mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 18:15:50 +03:00
[GH-ISSUE #432] VPN_CONFIG_PROTECT password invalid #404
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @lewtopia on GitHub (May 26, 2024).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/432
Checklist
Describe the issue
Even when VPN_CONFIG_PROTECT is set to NO, the produced certificates are password protected.
When examining the vpnuser.mobileconfig file in an editor, the certificate section does display a password key / value, but this string is not the password, as it fails to open the certificate.
How or where to find the password that is generated to config protect the certificates?
To Reproduce
Steps to reproduce the behavior:
Expected behavior
OR
Logs
Server (please complete the following information)
Client (please complete the following information)
Additional context
Add any other context about the problem here.
@hwdsl2 commented on GitHub (May 28, 2024):
@lewtopia Hello! Apple devices require
.mobileconfigfiles to have a password when importing. The password cannot be blank. As a result, this project handles this password in the following way. There are two cases:If
VPN_PROTECT_CONFIGis NOT set toyes(or not set), a random password is generated to protect the.mobileconfigfile, and that password is embedded in the.mobileconfigfile itself. Apple devices will retrieve the password from the file automatically when importing, and will not ask the user for the password during import. In your issue description, you are probably referring to this password. It is the password used when encrypting the certificate in the file.If
VPN_PROTECT_CONFIGis set toyes, a random password is generated to protect the.mobileconfigfiles, but the password is NOT embedded in the.mobileconfigfiles. To retrieve the generated password, first open a Bash shell inside the container, then runcat /etc/ipsec.d/.vpnconfig. If this file does not exist, this case (2) does not apply to you, see (1) above instead.Note that if
VPN_PROTECT_CONFIGwas previously set toyes, changing it tonoat a later time will not remove the password. If you want to remove the password for newly generated client configuration files, remove/etc/ipsec.d/.vpnconfiginside the container, then runsudo ikev2.shto re-create the client configuration.@LeveinOvO commented on GitHub (Jun 10, 2024):
I think I found the problem: see if your mirror version is old, and if so, update it to the latest version. Because of Aliyun's image warehouse, I pulled the image from two years ago that caused the same problem as you. Today, I changed the image warehouse, and the updated version was solved.