3

I run my own OpenVPN server, since the discovery of heartbleed I updated OpenSSL, changed the server password and ran the command ./clean-all to erase all keys and certificates. And of course, I generate new ones.

My doubt/question is:

It's ./clean-all safe enough to avoid unauthorized acess to my VPN? Assuming that any of the access keys had been stolen.

1

./clean-all nukes your $KEY_DIR (an env variable usually set via the ./vars script). The contents of the script are below. This should mean that the foundational keys that make your CA are toast and you should be forced to run build-ca in order to create new certs. This means you are safe from MitM attacks using your old keys should they have been compromised. You've ripped the foundation out and completely replaced it from the CA up.

#!/bin/sh

#
# Initialize the $KEY_DIR directory.
# Note that this script does a
# rm -rf on $KEY_DIR so be careful!
#

d=$KEY_DIR

if test $d; then
    rm -rf $d
    mkdir $d && \
    chmod go-rwx $d && \
    touch $d/index.txt && \
    echo 01 >$d/serial
else
    echo you must define KEY_DIR
fi
  • That's what I thought, I just wasn't 100% sure. Thanks for the clarification :) – Removed Apr 18 '14 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.