manage-users.md

Manage VPN Users

Read this in other languages: English, 简体中文.

By default, a single user account for VPN login is created. If you wish to view or manage users for the IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes, read this document. For IKEv2, see Manage client certificates.

• Manage VPN users using helper scripts
• View VPN users
• View or update the IPsec PSK
• Manually manage VPN users

Manage VPN users using helper scripts

Read this in other languages: English, 简体中文.

You may use helper scripts to add, delete or update all VPN users for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes. For IKEv2 mode, please instead see Manage client certificates.

Note: Replace command arguments below with your own values. VPN users are stored in /etc/ppp/chap-secrets and /etc/ipsec.d/passwd. The scripts will backup these files before making changes, with .old-date-time suffix.

Add or edit a VPN user

Add a new VPN user, or update an existing VPN user with a new password.

Run the script and follow the prompts:

sudo addvpnuser.sh

Error: "sudo: addvpnuser.sh: command not found".

This is normal if you used an older version of the VPN setup script. First, download the helper script:

wget -nv -O /opt/src/addvpnuser.sh https://bit.ly/addvpnuser
chmod +x /opt/src/addvpnuser.sh && ln -s /opt/src/addvpnuser.sh /usr/bin

Then run the script using the instructions.

Alternatively, you can run the script with arguments:

# All values MUST be placed inside 'single quotes'
# DO NOT use these special characters within values: \ " '
sudo addvpnuser.sh 'username_to_add' 'password'
# OR
sudo addvpnuser.sh 'username_to_update' 'new_password'

Delete a VPN user

Delete the specified VPN user.

Run the script and follow the prompts:

sudo delvpnuser.sh

Error: "sudo: delvpnuser.sh: command not found".

This is normal if you used an older version of the VPN setup script. First, download the helper script:

wget -nv -O /opt/src/delvpnuser.sh https://bit.ly/delvpnuser
chmod +x /opt/src/delvpnuser.sh && ln -s /opt/src/delvpnuser.sh /usr/bin

Then run the script using the instructions.

Alternatively, you can run the script with arguments:

# All values MUST be placed inside 'single quotes'
# DO NOT use these special characters within values: \ " '
sudo delvpnuser.sh 'username_to_delete'

Update all VPN users

Remove all existing VPN users and replace with the list of users you specify.

First, download the script:

wget -nv -O updatevpnusers.sh https://bit.ly/updatevpnusers

To use this script, choose one of the following options:

Important: This script will remove ALL existing VPN users and replace them with the list of users you specify. Therefore, you must include any existing user(s) you want to keep in the variables below.

Option 1: Edit the script and enter VPN user details:

nano -w updatevpnusers.sh
[Replace with your own values: YOUR_USERNAMES and YOUR_PASSWORDS]
sudo bash updatevpnusers.sh

Option 2: Define VPN user details as environment variables:

# List of VPN usernames and passwords, separated by spaces
# All values MUST be placed inside 'single quotes'
# DO NOT use these special characters within values: \ " '
sudo \
VPN_USERS='username1 username2 ...' \
VPN_PASSWORDS='password1 password2 ...' \
bash updatevpnusers.sh

View VPN users

By default, the VPN setup scripts will create the same VPN user for both IPsec/L2TP and IPsec/XAuth ("Cisco IPsec") modes.

For IPsec/L2TP, VPN users are specified in /etc/ppp/chap-secrets. The format of this file is:

"username1"  l2tpd  "password1"  *
"username2"  l2tpd  "password2"  *
... ...

For IPsec/XAuth ("Cisco IPsec"), VPN users are specified in /etc/ipsec.d/passwd. Passwords in this file are salted and hashed. See Manually manage VPN users for more details.

View or update the IPsec PSK

The IPsec PSK (pre-shared key) is stored in /etc/ipsec.secrets. All VPN users will share the same IPsec PSK. The format of this file is:

%any  %any  : PSK "your_ipsec_pre_shared_key"

To change to a new PSK, just edit this file. DO NOT use these special characters within values: \ " '

You must restart services when finished:

service ipsec restart
service xl2tpd restart

Manually manage VPN users

For IPsec/L2TP, VPN users are specified in /etc/ppp/chap-secrets. The format of this file is:

"username1"  l2tpd  "password1"  *
"username2"  l2tpd  "password2"  *
... ...

You can add more users, use one line for each user. DO NOT use these special characters within values: \ " '

For IPsec/XAuth ("Cisco IPsec"), VPN users are specified in /etc/ipsec.d/passwd. The format of this file is:

username1:password1hashed:xauth-psk
username2:password2hashed:xauth-psk
... ...

Passwords in this file are salted and hashed. This step can be done using e.g. the openssl utility:

# The output will be password1hashed
# Put your password inside 'single quotes'
openssl passwd -1 'password1'

License

Copyright (C) 2016-2022 Lin Song

This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 Unported License
Attribution required: please include my name in any derivative and let me know how you have improved it!