www.pudn.com > ejbca_3_5_3(1).zip > mk_openvpn_windows_installer.sh


#!/bin/bash

DIR=/usr/local/tmp/

# this script is used by EJBCA_3_1_3 to create OpenVPN windows
# installer programs using the nsis package for linux.
# Contributed by Jon Bendtsen.

# EJBCA expects this program to be at
# /usr/local/ejbca/openvpn/mk_openvpn_windows_installer.sh
# EJBCA leaves a PKCS12 file in /usr/local/tmp, and expects
# the openvpn windows installer program at the same location
# with a particular name
# /usr/local/tmp/openvpn-gui-install-$USERNAME.exe


# The user name, IssuerDN and SubjectDN are written from EJBCA
# to stdout which is connected to the stdin of this script.
read username
read IssuerDN
read SubjectDN


# This script can use the username, IssuerDN and/or SubjectDN
# to give the user a particular OpenVPN configuration file.
#
# username is unique - username is NOT the Common Name
# IssuerDN is the Distinguised Name of the CA's cert
# SubjectDN is the Distinguised Name of this user's cert
#
# username might look like "jens"
# IssuerDN might look like "CN=AdminCA1,O=Example,C=Com"
# SubjectDN might look like "CN=Jens Hansen,O=Example,OU=Sales,C=Com"
# you could use the O or OU from a DN to specify the needed
# openvpn configuration
#
# But _YOU_ are expected to make the needed changes to this script
# if you dont, you will just get the default called client.conf
# from /usr/local/ejbca/openvpn/default-client.ovpn
# if the file does not exist, the openvpn-gui-install-$USERNAME.exe
# will not be made
cfg=default-client.ovpn
org=work
zipfile=openvpn_install_source-2.0.5-gui-1.0.3.zip
#openvpn_install_source-2.0.5-gui-1.0.3.zip
#openvpn_install_source-2.1beta7-gui-1.0.3.zip


move_files() {
# this function moves the configuration and certificate
# to the right place in the tree in $DIR/$username
#
# this function also changes the configuration file
# to use this users certificate, and to the name of
# the organisation which is usually extracted from
# the SubjectDN, if no organisation is extracted
# the default named work is used.
#
# before that the tree under $DIR/$username is
# extracted from a zipfile. The zipfile is either the
# default openvpn_install_source-2.0.5-gui-1.0.3.zip
# or extracted from the username, IssuerDN and/or SubjectDN
# this lets you run with different OpenVPN versions.
olddir=$PWD
cd $DIR/$username
unzip -q /usr/local/ejbca/openvpn/$zipfile

# now we move the certificate to the right location
# EJBCA saves the certificate as $username.p12
mv ../$username.p12 openvpn/config/

# now we take the configuration file, and make it use
# the certificate of this particular user
cat /usr/local/ejbca/openvpn/$cfg | sed -e "s/_-USER-_/$username/g"\
> openvpn/config/$org.ovpn

cd $olddir
}

run_nsis() {
# now that the PKCS12 certificate and the configuration file
# is in place, we call the nsis program to actually make the
# /usr/local/tmp/openvpn-gui-install-$USERNAME.exe

olddir=$PWD
cd $DIR/$username

# first we make changes to the nsis configuration file to
# include the configuration and certificate during install
# and when the program is removed
cat openvpn-gui.nsi | sed -e "s/_-USER-_/$username/g" | \
sed -e "s/_-ORGANISATION-_/$org/g" > $username.nsi

# now we run makensis to create the openvpn windows installer
makensis $username.nsi >> /dev/null

# move the openvpn windows installer to /usr/local/tmp
mv *.exe /usr/local/tmp/openvpn-gui-install-$username.exe

cd $olddir
}


# so we have a place to store our files while we make the nsis
# openvpn windows installer program
mkdir -p $DIR/$username

# First we run a check for the setup for this IssuerDN
# Second we run a check for the setup for this SubjectDN without this user's CN
# Third we run a check for the setup for this username

case "$IssuerDN" in
CN=AdminCA1,O=Example,C=com)
cfg=employee-client.conf
org=work
zipfile=openvpn_install_source-2.1beta7-gui-1.0.3.zip
;;
"CN=PartnerCA1,O=Partners of Example,C=Example")
cfg=partner-vpn-client.conf
org=example
zipfile=openvpn_install_source-2.1beta7-gui-1.0.3.zip
;;
# *)
# # * means the default
# cfg="default-client.conf"
# ;;
esac

# since the SubjectDN includes the users Common Name you will most
# likely have to extract the O (Organisation) and/or OU (Organisational
# Unit) from the SubjectDN
newSubjectDN=$(echo "$SubjectDN" | cut -d"," -f2-)

case "$newSubjectDN" in
O=Example,OU=Sales,C=Com)
cfg="Example.Sales.com-client.conf"
org=ExampleSales
;;
# *)
# # * means the default
# cfg="default-client.conf"
# ;;
esac

# uncomment if you need to check for special users
# you can also let the OpenVPN server give some users a special
# configuration for some things, but stuff like the address
# of the openvpn server can not be set from the server, only
# in the configuration file on the client.
#case "$username" in
# john)
# cfg=john-special-openvpn.conf
# ;;
#
# *)
# # * means the default
# cfg="default-client.conf"
# ;;
#esac

move_files
run_nsis

# cleanup time
rm -rf /usr/local/tmp/$username
rm -rf /usr/local/tmp/$username.p12
rmdir $DIR/$username