Comments (7)
Testing for Windows administrator access is simple, however, solving the UX is not so straight forward.
Teaching people how to deliberately use an administrator account, in ways that Windows is no longer prepared to tolerate, is not a sound approach. Also, Windows default is to not allow EasyRSA-Start.bat
to be run-as admin, instead, if run-as admin
is selected then Windows forcibly exits to desktop.
After consideration, I believe the simplest solution is as follows:
- OpenVPN Windows installer requires a second EasyRSA shortcut launcher.
- The second would be named along the lines of
EasyRSA (Non-Admin)
. - This would drop
easyrsa
prompt to\User\$Home
, instead ofProgram Files
. easyrsa
will then run from$PATH
.
This also allows users (Clients) to generate CSRs without the need for admin access.
So this is probably going to be a little bit more complicated.
This does all fit into the scope and capabilities of Easy-RSA v3.2.0
.
from easy-rsa.
Could you clarify this would drop easyrsa prompt to \User\$Home
?
Anything else required from installer except creating a new shortcut? Do we need another EasyRSA-Start.bat
?
from easy-rsa.
Could you clarify
this would drop easyrsa prompt to \User\$Home
?
Currently, executes EasyRSA-Start.bat
mksh/sh.exe
to drop the prompt into \Program Files\OpenVPN\easy-rsa\
and await input.
This change would add some logic to to choose to "create (as required) and drop to" EasyRSA-Start.bat
\Users\$HOME\easy-rsa
, instead. This logic would be called via the new shortcut launcher with a new command option, such as --use-home-dir
.
Anything else required from installer except creating a new shortcut? Do we need another EasyRSA-Start.bat?
At this stage, I am only proposing a new shortcut launcher; all other changes would be made in the Easy-RSA repository.
Edit: My mistake is:
- I mean
easyrsa-shell-init.sh
notEasyRSA-Start.bat
. - This also applies to comments below.
from easy-rsa.
Additionally, would check for Windows access.EasyRSA-Start.bat
When the standard shortcut is used, it is necessary to deliberately check if the shell can write to the PKI. Otherwise, easyrsa
will fail in strange ways, due to the mkdir -p
problem.
When the new shortcut is used EasyRSA (Non-Admin)
, it is not necessary to check for this issue because easyrsa
fails correctly, when permissions are not correct.
from easy-rsa.
This approach should also work for Easy-RSA source code tarballs.
The logic to determine Windows access is still part of Easy-RSA-Start.bat
, which is still required to use the source tarballs.
A Windows access error could then return a message explaining how to use Non-Admin option.
Also, I have access to Windows 10, which replicates this issue and can be thoroughly tested.
from easy-rsa.
My mistake,
I obviously mean easyrsa-shell-init.sh
not EasyRSA-Start.bat
.
Still working on it.
from easy-rsa.
These are the changes to OpenVPN-build Windows-Installer that this fix would require:
-
Additional EasyRSA shortcut:
EasyRSA shell (Non-Admin)
This would execute command:
EasyRSA-Start.bat /NA
(/NA
means Non-Admin, any suitable label will do). -
Change
Easy-Start.bat
to pass on the command option above.
This would execute command:
bin\sh.exe bin\easyrsa-shell-init.sh "%1"
(%1
is the label for Non-Admin).
This change will also go into the Easy-RSA version ofEasy-Start.bat
.
Because I'm not sure how Openvpn-build creates this file, the change to Easy-RSA could propagate to Openvpn-build.
All other changes can be managed by easyrsa-shell-init.sh
.
I have a working patch for EasyRSA but not for Openvpn-build.
Sorry for the earlier confusion regarding the file names.
from easy-rsa.
Related Issues (20)
- easyrsa visually hangs when run in Windows Terminal HOT 26
- Upgrade easy-rsa of OVPN-Server without switching to Debian 13 (Trixie) HOT 4
- easy-rsa - renew command v1: Is the old version of the certificate revoked automatically HOT 2
- Command `export-p12`, option `usefn` implementation is limited HOT 1
- Command `export-p1` use of traditional format should be conditional
- openssl execution fails when --enddate is used HOT 7
- `gen-crl` should use `-crldays` not `-days` HOT 1
- Command `write` is not compatible with `--verbose` mode HOT 1
- Command `write` syntax details
- `build-ca`, password cannot use `$` character HOT 9
- `sign-req`: Cert. `$serial` number is only 32bit
- Abandon `escape_hazard()` - Replace with heredoc expansion HOT 1
- LibreSSL: Command `x509`, does not support option `-ext`
- Input/output error: Cannot create openssl-easyrsa.cnf HOT 11
- set_var EASYRSA_SSL_CONF - add wrong / HOT 5
- EasyRSA on Windows 11 with `mksh` hangs HOT 3
- Easy-RSA hangs on Windows 11
- vars file not found HOT 3
- Windows Users of Easy-RSA
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from easy-rsa.