This shows you the differences between two versions of the page.
Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
пакет_openvpn [2017/12/06 16:45] val [Настройка с использованием клиентских сертификатов] |
пакет_openvpn [2024/05/08 17:09] val [Настройка с использованием клиентских сертификатов] |
||
---|---|---|---|
Line 8: | Line 8: | ||
<code> | <code> | ||
# apt install openvpn | # apt install openvpn | ||
- | |||
- | # cd /etc/openvpn/ | ||
</code> | </code> | ||
- | ==== FreeBSD ==== | ||
- | <code> | ||
- | # pkg install openvpn | ||
- | # cat /etc/rc.conf | ||
- | </code><code> | ||
- | ... | ||
- | openvpn_enable=yes | ||
- | </code><code> | ||
- | # mkdir /usr/local/etc/openvpn/ | ||
- | |||
- | # cd /usr/local/etc/openvpn/ | ||
- | </code> | ||
==== CentOS 7 ==== | ==== CentOS 7 ==== | ||
Line 39: | Line 25: | ||
=== Настройка сервера === | === Настройка сервера === | ||
<code> | <code> | ||
- | gate# cat openvpn.conf | + | # cp ca.* /etc/ssl/certs/ |
+ | # cp gate.crt /etc/ssl/certs/ | ||
+ | # cp gate.key /etc/ssl/private/ | ||
+ | |||
+ | gate# cat /etc/openvpn/openvpn1.conf | ||
</code><code> | </code><code> | ||
dev tun | dev tun | ||
Line 47: | Line 37: | ||
server 192.168.200+X.0 255.255.255.0 | server 192.168.200+X.0 255.255.255.0 | ||
push "route 192.168.100+X.0 255.255.255.0" | push "route 192.168.100+X.0 255.255.255.0" | ||
- | dh /root/dh1024.pem | + | |
- | ca /root/ca.crt | + | #push "dhcp-option DNS 192.168.X.10" |
- | crl-verify /root/ca.crl | + | #push "block-outside-dns" |
- | cert /root/gate.crt | + | #push "dhcp-option DOMAIN corpX.un" |
- | key /root/gate.key | + | |
- | status /var/log/openvpn-status.log | + | dh /etc/openvpn/dh2048.pem |
+ | |||
+ | ca /etc/ssl/certs/ca.crt | ||
+ | crl-verify /etc/ssl/certs/ca.crl | ||
+ | cert /etc/ssl/certs/gate.crt | ||
+ | key /etc/ssl/private/gate.key | ||
+ | |||
+ | status /var/log/openvpn1-status.log | ||
</code> | </code> | ||
- | === Настройка клиента === | + | === Тестирование конфигурации === |
- | * [[http://val.bmstu.ru/unix/OpenVPN/openvpn-2.1.4-install.exe]] | + | <code> |
+ | # openvpn --config /etc/openvpn/openvpn1.conf | ||
+ | |||
+ | # timeout 5 openvpn --port 65500 --config /etc/openvpn/openvpn1.conf; test $? -eq 124 && echo OK | ||
+ | </code> | ||
+ | |||
+ | === Включение и запуск === | ||
+ | |||
+ | <code> | ||
+ | # systemctl enable openvpn@openvpn1 | ||
+ | |||
+ | # systemctl start openvpn@openvpn1 | ||
+ | </code> | ||
+ | |||
+ | ==== Настройка клиента ==== | ||
+ | |||
+ | === Windows === | ||
+ | |||
+ | * [[https://mail.bmstu.ru/~postmaster/openvpn-install-2.4.0-I601.exe]] | ||
+ | * [[https://openvpn.net/community-downloads/|OpenVPN community downloads]] | ||
* Начиная с Windows 7 необходимо запускать OpenVPN с правами администратора | * Начиная с Windows 7 необходимо запускать OpenVPN с правами администратора | ||
* [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]] | * [[Пакет OpenSSL#Создание пользовательского сертификата, подписанного CA]] | ||
Line 72: | Line 88: | ||
cert user1.crt | cert user1.crt | ||
key user1.key | key user1.key | ||
+ | </code> | ||
+ | |||
+ | === Linux === | ||
+ | |||
+ | <code> | ||
+ | debian:~# apt install openvpn resolvconf wget | ||
+ | |||
+ | debian:~# openvpn --script-security 2 --up /etc/openvpn/update-resolv-conf --down /etc/openvpn/update-resolv-conf --config user1.ovpn | ||
</code> | </code> | ||
Line 79: | Line 103: | ||
<code> | <code> | ||
- | gate# cat openvpn.conf | + | gate# cat /etc/openvpn/openvpn1.conf |
</code><code> | </code><code> | ||
... | ... | ||
Line 85: | Line 109: | ||
... | ... | ||
</code><code> | </code><code> | ||
- | gate# cat ccd/userN | + | gate# cat /etc/openvpn/ccd/userN |
</code><code> | </code><code> | ||
ifconfig-push 192.168.200+X.4*N+2 192.168.200+X.4*N+1 | ifconfig-push 192.168.200+X.4*N+2 192.168.200+X.4*N+1 | ||
</code> | </code> | ||
- | ==== Использование PAM аутентификации вместо клиентских сертификатов ==== | + | ==== Использование PAM аутентификации ==== |
* [[https://www.linuxsysadmintutorials.com/setup-pam-authentication-with-openvpns-auth-pam-module|Setup PAM authentication with OpenVPN's auth-pam module]] | * [[https://www.linuxsysadmintutorials.com/setup-pam-authentication-with-openvpns-auth-pam-module|Setup PAM authentication with OpenVPN's auth-pam module]] | ||
* [[https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam|openvpn/src/plugins/auth-pam/]] | * [[https://github.com/OpenVPN/openvpn/tree/master/src/plugins/auth-pam|openvpn/src/plugins/auth-pam/]] | ||
+ | * [[https://openvpn.net/community-resources/using-alternative-authentication-methods/|OpenVPN Using alternative authentication methods]] | ||
+ | * [[Пакет OpenSSL#Создание самоподписанного сертификата]] | ||
<code> | <code> | ||
- | gate# cat /etc/pam.d/login | + | gate# less /etc/pam.d/login |
- | gate# cat openvpn.conf | + | gate# cat /etc/openvpn/openvpn1.conf |
</code><code> | </code><code> | ||
... | ... | ||
- | plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login | + | #### crl-verify ... |
- | client-cert-not-required | + | |
+ | ca /etc/ssl/certs/server.crt | ||
+ | cert /etc/ssl/certs/server.crt | ||
+ | ... | ||
+ | plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login | ||
+ | verify-client-cert none | ||
username-as-common-name | username-as-common-name | ||
- | ... | + | #duplicate-cn #несколько подключений под одной учетной записью |
</code><code> | </code><code> | ||
- | C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn | + | cmd run as admin C:\>notepad C:\Program Files\OpenVPN\config\client.ovpn |
</code><code> | </code><code> | ||
- | dev tun | + | ... |
- | client | + | |
- | remote 172.16.1.X | + | |
- | ca ca.crt | + | |
auth-user-pass | auth-user-pass | ||
+ | <ca> | ||
+ | -----BEGIN CERTIFICATE----- | ||
+ | ... | ||
+ | -----END CERTIFICATE----- | ||
+ | </ca> | ||
</code> | </code> | ||
==== Использование RADIUS аутентификации и учета ==== | ==== Использование RADIUS аутентификации и учета ==== | ||
Line 122: | Line 155: | ||
==== Debian/Ubuntu/FreeBSD ==== | ==== Debian/Ubuntu/FreeBSD ==== | ||
<code> | <code> | ||
+ | gate.corpX.un# cd /etc/openvpn/ | ||
+ | |||
gate.corpX.un# openvpn --genkey --secret static.key | gate.corpX.un# openvpn --genkey --secret static.key | ||
- | gate.corpX.un# scp static.key gate.corpY.un: | + | gate.corpX.un# scp static.key gate.corpY.un:/etc/openvpn/ |
gate.corpX.un# cat connect_to_Y.conf | gate.corpX.un# cat connect_to_Y.conf | ||
Line 135: | Line 170: | ||
ifconfig 192.168.X+Y.X 192.168.X+Y.Y | ifconfig 192.168.X+Y.X 192.168.X+Y.Y | ||
route 192.168.100+Y.0 255.255.255.0 | route 192.168.100+Y.0 255.255.255.0 | ||
- | secret /root/static.key | + | secret /etc/openvpn/static.key |
</code> | </code> | ||
Line 149: | Line 184: | ||
</code> | </code> | ||
- | ===== Запуск сервиса ===== | ||
- | |||
- | ==== Debian/Ubuntu ==== | ||
- | <code> | ||
- | # service openvpn@openvpn start | ||
- | </code> | ||
===== Мониторинг сервиса ===== | ===== Мониторинг сервиса ===== | ||
<code> | <code> | ||
- | gate# cat /var/log/openvpn-status.log | + | gate# cat /var/log/openvpn1-status.log |
gate# tail -f /var/log/syslog | gate# tail -f /var/log/syslog | ||
- | gate# cat openvpn.conf | + | gate# cat /etc/openvpn/openvpn1.conf |
</code><code> | </code><code> | ||
... | ... | ||
management localhost 7505 | management localhost 7505 | ||
+ | # management 0.0.0.0 7505 | ||
... | ... | ||
</code><code> | </code><code> | ||
Line 171: | Line 201: | ||
</code><code> | </code><code> | ||
status | status | ||
+ | |||
+ | kill user1 | ||
</code> | </code> | ||