OpenVPN Server on EL6 - Revision history

Digimer at 03:53, 5 May 2013

2013-05-05T03:53:27Z

← Older revision		Revision as of 03:53, 5 May 2013
Line 114:		Line 114:
	+export KEY_CITY="Toronto"		+export KEY_CITY="Toronto"
	+export KEY_ORG="Alteeve's Niche!"		+export KEY_ORG="Alteeve's Niche!"
	+export KEY_EMAIL="admin@alteeve.~~com~~"		+export KEY_EMAIL="admin@alteeve.ca"
	</source>		</source>

Line 191:		Line 191:
	Common Name (eg, your name or your server's hostname) [Alteeve's Niche! CA]:		Common Name (eg, your name or your server's hostname) [Alteeve's Niche! CA]:
	Name []:		Name []:
	Email Address [admin@alteeve.~~com~~]:		Email Address [admin@alteeve.ca]:
	</source>		</source>

	=== Generate the Server's Key and Certificate ===		=== Generate the Server's Key and Certificate ===

	Run the following, substituting <span class="code">daimon.alteeve.~~com~~</span> with the name of the server you are using:		Run the following, substituting <span class="code">daimon.alteeve.ca</span> with the name of the server you are using:

	<source lang="bash">		<source lang="bash">
	./build-key-server daimon.alteeve.~~com~~		./build-key-server daimon.alteeve.ca
	</source>		</source>

Line 207:		Line 207:

	<source lang="bash">		<source lang="bash">
	./build-key-server daimon.alteeve.~~com~~		./build-key-server daimon.alteeve.ca
	</source>		</source>
	<source lang="text">		<source lang="text">
Line 213:		Line 213:
	..................................++++++		..................................++++++
	..................................................++++++		..................................................++++++
	writing new private key to 'daimon.alteeve.~~com~~.key'		writing new private key to 'daimon.alteeve.ca.key'
	-----		-----
	You are about to be asked to enter information that will be incorporated		You are about to be asked to enter information that will be incorporated
Line 227:		Line 227:
	Organization Name (eg, company) [Alteeve's Niche!]:		Organization Name (eg, company) [Alteeve's Niche!]:
	Organizational Unit Name (eg, section) []:		Organizational Unit Name (eg, section) []:
	Common Name (eg, your name or your server's hostname) [daimon.alteeve.~~com~~]:		Common Name (eg, your name or your server's hostname) [daimon.alteeve.ca]:
	Name []:		Name []:
	Email Address [admin@alteeve.~~com~~]:		Email Address [admin@alteeve.ca]:

	Please enter the following 'extra' attributes		Please enter the following 'extra' attributes
Line 243:		Line 243:
	localityName :PRINTABLE:'Toronto'		localityName :PRINTABLE:'Toronto'
	organizationName :T61STRING:'Alteeve's Niche!'		organizationName :T61STRING:'Alteeve's Niche!'
	commonName :PRINTABLE:'daimon.alteeve.~~com~~'		commonName :PRINTABLE:'daimon.alteeve.ca'
	emailAddress :IA5STRING:'admin@alteeve.~~com~~'		emailAddress :IA5STRING:'admin@alteeve.ca'
	Certificate is to be certified until Sep 26 04:30:26 2021 GMT (3650 days)		Certificate is to be certified until Sep 26 04:30:26 2021 GMT (3650 days)
	</source>		</source>
Line 295:		Line 295:
	Organizational Unit Name (eg, section) []:		Organizational Unit Name (eg, section) []:
	Common Name (eg, your name or your server's hostname) [digimer-lework]:		Common Name (eg, your name or your server's hostname) [digimer-lework]:
	Email Address [admin@alteeve.~~com~~]:		Email Address [admin@alteeve.ca]:

	Please enter the following 'extra' attributes		Please enter the following 'extra' attributes
Line 310:		Line 310:
	organizationName :PRINTABLE:'Alteeve's Niche!'		organizationName :PRINTABLE:'Alteeve's Niche!'
	commonName :T61STRING:'digimer-lework'		commonName :T61STRING:'digimer-lework'
	emailAddress :IA5STRING:'admin@alteeve.~~com~~'		emailAddress :IA5STRING:'admin@alteeve.ca'
	Certificate is to be certified until Nov 3 03:33:58 2019 GMT (3650 days)		Certificate is to be certified until Nov 3 03:33:58 2019 GMT (3650 days)
	</source>		</source>
Line 418:		Line 418:
	<source lang="text">		<source lang="text">
	###############################################################################		###############################################################################
	# OpenVPN 2.0 config file the for the Alteeve's Niche! 'daimon.alteeve.~~com~~' #		# OpenVPN 2.0 config file the for the Alteeve's Niche! 'daimon.alteeve.ca' #
	# server. #		# server. #
	# #		# #
Line 457:		Line 457:
	#		#
	# See:		# See:
	# https://alteeve.~~com~~/w/OpenVPN_Server_on_EL6#Generate_the_Master_CA_Certificate_and_Key		# https://alteeve.ca/w/OpenVPN_Server_on_EL6#Generate_the_Master_CA_Certificate_and_Key
	# for instructions on generating RSA certificates and private keys. Remember		# for instructions on generating RSA certificates and private keys. Remember
	# to use a unique Common Name for the server and each of the client certificates.		# to use a unique Common Name for the server and each of the client certificates.
Line 467:		Line 467:
	;key keys/server.key # This file should be kept secret		;key keys/server.key # This file should be kept secret
	ca keys/ca.crt		ca keys/ca.crt
	cert keys/daimon.alteeve.~~com~~.crt		cert keys/daimon.alteeve.ca.crt
	key keys/daimon.alteeve.~~com~~.key		key keys/daimon.alteeve.ca.key

	# Diffie hellman parameters.		# Diffie hellman parameters.
Line 709:		Line 709:
	Common Name (eg, your name or your server's hostname) [digimer-lework]:		Common Name (eg, your name or your server's hostname) [digimer-lework]:
	Name []:		Name []:
	Email Address [admin@alteeve.~~com~~]:		Email Address [admin@alteeve.ca]:

	Please enter the following 'extra' attributes		Please enter the following 'extra' attributes
Line 724:		Line 724:
	organizationName :T61STRING:'Alteeve's Niche!'		organizationName :T61STRING:'Alteeve's Niche!'
	commonName :PRINTABLE:'digimer-lework'		commonName :PRINTABLE:'digimer-lework'
	emailAddress :IA5STRING:'admin@alteeve.~~com~~'		emailAddress :IA5STRING:'admin@alteeve.ca'
	Certificate is to be certified until Oct 13 01:24:21 2021 GMT (3650 days)		Certificate is to be certified until Oct 13 01:24:21 2021 GMT (3650 days)
	Sign the certificate? [y/n]:y		Sign the certificate? [y/n]:y
Line 750:		Line 750:
	################################################################################		################################################################################
	# Client-side OpenVPN 2.0 config file for client devices connecting to the #		# Client-side OpenVPN 2.0 config file for client devices connecting to the #
	# Alteeve's Niche! -> 'daimon.alteeve.~~com~~' multi-client OpenVPN server. #		# Alteeve's Niche! -> 'daimon.alteeve.ca' multi-client OpenVPN server. #
	# #		# #
	# This configuration can be used by multiple clients, however each client #		# This configuration can be used by multiple clients, however each client #
Line 780:		Line 780:
	# to load balance between the servers.		# to load balance between the servers.
	;remote my-server-2 1194		;remote my-server-2 1194
	remote daimon.alteeve.~~com~~ 1194		remote daimon.alteeve.ca 1194

	# Choose a random host from the remote list for load-balancing. Otherwise try		# Choose a random host from the remote list for load-balancing. Otherwise try
Line 935:		Line 935:
	\|style="color: #1fdf1f;"\|No		\|style="color: #1fdf1f;"\|No
	\|-		\|-
	\|<span class="code">daimon.alteeve.~~com~~.crt</span>		\|<span class="code">daimon.alteeve.ca.crt</span>
	\|<span class="code">daimon.alteeve.~~com~~</span> server only		\|<span class="code">daimon.alteeve.ca</span> server only
	\|Server Certificate		\|Server Certificate
	\|style="color: #1fdf1f;"\|No		\|style="color: #1fdf1f;"\|No
	\|-		\|-
	\|<span class="code">daimon.alteeve.~~com~~.key</span>		\|<span class="code">daimon.alteeve.ca.key</span>
	\|<span class="code">daimon.alteeve.~~com~~</span> server only		\|<span class="code">daimon.alteeve.ca</span> server only
	\|Server Key		\|Server Key
	\|style="color: #df1f1f;"\|Yes		\|style="color: #df1f1f;"\|Yes

Digimer: Undo revision 3720 by Digimer (talk)

2011-12-11T06:13:20Z

Undo revision 3720 by Digimer (talk)

Show changes

Digimer at 22:26, 23 October 2011

2011-10-23T22:26:39Z

Show changes

Digimer: /* Starting */

2011-10-16T02:12:19Z

Starting

← Older revision		Revision as of 02:12, 16 October 2011
Line 958:		Line 958:
	\|}		\|}

	= Starting =		== Starting OpenVPN On The Client ==

	~~With all~~ the ~~files ready, it's~~ now ~~time~~ to ~~copy~~ the server~~'s files from the <span class="code">keys</span> directory:~~		You should now be able to start the OpenVPN daemon on the client machines now. This is identical to starting it on the server.

	<source lang="bash">		<source lang="bash">
	cd /etc/~~openvpn/~~		/etc/init.d/openvpn start
	~~mv keys/dh2048~~.~~pem .~~		</source>
	~~mv keys~~/~~daimon.alteeve.com.crt .~~		<source lang="bash">
	~~mv keys~~/~~daimon.alteeve.com.key .~~		Starting openvpn: [ OK ]
	~~mv keys/ca.crt .~~
	~~mv keys/ca.key .~~
	</source>		</source>

	~~Now start~~ the ~~server and then set it to~~ start ~~on boot. If you have any trouble~~, ~~tail~~ <span class="code">/var/log/messages</span> for ~~a clue:~~		If the start fails, look in <span class="code">/var/log/messages</span> for clues to the problem.

	<~~source lang~~="~~bash~~">		To confirm that the server is up, check the interfaces and you should now see a <span class="code">tun0</span> device.
	~~/etc/init.d/openvpn start~~
	~~chkconfig openvpn on~~
	</~~source~~>

			{{note\|1=If you have anything already using <span class="code">tun0</span>, the '0' will be incremented to the first free integer.}}

	<source lang="bash">		<source lang="bash">
			ifconfig tun0
	</source>		</source>
	<source lang="~~text~~">		<source lang="bash">
			tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
			inet addr:10.30.0.10 P-t-P:10.30.0.9 Mask:255.255.255.255
			UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
			RX packets:0 errors:0 dropped:0 overruns:0 frame:0
			TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
			collisions:0 txqueuelen:100
			RX bytes:0 (0.0 b) TX bytes:0 (0.0 b)
	</source>		</source>

			You should now be able to connect to the server, and vice-versa, using the <span class="code">10.30.0.0</span> network.

			''Done!!''

	{{footer}}		{{footer}}

Digimer: /* Starting The Server */

2011-10-16T02:05:41Z

Starting The Server

← Older revision		Revision as of 02:05, 16 October 2011
Line 653:		Line 653:

	If the start fails, look in <span class="code">/var/log/messages</span> for clues to the problem.		If the start fails, look in <span class="code">/var/log/messages</span> for clues to the problem.

			To confirm that the server is up, check the interfaces and you should now see a <span class="code">tun0</span> device.

			{{note\|1=If you have anything already using <span class="code">tun0</span>, the '0' will be incremented to the first free integer.}}

			<source lang="bash">
			ifconfig tun0
			</source>
			<source lang="bash">
			tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
			inet addr:10.30.0.1 P-t-P:10.30.0.2 Mask:255.255.255.255
			UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
			RX packets:34 errors:0 dropped:0 overruns:0 frame:0
			TX packets:42 errors:0 dropped:0 overruns:0 carrier:0
			collisions:0 txqueuelen:100
			RX bytes:4621 (4.5 KiB) TX bytes:4997 (4.8 KiB)
			</source>

	= Client Setup =		= Client Setup =

Digimer: /* Client Setup */

2011-10-16T01:56:45Z

Client Setup

Show changes

Digimer: /* client.conf */

2011-10-16T01:25:10Z

client.conf

@@ Line 641: / Line 641: @@
 </source>
-=== client.conf ===
+=== Starting The Server ===
 This file can be created on the server and then sent to the client, or created directly on the client device if you have access to it.

Digimer: /* client.conf */

2011-10-16T00:41:27Z

client.conf

← Older revision		Revision as of 00:41, 16 October 2011
Line 642:		Line 642:

	=== client.conf ===		=== client.conf ===

			This file can be created on the server and then sent to the client, or created directly on the client device if you have access to it.

	The most important lines to change for each new client device are:		The most important lines to change for each new client device are:
Line 724:		Line 726:
	;cert digimer-lework.crt		;cert digimer-lework.crt
	;key digimer-lework.key		;key digimer-lework.key
	cert keys/an-~~node02~~.crt		cert keys/digimer-lework.crt
	key keys/an-~~node02~~.key		key keys/digimer-lework.key

	# Verify server certificate by checking that the certicate has the nsCertType		# Verify server certificate by checking that the certicate has the nsCertType

Digimer: /* Files to Send to the Client */

2011-10-16T00:40:27Z

Files to Send to the Client

← Older revision		Revision as of 00:40, 16 October 2011
Line 776:		Line 776:
	Now that you've generated the keys, switch into the <span class="code">/etc/openvpn/keys</span> directory. You will need to send the following to the client.		Now that you've generated the keys, switch into the <span class="code">/etc/openvpn/keys</span> directory. You will need to send the following to the client.

	~~Before you~~ send ~~any~~ files to the ~~client~~, ~~make them a copy of the <span class="code">client.conf</span> file and edit the following lines~~ to ~~reflect~~ their ~~certificate and key names. For example, if we used the name <span class="code">digimer-lework</span> when creating their key, uncomment and change:~~		{{warning\|1=Be sure to send these files to the user over secure channels, preferably directly to their device!}}

	~~<source lang="bash">~~		From
	~~;cert digimer-lework.crt~~
	~~;key digimer-lework.key~~
	~~</source>~~

	~~To:~~

	<source lang="bash">		<source lang="bash">
	~~cert~~ digimer-lework.crt		keys/ca.crt
	~~key~~ digimer-lework.key		keys/digimer-lework.crt
			keys/digimer-lework.key
	</source>		</source>

	~~'''Note that the updated lines are uncommented!'''~~

	~~Now pack up these four files and '''''securely''''' send them to the user, preferably directly to their device:~~

	* ca.crt
	* client.conf
	* digimer-lework.crt
	* digimer-lework.key

	==== *nix Client Connects to One Server ====		==== *nix Client Connects to One Server ====

Digimer: /* OpenVPN Client Software Install */

2011-10-16T00:37:06Z

OpenVPN Client Software Install

← Older revision		Revision as of 00:37, 16 October 2011
Line 763:		Line 763:

	How the client installs the OpenVPN software depends on the specifics of their operating system.		How the client installs the OpenVPN software depends on the specifics of their operating system.

			On RPM based systems, you can install the OpenVPN package. On [[EL6]] machines, this will require installing from the DAG repositories as was done for the server.

	On Ubuntu and other Debian-derivative distributions, run:		On Ubuntu and other Debian-derivative distributions, run:

	<~~span class~~="~~code~~">~~sudo~~ apt-get install openvpn</~~span~~>		<source lang="bash">
			apt-get install openvpn
			</source>

	==== Files to Send to the Client ====		==== Files to Send to the Client ====