<br><br><div class="gmail_quote">On 28 January 2011 16:36, George Prowse <span dir="ltr"><<a href="mailto:george.prowse@gmail.com">george.prowse@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
<div><div></div><div class="h5">On 28/01/2011 16:23, Peter Childs wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Does anyone know where I can find some understandable instructions on<br>
how to set up a VPN using OpenVPN possibly with some kind of UI for<br>
setting up the keys, and what Keys do what?<br>
<br>
Its just the instructions are all very well but I'm yet to work out what<br>
I need to do with the 3 certificates, and 2 or more odd keys the<br>
instructions seam to tell me to create....<br>
<br>
Peter.<br>
<br>
</blockquote></div></div>
This is a great start and isn't terribly distro-specific:<br>
<br>
<a href="http://en.gentoo-wiki.com/wiki/OpenVPN" target="_blank">http://en.gentoo-wiki.com/wiki/OpenVPN</a><div><div></div><div class="h5"><br><br></div></div></blockquote><div><br></div><div>Hmm That makes better sense than the original..... Now to figure out the unanswered question.</div>
<div><br></div><div>Do I need different Client Keys for each Client(peer) or can Multiple Clients(peers) use the same Client Key, Hence If I'm not worried about security and not going to password and lock up my keys can I get away with one client key.</div>
<div><br></div><div>Hence</div><div><br></div><div>Each Group needs one Root Certificate (which could also be signed for your secure web server hence in an ideal world every organisation should have a Certificate for signing everything they do so it all matches, yep that means if your using Cups and Webmin all the Root certificates match... (Great idea if it worked, the machine installation program could ask for your Root Certificate or to Generate one on machine installation and then anything that needs it could just pick it up... (Sounds like an enhancement to deb, rpm, emerge to me wonder why nobody has done that yet....)</div>
<div><br></div><div>Each Server Needs</div><div>1. The Root Certificate (CA).</div><div>2. A Certificate for its self, signed by the Root </div><div>3. A Private Key also signed I guess</div><div><br></div><div>Each Client Needs</div>
<div>1. The Root Certficate (CA)</div><div>2. A Certificate for its self, signed by the Root, which it sends to the server on connection ????</div><div>3. A Private Key that could be password protected.</div><div><br></div>
<div>Now is that right or am I still suffering from spaghetti brain.</div><div><br></div><div>Peter.</div><div><br></div><div><br></div></div>