OpenVPN Puppet module

Puppet module to manage OpenVPN servers and clients.

Features

• Client-specific rules and access policies
• Generated client configurations and SSL-Certificates
• Downloadable client configurations and SSL-Certificates for easy client configuration
• Support for multiple server instances
• Support for LDAP-Authentication
• Support for server instance in client mode
• Support for TLS

Supported OS

• Ubuntu
• Debian
• CentOS
• RedHat
• Solaris

Dependencies

• puppetlabs-concat 3.0.0+
• puppetlabs-stdlib 4.25.0+

Puppet

The supported Puppet versions are listed in the metadata.json

REFERENCES

Please see REFERENCE.md for more details.

Example with hiera

---
classes:
  - openvpn

openvpn::servers:
  'winterthur':
    country: 'CH'
    province: 'ZH'
    city: 'Winterthur'
    organization: 'example.org'
    email: 'root@example.org'
    server: '10.200.200.0 255.255.255.0'

openvpn::client_defaults:
  server: 'winterthur'

openvpn::clients:
  'client1': {}
  'client2': {}
  'client3': {}

openvpn::client_specific_configs:
  'client1':
    server: 'winterthur'
    ifconfig: '10.200.200.50 10.200.200.51'

openvpn::revokes:
  'client3':
    server: 'winterthur'

Don't forget the sysctl directive net.ipv4.ip_forward!

Encryption Choices

This module provides certain default parameters for the openvpn encryption settings.

These settings have been applied in line with current "best practices" but no guarantee is given for their saftey and they could change in future.

You should double check these settings yourself to make sure they are suitable for your needs and in line with current best practices.

Example for automating client deployment to nodes managed by Puppet

Exporting the configurations for a client in the VPN server manifest:

  openvpn::deploy::export { 'client1':
    server => 'winterthur',
  }

Installation, configuration and starting the OpenVPN client in a configured node manifest:

  openvpn::deploy::client { 'client1':
    server => 'winterthur',
  }

Experimenting and developing in Vagrant

This project includes a Vagrantfile which allows you to easily develop this module or try it out. The prerequisites are Vagrant and VirtualBox.

To bring up the OpenVPN server VM:

vagrant up server_ubuntu

To bring up the OpenVPN client VM:

vagrant up client_ubuntu

Client's OpenVPN configuration is generated on the server, but it needs to be deployed to the client manually as exported resources are not available in Vagrant. To get the client config from server:

vagrant ssh server_ubuntu
sudo -i
cp /etc/openvpn/winterthur/download-configs/client1.ovpn /vagrant/
exit

To copy it to the client:

vagrant ssh client_ubuntu
sudo -i
mv /vagrant/client1.ovpn /etc/openvpn/client/client1.conf

To connect directly with OpenVPN:

openvpn --config /etc/openvpn/client/client1.conf

To connect with systemd:

systemctl start openvpn-client@client1

To test connectivity between client and server:

ping 10.200.200.1

References

• The readme file of github.com/Angristan/OpenVPN-install outlines some of reasoning behind such choices.

• The OpenVPN documentation about the SWEET32 attack gives some reasons and recommendations for which ciphers to use.

• The OpenVPN hardening documentation also gives further examples

ssl_key_size

The default key size is now set to 2048 bits. This setting also affects the size of the dhparam file.

Why

2048 bits is OK, but both NSA and ANSSI recommend at least a 3072 bits for a future-proof key. As the size of the key will have an impact on speed, I leave the choice to use 2048, 3072 or 4096 bits RSA key. 4096 bits is what's most used and recommened today, but 3072 bits is still good.

Cipher

The default data channel cipher is now set to AES-256-GCM

Why

OpenVPN was setting its default value to BF-CBC. In newer versions of OpenVPN it warns that this is no longer a secure cipher. The OpenVPN documentation recommends using this setting.

tls_cipher

The default tls_cipher option is now set to: TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256

Why

Details of these ciphers and their uses can be found in the documentation links above.

Contributions

This module is maintained by Vox Pupuli. Voxpupuli welcomes new contributions to this module, especially those that include documentation and rspec tests. We are happy to provide guidance if necessary.

Please see CONTRIBUTING for more details.

Authors

• Raffael Schmid raffael@yux.ch
• Vox Pupuli Team
• List of contributors https://github.com/voxpupuli/puppet-openvpn/graphs/contributors

Reference

Table of Contents

Classes

• openvpn: This module installs the openvpn service, configures vpn endpoints, generates client certificates, and generates client config files
• openvpn::config: This class sets up the openvpn enviornment as well as the default config file
• openvpn::install: This module installs the openvpn service, configures vpn endpoints, generates client certificates, and generates client config files
• openvpn::service: This class maintains the openvpn service.

Defined types

• openvpn::ca: This define creates the openvpn ca and ssl certificates
• openvpn::client: This define creates client certs for a specified server as well as a tarball that can be directly imported into clients
• openvpn::client_specific_config: This feature is explained here: http://openvpn.net/index.php/open-source/documentation/howto.html#policy All the parameters are explained in
• openvpn::revoke: This define creates a revocation on a certificate for a specified server.
• openvpn::server: This define creates the openvpn server instance which can run in server or client mode.

Classes

openvpn

This module installs the openvpn service, configures vpn endpoints, generates client certificates, and generates client config files

Examples

class { 'openvpn':
  autostart_all => true,
}

Parameters

The following parameters are available in the openvpn class:

• autostart_all
• manage_service
• etc_directory
• group
• link_openssl_cnf
• pam_module_path
• namespecific_rclink
• default_easyrsa_ver
• easyrsa_source
• additional_packages
• ldap_auth_plugin_location
• client_defaults
• clients
• client_specific_config_defaults
• client_specific_configs
• revoke_defaults
• revokes
• server_defaults
• servers
• server_directory
• server_service_name

autostart_all

Data type: Boolean

Whether openvpn instances should be started automatically on boot.

manage_service

Data type: Boolean

Whether the openvpn service should be managed by puppet.

etc_directory

Data type: Stdlib::Absolutepath

Path of the configuration directory.

group

Data type: String[1]

File group of the generated config files.

link_openssl_cnf

Data type: Boolean

Link easy-rsa/openssl.cnf to easy-rsa/openssl-1.0.0.cnf

pam_module_path

Data type: Optional[Stdlib::Absolutepath]

Path to openvpn-auth-pam.so

namespecific_rclink

Data type: Boolean

Enable namespecific rclink's (BSD-style)

default_easyrsa_ver

Data type: Pattern[/^[23]\.0$/]

Expected version of easyrsa.

easyrsa_source

Data type: Stdlib::Unixpath

Location of easyrsa.

additional_packages

Data type: Variant[String[1], Array[String[1]]]

Additional packages

ldap_auth_plugin_location

Data type: Optional[Stdlib::Absolutepath]

Path to the ldap auth pam module

client_defaults

Data type: Hash

Hash of defaults for clients passed to openvpn::client defined type.

Default value: {}

clients

Data type: Hash

Hash of clients passed to openvpn::client defined type.

Default value: {}

client_specific_config_defaults

Data type: Hash

Hash of defaults for client specific configurations passed to openvpn::client_specific_config defined type.

Default value: {}

client_specific_configs

Data type: Hash

Hash of client specific configurations passed to openvpn::client_specific_config defined type.

Default value: {}

revoke_defaults

Data type: Hash

Hash of defaults for revokes passed to openvpn::revoke defined type.

Default value: {}

revokes

Data type: Hash

Hash of revokes passed to openvpn::revoke defined type.

Default value: {}

server_defaults

Data type: Hash

Hash of defaults for servers passed to openvpn::server defined type.

Default value: {}

servers

Data type: Hash

Hash of servers passed to openvpn::server defined type.

Default value: {}

server_directory

Data type: Optional[Stdlib::Absolutepath]

Path of the server configuration. This is usually /etc_directory/openvpn, but RHEL/CentOS 8 uses /etc_directory/openvpn/server

server_service_name

Data type: String[1]

Name of the openvpn server service. This is usually openvpn, but RHEL/CentOS 8 uses openvpn-server.

openvpn::config

This class sets up the openvpn enviornment as well as the default config file

openvpn::install

This module installs the openvpn service, configures vpn endpoints, generates client certificates, and generates client config files

openvpn::service

This class maintains the openvpn service.

Defined types

openvpn::ca

This define creates the openvpn ca and ssl certificates

Examples

openvpn::ca {
  'my_user':
    server      => 'contractors',
    remote_host => 'vpn.mycompany.com'
 }

Parameters

The following parameters are available in the openvpn::ca defined type:

• dn_mode
• country
• province
• city
• organization
• email
• common_name
• group
• ssl_key_algo
• ssl_key_size
• ssl_key_curve
• key_expire
• ca_expire
• digest
• key_name
• key_ou
• key_cn
• tls_auth
• tls_static_key
• crl_days

dn_mode

Data type: Enum['org','cn_only']

EasyRSA X509 DN mode.

Default value: 'org'

country

Data type: Optional[String]

Country to be used for the SSL certificate

Default value: undef

province

Data type: Optional[String]

Province to be used for the SSL certificate

Default value: undef

city

Data type: Optional[String]

City to be used for the SSL certificate

Default value: undef

organization

Data type: Optional[String]

Organization to be used for the SSL certificate

Default value: undef

email

Data type: Optional[String]

Email address to be used for the SSL certificate

Default value: undef

common_name

Data type: String

Common name to be used for the SSL certificate

Default value: 'server'

group

Data type: Optional[String]

User to drop privileges to after startup

Default value: undef

ssl_key_algo

Data type: Enum['rsa', 'ec', 'ed']

SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys

Default value: 'rsa'

ssl_key_size

Data type: Integer

Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa

Default value: 2048

ssl_key_curve

Data type: String

Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed

Default value: 'secp384r1'

key_expire

Data type: Integer

The number of days to certify the server certificate for

Default value: 3650

ca_expire

Data type: Integer

The number of days to certify the CA certificate for

Default value: 3650

digest

Data type: Enum['md5','sha1','sha256','sha224','sha384','sha512']

Cryptographic digest to use

Default value: 'sha512'

key_name

Data type: Optional[String]

Value for name_default variable in openssl.cnf and KEY_NAME in vars

Default value: undef

key_ou

Data type: Optional[String]

Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars

Default value: undef

key_cn

Data type: Optional[String]

Value for commonName_default variable in openssl.cnf and KEY_CN in vars

Default value: undef

tls_auth

Data type: Boolean

Determins if a tls key is generated

Default value: false

tls_static_key

Data type: Boolean

Determins if a tls key is generated

Default value: false

crl_days

Data type: Integer

Default value: 30

openvpn::client

This define creates client certs for a specified server as well as a tarball that can be directly imported into clients

Examples

openvpn::client {
  'my_user':
    server      => 'contractors',
    remote_host => 'vpn.mycompany.com'
 }

Parameters

The following parameters are available in the openvpn::client defined type:

• server
• compression
• dev
• mute
• mute_replay_warnings
• nobind
• persist_key
• persist_tun
• port
• proto
• remote_host
• cipher
• tls_cipher
• resolv_retry
• auth_retry
• verb
• pam
• authuserpass
• tls_auth
• tls_crypt
• x509_name
• setenv
• setenv_safe
• up
• down
• sndbuf
• rcvbuf
• shared_ca
• custom_options
• expire
• readme
• pull
• server_extca_enabled
• remote_cert_tls

server

Data type: String

Name of the corresponding openvpn endpoint

compression

Data type: Optional[String[1]]

Which compression algorithm to use. This parameter is deprecated in OpenVPN 2.5.

Default value: undef

dev

Data type: Enum['tap', 'tun']

Device method

Default value: 'tun'

mute

Data type: Integer

Set log mute level

Default value: 20

mute_replay_warnings

Data type: Boolean

Silence duplicate packet warnings (common on wireless networks)

Default value: true

nobind

Data type: Boolean

Whether or not to bind to a specific port number

Default value: true

persist_key

Data type: Boolean

Try to retain access to resources that may be unavailable because of privilege downgrades

Default value: true

persist_tun

Data type: Boolean

Try to retain access to resources that may be unavailable because of privilege downgrades

Default value: true

port

Data type: String

The port the openvpn server service is running on

Default value: '1194'

proto

Data type: Enum['tcp','udp']

What IP protocol is being used.

Default value: 'tcp'

remote_host

Data type: Variant[String, Array[String]]

The IP or hostname of the openvpn server service.

Default value: $facts['networking']['fqdn']

cipher

Data type: String

Cipher to use for packet encryption

Default value: 'AES-256-GCM'

tls_cipher

Data type: String

TLS Ciphers to use

Default value: 'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256'

resolv_retry

Data type: String

How many seconds should the openvpn client try to resolve the server's hostname

Default value: 'infinite'

auth_retry

Data type: Enum['none', 'nointeract', 'interact']

Controls how OpenVPN responds to username/password verification errors such as the client-side response to an AUTH_FAILED message from the server or verification failure of the private key password.

Default value: 'none'

verb

Data type: String

Level of logging verbosity

Default value: '3'

pam

Data type: Boolean

DEPRECATED: Boolean, Enable/Disable.

Default value: false

authuserpass

Data type: Boolean

Set if username and password required

Default value: false

tls_auth

Data type: Boolean

Activates tls-auth to Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks. This has to be set to the same value as on the Server

Default value: false

tls_crypt

Data type: Boolean

Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)

Default value: false

x509_name

Data type: Optional[String]

Common name of openvpn server to make an x509-name verification

Default value: undef

setenv

Data type: Hash

Set a custom environmental variable name=value to pass to script.

Default value: {}

setenv_safe

Data type: Hash

Set a custom environmental variable OPENVPNname=value to pass to script. This directive is designed to be pushed by the server to clients, and the prepending of "OPENVPN" to the environmental variable is a safety precaution to prevent a LD_PRELOAD style attack from a malicious or compromised server.

Default value: {}

up

Data type: Optional[String[1]]

Script which we want to run when openvpn client is connecting

Default value: undef

down

Data type: Optional[String[1]]

Script which we want to run when openvpn client is disconneting

Default value: undef

sndbuf

Data type: Optional[Integer]

Set the TCP/UDP socket send buffer size.

Default value: undef

rcvbuf

Data type: Optional[Integer]

Set the TCP/UDP socket receive buffer size.

Default value: undef

shared_ca

Data type: Optional[String]

The name of an openssl::ca resource to use.

Default value: undef

custom_options

Data type: Hash

Hash of additional options that you want to append to the configuration file.

Default value: {}

expire

Data type: Optional[Integer]

Set a custom expiry time to pass to script. Value is the number of days the certificate is valid for.

Default value: undef

readme

Data type: Optional[String]

Text to place in a README file which is included in download-configs archive.

Default value: undef

pull

Data type: Boolean

Allow server to push options like dns or routes

Default value: false

server_extca_enabled

Data type: Boolean

Turn this on if you are using an external CA solution, like FreeIPA. Use this in Combination with exported_ressourced, since they don't have Access to the Serverconfig

Default value: false

remote_cert_tls

Data type: Boolean

Enable or disable use of remote-cert-tls used with client configuration

Default value: true

openvpn::client_specific_config

This feature is explained here: http://openvpn.net/index.php/open-source/documentation/howto.html#policy All the parameters are explained in the openvpn documentation http://openvpn.net/index.php/open-source/documentation/howto.html#policy

Examples

openvpn::client_specific_config {
  'vpn_client':
    server       => 'contractors',
    iroute       => ['10.0.1.0 255.255.255.0'],
    ifconfig     => '10.10.10.1 10.10.10.2',
    dhcp_options => ['DNS 8.8.8.8']
 }

Parameters

The following parameters are available in the openvpn::client_specific_config defined type:

• server
• iroute
• iroute_ipv6
• route
• ifconfig
• ifconfig_ipv6
• dhcp_options
• redirect_gateway
• custom_options
• ensure
• manage_client_configs

server

Data type: String[1]

Name of the corresponding openvpn endpoint

iroute

Data type: Array[String[1]]

Array of iroute combinations.

Default value: []

iroute_ipv6

Data type: Array[String[1]]

Array of IPv6 iroute combinations.

Default value: []

route

Data type: Array[String[1]]

Array of route combinations pushed to client.

Default value: []

ifconfig

Data type: Optional[String[1]]

IP configuration to push to the client.

Default value: undef

ifconfig_ipv6

Data type: Optional[String[1]]

IPv6 configuration to push to the client.

Default value: undef

dhcp_options

Data type: Array[String[1]]

DHCP options to push to the client.

Default value: []

redirect_gateway

Data type: Boolean

Redirect all traffic to gateway

Default value: false

custom_options

Data type: Hash

Hash of additional options to append to the configuration file.

Default value: {}

ensure

Data type: Enum['present', 'absent']

Sets the client specific configuration file status (present or absent)

Default value: present

manage_client_configs

Data type: Boolean

Manage dependencies on Openvpn::Client ressources

Default value: true

openvpn::revoke

This define creates a revocation on a certificate for a specified server.

Examples

openvpn::client {
  'my_user':
    server      => 'contractors'
}

openvpn::revoke {
  'my_user':
    server      => 'contractors'
 }

Parameters

The following parameters are available in the openvpn::revoke defined type:

• server

server

Data type: String

Name of the corresponding openvpn endpoint

openvpn::server

This define creates the openvpn server instance which can run in server or client mode.

Examples

install

openvpn::server { 'winterthur':
    country      => 'CH',
    province     => 'ZH',
    city         => 'Winterthur',
    organization => 'example.org',
    email        => 'root@example.org',
    server       => '10.200.200.0 255.255.255.0',
}

a server in client mode

file {
  '/etc/openvpn/zurich/keys/ca.crt':
    source => 'puppet:///path/to/ca.crt';
  '/etc/openvpn/zurich/keys/zurich.crt':
    source => 'puppet:///path/to/zurich.crt';
  '/etc/openvpn/zurich/keys/zurich.key':
    source => 'puppet:///path/to/zurich.key';
}
openvpn::server { 'zurich':
  remote  => [ 'mgmtnet3.nine.ch 1197', 'mgmtnet2.nine.ch 1197' ],
  require => [ File['/etc/openvpn/zurich/keys/ca.crt'],
               File['/etc/openvpn/zurich/keys/zurich.crt'],
               File['/etc/openvpn/zurich/keys/zurich.key'] ];
}

Parameters

The following parameters are available in the openvpn::server defined type:

• dn_mode
• country
• province
• city
• organization
• email
• remote
• remote_random_hostname
• remote_random
• common_name
• compression
• dev
• user
• group
• ipp
• duplicate_cn
• local
• logfile
• manage_logfile_directory
• logdirectory_user
• logdirectory_group
• port
• portshare
• proto
• status_log
• status_version
• server
• server_ipv6
• server_bridge
• push
• route
• route_ipv6
• keepalive
• ssl_key_algo
• ssl_key_size
• ssl_key_curve
• ecdh_curve
• topology
• c2c
• tcp_nodelay
• ccd_exclusive
• pam
• pam_module_arguments
• management
• management_ip
• management_port
• up
• down
• client_connect
• client_disconnect
• username_as_common_name
• client_cert_not_required
• ldap_enabled
• ldap_server
• ldap_binddn
• ldap_bindpass
• ldap_u_basedn
• ldap_u_filter
• ldap_g_basedn
• ldap_gmember
• ldap_g_filter
• ldap_memberatr
• ldap_tls_enable
• ldap_tls_ca_cert_file
• ldap_tls_ca_cert_dir
• ldap_tls_client_cert_file
• ldap_tls_client_key_file
• verb
• cipher
• tls_cipher
• persist_key
• persist_tun
• key_expire
• crl_days
• digest
• ca_expire
• key_name
• key_ou
• key_cn
• tls_auth
• tls_crypt
• tls_server
• tls_client
• server_poll_timeout
• ping_timer_rem
• sndbuf
• rcvbuf
• shared_ca
• crl_verify
• crl_auto_renew
• crl_renew_schedule_period
• crl_renew_schedule_repeat
• extca_enabled
• extca_ca_cert_file
• extca_ca_crl_file
• extca_server_cert_file
• extca_server_key_file
• extca_dh_file
• extca_tls_auth_key_file
• autostart
• remote_cert_tls
• nobind
• secret
• scripts
• custom_options
• fragment

dn_mode

Data type: Enum['org','cn_only']

EasyRSA X509 DN mode.

Default value: 'org'

country

Data type: Optional[String[1]]

Country to be used for the SSL certificate, mandatory for server mode.

Default value: undef

province

Data type: Optional[String[1]]

Province to be used for the SSL certificate, mandatory for server mode.

Default value: undef

city

Data type: Optional[String[1]]

City to be used for the SSL certificate, mandatory for server mode.

Default value: undef

organization

Data type: Optional[String[1]]

Organization to be used for the SSL certificate, mandatory for server mode.

Default value: undef

email

Data type: Optional[String[1]]

Email address to be used for the SSL certificate, mandatory for server mode.

Default value: undef

remote

Data type: Optional[Array]

List of OpenVPN endpoints to connect to.

Default value: undef

remote_random_hostname

Data type: Boolean

OpenVPN will prepend a random string (6 bytes, 12 hex characters) to hostname to prevent DNS caching. For example, "foo.example.com" would be modified to ".foo.example.com".

Default value: false

remote_random

Data type: Boolean

When multiple ${remote} address/ports are specified, initially randomize the order of the list as a kind of basic load-balancing measure.

Default value: false

common_name

Data type: String

Common name to be used for the SSL certificate

Default value: 'server'

compression

Data type: Optional[String[1]]

Which compression algorithm to use. This parameter is deprecated in OpenVPN 2.5.

Default value: undef

dev

Data type: String

TUN/TAP virtual network device

Default value: 'tun0'

user

Data type: String

Group to drop privileges to after startup

Default value: 'nobody'

group

Data type: Optional[String]

User to drop privileges to after startup

Default value: undef

ipp

Data type: Boolean

Persist ifconfig information to a file to retain client IP addresses between sessions

Default value: false

duplicate_cn

Data type: Boolean

Allow multiple connections on one cn

Default value: false

local

Data type: String

Interface for openvpn to bind to.

Default value: $facts['networking']['ip']

logfile

Data type: Variant[Boolean, String]

Logfile for this openvpn server

Default value: false

manage_logfile_directory

Data type: Boolean

Manage the directory that the logfile is located in

Default value: false

logdirectory_user

Data type: String[1]

The owner user of the logfile directory

Default value: 'nobody'

logdirectory_group

Data type: String[1]

The owner group of the logfile directory

Default value: 'nobody'

port

Data type: String

The port the openvpn server service is running on#

Default value: '1194'

portshare

Data type: Optional[String]

The address and port to which non openvpn request shall be forwared, e.g. 127.0.0.1 8443

Default value: undef

proto

Data type: Enum['tcp', 'tcp4', 'tcp6', 'udp', 'udp4', 'udp6']

What IP protocol is being used.

Default value: 'tcp'

status_log

Data type: String

Logfile for periodic dumps of the vpn service status

Default value: "/var/log/openvpn/${name}-status.log"

status_version

Data type: Enum['1', '2', '3', '']

Choose the status file format version number.

Default value: ''

server

Data type: Optional[String[1]]

Network to assign client addresses out of. Required in tun mode, not in tap mode

Default value: undef

server_ipv6

Data type: Optional[String[1]]

IPv6 network to assign client addresses out of

Default value: undef

server_bridge

Data type: Optional[String[1]]

Server configuration to comply with existing DHCP server

Default value: undef

push

Data type: Array

Options to push out to the client. This can include routes, DNS servers, DNS search domains, and many other options.

Default value: []

route

Data type: Array

Add route to routing table after connection is established. Multiple routes can be specified.

Default value: []

route_ipv6

Data type: Array

Add IPv6 route to routing table after connection is established. Multiple routes can be specified.

Default value: []

keepalive

Data type: Optional[String[1]]

Add keepalive directive (ping and ping-restart) to server. Should match the form "n m".

Default value: undef

ssl_key_algo

Data type: Enum['rsa', 'ec', 'ed']

SSL Key Algo. ec can enable elliptic curve support. ed uses ed25519 keys

Default value: 'rsa'

ssl_key_size

Data type: Integer

Length of SSL keys (in bits) generated by this module, used if ssl_key_algo is rsa

Default value: 2048

ssl_key_curve

Data type: String

Define the named curve for the ssl keys, used if ssl_key_algo is ec, ed

Default value: 'secp384r1'

ecdh_curve

Data type: Optional[String[1]]

Define the named curve for ECDH key exchange, used if ssl_key_algo is ec, ed

Default value: undef

topology

Data type: String

Define the network topology type

Default value: 'net30'

c2c

Data type: Boolean

Enable client to client visibility

Default value: false

tcp_nodelay

Data type: Boolean

Enable/Disable.

Default value: false

ccd_exclusive

Data type: Boolean

Enable/Disable.

Default value: false

pam

Data type: Boolean

Enable/Disable.

Default value: false

pam_module_arguments

Data type: String

Arguments to pass to the PAM module. For FreeIPA, set this to "openvpn login USERNAME password PASSWORD" and create HBAC Service "openvpn".

Default value: 'login'

management

Data type: Boolean

Enable management interface

Default value: false

management_ip

Data type: String

IP address where the management interface will listen

Default value: 'localhost'

management_port

Data type: Variant[Stdlib::Port::Unprivileged,Enum['unix']]

Port where the management interface will listen

Default value: 7505

up

Data type: Optional[String[1]]

Script which we want to run when openvpn server starts. If the path to the scirpt does not contain a slash, it will be assumed to be in openvpn/${name}/scripts directory.

Default value: undef

down

Data type: Optional[String[1]]

Script which we want to run when openvpn server stops. If the path to the scirpt does not contain a slash, it will be assumed to be in openvpn/${name}/scripts directory.

Default value: undef

client_connect

Data type: Optional[String[1]]

Script which we want to run when a client connects. If the path to the scirpt does not contain a slash, it will be assumed to be in openvpn/${name}/scripts directory.

Default value: undef

client_disconnect

Data type: Optional[String[1]]

Script which we want to run when a client disconnects. If the path to the scirpt does not contain a slash, it will be assumed to be in openvpn/${name}/scripts directory.

Default value: undef

username_as_common_name

Data type: Boolean

If true then set username-as-common-name

Default value: false

client_cert_not_required

Data type: Boolean

If true then set client-cert-not-required

Default value: false

ldap_enabled

Data type: Boolean

If ldap is enabled, do stuff

Default value: false

ldap_server

Data type: Optional[String[1]]

URL of LDAP server. ie. ldap://URL:PORT

Default value: undef

ldap_binddn

Data type: Optional[String[1]]

LDAP DN to bind as#

Default value: undef

ldap_bindpass

Data type: Optional[String[1]]

LDAP password for ldapbinddn

Default value: undef

ldap_u_basedn

Data type: Optional[String[1]]

Place in the LDAP tree to look for users

Default value: undef

ldap_u_filter

Data type: Optional[String[1]]

User SearchFilter for LDAP accounts

Default value: undef

ldap_g_basedn

Data type: Optional[String[1]]

Place in the LDAP tree to look for groups

Default value: undef

ldap_gmember

Data type: Boolean

If defined use group block in ldap.conf

Default value: false

ldap_g_filter

Data type: Optional[String[1]]

Group SearchFilter for LDAP accounts

Default value: undef

ldap_memberatr

Data type: Optional[String[1]]

Attribute for MemberAttribute. Used with ldapfilter

Default value: undef

ldap_tls_enable

Data type: Boolean

Enable TLS for the LDAP authentication

Default value: false

ldap_tls_ca_cert_file

Data type: Optional[String[1]]

LDAP TLS authentication: path to the CA certificate.

Default value: undef

ldap_tls_ca_cert_dir

Data type: Optional[String[1]]

LDAP TLS authentication: path to the CA certificates.

Default value: undef

ldap_tls_client_cert_file

Data type: Optional[Stdlib::Absolutepath]

LDAP TLS authentication: path to the tls client certificate

Default value: undef

ldap_tls_client_key_file

Data type: Optional[Stdlib::Absolutepath]

LDAP TLS authentication: path to the tls client key

Default value: undef

verb

Data type: Optional[String]

Level of logging verbosity

Default value: undef

cipher

Data type: String

Cipher to use for packet encryption

Default value: 'AES-256-GCM'

tls_cipher

Data type: String

TLS Ciphers to use

Default value: 'TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-128-CBC-SHA256'

persist_key

Data type: Boolean

Try to retain access to resources that may be unavailable because of privilege downgrades

Default value: false

persist_tun

Data type: Boolean

Try to retain access to resources that may be unavailable because of privilege downgrades

Default value: false

key_expire

Data type: Integer

The number of days to certify the server certificate for

Default value: 3650

crl_days

Data type: Integer[1]

The number of days the client revocation list will be valid for after generating

Default value: 30

digest

Data type: Enum['md5','sha1','sha256','sha224','sha384','sha512']

Cryptographic digest to use

Default value: 'sha512'

ca_expire

Data type: Integer

The number of days to certify the CA certificate for

Default value: 3650

key_name

Data type: Optional[String]

Value for name_default variable in openssl.cnf and KEY_NAME in vars

Default value: undef

key_ou

Data type: Optional[String]

Value for organizationalUnitName_default variable in openssl.cnf and KEY_OU in vars

Default value: undef

key_cn

Data type: Optional[String]

Value for commonName_default variable in openssl.cnf and KEY_CN in vars

Default value: undef

tls_auth

Data type: Boolean

Activates tls-auth to Add an additional layer of HMAC authentication on top of the TLS control channel to protect against DoS attacks.

Default value: false

tls_crypt

Data type: Boolean

Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)

Default value: false

tls_server

Data type: Boolean

If proto not tcp it lets you choose if the parameter tls-server is set or not.

Default value: false

tls_client

Data type: Boolean

Allows you to set this server up as a tls-client connection.

Default value: false

server_poll_timeout

Data type: Optional[Integer]

Value for timeout before trying the next server.

Default value: undef

ping_timer_rem

Data type: Boolean

Do not start clocking timeouts until a remote peer connects.

Default value: false

sndbuf

Data type: Optional[Integer]

Set the TCP/UDP socket send buffer size.

Default value: undef

rcvbuf

Data type: Optional[Integer]

Set the TCP/UDP socket receive buffer size.

Default value: undef

shared_ca

Data type: Optional[String]

Name of a openssl::ca resource to use config with

Default value: undef

crl_verify

Data type: Boolean

Enable CRL checking. Disabling this is not recommended.

Default value: true

crl_auto_renew

Data type: Boolean

Enables automatic renewing of crl.pem.

Default value: false

crl_renew_schedule_period

Data type: String

Sets the "period" Parameter of the schedule for renewing the CRL. Since changing the expiry of 30 days is not possible with easy-rsa2, twice a month should be good

Default value: 'monthly'

crl_renew_schedule_repeat

Data type: Integer

Sets the "repeat" Parameter of the schedule for renewing the CRL. Since changing the expiry of 30 days is not possible with easy-rsa2, twice a month should be good

Default value: 2

extca_enabled

Data type: Boolean

Turn this on if you are using an external CA solution, like FreeIPA. Once enabled, you must configure the remaining extca_* parameters.

Default value: false

extca_ca_cert_file

Data type: Optional[String]

External CA: Path to the CA certificate.

Default value: undef

extca_ca_crl_file

Data type: Optional[String]

External CA: Path to the CA's CRL file. For FreeIPA-based CAs, CRLs expire every four hours, which means you may need your own solution for maintaining a local copy of your CA's CRL. Otherwise, you can set crl_verify to false (not recommended).

Default value: undef

extca_server_cert_file

Data type: Optional[String]

External CA: Path to the external CA issued OpenVPN server certificate.

Default value: undef

extca_server_key_file

Data type: Optional[String]

External CA: Path to the key file that corresponds to $extca_server_cert_file

Default value: undef

extca_dh_file

Data type: Optional[String]

External CA: Path to your Dillie-Hellman parameter file. You will need to create one yourself. Make sure key-size matches the public key size of your CA-issued server certificate. Like this: openssl dhparam -out /path/to/dh.pem 2048 Note: This is only required if you are enabling $tls_server.

Default value: undef

extca_tls_auth_key_file

Data type: Optional[String]

External CA: If you are enabling $extca_enabled and $tls_auth, you will also need to create the tls-auth key file and specify its location here. The file can be created like this: openvpn --genkey --secret /path/to/ta.key. Note: you will need to distribute this file to your clients as well.

Default value: undef

autostart

Data type: Optional[Boolean]

Enable autostart for server if openvpn::autostart_all is false.

Default value: undef

remote_cert_tls

Data type: Boolean

Enable or disable use of remote-cert-tls for the session. Generally used with client configuration

Default value: true

nobind

Data type: Boolean

Whether or not to bind to a specific port number.#

Default value: false

secret

Data type: Optional[String]

A pre-shared static key.

Default value: undef

scripts

Data type: Hash[String, Hash]

Hash of scripts to copy with this instance. For example, to put a script in /etc/openvpn/test-site/scripts/add-tap-to-bridge.sh and use it as an up script

openvpn::server { 'test-site':
  ....
  up => 'add-tap-to-bridge.sh',
  scripts => {
    "add-tap-to-bridge.sh" => {
      source => 'puppet:///path/to/add-tap-to-bridge.sh',
    },
  },
}

Default value: {}

custom_options

Data type: Hash

Hash of additional options to append to the configuration file.

Default value: {}

fragment

Data type: Variant[Boolean, Integer]

Default value: false

Changelog

All notable changes to this project will be documented in this file. Each new release typically also includes the latest modulesync defaults. These should not affect the functionality of the module.

v10.3.0 (2022-08-24)

Full Changelog

Implemented enhancements:

• Make ecdh-curve optional #436 (jkroepke)
• Add Ubuntu 22.04 #435 (jkroepke)

v10.2.1 (2022-06-28)

Full Changelog

Fixed bugs:

• Fix path for crl_auto_renew with easy_rsa 3.0 #437 (cible)

v10.2.0 (2022-04-26)

Full Changelog

Implemented enhancements:

• Add support for easyrsa X509 DN mode 'cn_only' #432 (jkroepke)
• Add support for elliptic curve keys #431 (jkroepke)

v10.1.0 (2022-03-28)

Full Changelog

Implemented enhancements:

• Add basic support for Solaris/Illumos/SmartOS #429 (smokris)
• Support custom_options in client_specific_config #428 (smokris)

v10.0.0 (2022-03-25)

Full Changelog

Breaking changes:

• Remove openvpn::deploy #424 (jkroepke)
• Replace ns_cert_type with remote_cert_tls (**client config regeneration needed**) #415 (jkroepke)
• Drop Ubuntu 16.04 #413 (jkroepke)
• Disable compression and set cipher to AES-256-GCM by default #412 (jkroepke)
• Use Deferred functions instead facts #410 (jkroepke)

Implemented enhancements:

• Allowed openvpn::ca declared in openvpn::server to set crl_days parameter #419 (Deroin)

Closed issues:

• Client configurations with the new Deferred function aren't working #421
• Warning: Fact value '...' with the value length: '5274' exceeds the value length limit: 4096 #409
• openvpn facts not generated on server #352
• Fact openvpn exposes private keys #322

Merged pull requests:

• Unbreak vagrant #422 (mattock)

v9.1.0 (2021-09-18)

Full Changelog

Implemented enhancements:

• Add Debian 11 support #414 (root-expert)

Closed issues:

• Latest tags are not really up to date #398
• New release with script-pushing #359

Merged pull requests:

• Allow stdlib 8.0.0 #408 (smortex)

v9.0.0 (2021-08-09)

Full Changelog

Breaking changes:

• Drop Puppet 5 support #399 (root-expert)
• Drop CentOS 6 support #393 (bastelfreak)
• Drop EOL Debian 8 support #388 (bastelfreak)

Implemented enhancements:

• Add Ubuntu 20.04 support #401 (root-expert)
• Add Puppet 7 support #400 (root-expert)

Closed issues:

• FREQ: Please update/certify for Ubuntu 20.04 LTS support please #395

Merged pull requests:

• Update badges in README and regenerate REFERENCE #406 (root-expert)
• Change ensure to "installed" instead of "present" in specs #405 (root-expert)
• Allow puppetlabs/concat and puppetlabs/stdlib 7.x #404 (root-expert)
• Fix typo #397 (itzwam)
• fix(client): Handle expire value for easyrsa version 3 #392 (Turgon37)

v8.3.0 (2020-10-20)

Full Changelog

Debian 8 is end of life since a few months. We do not support EOL operating systems. This is the last puppet-openvpn release with Debian 8 support. Afterwards we will do a 9.0.0 release which only supports Debian 9 and 10.

Implemented enhancements:

• Update code to set status parameter optional #385 (smutel)
• Add Debian Buster support #379 (NITEMAN)
• Enable revocation when easyrsa version 3.0 is used #369 (Rubueno)
• Add RHEL 8 support #364 (yakatz)
• Add remote-random and remote-random-hostname to managed server parameters #363 (yakatz)
• Add debian buster to collect easyrsa fact #362 (smutel)
• Optionally manage logfile parent directory #343 (Bluewind)
• Add scripts with server #339 (yakatz)

Fixed bugs:

• Fixes #374 - Revocation command update and crl renew #375 (Rubueno)
• Update server.erb - fix proto for tcp client mode #349 (jimirocks)

Closed issues:

• Problem while revoking certificate #374
• Revoke command missing on easy-rsa 3.0 #331

Merged pull requests:

• Repair link to REFERENCE.md in README.md #366 (gabe-sky)
• drop Ubuntu 14.04 support #361 (bastelfreak)
• Clean up acceptance spec helper #356 (ekohl)
• cleanup types in openvpn::client_specific_config #342 (bastelfreak)

v8.2.0 (2019-07-19)

Full Changelog

Implemented enhancements:

• Add tls_crypt #334 (jkroepke)
• Adjust clients $compression type to match servers #333 (jkroepke)
• client_specific_config: add support for ifconfig-ipv6-push #235 (invidian)

Fixed bugs:

• Apparently openvpn 2.4 needs double quotes around client specific push options #329
• Only output ldap_tls_client_cert_file and ldap_tls_client_key_file when set #341 (Bluewind)
• Allow puppetlabs/concat 6.x, puppetlabs/stdlib 6.x #340 (dhoppe)
• use double quotes on all push options #330 (qs5779)

Closed issues:

• var renaming overlooked KEY_DIR => EASYRSA_PKI #336

Merged pull requests:

• Add option to disable ordering dependencies on Openvpn::Client #344 (Bluewind)
• Updated KEY_DIR to match new variable #337 (xepa)
• Use stdlib functions for hash key discovery #324 (towo)

v8.1.0 (2019-02-03)

Full Changelog

Fixed bugs:

• Allow 4 and 6 suffix inside proto to limit ip4 or ip6 connection only. #327 (jkroepke)

v8.0.0 (2019-01-29)

Full Changelog

Breaking changes:

• modulesync 2.5.1 and drop Puppet 4 support #325 (bastelfreak)
• Data in Modules, Modern facts & Cleanup #305 (jkroepke)

Implemented enhancements:

• Timeout when generating Diffie-Hellman parameters on a low-performance CPU #316
• Implement Ubuntu 18.04 support #306
• Should be an option to install openvpn from http://swupdate.openvpn.net/ repo #218
• Set DH timeout to accommodate low performance CPU #317 (dspinellis)

Fixed bugs:

• crl auto renewal broken with easyrsa 3.0 #318
• consider the easyrsa version to trigger the renew crl command #321 (Dan33l)

Closed issues:

• New release ? #323
• Non-executable easy-rsa files cause module to fail #313
• Do not fail fatal if OS is unsupported. #304
• Failures after upgrade #303
• OpenVPN is now generating blank/empty user certificates #225

Merged pull requests:

• updated documentation to conform with REFERENCE.md standard for forge #311 (danquack)
• add acceptance tests with real vpn client/server setup #310 (Dan33l)
• modulesync 2.2.0 and allow puppet 6.x #299 (bastelfreak)

v7.4.0 (2018-10-16)

Full Changelog

Implemented enhancements:

• update supported OSes in params.pp #296 (Dan33l)
• use new fact easyrsa to configure easyrsa 2 or 3 #292 (Dan33l)

Fixed bugs:

• Support for easy-rsa version 3 #216

Closed issues:

• debian 7 support broken #291
• Epel has upgraded easy-rsa to version 3.x and removed 2.x, breaking the module #269

Merged pull requests:

• FreeBSD: change additional_packages to easy-rsa2 #301 (olevole)
• Update puppetlabs-stdlib dependency version in README #298 (simonrondelez)
• move concat version_requirement to >= 3.0.0 \< 6.0.0 #294 (Dan33l)
• allow puppetlabs/stdlib 5.x #290 (bastelfreak)
• Remove deprecated hiera_hash #289 (Dan33l)
• Remove deprecated hiera_hash #276 (jkroepke)

v7.3.0 (2018-08-18)

Full Changelog

Implemented enhancements:

• Allow management_port to be a string; require stdlib >= 4.25.0 #275 (marieof9)

Fixed bugs:

• Configuring management unix socket is no longer possible #274
• openvpn::server, documentation doesn't match the code for parameter 'port' #272

Merged pull requests:

• Remove docker nodesets #282 (bastelfreak)
• drop EOL OSs; fix puppet version range #280 (bastelfreak)
• Changed type for port in class documentation #273 (clxnetom)

v7.2.0 (2018-03-17)

Full Changelog

Implemented enhancements:

• Allow to define remote-cert-tls #266 (jkroepke)

Fixed bugs:

• Bug Fix: Ensure cipher and tls_cipher can be disabled entirely #270 (jcarr-sailthru)

Closed issues:

• Looking for Maintainers #228

v7.1.0 (2018-01-11)

Full Changelog

Implemented enhancements:

• add openvpn::deploy::(export/client) #261 (to-kn)

Closed issues:

• Elegant solution for renewing CRL #236

v7.0.0 (2018-01-06)

Full Changelog

Breaking changes:

• add datatypes to all params #259 (to-kn)

Implemented enhancements:

• Add crl renewal #256 (to-kn)

v6.0.0 (2017-11-21)

Full Changelog

Breaking changes:

• Turned up options for encryption #223 (mcrmonkey)

Fixed bugs:

• Doesn't work properly with "remote" in openvpn::server #252
• Correct 252 #253 (cjeanneret)

Merged pull requests:

• replace validate_* with datatypes in init.pp #251 (bastelfreak)

v5.0.0 (2017-11-13)

Full Changelog

Breaking changes:

• Breaking: Update puppet, stdlib, and concat requirements in prep for release #242 (wyardley)

Implemented enhancements:

• Upped version requirement of concat and added Debian 9 (stretch) #243 (hp197)

v4.1.1 (2017-10-07)

Full Changelog

v4.1.0 (2017-10-06)

Full Changelog

Closed issues:

• Install openvpn & certs also on client nodes #231
• Download config has incorrect protocol #219
• Error while evaluating a Function Call, cannot currently create client configs when corresponding openvpn::server is extca_enabled #199

Merged pull requests:

• Fix auth tls ovpn profile and ldap auth file perms #220 (szponek)
• Correct path of openvpn-auth-pam.so on modern Debian distros. #217 (oc243)
• Add rhel6 support for ldap auth plugin #215 (miguelwhite)
• fix broken namespecific rclink #209 (alxwr)

4.0.1 (2016-09-25)

• Fix namespecific_rclink variable warning for non BSD systems (#214)

4.0.0

• Workaround for MODULES-2874 (#201)
• Fix for external CA handling with exported resources (#201)
• Drop Support for Puppet 3.x (#212)

3.1.0

• Support for FreeBSD (#180)
• Support for port-share (#182/#185)
• Support for pre-shared keys (#186)
• Support LDAP anonymous binds (#189)
• Fix .ovpn files generation (#190)
• Support for external CAs (#192)
• Small Typo fix (#192)
• Fix support for Amazon Linux (#194)
• Client pull option (#195)
• Allow remote_host to be an array of servers (#195)
• More robust Shared CA handling (#191, #196)

3.0.0

• Support for Ubuntu 15.04 (#168)
• Support for specifying TLS-Cipher (#169)
• Support for specifying custom certificate expiry (#169)
• Support for README in download configs (#169)
• Support for Tunnelblick configurations (#169)
• Fix certificate revocation in Ubuntu Precise (#169)
• Use concat for ovpn generation (#176)

2.9.0

This will be the last version of version 2.x with new features.

• Support to send ipv6 routes (#153, #154)
• Support for nobind param for server in client mode (#156)
• Fixing autostart_all behaviour (#163)
• Add systemd support for Debian >= 8.0 (#161)
• Support for Archlinux (#162)
• Support to enable/disable service management(#158)
• Fix installation for older Redhat based systems (#165)
• Add ability to specify custom options for clients (#167)

2.8.0

• Support for systems without lsb-release package (#134)
• Support for Amazon EC2 OS (#134)
• Move default log path for status log to /var/log/openvpn (#139)
• Support for format parameter (#138)
• Ability to configure autostart management on debian (#144)
• Fix ordering in /etc/default/openvpn with puppet future parser (#142
• Support for TLS auth when server acts as client (#147)
• Support for customer server options (#147)
• Allow disabling ns-cert-type server for server-clients (#147)
• Fix pam plugin path on RedHat/CentOS (#148)

2.7.1

• Fix server in client mode (#137)

2.7.0

• Support for removing a client specific conf file (#115)
• Support for rcvbuf and sndbuf (#116)
• Fix RedHat and CentOS package selection (#97)
• Support for TLS and x509-name verification (#118)
• Fix unset client cipher producing invalid configs (#129)
• Support to share a CA between multiple server instances (#112)
• Support for systemd (#127)

2.6.0

• Support for setting up and/or down scripts for clients (#89)
• Fixing the permissions of the created directories and files (#90, #92, #94, #102)
• Refactor templates to use instance variables instead of scope.lookupvar (#100)
• Add client mode server (#100)
• Move CA management into its own defined type (#100)
• Fix LDAP-Support on Debian Wheezy (#103)
• Support for status-version (#108)
• Change layout of downloadable client config to prevent overriding other client configurations when extracting the tarball (#104)
• Add ns-cert-type server for server-clients (#109)

2.5.0

• Do not include deprecated concat::setup anymore (#71)
• Only warn about pam deprecation if it's used (#72)
• Ability to specify a down script (#75)
• Support for client-cert-not-required in server config (#76)
• Support for auth-retry in client config (#76)
• Support for setenv in client config (#79)
• Support for setenv_safe in client config (#79)
• Support for cipher in client config (#80)
• Support for push route in client specific config (#80)

2.4.0

Bugfixes

• Fix Ubuntu Trusty support (#64)

New Features

• Basic support to hand out IPv6 addresses (#66)
• Ability to specify the common name of a server (#65)
• Options for KEY_EXPIRE, CA_EXPIRE, KEY_NAME, KEY_OU, KEY_CN easy-rsa vars. (#58, #70)
• Options for cipher, verb, persist-key, persist-tun server directives. (#58, #70)

Before

• A lot of stuff I don't know anymore :disappointed:

* This Changelog was automatically generated by github_changelog_generator