But I’ll share a few recent snippets of our recent dealings with them:

“Why would you want to move your account to another branch, you can do everything from any branch.”
“Oh, you want to do (Insert any common banking activity here), you have to do that at the branch your account is held at”

“Sure, this cheque is a Bank of Ireland cheque, it’ll clear in a few hours” – Bank of Irelands definition of “few hours” means anything from 3 hours, to 72 hours.

When I want to do banking, I go to a bank. If I wanted lies, I’d go find a politician.

Keyboard pants.

I know… what a brilliant idea. I’m annoyed that I didn’t think of this myself.

I have a roll-up keyboard, and its new destiny is to become part of some form of clothing…

No, the plastic puppet, that was used in the Nandos advert.

  apt-get install openvpn

See, I said it was easy. Now there’s a little more of a complex part, where we setup the CA and utilities needed for generating Certificates for the Server and all the Clients.

I like to move the easy-rsa directory into my /etc/openvpn directory, since its easier to work with it there (and easier to remember where it is). So run the following command to copy it across:

mkdir /etc/openvpn/{keys,easy-rsa}
cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/ 

Then you need to edit your /etc/openvpn/easy-rsa/vars file, and make a few changes. I’ve set the following variables.

export EASY_RSA="/etc/openvpn/easy-rsa/"
export KEY_DIR="/etc/openvpn/keys"

And I tweaked my KEY_ variables so I don’t have to fill them in every time:

Then, you need to setup your environment by running

cd /etc/openvpn/easy-rsa
. vars
./clean-all

Careful with the clean-all command. Only run this ONCE, when you FIRST start this setup. It deletes ALL your keys, so you have a blank slate!

Now you build your own Certificate Authority (CA) certificate and key

./build-ca

Then build your Diffie-Hellman Paramaters (for SSL/TLS connections)

./build-dh

Then, build a key for your OpenVPN server. This generates a server.crt and server.key
Make sure you set the CommonName attribute to something meaningful for you (and unique) 

./build-key-server server

Now you’ll want to generate a key for each of the connecting clients. We can do one now, and then you can come back to follow these steps to add more at a later stage. Make sure the CommonName attribute is unique in all of these. Infact, I’d urge you to make them correspond to the username that the will authenticate with (this will be stored in the database).

./build-key client1

The basics of RSA dictate that anything with a .key is to be kept private, and is relevant only to the machine it was intended for, and the .crt is for your local machine, and the remote end too.

So: 
server.key never leaves the server
server.crt gets copied to the client
client1.key gets copied to the client
client1.crt gets copied to the client
dh1024.pem gets copied to the client
ca.crt gets copied to the client.
ca.key is super secret. If someone got their hands on it, they could create more client certificates, which is a bad thing ™. 

And thats all I’ll cover in this Howto.

In the next one, we’ll install radiusplugin, and I’ll show you the configuration files needed for the server and clients.

And then they’ll all be heading to Wimpy for their free coffee

And those of you with a sense of humour, will read Hayibo’s Election News, and giggle to yourselves at the new Nandos advert. (Those without a sense of humour will be offended, and try to sue Nandos. Or take Militant action, whatever floats your gravy boat)

They call it the RTE Player.

I’ve been playing around with this for a few days now. (Thanks RTE for giving me a beta account!)

Its very impressive actually. Quality is great, and I haven’t found a single bug yet. It just works.

And this man, clearly had too much free time when he came up with this.

He’s used a pile of what most people (including my wife) would call old, useless junk. But instead, he saw potential, to make music!

More info on this project here and more fine examples of this style of music making here.

So this is where we will begin the Monster VPN Project

I’m assuming you’ve already got Debian installed. I’m not going into this, as its been documented all over the place, and isn’t that much of a problem. (And in all honesty, if you struggle with this, you might want to reconsider continueing this project) 

The best place to start on this project, is to install MySQL. Since its going to be the database that stores all the data for the VPN’s, its best to have this in place before you start with the rest of it.

Thankfully, this is pretty simple in Debian.

Make sure you’re logged in as root, and run

apt-get install mysql-client-5.0 mysql-common mysql-server-5.0 

This will install the binaries needed to run a MySQL server, and the client. But since we’ll be compiling radiusplugin from source, we also need the -dev libraries for the MySQL client, so run the following too:

apt-get install libmysqlclient15-dev

Well, thats it! I did say it was easy…

The idea is to have a simple web interface where I can add/remove/edit user accounts, Generate Certificates for endpoints and check users usage.

RADIUS is a fantastic AAA (Accounting Authentication And Authorization) protocol, which is used for almost everything ISP related (dial-up, dsl, wimax, wifi hotspots), so it seems only fitting that I use it for this application. It also means I can integrate other things into it, without serious modification (since its a standard). I may even start using it for building my own Hotspot controller for Mikrotik RouterOS based hotspots.

Here’s the plan:
Debian as the Linux flavour
MySQL to store all the authentication and configuration information (howto)
FreeRADIUS to provide an interface into getting at the information, and for accounting
OpenVPN for the actual VPN server
RadiusPlugin for making OpenVPN play nicely with FreeRADIUS 
Apache HTTP server, since its going to be a web frontend
PHP for the service side part of the web frontend 

I’ve followed a few guides to get this going, and this one is possibly the most useful one I’ve come across.

So far, I’ve had bits and pieces working, but I haven’t managed to get them all working together at the same time.

Over the next few days, I’ll be documenting (in as much details as I can remember), the steps needed to set this up. I’m doing this for personal documentation purposes as well as to share with the community should anyone else want to do something similar.

So stay tuned, subscribe to my RSS feed, and keep your eyes open for my follow-up posts.

Ivy Matsepe-Casaburri, better known as Poison Ivy, was the topic of a few of my rants in the past.

She was really good at stuffing things up, and then starting legal procedures against anyone who tried to fix it. I think she’s the first true example of the “If it aint fixed, don’t fix it, sleep instead” mindset.

Government released their own tribute to her, which ignores all her failings.

So it was left to some more objective people to come up with a fitting tribute.