Openvpn | Записки системного администратора

Записи с меткой ‘Openvpn’

Установка и настройка OpenVPN-сервера на Debian8

Июль 7th, 2016

Evgeniy Kamenev

1.Установка OpenVPN-сервера

# apt-get install openvpn openssl

1	# apt-get install openvpn openssl

# mkdir /etc/openvpn/easy-rsa/

1	# mkdir /etc/openvpn/easy-rsa/

# cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

1	# cp -r /usr/share/easy-rsa/* /etc/openvpn/easy-rsa/

# cd /etc/openvpn/easy-rsa/

1	# cd /etc/openvpn/easy-rsa/

2.Настройка переменных окружения

# nano  vars

1	# nano vars

export KEY_COUNTRY="UA"
export KEY_PROVINCE="Kharkov"
export KEY_CITY="Kharkov"
export KEY_ORG="IT"
export KEY_EMAIL="admin@mydomain.com"
export KEY_OU="IT-Department"

export KEY_COUNTRY="UA"

export KEY_PROVINCE="Kharkov"

export KEY_CITY="Kharkov"

export KEY_ORG="IT"

export KEY_EMAIL="admin@mydomain.com"

export KEY_OU="IT-Department"

Выполняем инициализацию переменных.

# source ./vars

1	# source ./vars

NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

1	NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easy-rsa/keys

Удаляем старые ключи

# ./clean-all

1	# ./clean-all

3.Создание сертификатов и ключей Создаём корневой сертификат и ключ:

# ./build-ca

1	# ./build-ca

Generating a 2048 bit RSA private key
....+++
.....................+++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [IT CA]:server
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Generating a 2048 bit RSA private key

....+++

.....................+++

writing new private key to 'ca.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [IT CA]:server

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Создаём сертификат и ключ для сервера:

# ./build-key-server server

1	# ./build-key-server server

Generating a 2048 bit RSA private key
................+++
...............+++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [server]:
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UA'
stateOrProvinceName   :PRINTABLE:'Kharkov'
localityName          :PRINTABLE:'Kharkov'
organizationName      :PRINTABLE:'IT'
organizationalUnitName:PRINTABLE:'IT-Department'
commonName            :PRINTABLE:'server'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'admin@mydomain.com'
Certificate is to be certified until Jul  4 20:31:26 2026 GMT (3650 days)
Sign the certificate? [y/n]:y 



1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Generating a 2048 bit RSA private key

................+++

...............+++

writing new private key to 'server.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [server]:

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName :PRINTABLE:'UA'

stateOrProvinceName :PRINTABLE:'Kharkov'

localityName :PRINTABLE:'Kharkov'

organizationName :PRINTABLE:'IT'

organizationalUnitName:PRINTABLE:'IT-Department'

commonName :PRINTABLE:'server'

name :PRINTABLE:'EasyRSA'

emailAddress :IA5STRING:'admin@mydomain.com'

Certificate is to be certified until Jul 4 20:31:26 2026 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Создаем ключ и сертификат для клиента user1

# ./build-key user1

1	# ./build-key user1

Generating a 2048 bit RSA private key
................................................................+++
...................................+++
writing new private key to 'user1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [UA]:
State or Province Name (full name) [Kharkov]:
Locality Name (eg, city) [Kharkov]:
Organization Name (eg, company) [IT]:
Organizational Unit Name (eg, section) [IT-Department]:
Common Name (eg, your name or your server's hostname) [user1]:
Name [EasyRSA]:
Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'UA'
stateOrProvinceName   :PRINTABLE:'Kharkov'
localityName          :PRINTABLE:'Kharkov'
organizationName      :PRINTABLE:'IT'
organizationalUnitName:PRINTABLE:'IT-Department'
commonName            :PRINTABLE:'user1'
name                  :PRINTABLE:'EasyRSA'
emailAddress          :IA5STRING:'admin@mydomain.com'
Certificate is to be certified until Jul  4 20:32:23 2026 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Generating a 2048 bit RSA private key

................................................................+++

...................................+++

writing new private key to 'user1.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [UA]:

State or Province Name (full name) [Kharkov]:

Locality Name (eg, city) [Kharkov]:

Organization Name (eg, company) [IT]:

Organizational Unit Name (eg, section) [IT-Department]:

Common Name (eg, your name or your server's hostname) [user1]:

Name [EasyRSA]:

Email Address [admin@mydomain.com]:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

Using configuration from /etc/openvpn/easy-rsa/openssl-1.0.0.cnf

Check that the request matches the signature

Signature ok

The Subject's Distinguished Name is as follows

countryName :PRINTABLE:'UA'

stateOrProvinceName :PRINTABLE:'Kharkov'

localityName :PRINTABLE:'Kharkov'

organizationName :PRINTABLE:'IT'

organizationalUnitName:PRINTABLE:'IT-Department'

commonName :PRINTABLE:'user1'

name :PRINTABLE:'EasyRSA'

emailAddress :IA5STRING:'admin@mydomain.com'

Certificate is to be certified until Jul 4 20:32:23 2026 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Аналогично […]

Опубликовано в рубрике Debian/Ubuntu, Other

Метки: Openvpn, vpn

Комментарии отключены

Установка и настройка Openvpn на FreeBSD

Ноябрь 10th, 2013

Evgeniy Kamenev

1.Установить из портов Openvpn: а) cd /usr/ports/security/openvpn б) make в) make install 2.Скопировать папку easy-rsa из /usr/local/share/doc/openvpn в /home/test(это пример,на самом деле можно копировать в любое место) 3.В /easy-rsa/vars отредактировать переменные export KEY_COUNTRY=UK export KEY_PROVINCE=KH export KEY_CITY=KHARKOV export KEY_ORG=»server» export KEY_EMAIL=test@kiev.ua #E-Mail администратора 4.На папку /easy-rsa дать права 4755: Chmod –R 4755 /home/test/easy-rsa 5.Перейти в […]

Опубликовано в рубрике FreeBSD, Security

Метки: Openvpn

Комментарии отключены

Установка и настройка OpenVPN на Centos6/7

Ноябрь 6th, 2013

Evgeniy Kamenev

1.Установка OpenVPN-сервера

# yum install openvpn easy-rsa

1	# yum install openvpn easy-rsa

2. Создание сертификатов/ключей Создаём директорию для сертификатов

# mkdir -p /etc/openvpn/easy-rsa/keys

1	# mkdir -p /etc/openvpn/easy-rsa/keys

Копируем необходимые файлы:

# cp -r /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

1	# cp -r /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/

Редактируем файл с переменными

# nano /etc/openvpn/easy-rsa/vars

1	# nano /etc/openvpn/easy-rsa/vars

export KEY_COUNTRY="UA"
export KEY_PROVINCE="Kharkov"
export KEY_CITY="Kharkov"
export KEY_ORG="MyOrganization"
export KEY_EMAIL="root@server.mydomain.com"
export KEY_OU="IT-Department"
export KEY_CN="server.mydomain.com"

export KEY_COUNTRY="UA"

export KEY_PROVINCE="Kharkov"

export KEY_CITY="Kharkov"

export KEY_ORG="MyOrganization"

export KEY_EMAIL="root@server.mydomain.com"

export KEY_OU="IT-Department"

export KEY_CN="server.mydomain.com"

Создание сертфикатов и ключей Перечитываем файл vars(выполняем инициализацию переменных)

# cd /etc/openvpn/easy-rsa/

1	# cd /etc/openvpn/easy-rsa/

# . ./vars

1	# . ./vars

Удаляем старые ключи

# ./clean-all

1	# ./clean-all

Создаём корневой сертификат и ключ:

# ./build-ca

1	# ./build-ca

Проверяем наличие CA(CentralAuthority) сертификатов

# ls -al /etc/openvpn/easy-rsa/keys/ | grep ca\.

1	# ls -al /etc/openvpn/easy-rsa/keys/ \| grep ca\.

-rw-r--r-- 1 root root 1854 Dec 25 19:20 ca.crt
-rw------- 1 root root 1704 Dec 25 19:20 ca.key

1 2	-rw-r--r-- 1 root root 1854 Dec 25 19:20 ca.crt -rw------- 1 root root 1704 Dec 25 19:20 ca.key

Если будет сообщение о том, что […]

Опубликовано в рубрике Centos, Security

Метки: Openvpn

Комментарии отключены

Записи с меткой ‘Openvpn’

Установка и настройка OpenVPN-сервера на Debian8

Установка и настройка Openvpn на FreeBSD

Установка и настройка OpenVPN на Centos6/7

Страницы

Свежие записи

Архивы

Рубрики

Админ-панель