Differences

This shows you the differences between two versions of the page.

--- пакет_openvpn [2023/09/20 08:17]
val [Настройка с использованием клиентских сертификатов]
+++ пакет_openvpn [2025/10/20 08:27] (current)
val [Настройка клиента]
@@ Line 25: / Line 25: @@
 === Настройка сервера ===
 <code>
-# cp ca.* /etc/ssl/certs/
+gate#
-# cp gate.crt /etc/ssl/certs/
+cp -v ca.* /etc/ssl/certs/
-# cp gate.key /etc/ssl/private/
+cp -v gate.crt /etc/ssl/certs/
+cp -v gate.key /etc/ssl/private/
 gate# cat /etc/openvpn/openvpn1.conf
@@ Line 38: / Line 39: @@
 push "route 192.168.100+X.0 255.255.255.0"
+#push "route 192.168.X.0 255.255.255.0"
 #push "dhcp-option DNS 192.168.X.10"
 #push "block-outside-dns"
@@ Line 57: / Line 59: @@
 # openvpn --config /etc/openvpn/openvpn1.conf
-# timeout 5 openvpn --config /etc/openvpn/openvpn1.conf; test $? -eq 124 && echo OK
+# timeout 5 openvpn --config /etc/openvpn/openvpn1.conf --management 127.0.0.1 65501 --port 65500; test $? -eq 124 && echo OK
 </code>
@@ Line 73: / Line 75: @@
   * [[https://mail.bmstu.ru/~postmaster/openvpn-install-2.4.0-I601.exe]]
-  * [[https://openvpn.net/community-downloads/|OpenVPN community downloads]]
+  * [[https://openvpn.net/community-downloads/|OpenVPN community downloads]] [[Chrome]]
   * Начиная с Windows 7 необходимо запускать OpenVPN с правами администратора
   * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]]
 <code>
+Start OpenVPN GUI
 C:\>notepad C:\Users\student\OpenVPN\config\user1.ovpn
 </code><code>
@@ Line 89: / Line 93: @@
 key user1.key
 </code>
+  * !!! [[https://serverfault.com/questions/607601/include-certificates-in-ovpn-file|include certificates in .OVPN file]]
 === Linux ===
@@ Line 99: / Line 105: @@
 ==== Индивидуальная настройка параметров клиентов ====
+  * [[https://serverfault.com/questions/1048592/openvpn-routing-from-server-to-client|OpenVPN routing from server to client]]
   * базируется на атрибуте CN
@@ Line 107: / Line 115: @@
 ...
 client-config-dir ccd
+#route 192.168.100+Y.0 255.255.255.0
 ...
 </code><code>
@@ Line 112: / Line 121: @@
 </code><code>
 ifconfig-push 192.168.200+X.4*N+2 192.168.200+X.4*N+1
+#iroute 192.168.100+Y.0 255.255.255.0
 </code>
@@ Line 131: / Line 141: @@
 ca /etc/ssl/certs/server.crt
 cert /etc/ssl/certs/server.crt
+key /etc/ssl/private/server.key
 ...
 plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login
@@ Line 136: / Line 147: @@
 username-as-common-name
 #duplicate-cn  #несколько подключений под одной учетной записью
-</code><code>
+</code>
+  * [[#Тестирование конфигурации]]
+  * [[#Настройка клиента]]
+<code>
 cmd run as admin C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn
-</code><code>
+</code>
+<code>
 ...
 auth-user-pass
+#static-challenge "Enter TOTP Authenticator Code" 1
 <ca>
 -----BEGIN CERTIFICATE-----
@@ Line 146: / Line 164: @@
 -----END CERTIFICATE-----
 </ca>
+</code>
+=== Включение 2FA ===
+<code>
+debian:~# cp /etc/pam.d/login /etc/pam.d/openvpn
+debian:~# cat /etc/pam.d/openvpn
+</code><code>
+auth required pam_google_authenticator.so authtok_prompt=pin
+#auth required pam_google_authenticator.so authtok_prompt=pin user=root secret=/etc/openvpn/google-auth/${USER}
+...
+</code>
+  * [[Использование библиотеки PAM#Использование pamtester]]
+<code>
+# cat /etc/openvpn/openvpn1.conf
+</code><code>
+...
+plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so "openvpn login USERNAME password PASSWORD pin OTP"
+...
+</code><code>
+debian:~# systemctl enable openvpn@openvpn1 --now
+debian:~# journalctl -f
+...
+Aug 29 09:45:09 debian openvpn(pam_google_authenticator)[2483]: Failed to read "/home/student/.google_authenticator" for "student"
+...
+</code><code>
+# systemctl edit openvpn@openvpn1
+</code><code>
+[Service]
+ProtectHome=no
 </code>
 ==== Использование RADIUS аутентификации и учета ====
-  * [[http://itinrussian.ru/freeradius-openvpn-%D0%BD%D0%B0-debian-8/|Freeradius + openvpn]]
+  * [[https://stackoverflow.com/questions/71159790/authenticate-openvpn-users-via-radius-freeradius]]
 ===== Настройка peer2peer конфигурации =====
+  * В новых версиях (с Debian12) теперь так: [[https://wiki.gentoo.org/wiki/OpenVPN/fingerprint-authentication|OpenVPN/fingerprint-authentication]]
 ==== Debian/Ubuntu/FreeBSD ====

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools