logger -p user.error -t $PNAME "$PEER Password isn't set"
exit 1
fi
local hashinput=$(echo "$password" | md5sum | cut -d " " -f 1)
local hashinput=$(echo "$password" | openssl dgst -sha256 | cut -d " " -f 2)
if [ "$hashinput" == "" ]; then
logger -p user.error -t $PNAME "$PEER Hash from password isn't set"
exit 1
Expand All @@ -71,4 +71,4 @@ elif [ "$script_type" != "" ]; then
else
exit 1
fi
# Done
# Done