注册
登录
| 关键词： nbsp openvpn Name Frank 客户端 KEY server PRINTABLE 服务器 证书 |
一 openvpn 简介 openvpn 是基于SSL的vpn ,其使用工业标准的SSL/TLS协议实现第二层和第三层的安全数据链路VPN .其优点如下: 1 基于SSL协议,安全,并使用单一TCP 或者UDP 端口即可实现 2 使用双向验证,服务器只需保存自己的证书和密钥; 3 服务器只接受那些由主CA证书签名的客户端,并有撤回机制,而不需要重建个PKI; 4 可以实现基于Common Name 的权限控制 二 系统环境:RHEL5.4 应用软件 openvpn-2.1.4.tar.gz lzo-2.05.tar.gz 三 安装openvpn # tar xvf lzo-2.05.tar.gz #cd lzo-2.05 # ./configure # make # make check # make test # make install #tar xvf openvpn-2.1.4.tar.gz #cd openvpn-2.1.4 #./configure #make && make install 四 配置openv 1 为openvpn 建立专用CA,并分别为Openvpn的服务器端机器各个客户端申请所需要的证书;openvpn 支持两种认证模型:以共享密钥及基于TLS 认证模型. 出于安装机器简话认证过程等目的,Openvpn 要求服务器端在建立通信前进行基于证书的双向认证.而证书的使用依赖于PKI OpenVPN 为使用私有的CA 来颁发证书准备了许多脚本,在openvpn 源码包下面的easy-rsa 下面 2 创建CA及Openvpn 服务器和个客户端所需要的证书,需啊哟为证书使用者所处的国家等信息,而这些可以在vars 文件中指定其默认值,参数包括 #cd /root/openvpn/openvpn-2.1.4/easy-rsa/2.0 #vim vars export KEY_COUNTRY="CN" export KEY_PROVINCE="SHANGHAI" export KEY_CITY="SHANGHAI" export KEY_ORG="Frank" export [email protected] 3 配置PKI #source vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /root/openvpn/openvpn-2.1.4/easy-rsa/2.0/keys [root@openvpn 2.0]# ./clean-all 4 创建本地CA [root@openvpn 2.0]# ./build-ca Generating a 1024 bit RSA private key ...............................................................++++++ ........++++++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SHANGHAI]: Locality Name (eg, city) [SHANGHAI]: Organization Name (eg, company) [Frank]: Organizational Unit Name (eg, section) []:Frank Common Name (eg, your name or your server's hostname) [Frank CA]:FRANK Name []:frank Email Address [[email protected]]: 4 为Openvpn 创建密钥及证书 [root@openvpn 2.0]# ./build-key-server server Generating a 1024 bit RSA private key ................................................................++++++ ..++++++ writing new private key to 'server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SHANGHAI]: Locality Name (eg, city) [SHANGHAI]: Organization Name (eg, company) [Frank]: Organizational Unit Name (eg, section) []:Frank Common Name (eg, your name or your server's hostname) [server]: Name []:frank Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /root/openvpn/openvpn-2.1.4/easy-rsa/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'SHANGHAI' localityName :PRINTABLE:'SHANGHAI' organizationName :PRINTABLE:'Frank' organizationalUnitName:PRINTABLE:'Frank' commonName :PRINTABLE:'server' name :PRINTABLE:'frank' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Aug 9 17:43:47 2021 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated 5 创建客户端的的密钥及证书 [root@openvpn 2.0]# ./build-key frank Generating a 1024 bit RSA private key .......................++++++ ....++++++ writing new private key to 'frank.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [SHANGHAI]: Locality Name (eg, city) [SHANGHAI]: Organization Name (eg, company) [Frank]: Organizational Unit Name (eg, section) []:Frank Common Name (eg, your name or your server's hostname) [frank]: Name []:frank Email Address [[email protected]]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /root/openvpn/openvpn-2.1.4/easy-rsa/2.0/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'SHANGHAI' localityName :PRINTABLE:'SHANGHAI' organizationName :PRINTABLE:'Frank' organizationalUnitName:PRINTABLE:'Frank' commonName :PRINTABLE:'frank' name :PRINTABLE:'frank' emailAddress :IA5STRING:'[email protected]' Certificate is to be certified until Aug 9 18:45:05 2021 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n] CERTIFICATION CANCELED 6 创建Dffie Hellman 参数.DiffieHellman 用于增强安全性,在OpenVPN 是必须的,在OpenVPN的主配置文件中,tls-auth指令可以为SSL/TLS协议的handshake 数据包添加HMAC 签名,任何未经过签名验证的UDP包都会被丢弃,这就是SSL/TLS的安全提升了一个级别.他可以为Openvpn 的UDP 提供防止Dos 或端口洪泛攻击,避开对Openvpn 监听端口的扫描及防止缓冲区溢出等 [root@openvpn 2.0]# ./build-dh Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ......+.................+....................+...........................+...............+......+....................................+...................................................................................................................................................................................................+..........+...............+..........+.........................................................................+...........+....................................................................................................................+.............+.............................................................................................................+.......+..............................................................................................................+.......+........................................................................+...............+........+................................................................................................................+........................................+..........................................................................................................................................................................+...............................................+...+.........+........................+.+...........+.......................+..................................................................+..............................................+.........................................................+.....................................................................+.................+.....................................+..................+....................+.+..................................................+....................................................................+..................................+..............+.............................................................................+...............+.+..........................................+................+............................+.+................................................+..............................................................+.................................+..............................................+.......+.......................................................................................................+..............................+......................................................................................+.....+......................+.........................................................................................................................................................+............................................+....................++*++*++* 7 开启tls-auth功能需要用到一个预共享密钥,此密码经常跟证书等文件一起存放,此预共享密钥可以使用下面的的命令生成 [root@openvpn 2.0]# openvpn --genkey --secret ta.key 8 配置openvpn 服务器端openvpn 主配置文件 #mkdir /etc/openvpn/keys #cp -v keys/{ca.crt,server.crt.server.key,dh1024.pem} /etc/openvpn/keys #cp ta.key /etc/openvpn/keys #cd /etc/openvpn #cat openvpn.conf #openvpn 监听的IP地址 local 1.1.1.1 #openvpn 监听的端口 port 1194 #openvpn 使用的协议,如果使用HTTP proxy ,必须使用TCP协议 ;proto tcp proto udp #生命使用的设备可选tap 和tun,tap 是二层设备,支持数据链路层协议 #tun 是IP层的点对点协议,限制稍微多一些 dev tun #Openvpn 使用ROOT CA,使用build-ca 生成的,用于验证客户端证书是否合法 ca /etc/openvpn/keys/ca.crt #openvpn 服务器server 使用的证书文件 cert /etc/openvpn/keys/server.crt #openvpn 服务器Server 使用的证书对应的key,注意文件的权限,防止被盗 key /etc/openvpn/keys/server.key # This file should be kept secret #builddh 生成的Diffie-Hellman 文件 dh /etc/openvpn/keys/dh1024.pem #配置VPN 使用的网络,Openvpn 会自动提供基于该网段的DHCP服务,但是不能和任何一方的局域网端重复,并保证唯一性; #server 端的IP默认会设置为.1 的地址 server 10.8.0.0 255.255.255.0 #防止openvpn 重新启动后”忘记”Client 曾经使用过的IP地址 ifconfig-pool-persist ipp.txt ;server-bridge #把该条路由发送给客户端,客户端连接成功后自动加入路由表,省略了下一跳地址 push "route 192.168.1.0 255.255.255.0" ;client-config-dir ccd ;route 192.168.40.128 255.255.255.248 ;client-config-dir ccd ;route 10.9.0.0 255.255.255.252 ;learn-address ./script ;push "redirect-gateway def1 bypass-dhcp" #为客户端指定默认的网关,即是客户端所有的数据流量都通过该网关 push "redirect-gateway def1 bypass-dhcp" #为客户端指定DNS服务器 push "dhcp-option DNS 210.5.153.250" push "dhcp-option DNS 192.168.0.1" #配置允许客户端之间进行访问 client-to-client #开启允许多个客户端同时连接.如果Client使用的CA的Common Name 有重复,或者说客户端都使用相同的CA 和keys 连接VPN,一定要打开这个选项,否则只允许一个人连接 duplicate-cn #NAT 后面使用的VPN,如果长时间不通信,NAT Session 可能会失效,导致VPN 连接丢失,为防止此类事情发生,keepalive 提供一个类似于ping 的机制, #下面表示没10 秒通过VPN 的Control 通道ping对方,如果连续120 秒无法ping通.认为连接丢失,并重新启动VPN,重新连接,对于mode server 模式下的openvpn 不会重新连接 keepalive 10 120 ;tls-auth ta.key 0 # This file is secret #在上面提起的HMAC 防火墙,防止DOS 攻击,对于所有的控制信息,都使用HMAC signature ,没有HMAC signature的控制信息不予处理,主要server 后面的数字肯定使用0,client 使用的是1 tls-auth /etc/openvpn/keys/ta.key 0 # This file is secret ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES #对数据进行压缩,主要Server 和Client 一致 comp-lzo #定义最大连接数 max-clients 100 #定义运行openvpn 的用户 user nobody group nobody #通过keepalive 检查超时,重启VPN,不重读取keys,保留第一次使用的keys persist-key #通过keepalive 检查超时后,重新启动VPN,一直保持tun 或者tap 设备是linkup 的,否则网络连接会先linkdown 然后linkup persist-tun #定期把openvpn 额状态信息写到文件中,以便自己写程序计费或者进行其他操作 status /var/log/openvpn_status.log #记录日志,每次重新启动openvpn后删除原有的log信息 ;log openvpn.log #和log一致,每次重新启动openvpn 后保留原有的log信息,新信息追加到文件的尾部 log-append /var/log/openvpn.log verb 4 ;mute 20 9 修改系统参数并把openvpn 添加到开机自动启动,启动openvpn #vim /etc/sysctl.conf net.ipv4.ip_forward=0 修改为 net.ipv4.ip_forward=1 #sysctl -p #chkconfig add openvpn #chkconfig openvpn on #service openvpn start 10 配置客户端openvpn ,windows 下安装 openvpn-2.1.4-install.exe 11 并配置openvpn,用记事本打开openvpn 安装目录下面conf 中client.ovpn 配置如下 #定义客户端 client #定义使用的是路由IP模式,必须与服务器一致 dev tun #使用的协议,必须与服务器端一致 proto udp #指定服务器地址和端口,可以用多行指定多台服务器 remote 1.1.1.1 1194 # Choose a random host from the remote # list for load-balancing. Otherwise # try hosts in the order specified. #如果有多台服务器,让客户端随机连接 ;remote-random #解析服务器域名 resolv-retry infinite #客户端不需要绑定端口 nobind # Downgrade privileges after initialization (non-Windows only) ;user nobody ;group nobody # Try to preserve some state across restarts. persist-key persist-tun #指定ca和客户端的证书 ca ca.crt cert client.crt key client.key #安装配置参数 ns-cert-type server # If a tls-auth key is used on the server # then every client must also have the key. #此处的值必须是1 tls-auth ta.key 1 #使用lzo 压缩,与服务器端一致 comp-lzo #设置日志级别 verb 3 # Silence repeating messages ;mute 20 参考: http://blogold.chinaunix.net/u/24866/showart_2437456.html 本文出自 “Gone with the wind” 博客，请务必保留此出处http://freehat.blog.51cto.com/1239536/646531 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
