当前位置：网站首页>Open那啥的搭建文档
Open那啥的搭建文档
2022-07-02 01:58:00 【低调说】
公司之前那个鬼人安装了1个不用用户密码认证就能登录的，然后他跑了，这破玩意搭建就到我身上了，我一开始也没弄过，折腾了3天终于给他搞定了。
后来TM的能连上了，服务器登录不了，配置没啥问题，后来逼得我看日志，我这知道怎么回事，终于没毛病了。赶紧给记录下来。
这是准备工作 ，先给安装一下，准备下东西。
OpenVPN install document
yum install openvpn
yum install easy-rsa
mkdir /etc/openvpn/easy-rsa && cd /etc/openvpn/easy-rsa
cp -r /usr/share/easy-rsa/3.0.8/* /etc/openvpn/easy-rsa/
cp /usr/share/doc/easy-rsa-3.0.8/vars.example /etc/openvpn/easy-rsa/vars
这个东西要改改，这里应该还有个可以改证书时间的东西，我没改，你们可以找找
vim /etc/openvpn/easy-rsa/vars
set_var EASYRSA_DN "cn_only"
set_var EASYRSA_REQ_COUNTRY "CN"
set_var EASYRSA_REQ_PROVINCE "Beijing"
set_var EASYRSA_REQ_CITY "Beijing"
set_var EASYRSA_REQ_ORG "cabpo.net"
set_var EASYRSA_REQ_EMAIL "[email protected]"
set_var EASYRSA_REQ_OU "cabpo"
初始化创建pki目录用于存储证书
/etc/openvpn/easy-rsa/easyrsa init-pki
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa init-pki
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki
创建根证书，根证书用于ca对之后生成的server和client证书签名时使用
/etc/openvpn/easy-rsa/easyrsa build-ca
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa build-ca
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Enter New CA Key Passphrase: (输入自定义密码)
Re-Enter New CA Key Passphrase: (输入自定义密码)
Generating RSA private key, 2048 bit long modulus
........................+++
.....................................................................+++
e is 65537 (0x10001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:(回车)
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/pki/ca.crt
创建server端证书和密钥文件(nopass表示不加密密钥文件，生成过程中直接默认回车)
/etc/openvpn/easy-rsa/easyrsa gen-req server nopass
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa gen-req server nopass
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
......................................................................+++
.............+++
writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-19178.xyEJwt/tmp.NTyyFh'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [server]:(回车)
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/server.req
key: /etc/openvpn/easy-rsa/pki/private/server.key
给server端证书签名
/etc/openvpn/easy-rsa/easyrsa sign server server
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa sign server server
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 825 days:
subject=
commonName = server
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-19206.WkkjHk/tmp.giM6Ps
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:(输入自定义的CA密码,如果忘记就再来一遍)
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server'
Certificate is to be certified until Oct 1 06:52:05 2024 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/server.crt #证书位置
创建Diffie-Hellman文件，密钥交换时的Diffie-Hellman算法
/etc/openvpn/easy-rsa/easyrsa gen-dh
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa gen-dh
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
..+....................................................+.......+.................................................................................................................................................................................................+..............................................+...........................+.............................+................................................................................................................................+...........................................................................................................+................................................................................+..............................................................................................................................................+........................................+..........+................................................................................................................................................................................................................................................+...........................................+.........................................................................................+...................................................+.....................................................................................................................................................................................................................................+............................................................................................................................................................................................................................+.....+..........................................................................................................+.......+........................+.........................................................................................................................................................+...................+..........+..................+...............................+..................................................................................+............+...........................................................................+..........+............................................................................+..........................................+.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................+....................+...............................+..............+..........................................................................+.....................................................................................................................+....................................+.........................................................................................................................................+........................+...............................................+...............................+..............+...................................................................................................................................................................................................................................+..............................................+............................................................................+.....................................................................................................+....................................................................+.+...............................................................................+.....................................................................................+....................+...............................................................................................................................................................................................................................................................................................................................+................+....................................................................+.........................................................................................................................................................................................................................................+........................................................................+...........................+.................................+......................................................................................................................................................................................+...............+....................++*++*
DH parameters of size 2048 created at /etc/openvpn/easy-rsa/pki/dh.pem
创建client端证书和密钥文件(nopass表示不加密密钥文件，生成过程中直接默认回车)
/etc/openvpn/easy-rsa/easyrsa gen-req client nopass
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa gen-req client nopass
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
Generating a 2048 bit RSA private key
.................................................................................................................+++
........................+++
writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa-19354.8qb3q9/tmp.KMQYGU'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [client]:(默认回车)
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/client.req
key: /etc/openvpn/easy-rsa/pki/private/client.key
给client端证书签名
/etc/openvpn/easy-rsa/easyrsa sign client client
[[email protected] easy-rsa]# /etc/openvpn/easy-rsa/easyrsa sign client client
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 825 days:
subject=
commonName = client
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes(这里要输入yes)
Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa-19420.6Lzvxz/tmp.EzirLF
Enter pass phrase for /etc/openvpn/easy-rsa/pki/private/ca.key:(输入自定义的CA密码)
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows commonName :ASN.1 12:'client'
Certificate is to be certified until Oct 1 07:07:29 2024 GMT (825 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/client.crt
创建TLS认证密钥
openvpn --genkey --secret /etc/openvpn/ta.key
[[email protected] openvpn]# openvpn --genkey --secret /etc/openvpn/ta.key
[[email protected] openvpn]# ls
client easy-rsa server ta.key
将生成的密钥进行集中存储。并且修改server.conf配置文件指向密钥的路径
mkdir /etc/openvpn/server_keys
cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/server_keys/
cp /etc/openvpn/easy-rsa/pki/private/server.key /etc/openvpn/server_keys/
cp /etc/openvpn/easy-rsa/pki/issued/server.crt /etc/openvpn/server_keys/
cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server_keys/
cp /etc/openvpn/ta.key /etc/openvpn/server_keys/
创建server.conf
vim /etc/openvpn/server.conf
local 10.0.1.192
# 监听本机端口
port 11194
# 指定采用的传输协议,可选tcp或udp
proto tcp
# 指定创建的通信隧道类型,可选tun或tap
dev tun
# 指定CA证书的文件路径
ca /etc/openvpn/server_keys/ca.crt
# 指定服务器端的证书文件路径
cert /etc/openvpn/server_keys/server.crt
# 指定服务器端的私钥文件路径
key /etc/openvpn/server_keys/server.key
# 指定迪菲赫尔曼参数的文件路径,也就是交换证书
dh /etc/openvpn/server_keys/dh.pem
# 安全问题
cipher AES-256-CBC
# 给客户端分配地址池,注意:不能和VPN服务器内网网段有相同 这个一定得注意
# 比如你的eth0 10.0.1.192 你再添加下面的10.8 这个路由就出错了
server 10.8.0.0 255.255.255.0
# 允许客户端访问内网网段
# push "route 10.8.0.0 255.255.0.0"
# 服务器自动给客户端分配IP后,客户端下次连接时,仍然采用上次的IP地址"第一次分配的IP保存在ipp.txt中,下一次分配其中保存的IP"
push "redirect-gateway def1 bypass-dhcp" #给网关
push "dhcp-option DNS 114.114.114.114" #dhcp分配dns
ifconfig-pool-persist ipp.txt
# 存活时间,10秒ping一次,120如未收到响应则视为断线
keepalive 10 120
# 最多允许100个客户端连接
max-clients 100
# 日志记录位置
status openvpn-status.log
#openvpn版本
verb 3
# 允许客户端与客户端相连接,默认情况下客户端只能与服务器相连接
client-to-client
# openvpn日志记录位置
log /var/log/openvpn.log
# 通过keepalive检测超时后,重新启动VPN,不重新读取keys,保留第一次使用的keys
persist-key
#检测超时后,重新启动VPN,一直保持tun是linkup的.否则网络会先linkdown然后再linkup
persist-tun
#开启TLS-auth,使用ta.key防御攻击.服务器端的第二个参数值为0,客户端的为1
tls-auth /etc/openvpn/server_keys/ta.key 0
# 新增配置
#允许使用自定义脚本
script-security 3
# 脚本路径
auth-user-pass-verify /etc/openvpn/check.sh via-env
# 用户密码登陆方式验证
username-as-common-name
# 则代表只使用用户名密码方式验证登录，如果不加，则代表需要证书和用户名密码双重验证登录
client-cert-not-required
做密码验证还要密码脚本和账号密码文件
[[email protected] ~]# vim /etc/openvpn/check.sh
#!/bin/sh
###########################################################
PASSFILE="/etc/openvpn/openvpnpass"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`
if [ ! -r "${PASSFILE}" ]; then
echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${
username}'"{print $2;exit}' ${
PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
exit 0
fi
echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
chmod 755 check.sh
echo 'hans zhang870731' > psw-file
新用户直接写到这里就可以了
[[email protected] openvpn]# openvpn --config server.conf --daemon
[[email protected] openvpn]# ps -ef | grep openvpn
root 19766 1 0 16:06 ? 00:00:00 openvpn --config server.conf --daemon
root 19795 18724 0 16:06 pts/0 00:00:00 grep --color=auto openvpn
[[email protected] log]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.0.46 netmask 255.255.255.0 broadcast 192.168.0.255
inet6 fe80::f816:3eff:fec2:1a48 prefixlen 64 scopeid 0x20<link>
ether fa:16:3e:c2:1a:48 txqueuelen 1000 (Ethernet)
RX packets 73989 bytes 72395781 (69.0 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 93019 bytes 7348052 (7.0 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1000 (Local Loopback)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tun0: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1500
inet 10.8.0.1 netmask 255.255.255.255 destination 10.8.0.2
inet6 fe80::3a6b:5910:d875:982e prefixlen 64 scopeid 0x20<link>
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 3 bytes 144 (144.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
# 建立防火墙规则
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
# 或者这样写规则
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 10.0.1.192
建立客户端配置文件
client.ovpn
#指定当前VPN是客户端
client
#使用tun隧道传输协议
dev tun
#使用udp协议传输数据
proto tcp
#openvpn服务器IP地址端口号
remote x.x.x.x 1194
#断线自动重新连接，在网络不稳定的情况下非常有用
resolv-retry infinite
#不绑定本地特定的端口号
nobind
cipher AES-256-CBC #安全问题
#指定CA证书的文件路径
ca ca.crt
#指定当前客户端的证书文件路径
cert client.crt
#指定当前客户端的私钥文件路径
key client.key
#指定日志文件的记录详细级别，可选0-9，等级越高日志内容越详细
verb 3
#通过keepalive检测超时后，重新启动VPN，不重新读取keys，保留第一次使用的keys
persist-key
#检测超时后，重新启动VPN，一直保持tun是linkup的。否则网络会先linkdown然后再linkup
persist-tun
#使用ta.key防御攻击。服务器端的第二个参数值为0，客户端的为1
tls-auth ta.key 1
auth-user-pass
还得把ca.crt client.key client.cert ta.key 和client.ovpn放到一个目录就可以了
边栏推荐
- Software No.1
- New news, Wuhan Yangluo international port, filled with black technology, refreshes your understanding of the port
- 分卷压缩，解压
- 1217 supermarket coin processor
- Based on configured schedule, the given trigger will never fire
- 花一个星期时间呕心沥血整理出高频软件测试/自动化测试面试题和答案
- Number of palindromes in C language (leetcode)
- Ks006 student achievement management system based on SSM
- 剑指 Offer 42. 连续子数组的最大和
- Exception handling of class C in yyds dry goods inventory
猜你喜欢
leetcode2312. Selling wood blocks (difficult, weekly race)
1069. Division of convex polygons (thinking, interval DP)
leetcode2310. The one digit number is the sum of integers of K (medium, weekly)
Design and implementation of key value storage engine based on LSM tree
matlab 使用 audioread 、 sound 读取和播放 wav 文件
Medical management system (C language course for freshmen)
leetcode2309. The best English letters with both upper and lower case (simple, weekly)
Another programmer "deleted the library and ran away", deleted the code of the retail platform, and was sentenced to 10 months
From January 11, 2007 to January 11, 2022, I have been in SAP Chengdu Research Institute for 15 years
k线图形态这样记（口诀篇）
随机推荐
剑指 Offer 62. 圆圈中最后剩下的数字
MPLS experiment operation
Experimental reproduction of variable image compression with a scale hyperprior
遷移雲計算工作負載的四個基本策略
Deep learning: a solution to over fitting in deep neural networks
Three core problems of concurrent programming
leetcode2305. Fair distribution of biscuits (medium, weekly, shaped pressure DP)
Redis环境搭建和使用的方法
Based on configured schedule, the given trigger will never fire
Volume compression, decompression
MySQL主从延迟问题怎么解决
如何远程、在线调试app？
leetcode2309. 兼具大小写的最好英文字母（简单，周赛）
医药管理系统（大一下C语言课设）
[Video] visual interpretation of Markov chain principle and Mrs example of R language region conversion | data sharing
Raspberry pie 4B learning notes - IO communication (1-wire)
Design and implementation of key value storage engine based on LSM tree
成功实现边缘编码需要了解的六大经验教训
The concept, function, characteristics, creation and deletion of MySQL constraints
leetcode2305. 公平分发饼干（中等，周赛，状压dp）