Merge lp:~markthomas/serverguide/serverguide-review-22.1 into lp:~ubuntu-core-doc/serverguide/saucy

[Mark Thomas]

This is an update to the OpenVPN page for the Ubuntu Server Guide, Saucy ed.

Minor enhancements to the Windows section:
- two installers are no longer necessary
- if not using user authentication, some of the options caused problems. This has been clarified.

Minor enhancements to server section:
- PAM module name and location have been updated.
- easy-rsa is now a separate package

Minor enhancements to client section:
- The key/cert file names produced with the easy-rsa script in the example did not match those in the template config file used. This has been clarified.

Tunnelblick section has not been tested--I do not have the means to test this.

All instances of /etc/init.d/networking restart have been replaces with "restart networking"
All instances of /etc/init.d/openvpn restart have been replaced with "service openvpn restart"

[Peter Matulis (petermatulis)]

So no upstart for openvpn yet?

[Peter Matulis (petermatulis)]

"- PAM module name and location have been updated."

I don't see any reference to PAM in your edit.

[Doug Smythies (dsmythies)]

I do not understand these comments:

"All instances of /etc/init.d/networking restart have been replaces with "restart networking"
All instances of /etc/init.d/openvpn restart have been replaced with "service openvpn restart""

With respect to the actual differences listed.

For the differences line 70 and 71, isn't the actual problem the typo where "network" should be "networking". Using "sudo service networking restart" would be consistent with the rest of the serverguide, that has just been changed over the last few revisions to consistently use "sudo service bla bla" throughout.

[Mark Thomas (markthomas)]

> So no upstart for openvpn yet?

Nothing in /etc/init.

[Mark Thomas (markthomas)]

> "- PAM module name and location have been updated."
>
> I don't see any reference to PAM in your edit.

Yes, it looks like that somehow wasn't saved/was reverted. I'll update with the new library path. Not sure how that happened.

[Mark Thomas (markthomas)]

> For the differences line 70 and 71, isn't the actual problem the typo where
> "network" should be "networking". Using "sudo service networking restart"
> would be consistent with the rest of the serverguide, that has just been
> changed over the last few revisions to consistently use "sudo service bla bla"
> throughout.

If that will be more consistent, I will implement that change.

[lp:~markthomas/serverguide/serverguide-review-22.1]

151. By Mark Thomas <markthomas@ubuntu> on 2013-07-10

Reviewing sub-chapter 22.1, round 2

[Peter Matulis (petermatulis)]

All good. Thanks for helping.

review: Approve

=== modified file 'serverguide/C/vpn.xml'
--- serverguide/C/vpn.xml	2013-04-26 03:32:19 +0000
+++ serverguide/C/vpn.xml	2013-07-10 16:39:26 +0000
@@ -32,7 +32,7 @@
       To install <application>openvpn</application> in a terminal enter:
       </para>
 <screen>
-<command>sudo apt-get install openvpn</command>
+<command>sudo apt-get install openvpn easy-rsa</command>
 </screen>
 
     </sect2>
@@ -72,7 +72,7 @@
 
 <screen>
 <command>mkdir /etc/openvpn/easy-rsa/</command>
-<command>cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/</command>
+<command>cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/</command>
 </screen>
 
         <para>
@@ -85,6 +85,10 @@
 export KEY_CITY="Winston-Salem"
 export KEY_ORG="Example Company"
 export KEY_EMAIL="[e-mail]"
+export KEY_CN=MyVPN
+export KEY_NAME=MyVPN
+export KEY_OU=MyVPN
+
 </programlisting>
 
         <para>
@@ -259,6 +263,14 @@
 </programlisting>
 
         <para>
+Also, make sure you specify the key file names you copied from the server
+        </para>
+<programlisting>
+ca ca.crt
+cert client1.crt
+key client1.key
+</programlisting>
+        <para>
 Now start the OpenVPN client:
         </para>
 
@@ -320,6 +332,9 @@
 Check your syslog, e.g. grep -i vpn /var/log/syslog
           </para></listitem>
           <listitem><para>
+Check that you have specified the keyfile names correctly in client.conf and server.conf.
+          </para></listitem>
+          <listitem><para>
 Can the client connect to the server machine? Maybe a firewall is blocking access? Check syslog on server.
           </para></listitem>
           <listitem><para>
@@ -333,7 +348,6 @@
           </para></listitem>
         </itemizedlist>
 
-
 </sect2>
       <sect2 id="openvpn-advanced-config" status="review">
         <title>Advanced configuration</title>
@@ -457,7 +471,7 @@
 Useful if you have centralized authentication with e.g. Kerberos.
 </para>
 <programlisting>
-plugin /usr/lib/openvpn/openvpn-auth-pam.so login
+plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
 </programlisting>
 
 <note> <para>
@@ -526,7 +540,7 @@
 At this point you need to restart networking. Be prepared that this might not work as expected and that you will lose remote connectivity. Make sure you can solve problems having local access.
         </para>
 <screen>
-<command>sudo service network restart</command>
+<command>sudo service networking restart</command>
 </screen>
 
 </sect4>
@@ -605,6 +619,9 @@
 <programlisting>
 dev tap
 ;dev tun
+ca ca.crt
+cert client1.crt
+key client1.key
 </programlisting>
 
         <para>
@@ -667,7 +684,7 @@
 add the OpenVPN's server
 name as the 'Gateway', set 'Type' to 'Certificates (TLS)', point 'User Certificate'
 to your user certificate, 'CA Certificate' to your CA certificate and 'Private Key'
-to your private key file. Use the advanced button to enable compression or other
+to your private key file. Use the advanced button to enable compression (e.g. comp-lzo), dev tap, or other
 special settings you set on the server. Now try to establish your VPN.
     </para>
 
@@ -706,9 +723,8 @@
       <title>OpenVPN with GUI for Win 7</title>
 
     <para>
-First download and install the latest <ulink url="http://www.openvpn.net/index.php/open-source/downloads.html">OpenVPN Windows Installer</ulink>. OpenVPN 2.2.1 was the latest when this was written.
-Additionally download an alternative Open VPN Windows GUI. The OpenVPN MI GUI from <ulink url="http://openvpn-mi-gui.inside-security.de">http://openvpn-mi-gui.inside-security.de</ulink> seems to be a nice one for Windows 7.
-Download the latest version. 20110624 was the latest version when this was written.
+First download and install the latest <ulink url="http://www.openvpn.net/index.php/open-source/downloads.html">OpenVPN Windows Installer</ulink>. OpenVPN 2.3.2 was the latest when this was written.
+As of this writing, the management GUI is included with the Windows binary installer.
     </para>
 
     <para>
@@ -740,7 +756,21 @@
 management-hold
 management-query-passwords
 auth-retry interact
-</programlisting>
+; Set the name of the Windows TAP network interface device here
+dev-node MyTAP
+
+</programlisting>
+<para>
+Note: If you are not using user authentication and/or you want to run the service without user interaction, comment out the following options:
+</para>
+<programlisting>
+auth-user-pass
+auth-retry interact
+management 127.0.0.1 1194
+management-hold
+management-query-passwords
+</programlisting>
+<para>You may want to set the Windows service to "automatic".</para>
 
 </sect3>
     <sect3 id="openvpn-client-openwrt" status="review">