OpenVPN

Konfigurace OpenVPN serveru a klienta

Server

Nainstalovat balik openvpn.

Pridat uzivatele a skupinu openvpn.

Dale je potreba vygenerovat certifikaty a klice. Budto se pouzije stavajici CA UVT, ktera je ulozena ve sdileni linux openvpn/UVTCA, nebo se vygeneruje nova CA

Zkopirovat /usr/share/doc/openvpn-2.0.9/easy-rsa/2.0 do /etc/openvpn/easy-rsa

cd /etc/openvpn/easy-rsa

chmod a+x ./*

. ./vars

./build-ca

./build-dh

Kdyz mame CA, musime vygenerovat certifikat pro server a klienty.

. ./vars

./build-key-server mail.hostname.cz

./build-key client.mail.hostname.cz

V pripade ze jsme generovali novou CA tak uz jenom pripravit konfiguraci, v pripade ze jsme generovali klice a certifikaty na jalovici tak presunout certifikat a klic serveru + ca.crt a dh1024.pem do /etc/openvpn/keys

Konfiguracni soubor /etc/openvpn/server.conf

mode server
tls-server
proto tcp-server
dev tap0
# adresa rozhrani tap0, musi byt jiny nez ten co je na routeru
ifconfig 192.168.2.1 255.255.255.0
# rozsah adres pro vpn
ifconfig-pool 192.168.2.2 192.168.2.20 255.255.255.0

# parametry ktere si ma nacist klient
push "dhcp-option DNS 192.168.1.2"
push "dhcp-option WINS 192.168.1.2"
push "route-gateway 192.168.2.1"

# pridani route pro spravnou funkci
push "route 192.168.1.0 255.255.255.0 192.168.2.1"
push "route 192.168.2.0 255.255.255.0 192.168.2.1"
duplicate-cn

ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem

plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so openvpn

status /var/run/openvpn/vpn.status 10

keepalive 10 120
persist-key
persist-tun
user openvpn
group openvpn
daemon
comp-lzo
verb 3

Overovani uzivatelu je mozne dvema zpusoby, budto pres LDAP nebo pam, tzn ze uzivatele musi existovat lokalne.

Overovani pres ldap

Je potreba vytvorit /etc/openvpn/ldap/pam_ldap.conf

base dc=users,dc=uvt.cz,dc=accounts,dc=uvt,dc=cz
#uri ldaps://sure.the.right.uri:666/
uri ldap://10.0.10.3/
ldap_version 3
#pam_login_attribute=uid #is default
#ssl on
debug 8 #guessed. found nothing in mapages.
logdir /var/log/pam_ldap.log

a /etc/pam.d/openvpn

auth sufficient pam_ldap.so config=/etc/openvpn/ldap/pam_ldap.conf
account sufficient pam_ldap.so config=/etc/openvpn/ldap/pam_ldap.conf

Overovani vuci lokalnim uzivatelum

Udelane je to tak ze povoli autorizaci jenom uzivatelum ve skupine openvpn.

Vytvorit soubor /etc/pam.d/openvpn

#%PAM-1.0
auth       required     pam_listfile.so onerr=fail item=group sense=allow file=/etc/security/vpn.group.allowed
auth       required     pam_env.so
auth       sufficient   pam_unix.so try_first_pass likeauth nullok
auth       required     pam_deny.so

account    required     pam_unix.so

# This can be used only if you enabled the cracklib USE flag
password   required     pam_cracklib.so difok=2 minlen=8 dcredit=2 ocredit=2 try_first_pass retry=3
# # This can be used only if you enabled the cracklib USE flag
password   sufficient   pam_unix.so try_first_pass use_authtok nullok md5 shadow
# # This can be used only if you enabled the !cracklib USE flag
# # password   sufficient pam_unix.so try_first_pass nullok md5 shadow
password   required     pam_deny.so
#
session    required     pam_limits.so
session    required     pam_unix.so

Do souboru /etc/security/vpn.group.allowed napsat openvpn. Pripadne jine jmeno skupiny ktera muze do vpn.

Konfigurace klienta

Stahnout a nainstalovat OpenVPNGUI.

Do adresare Program Files/OpenVPN/config nahrat ca.crt klic a certifikat klienta.
Vytvorit soubor firma.ovpn s obsahem

remote jalovice.czu.cz
proto tcp-client
tls-client
auth-user-pass
dev tap
pull

mute 10
ca ca.crt
cert client.crt
key client.key

comp-lzo
verb 3

Upravit remote prip cestu k certifikatum a klici.