OpenVPN Silent Install/Update & Kaseya Procedure

Due to the Heartbleed and more recent MITM vulnerabilies, we have needed to upgrade all of our OpenVPN clients to the latest version as quickly as possible. We are running Kaseya Virtual System Administrator (VSA), although any of these commands could be run via the command line or another tool.

You can download the latest version of OpenVPN here. There are 32-bit & 64-bit versions available.

I found details about command line/silent installation here. I chose to use the following switches:

openvpn-install-2.3.4-I002-x86_64.exe /SELECT_SHORTCUTS=0 /SELECT_OPENVPN=1 /SELECT_SERVICE=1 /SELECT_TAP=1 /SELECT_OPENVPNGUI=0 /SELECT_ASSOCIATIONS=1 /SELECT_OPENSSL_UTILITIES=0 /SELECT_EASYRSA=0 /SELECT_PATH=1 /SELECT_OPENSSLDLLS=1 /SELECT_LZODLLS=1 /SELECT_PKCS11DLLS=1 /S" 

One issue that I had was that OpenVPN makes you "trust" "OpenVPN Technologies, Inc" when installing the OpenVPN TAP adapter. If I hadn't previously "trusted" OpenVPN when installing a previous version, the command line script would fail. To get around this, our script will install install the certificate via the command line before starting the OpenVPN installer.

 

Download a copy of openvpn.cer here.

You can install the certificate using this command:

certutil -addstore "TrustedPublisher" openvpn.cer

My organization is running OpenVPN as a service. If you are not, you can ignore all of the commands related to the OpenVPN service.

Here are procedures that you can import into Kaseya. Make sure to upload the installer you wish to use to the VSASharedFiles section before running the script (In Kaseya VSA 6.5: Agent Procedures -> Installer Wizards -> Application Deploy). If the installer you are using is not version 2.3.4-I002, you will need to edit the procedure.

• 32-bit Procedure OpenVPN 2.3.4 x86.xml
• 64-bit Procedure OpenVPN 2.3.4 x64.xml

In short, here is what the procedures will do:

• Copy openvpn.cer to the system's temp folder
  (Kaseya)
• Copy OpenVPN installer to the system's temp folder
  (Kaseya)
• Run certutil to install the openvpn.cer certificate
  (certutil -addstore "TrustedPublisher" openvpn.cer)
• Stop the OpenVPN Service
  (net stop "openvpn service")
• Kill openvpn.exe & openvpnserv.exe, just to be safe
  (taskkill /IM openvpn.exe, taskkill /IM openvpnserv.exe)
• Run the OpenVPN installer with appropriate switches
  (openvpn-install-2.3.4-I002-x86_64.exe /SELECT_SHORTCUTS=0 /SELECT_OPENVPN=1 /SELECT_SERVICE=1 /SELECT_TAP=1 /SELECT_OPENVPNGUI=0 /SELECT_ASSOCIATIONS=1 /SELECT_OPENSSL_UTILITIES=0 /SELECT_EASYRSA=0 /SELECT_PATH=1 /SELECT_OPENSSLDLLS=1 /SELECT_LZODLLS=1 /SELECT_PKCS11DLLS=1 /S")
• Change service settings to start automatically
  (sc config openvpnservice start= auto)
• Start the OpenVPN Service
  (net start "openvpn service"