关于本文档 · 贡献者 · 文档协议 · 致谢
关于本文档
文档名称：《企业级VPN服务 OpenVPN》
使用协议：《知识共享公共许可协议(CCPL)》
贡献者
| 贡献者名称 | 贡献度 | 文档变更记录 | 个人主页 |
|---|---|---|---|
| 马哥（马永亮） | 主编 | http://github.com/iKubernetes/ | |
| 王晓春 | 作者 | 版本v2.0共71页 | http://www.wangxiaochun.com |
文档协议
署名要求 ：使用本系列文档，您必须保留本页中的文档来源信息，具体请参考《知识共享 (Creative Commons) 署名4.0公共许可协议国际版》。
非商业化使用 ：遵循《知识共享公共许可协议(CCPL)》，并且您不能将本文档用于马哥教育相关业务之外的其他任何商业用途。
您的权利 ：遵循本协议后，在马哥教育相关业务之外的领域，您将有以下使用权限：
共享 — 允许以非商业性质复制本作品。
改编 — 在原基础上修改、转换或以本作品为基础进行重新编辑并用于个人非商业使用。
致谢
本文档中，部分素材参考了相关项目的文档，以及通过搜索引擎获得的内容，这里先一并向相关的贡献者表示感谢。
本章内容
-
OpenVPN 简介
-
OpenVPN 部署
-
OpenVPN 管理
1 OpenVPN简介
1.1 VPN 介绍
一些组织需要实现跨地域的互相通信,比如:北京总公司和上海分公司之间进行网络互通,一般通过下面两种方式实现
专用网：
所谓专用网就是在两个网络（例如，北京总公司和广州分公司）的网络之间架设一条专用线路，但是它并不需要真正地去铺设光缆之类的物理线路。虽然没有实际去铺设网线，但是仍需要向电信运营商申请租用专线，在这条专用的线路上只传输自己组织之间的数据信息,所以此方式安全稳定,同时也费用高昂
VPN：
Virtual Private Network，虚拟私有网络，或称为虚拟专用网络，常用于在公用网络上实现专用网络功能，为了安全通常需要进行加密通讯。此方式在企业网络中有广泛应用。VPN网关通过对数据包的加密和数据包目标地址的转换实现远程访问。VPN功能可通过服务器、网络硬件、软件等多种方式实现
1.2 VPN 常见应用模式
1.2.1 点对站点 peer to site
1.2.2 站点对站点 site to site
1.3 OpenVPN
OpenVPN 是Linux下开源VPN的应用，提供了良好的性能和友好的用户GUI。
OpenVPN 是一个基于 OpenSSL 库的应用层 VPN 实现。和传统 VPN 相比，它的优点是简单易用。
OpenVPN允许参与建立VPN的单点使用共享密钥，电子证书，或者用户名/密码来进行身份验证。 OpenVPN支持在各种系统,,如:Linux、Windows、Mac OS X、Solaris、OpenBSD、FreeBSD、 NetBSD上运行，并包含了许多安全性的功能。它并不是一个基于Web的VPN软件，也不与IPsec及其他 VPN软件包兼容。
官方网站：https://openvpn.net
GitHub地址：https://github.com/OpenVPN/openvpn
OpenVPN 常见适用场景
实现远程主机到内网的连接
- 实现多个远程主机之间的连接
2 OpenVPN 部署
2.1 准备 OpenVPN 部署环境
官文文档: https://openvpn.net/community-resources/how-to/
可选择以下两套环境之一实现OpenVPN
2.1.1 环境1: 阿里云 OpenVPN 实战环境
准备阿里云网络实验环境
1 阿里云创建专有网络指定城市和可用区:华北3张家口可用区A区网段名magedu-net1和地址段172.16.0.0/12,默认资源组交换机名magedu-net1-sw1 可用区A IPv4的地址段 172.30.0.0/24 安全组开放22端口 2 创建OpenVPN服务器有公网IP的实例1个指定城市和可用区:华北3张家口可用区A区计算型c6 2vCPU 4G 网络:magedu-net1 交换机:magedu-net1-sw1 公网IP 按量收费 10M 默认安全组默认配置 22,3389,icmp centos8.2 系统盘存储默认高效云盘40G 3 创建局域网的服务器无公网IP的实例2个按量付费指定城市和可用区:华北3张家口可用区A区共享型 2vCPU2G centos8.2 系统盘存储默认高效云盘40G 网络:magedu-net1 magedu-net1-sw1 无公网IP 默认安全组主网卡sw1 4 重设所有实例密码 5 修改安全组打开 1194/TCP/UDP
2.1.1.1 购买第一台有公网IP的ECS
阿里云购买链接
https://ecs-buy.aliyun.com/wizard? spm=5176.8789780.1092585.1.1db055ca1sGhza#/prepay/cn-hangzhou? periodType=Yearly&period=1&instanceType=ecs.g5.large
2.1.1.2 先创建网络和交换机
创建交换机
2.1.1.3 再购买两台内网无公网的ECS
注意和第一台主机在同一个地域和可用区
网络和第一台主机一样,无公网IP
2.1.1.4 验证主机配置
创建完成,三台主机
[root@centos8 ~]#ssh 39.100.145.14 root@39.100.145.14's password:
Welcome to Alibaba Cloud Elastic Compute Service !
Activate the web console with: systemctl enable --now cockpit.socket
Last failed login: Tue Sep 15 10:15:15 CST 2020 from 222.137.18.20 on ssh:notty There was 1 failed login attempt since the last successful login. Last login: Tue Sep 15 10:13:10 2020 from 222.137.18.20 [root@vpn-server ~]# hostname -I 172.30.0.1 [root@vpn-server ~]# hostname vpn-server.magedu.org [root@vpn-server ~]# cat /etc/centos-release CentOS Linux release 8.2.2004 (Core)
[root@web1 ~]# hostname -I 172.30.0.100 [root@web1 ~]# hostname web1.magedu.org [root@web1 ~]# cat /etc/centos-release CentOS Linux release 8.2.2004 (Core)
[root@web2 ~]# hostname web2.magedu.org [root@web2 ~]# hostname -I 172.30.0.200 [root@web2 ~]# cat /etc/centos-release CentOS Linux release 8.2.2004 (Core)
2.1.1.5 修改网络防火墙规则
默认VPN的端口无法访问,修改网络防火墙规则,添加1规则实现1194/TCP/UDP端口允许通过
2.1.2 环境2: 局域网 OpenVPN 实战环境
共四台主机 1 openvpn server： CentOS 8.2 eth0:10.0.0.8/24 NAT模式,模拟公网IP eth1:172.30.0.1/24 仅主机模式,私网IP 2 内网主机两台第一台主机 eth0:172.30.0.100/24 仅主机模式,私网IP，无需网关第二台主机 eth0:172.30.0.200/24 仅主机模式,私网IP，无需网关 3 Windows 客户端 Windows 10
2.2 安装 OpenVPN 相关软件包
2.2.1 查看版本
2.2.1.1 查看官网的OpenVPN的版本
访问官网：https://openvpn.net
2.2.1.2 在不同OS上查看 OpenVPN 版本
CentOS系统上的EPEL源OpenVPN版本比Ubuntu的仓库中版本更新,以下选择在CentOS8上部署 OpenVPN
范例: CentOS 查看OpenVPN版本
[root@centos8 ~]#yum list openvpn Last metadata expiration check: 0:04:22 ago on Sun 02 Aug 2020 01:11:49 PM CST. Installed Packages openvpn.x86_64 2.4.9-1.el8 epel [root@centos7 ~]#yum list openvpn Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: Available Packages openvpn.x86_64 2.4.9-1.el7 epel [root@centos8 ~]#yum list easy-rsa Last metadata expiration check: 0:05:35 ago on Sun 02 Aug 2020 01:21:19 PM CST. Available Packages easy-rsa.noarch 3.0.7-1.el8 epel [root@centos8 ~]# [root@centos7 ~]#yum list easy-rsa Loaded plugins: fastestmirror Loading mirror speeds from cached hostfile * base: Available Packages easy-rsa.noarch 3.0.7-1.el7 epel
范例: Ubuntu 查看OpenVPN版本
root@ubuntu2004:~# apt show openvpn Package: openvpn Version: 2.4.7-1ubuntu2.20.04.1 Priority: optional Section: net Origin: Ubuntu Maintainer: Ubuntu Developers ubuntu-devel-discuss@lists.ubuntu.com Original-Maintainer: Bernhard Schmidt berni@debian.org Bugs: https://bugs.launchpad.net/ubuntu/+filebug Installed-Size: 1,188 kB Depends: debconf (>= 0.5) | debconf-2.0, libc6 (>= 2.15), liblz4-1 (>= 0.0~r130), liblzo2-2 (>= 2.02), libpam0g (>= 0.99.7.1), libpkcs11-helper1 (>= 1.11), libssl1.1 (>= 1.1.1), libsystemd0, iproute2, lsb-base (>= 3.0-6) Suggests: openssl, resolvconf, openvpn-systemd-resolved, easy-rsa Homepage: https://openvpn.net/ Task: ubuntu-desktop-minimal, ubuntu-desktop, ubuntu-mate-core, ubuntu-matedesktop, ubuntu-budgie-desktop
Download-Size: 477 kB
APT-Sources: http://mirrors.aliyun.com/ubuntu focal-proposed/main amd64 Packages Description: virtual private network daemon
OpenVPN is an application to securely tunnel IP networks over a single UDP or TCP port. It can be used to access remote sites, make secure point-to-point connections, enhance wireless security, etc.
OpenVPN uses all of the encryption, authentication, and certification features provided by the OpenSSL library (any cipher, key size, or HMAC digest).
OpenVPN may use static, pre-shared keys or TLS-based dynamic key exchange. It also supports VPNs with dynamic endpoints (DHCP or dial-up clients), tunnels over NAT or connection-oriented stateful firewalls (such as Linux's iptables).
N: There is 1 additional record. Please use the '-a' switch to see it
[root@ubuntu1804 ~]#apt list openvpn Listing... Done openvpn/bionic-proposed 2.4.4-2ubuntu1.4 amd64 N: There are 2 additional versions. Please use the '-a' switch to see the [root@ubuntu1804 ~]#apt-cache madison openvpn openvpn | 2.4.4-2ubuntu1.4 | http://mirrors.aliyun.com/ubuntu bionicproposed/main amd64 Packages openvpn | 2.4.4-2ubuntu1.3 | http://mirrors.aliyun.com/ubuntu bionicupdates/main amd64 Packages openvpn | 2.4.4-2ubuntu1 | http://mirrors.aliyun.com/ubuntu bionic/main amd64 Packages openvpn | 2.4.4-2ubuntu1 | http://mirrors.aliyun.com/ubuntu bionic/main Sources openvpn | 2.4.4-2ubuntu1.3 | http://mirrors.aliyun.com/ubuntu bionicupdates/main Sources openvpn | 2.4.4-2ubuntu1.4 | http://mirrors.aliyun.com/ubuntu bionicproposed/main Sources
[root@ubuntu1804 ~]#apt-cache madison easy-rsa easy-rsa | 2.2.2-2 | http://mirrors.aliyun.com/ubuntu bionic/universe amd64 Packages easy-rsa | 2.2.2-2 | http://mirrors.aliyun.com/ubuntu bionic/universe i386 Packages easy-rsa | 2.2.2-2 | http://mirrors.aliyun.com/ubuntu bionic/universe Sources
2.2.2 安装 OpenVPN
后面环境以CentOS8上基于EPEL源安装OpenVPN为例
2.2.2.1 安装 OpenVPN 和证书工具
注意: 需要提前配置epel源
[root@centos8 ~]#vim /etc/yum.repos.d/epel.repo [epel] name=EPEL baseurl=https://mirrors.aliyun.com/epel/$releasever/Everything/$basearch gpgcheck=0 enabled=1
#OpenVPN服务器端 [root@centos8 ~]#yum -y install openvpn #证书管理工具 [root@centos8 ~]#yum -y install easy-rsa
2.2.2.2 查看包中相关文件
[root@centos8 ~]#rpm -qi openvpn easy-rsa Name : openvpn Version : 2.4.9 Release : 1.el8 Architecture: x86_64 Install Date: Sun 02 Aug 2020 01:12:21 PM CST Group : Unspecified Size : 1526179 License : GPLv2 Signature : RSA/SHA256, Sat 25 Apr 2020 05:46:35 AM CST, Key ID 21ea45ab2f86d6a1 Source RPM : openvpn-2.4.9-1.el8.src.rpm Build Date : Sat 25 Apr 2020 05:29:33 AM CST Build Host : buildvm-06.phx2.fedoraproject.org Relocations : (not relocatable) Packager : Fedora Project Vendor : Fedora Project URL : https://community.openvpn.net/ Bug URL : https://bugz.fedoraproject.org/openvpn Summary : A full-featured SSL VPN solution Description :
OpenVPN is a robust and highly flexible tunneling application that uses all of the encryption, authentication, and certification features of the OpenSSL library to securely tunnel IP networks over a single UDP or TCP port. It can use the Marcus Franz Xaver Johannes Oberhumers LZO library for compression. Name : easy-rsa Version : 3.0.7 Release : 1.el8 Architecture: noarch Install Date: Sun 02 Aug 2020 01:46:51 PM CST Group : Unspecified Size : 120221 License : GPLv2 Signature : RSA/SHA256, Tue 31 Mar 2020 09:11:54 PM CST, Key ID 21ea45ab2f86d6a1 Source RPM : easy-rsa-3.0.7-1.el8.src.rpm Build Date : Tue 31 Mar 2020 09:04:35 PM CST Build Host : buildhw-12.phx2.fedoraproject.org Relocations : (not relocatable) Packager : Fedora Project
Vendor : Fedora Project URL : https://github.com/OpenVPN/easy-rsa Bug URL : https://bugz.fedoraproject.org/easy-rsa Summary : Simple shell based CA utility Description : This is a small RSA key management package, based on the openssl command line tool, that can be found in the easy-rsa subdirectory of the OpenVPN distribution. While this tool is primary concerned with key management for the SSL VPN application space, it can also be used for building web certificates.
[root@centos8 ~]#rpm -ql openvpn /etc/openvpn /etc/openvpn/client /etc/openvpn/server /run/openvpn-client /run/openvpn-server /usr/lib/.build-id /usr/lib/.build-id/3a /usr/lib/.build-id/3a/00fe00220dafac638790bcea63e7d727acec22 /usr/lib/.build-id/3f /usr/lib/.build-id/3f/c785a94d60af40e06e582db8be159f45e4e7b6 /usr/lib/.build-id/cc /usr/lib/.build-id/cc/ab4870a01d6f8444c300b7ca5601652582f1b7 /usr/lib/systemd/system/openvpn-client@.service /usr/lib/systemd/system/openvpn-server@.service /usr/lib/tmpfiles.d/openvpn.conf /usr/lib64/openvpn /usr/lib64/openvpn/plugins /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib64/openvpn/plugins/openvpn-plugin-down-root.so /usr/sbin/openvpn /usr/share/doc/openvpn /usr/share/doc/openvpn/AUTHORS /usr/share/doc/openvpn/COPYING /usr/share/doc/openvpn/COPYRIGHT.GPL /usr/share/doc/openvpn/ChangeLog /usr/share/doc/openvpn/Changes.rst /usr/share/doc/openvpn/README /usr/share/doc/openvpn/README.auth-pam /usr/share/doc/openvpn/README.down-root /usr/share/doc/openvpn/README.systemd /usr/share/doc/openvpn/contrib /usr/share/doc/openvpn/contrib/OCSP_check /usr/share/doc/openvpn/contrib/OCSP_check/OCSP_check.sh /usr/share/doc/openvpn/contrib/README /usr/share/doc/openvpn/contrib/openvpn-fwmarkroute-1.00 /usr/share/doc/openvpn/contrib/openvpn-fwmarkroute-1.00/README /usr/share/doc/openvpn/contrib/openvpn-fwmarkroute-1.00/fwmarkroute.down /usr/share/doc/openvpn/contrib/openvpn-fwmarkroute-1.00/fwmarkroute.up /usr/share/doc/openvpn/contrib/pull-resolv-conf /usr/share/doc/openvpn/contrib/pull-resolv-conf/client.down /usr/share/doc/openvpn/contrib/pull-resolv-conf/client.up /usr/share/doc/openvpn/management-notes.txt /usr/share/doc/openvpn/sample /usr/share/doc/openvpn/sample/sample-config-files /usr/share/doc/openvpn/sample/sample-config-files/README
/usr/share/doc/openvpn/sample/sample-config-files/client.conf /usr/share/doc/openvpn/sample/sample-config-files/firewall.sh /usr/share/doc/openvpn/sample/sample-config-files/home.up /usr/share/doc/openvpn/sample/sample-config-files/loopback-client /usr/share/doc/openvpn/sample/sample-config-files/loopback-server /usr/share/doc/openvpn/sample/sample-config-files/office.up /usr/share/doc/openvpn/sample/sample-config-files/openvpn-shutdown.sh /usr/share/doc/openvpn/sample/sample-config-files/openvpn-startup.sh /usr/share/doc/openvpn/sample/sample-config-files/roadwarrior-client.conf /usr/share/doc/openvpn/sample/sample-config-files/roadwarrior-server.conf /usr/share/doc/openvpn/sample/sample-config-files/server.conf /usr/share/doc/openvpn/sample/sample-config-files/static-home.conf /usr/share/doc/openvpn/sample/sample-config-files/static-office.conf /usr/share/doc/openvpn/sample/sample-config-files/tls-home.conf /usr/share/doc/openvpn/sample/sample-config-files/tls-office.conf /usr/share/doc/openvpn/sample/sample-config-files/xinetd-client-config /usr/share/doc/openvpn/sample/sample-config-files/xinetd-server-config /usr/share/doc/openvpn/sample/sample-scripts /usr/share/doc/openvpn/sample/sample-scripts/auth-pam.pl /usr/share/doc/openvpn/sample/sample-scripts/bridge-start /usr/share/doc/openvpn/sample/sample-scripts/bridge-stop /usr/share/doc/openvpn/sample/sample-scripts/ucn.pl /usr/share/doc/openvpn/sample/sample-scripts/verify-cn /usr/share/doc/openvpn/sample/sample-windows /usr/share/doc/openvpn/sample/sample-windows/sample.ovpn /usr/share/man/man8/openvpn.8.gz /var/lib/openvpn
[root@centos8 ~]#rpm -ql easy-rsa /usr/share/doc/easy-rsa /usr/share/doc/easy-rsa/COPYING.md /usr/share/doc/easy-rsa/ChangeLog /usr/share/doc/easy-rsa/README.md /usr/share/doc/easy-rsa/README.quickstart.md /usr/share/doc/easy-rsa/vars.example /usr/share/easy-rsa /usr/share/easy-rsa/3 /usr/share/easy-rsa/3.0 /usr/share/easy-rsa/3.0.7 /usr/share/easy-rsa/3.0.7/easyrsa /usr/share/easy-rsa/3.0.7/openssl-easyrsa.cnf /usr/share/easy-rsa/3.0.7/x509-types /usr/share/easy-rsa/3.0.7/x509-types/COMMON /usr/share/easy-rsa/3.0.7/x509-types/ca /usr/share/easy-rsa/3.0.7/x509-types/client /usr/share/easy-rsa/3.0.7/x509-types/code-signing /usr/share/easy-rsa/3.0.7/x509-types/email /usr/share/easy-rsa/3.0.7/x509-types/kdc /usr/share/easy-rsa/3.0.7/x509-types/server /usr/share/easy-rsa/3.0.7/x509-types/serverClient /usr/share/licenses/easy-rsa /usr/share/licenses/easy-rsa/gpl-2.0.txt
2.2.2.3 准备相关配置文件
#准备证书颁发相关文件
[root@centos8 ~]#cp -r /usr/share/easy-rsa/3/ /etc/openvpn/easy-rsa
#准备颁发证书相关变量的配置文件 [root@centos8 ~]#cp /usr/share/doc/easy-rsa/vars.example /etc/openvpn/easyrsa/vars
#建议修改给CA和OpenVPN服务器颁发的证书的有效期,可适当加长 [root@centos8 ~]#vim /etc/openvpn/easy-rsa/vars #CA的证书默认有效期为10年,可以适当延长,比如:36500天 #set_var EASYRSA_CA_EXPIRE 3650 set_var EASYRSA_CA_EXPIRE 36500 #服务器证书默为为825天,可适当加长,比如:3650天 #set_var EASYRSA_CERT_EXPIRE 825 #将上面行修改为下面 set_var EASYRSA_CERT_EXPIRE 3650 [root@centos8 ~]#tree /etc/openvpn/ /etc/openvpn/ ├── client ├── easy-rsa │ ├── easyrsa │ ├── openssl-easyrsa.cnf │ ├── vars │ └── x509-types │ ├── ca │ ├── client │ ├── code-signing │ ├── COMMON │ ├── email │ ├── kdc │ ├── server │ └── serverClient ├── server └── server.conf
2.3 准备证书相关文件
2.3.1 初始化PKI和CA颁发机构环境
2.3.1.1 脚本easyrsa帮助用法
[root@centos8 ~]#cd /etc/openvpn/easy-rsa [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#file ./easyrsa ./easyrsa: POSIX shell script, ASCII text executable [root@centos8 easy-rsa]#./easyrsa Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Easy-RSA 3 usage and overview
USAGE: easyrsa [options] COMMAND [command-options]
A list of commands is shown below. To get detailed usage and help for a command, run: ./easyrsa help COMMAND
For a listing of options that can be supplied before the command, use: ./easyrsa help options
Here is the list of commands available with a short syntax reminder. Use the 'help' command above to get full usage details.
init-pki build-ca [ cmd-opts ] gen-dh gen-req <filename_base> [ cmd-opts ] sign-req
DIRECTORY STATUS (commands would take effect on these locations) EASYRSA: /etc/openvpn/easy-rsa.0.7 PKI: /etc/openvpn/easy-rsa/pki
2.3.1.2 初始化PKI生成PKI相关目录和文件
[root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#ls easyrsa openssl-easyrsa.cnf vars x509-types #初始化数据,在当前目录下生成pki目录及相关文件 [root@centos8 easy-rsa]#./easyrsa init-pki Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/easy-rsa/pki [root@centos8 easy-rsa]#tree ├── easyrsa ├── openssl-easyrsa.cnf ├── pki #生成一个新目录及相关文件
│ ├── openssl-easyrsa.cnf │ ├── private │ ├── reqs │ └── safessl-easyrsa.cnf ├── vars └── x509-types ├── ca ├── client ├── code-signing ├── COMMON ├── email ├── kdc ├── server └── serverClient
2.3.2 创建 CA 机构证书环境
[root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#tree pki pki ├── openssl-easyrsa.cnf ├── private ├── reqs └── safessl-easyrsa.cnf
2 directories, 2 files
[root@centos8 easy-rsa]#./easyrsa build-ca nopass
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating RSA private key, 2048 bit long modulus (2 primes)
...................................................+++++
........+++++ e is 65537 (0x010001) You are about to be asked to enter information that will be incorporated into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank.
----Common Name (eg: your user, host, or server name) [Easy-RSA CA]: #回车接受默认值
CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/pki/ca.crt #生成自签名的证书文件
[root@centos8 easy-rsa]#tree pki pki ├── ca.crt #生成的自签名的证书文件 ├── certs_by_serial ├── index.txt ├── index.txt.attr ├── issued ├── openssl-easyrsa.cnf
├── private │ └── ca.key #生成的私钥文件 ├── renewed │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── reqs ├── revoked │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── safessl-easyrsa.cnf └── serial 12 directories, 7 files #查看生成CA相关的文件 [root@centos8 easy-rsa]#cat pki/serial 01 [root@centos8 easy-rsa]#ll pki/index.txt -rw------- 1 root root 0 Aug 2 16:42 pki/index.txt [root@centos8 easy-rsa]#cat pki/serial 01 [root@centos8 easy-rsa]#ll pki/ca.crt pki/private/ca.key -rw------- 1 root root 1204 Aug 2 16:42 pki/ca.crt -rw------- 1 root root 1675 Aug 2 16:42 pki/private/ca.key
#查看生成的自签名证书 [root@centos8 easy-rsa]#cat pki/ca.crt -----BEGIN CERTIFICATE----MIIDSzCCAjOgAwIBAgIUfOBoVD77VY3WI6i+X6tUbayrRnowDQYJKoZIhvcNAQEL BQAwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjAwODAyMDg0MjI3WhcNMzAw NzMxMDg0MjI3WjAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQTCCASIwDQYJKoZIhvcN AQEBBQADggEPADCCAQoCggEBAMejJZdSXakfGPfkSsXEzaIuVwMy7is9+DuhdxiZ UiZfuLs7clzRtd0arSSytDQEn+Fjf0zc8HCqvtYjJ3HdXx0bhBkGX4ikszbGcBJD JuE25Qu86P3CsNjhcSvAWTRlivKoYXJA1lIUNOXpBlUBA/7XbkvUdVM0CXechnSr 1sddffqISu/xnrsPpFsdjfgfwPRuYIUDiitozGk2jE8/fZo3VwwHbqe5GURFlv0k Y6/afOP2YJBwOFcjvoa1p5+VOhsVG5lhLBdXKc0kHrchzXPLjTODOKoNW0xxCvty B69b7l/t5HGNue2se3FuzH45mkQfNvi/t9Ms7F7FE4euuAsCAwEAAaOBkDCBjTAd BgNVHQ4EFgQU7IEA8jlzixju11dvjoC65Ula6rIwUQYDVR0jBEowSIAU7IEA8jlz ixju11dvjoC65Ula6rKhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR84GhU PvtVjdYjqL5fq1RtrKtGejAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkq hkiG9w0BAQsFAAOCAQEAZjyvrAL23EONViFexiAwVN0ypAd7X8yMwSJsHz/uPg/N HXBlEzFZLvny7hWcdoa3gaPOAawBR4ab2riuKFRiiqWu6VM9P/pGufGDBVXkYVnJ buxHtA4kCbFIy1LlqHw9pfZbRJ4esprLfr5KSgqdqFf2v2Vwq3RlapFTiSjJsIWj lsgboc2PtpXcB9YKN/x11Dqt1o15hmjjCHwFnE90NNQ/P/ENwhh2xZCfVVvg3Sr3 t/qwEi2uImBkBuJUhExykcl3jptwEse1Ql3SUs8VGkkCic03m8glwxjTGnaKNkG+ 9DiTvn57iCoM+VtKDgkOeusl36PDvG86XUZZUD5Vww== -----END CERTIFICATE----[root@centos8 easy-rsa]#openssl x509 -in pki/ca.crt -noout -text Certificate: Data: Version: 3 (0x2) Serial Number: 7c:e0:68:54:3e:fb:55:8d:d6:23:a8:be:5f:ab:54:6d:ac:ab:46:7a Signature Algorithm: sha256WithRSAEncryption Issuer: CN = Easy-RSA CA
Validity Not Before: Aug 2 08:42:27 2020 GMT Not After : Jul 31 08:42:27 2030 GMT Subject: CN = Easy-RSA CA Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:c7:a3:25:97:52:5d:a9:1f:18:f7:e4:4a:c5:c4: cd:a2:2e:57:03:32:ee:2b:3d:f8:3b:a1:77:18:99: 52:26:5f:b8:bb:3b:72:5c:d1:b5:dd:1a:ad:24:b2: b4:34:04:9f:e1:63:7f:4c:dc:f0:70:aa:be:d6:23: 27:71:dd:5f:1d:1b:84:19:06:5f:88:a4:b3:36:c6: 70:12:43:26:e1:36:e5:0b:bc:e8:fd:c2:b0:d8:e1: 71:2b:c0:59:34:65:8a:f2:a8:61:72:40:d6:52:14: 34:e5:e9:06:55:01:03:fe:d7:6e:4b:d4:75:53:34: 09:77:9c:86:74:ab:d6:c7:5d:7d:fa:88:4a:ef:f1: 9e:bb:0f:a4:5b:1d:8d:f8:1f:c0:f4:6e:60:85:03: 8a:2b:68:cc:69:36:8c:4f:3f:7d:9a:37:57:0c:07: 6e:a7:b9:19:44:45:96:fd:24:63:af:da:7c:e3:f6: 60:90:70:38:57:23:be:86:b5:a7:9f:95:3a:1b:15: 1b:99:61:2c:17:57:29:cd:24:1e:b7:21:cd:73:cb: 8d:33:83:38:aa:0d:5b:4c:71:0a:fb:72:07:af:5b: ee:5f:ed:e4:71:8d:b9:ed:ac:7b:71:6e:cc:7e:39: 9a:44:1f:36:f8:bf:b7:d3:2c:ec:5e:c5:13:87:ae: b8:0b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Subject Key Identifier: EC:81:00:F2:39:73:8B:18:EE:D7:57:6F:8E:80:BA:E5:49:5A:EA:B2 X509v3 Authority Key Identifier: keyid:EC:81:00:F2:39:73:8B:18:EE:D7:57:6F:8E:80:BA:E5:49:5A:EA:B2 DirName:/CN=Easy-RSA CA serial:7C:E0:68:54:3E:FB:55:8D:D6:23:A8:BE:5F:AB:54:6D:AC:AB:46:7A X509v3 Basic Constraints: CA:TRUE X509v3 Key Usage: Certificate Sign, CRL Sign Signature Algorithm: sha256WithRSAEncryption 66:3c:af:ac:02:f6:dc:43:8d:56:21:5e:c6:20:30:54:dd:32: a4:07:7b:5f:cc:8c:c1:22:6c:1f:3f:ee:3e:0f:cd:1d:70:65: 13:31:59:2e:f9:f2:ee:15:9c:76:86:b7:81:a3:ce:01:ac:01: 47:86:9b:da:b8:ae:28:54:62:8a:a5:ae:e9:53:3d:3f:fa:46: b9:f1:83:05:55:e4:61:59:c9:6e:ec:47:b4:0e:24:09:b1:48: cb:52:e5:a8:7c:3d:a5:f6:5b:44:9e:1e:b2:9a:cb:7e:be:4a: 4a:0a:9d:a8:57:f6:bf:65:70:ab:74:65:6a:91:53:89:28:c9: b0:85:a3:96:c8:1b:a1:cd:8f:b6:95:dc:07:d6:0a:37:fc:75: d4:3a:ad:d6:8d:79:86:68:e3:08:7c:05:9c:4f:74:34:d4:3f: 3f:f1:0d:c2:18:76:c5:90:9f:55:5b:e0:dd:2a:f7:b7:fa:b0: 12:2d:ae:22:60:64:06:e2:54:84:4c:72:91:c9:77:8e:9b:70: 12:c7:b5:42:5d:d2:52:cf:15:1a:49:02:89:cd:37:9b:c8:25: c3:18:d3:1a:76:8a:36:41:be:f4:38:93:be:7e:7b:88:2a:0c: f9:5b:4a:0e:09:0e:7a:eb:25:df:a3:c3:bc:6f:3a:5d:46:59: 50:3e:55:c3
2.3.3 准备服务端证书环境
2.3.3.1 创建服务端证书申请
[root@centos8 ~]#cd /etc/openvpn/easy-rsa [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa #创建服务器证书申请文件，其中server是文件前缀 [root@centos8 easy-rsa]#./easyrsa gen-req server nopass Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key ..................+++++ ................................................................................ ....................................................+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa2135.JNDCBg/tmp.6nXb8b' ----You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----Common Name (eg: your user, host, or server name) [server]: #接受Common Name的默认值,直接回车 Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/server.req #生成请求文件 key: /etc/openvpn/easy-rsa/pki/private/server.key #生成私钥文件 [root@centos8 easy-rsa]#tree pki pki ├── ca.crt ├── certs_by_serial ├── index.txt ├── index.txt.attr ├── issued ├── openssl-easyrsa.cnf ├── private │ ├── ca.key │ └── server.key #生成私钥文件 ├── renewed │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── reqs │ └── server.req #生成请求文件 ├── revoked │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── safessl-easyrsa.cnf └── serial
12 directories, 9 files
2.2.3.2 颁发服务端证书
2.2.3.1.1 查看颁发证书命令用法
[root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#./easyrsa help sign
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars
sign-req
This request file must exist in the reqs/ dir and have a .req file extension. See import-req below for importing reqs from other sources.
2.2.3.1.2 颁发服务端证书
#将上面server.req的申请,颁发server类型的证书 [root@centos8 ~]#cd /etc/openvpn/easy-rsa #第一个server表示证书的类型,第二个server表示请求文件名的前缀 [root@centos8 easy-rsa]#./easyrsa sign server server
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 3650 days: #可以看到 vars文件指定的有效期
subject= commonName = server Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes #输入yes回车 Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa2334.MEAQFE/tmp.SIdgaC Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'server' Certificate is to be certified until Oct 31 09:19:43 2020 GMT (90 days) Write out database with 1 new entries Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/server.crt #生成服务器证书文件
2.2.3.1.3 验证结果
[root@centos8 ~]#cd /etc/openvpn/easy-rsa [root@centos8 easy-rsa]#tree pki pki ├── ca.crt ├── certs_by_serial │ └── EDAEBAB8D65066D307AE58ADC1A56682.pem #生成的服务器证书文件 ├── index.txt ├── index.txt.attr ├── index.txt.attr.old ├── index.txt.old ├── issued │ └── server.crt #生成的服务器证书文件 ├── openssl-easyrsa.cnf ├── private │ ├── ca.key │ └── server.key ├── renewed │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── reqs │ └── server.req ├── revoked │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── safessl-easyrsa.cnf ├── serial └── serial.old 12 directories, 14 files
[root@centos8 easy-rsa]#diff pki/certs_by_serial/EDAEBAB8D65066D307AE58ADC1A56682.pem pki/issued/server.crt [root@centos8 easy-rsa]#ll !* ll pki/certs_by_serial/EDAEBAB8D65066D307AE58ADC1A56682.pem pki/issued/server.crt -rw------- 1 root root 4608 Aug 2 17:19 pki/certs_by_serial/EDAEBAB8D65066D307AE58ADC1A56682.pem -rw------- 1 root root 4608 Aug 2 17:19 pki/issued/server.crt [root@centos8 easy-rsa]#cat pki/issued/server.crt Certificate: Data: Version: 3 (0x2) Serial Number: ed:ae:ba:b8:d6:50:66:d3:07:ae:58:ad:c1:a5:66:82 Signature Algorithm: sha256WithRSAEncryption Issuer: CN=Easy-RSA CA
Validity Not Before: Aug 2 09:19:43 2020 GMT Not After : Aug 2 09:19:43 2030 GMT Subject: CN=server Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:e2:64:ae:f4:b2:5e:32:15:d6:4c:43:b3:24:79: d6:7c:44:5f:1b:d8:18:81:1a:e3:52:39:39:a3:11: c8:b8:ea:73:94:72:6f:af:ed:69:ab:4d:57:5e:53: e2:95:de:c4:c5:bd:58:77:ae:0e:56:a7:0b:46:81: 13:b0:92:06:cd:3a:f7:f7:ad:f2:39:4e:15:b4:16: 24:8e:64:a6:bf:39:61:16:47:24:b1:67:3c:9a:d3: e3:e6:9e:f2:dc:9e:90:b3:14:95:af:00:b8:6a:e2: 4a:83:3b:ff:5c:82:ef:5b:81:8f:b0:fc:11:15:b6: 2c:ac:e4:24:fc:f8:15:6f:d6:8e:24:05:71:f7:63: dd:8e:62:eb:d3:11:33:d8:d4:5a:9e:6e:14:0d:f0: 9a:db:3d:98:33:1f:a3:4e:aa:80:db:d1:63:1e:51: 63:ac:ff:ca:9b:4c:3f:45:d7:e2:a1:11:a2:9c:ff: bd:fd:09:33:94:fd:da:96:4d:40:20:dc:1c:4f:1a: 0d:52:93:ea:0d:30:6c:b6:b4:b6:7c:9e:f0:78:d7: 44:2b:e2:90:fb:0b:20:e0:5f:fe:84:f2:3e:7f:d3: bf:88:f6:14:f2:a2:a0:7c:d1:bf:49:9e:c8:8f:51: d5:f0:08:c8:3f:e9:4f:b9:5b:27:a9:94:c5:74:9d: f4:5b Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier: 2B:96:04:F2:CC:99:52:8A:35:43:5A:AF:BC:8B:AE:F7:A4:21:19:AF X509v3 Authority Key Identifier: keyid:EC:81:00:F2:39:73:8B:18:EE:D7:57:6F:8E:80:BA:E5:49:5A:EA:B2 DirName:/CN=Easy-RSA CA serial:7C:E0:68:54:3E:FB:55:8D:D6:23:A8:BE:5F:AB:54:6D:AC:AB:46:7A X509v3 Extended Key Usage: TLS Web Server Authentication X509v3 Key Usage: Digital Signature, Key Encipherment X509v3 Subject Alternative Name: DNS:server Signature Algorithm: sha256WithRSAEncryption b4:1e:b2:57:2f:3d:6c:93:8f:38:7f:03:e6:50:51:50:35:51: 21:ac:02:27:c4:01:68:8f:52:f9:55:7a:01:f3:8f:02:64:59: 04:56:58:8c:44:43:31:f6:0e:0f:81:8a:97:3d:16:50:0a:40: 5e:20:0c:18:23:d1:1c:3d:cf:92:9c:9f:75:62:58:e9:91:5f: 7e:8a:a5:90:51:0e:34:5c:61:4b:00:7a:35:3b:3c:23:61:86: 32:52:30:d3:50:de:51:e5:b8:b8:e5:3b:da:87:ce:94:1e:6b: c4:9e:f8:e2:a9:01:df:8a:21:38:8f:a9:09:81:87:fc:9e:b0: a6:35:72:99:05:8e:06:a8:2b:49:ab:0b:89:92:fc:fd:1a:02: 20:23:c3:ef:d9:40:93:2e:b8:53:07:59:1e:94:7f:ec:41:55: 2d:74:91:32:55:22:bb:da:b9:8b:4d:64:f0:ec:67:b5:9c:30: 05:de:85:e1:9d:2e:31:86:66:0e:25:7c:82:a3:83:68:10:1b: a5:7a:45:f7:b7:e1:22:4b:0e:73:dd:14:6a:34:79:13:e6:10:
62:2d:ff:44:8e:7b:ff:96:d7:40:5a:a6:ee:5b:53:e5:02:87: 29:ab:5d:8c:fb:ed:16:38:7d:99:71:66:36:18:c0:e4:b9:a9: 32:b8:ef:ce
-----BEGIN CERTIFICATE-----
MIIDaDCCAlCgAwIBAgIRAO2uurjWUGbTB65YrcGlZoIwDQYJKoZIhvcNAQELBQAw FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwHhcNMjAwODAyMDkxOTQzWhcNMjAxMDMx MDkxOTQzWjARMQ8wDQYDVQQDDAZzZXJ2ZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IB DwAwggEKAoIBAQDiZK70sl4yFdZMQ7MkedZ8RF8b2BiBGuNSOTmjEci46nOUcm+v 7WmrTVdeU+KV3sTFvVh3rg5WpwtGgROwkgbNOvf3rfI5ThW0FiSOZKa/OWEWRySx Zzya0+PmnvLcnpCzFJWvALhq4kqDO/9cgu9bgY+w/BEVtiys5CT8+BVv1o4kBXH3 Y92OYuvTETPY1FqebhQN8JrbPZgzH6NOqoDb0WMeUWOs/8qbTD9F1+KhEaKc/739 CTOU/dqWTUAg3BxPGg1Sk+oNMGy2tLZ8nvB410Qr4pD7CyDgX/6E8j5/07+I9hTy oqB80b9JnsiPUdXwCMg/6U+5WyeplMV0nfRbAgMBAAGjgbUwgbIwCQYDVR0TBAIw ADAdBgNVHQ4EFgQUK5YE8syZUoo1Q1qvvIuu96QhGa8wUQYDVR0jBEowSIAU7IEA 8jlzixju11dvjoC65Ula6rKhGqQYMBYxFDASBgNVBAMMC0Vhc3ktUlNBIENBghR8 4GhUPvtVjdYjqL5fq1RtrKtGejATBgNVHSUEDDAKBggrBgEFBQcDATALBgNVHQ8E BAMCBaAwEQYDVR0RBAowCIIGc2VydmVyMA0GCSqGSIb3DQEBCwUAA4IBAQC0HrJX Lz1sk484fwPmUFFQNVEhrAInxAFoj1L5VXoB848CZFkEVliMREMx9g4PgYqXPRZQ CkBeIAwYI9EcPc+SnJ91YljpkV9+iqWQUQ40XGFLAHo1OzwjYYYyUjDTUN5R5bi4 5Tvah86UHmvEnvjiqQHfiiE4j6kJgYf8nrCmNXKZBY4GqCtJqwuJkvz9GgIgI8Pv 2UCTLrhTB1kelH/sQVUtdJEyVSK72rmLTWTw7Ge1nDAF3oXhnS4xhmYOJXyCo4No EBulekX3t+EiSw5z3RRqNHkT5hBiLf9Ejnv/ltdAWqbuW1PlAocpq12M++0WOH2Z cWY2GMDkuakyuO/O
-----END CERTIFICATE-----
#查看证书相关文件
[root@centos8 easy-rsa]#cat pki/serial EDAEBAB8D65066D307AE58ADC1A56683 [root@centos8 easy-rsa]#cat pki/index.txt V 201031091943Z EDAEBAB8D65066D307AE58ADC1A56682 unknown /CN=server [root@centos8 easy-rsa]#cat pki/serial.old edaebab8d65066d307ae58adc1a56682
2.3.4 创建 Diffie-Hellman 密钥
2.3.4.1 Diffie-Hellman 算法说明
wiki参考链接:
https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange Diffie-Hellman 密钥交换方法是迪菲（Whitefield Diffie）和赫尔曼（Martin Hellman）在1976 年公布的一种秘钥交换算法，它是一种建立秘钥的方法，而不是加密方法，所以秘钥必须和其他一种加密算法结合使用。这种密钥交换技术的目的在于使两个用户安全地交换一个密钥，用此密钥做为对称密钥来加密后续的报文传输。
2.3.4.2 创建 Diffie-Hellman 密钥
[root@centos8 ~]#cd /etc/openvpn/easy-rsa [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa
#方法1
[root@centos8 easy-rsa]#./easyrsa gen-dh
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ................+..................................+............................ ..........................++++++++ .......#需要等待一会儿 DH parameters of size 2048 created at /etc/openvpn/easy-rsa-sever/3/pki/dh.pem
#查看生成的文件 [root@centos8 easy-rsa]#ll pki/dh.pem -rw------- 1 root root 424 Aug 2 17:41 pki/dh.pem [root@centos8 easy-rsa]#cat pki/dh.pem -----BEGIN DH PARAMETERS----MIIBCAKCAQEAkOTKU13dlokdC6nPi/Saa3T0ubfb2k3YvbA+ZTSWKUPvtlzf7IC1 IF9XvWJO5jC7m2XL7Gld1i43GmUU+vYfyxQ9av6BgiT/Ug1BJbuQMtLzyS8O9zY/ nPw95ouT50y3SACe9BF+2mRm/91bX+XyrHG/XxpKpKN+6q1M4RwMFnE7iRpfUTUv /DGml3pvLdtG7tMF5QOtmNlbRyA6iiuzABQ903tXQurOusQnDKolLp5DPgzSCKEQ qMwMGapXzwtfk/wxsaiPHDh4Erjo4SMu4msRM9DY2Q6b5heidEihB5Ud0UXLSelg vkqdEoqfWWzYZ5RKsugYgsIjc6uXhxxGiwIBAg== -----END DH PARAMETERS-----
#方法2
[root@centos8 ~]#openssl dhparam -out /etc/openvpn/dh2048.pem 2048 [root@centos8 ~]#ll /etc/openvpn/dh2048.pem -rw-r--r-- 1 root root 424 Aug 3 20:50 /etc/openvpn/dh2048.pem
2.3.5 准备客户端证书环境
上面服务端证书配置完成，下面是配置客户端证书
2.3.5.1 修改客户端证书有效期
[root@centos8 ~]#cd /etc/openvpn//easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/
#建议修改给客户端颁发证书的有效期,可适当减少,比如:90天 [root@centos8 ~]#vim /etc/openvpn/easy-rsa/vars #set_var EASYRSA_CERT_EXPIRE 825 #将上面行修改为下面 set_var EASYRSA_CERT_EXPIRE 90
2.3.5.2 创建客户端证书申请
[root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/
#生成客户端用户的证书申请 [root@centos8 easy-rsa]#./easyrsa gen-req wangxiaochun nopass
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key
.......................................................+++++ ................................................................................ .........................+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa3467.v5FPPS/tmp.GsttV6' ----You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----Common Name (eg: your user, host, or server name) [wangxiaochun]: #接受默认值,直接回车 Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/wangxiaochun.req #私钥文件 key: /etc/openvpn/easy-rsa/pki/private/wangxiaochun.key #证书申请文件
#生成两个新文件 [root@centos8 easy-rsa]#tree . ├── easyrsa ├── openssl-easyrsa.cnf ├── pki │ ├── openssl-easyrsa.cnf │ ├── private │ │ └── wangxiaochun.key #私钥文件 │ ├── reqs │ │ └── wangxiaochun.req #证书申请文件 │ └── safessl-easyrsa.cnf ├── vars └── x509-types ├── ca ├── client ├── code-signing ├── COMMON ├── email ├── kdc ├── server └── serverClient
2.3.5.3 颁发客户端证书
[root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/
#颁发客户端证书
[root@centos8 easy-rsa]#./easyrsa sign client wangxiaochun
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 90 days:
subject= commonName = wangxiaochun Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes #输入yes后回车 Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa3617.XN7fIU/tmp.P7NKo8 Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'wangxiaochun' Certificate is to be certified until Oct 31 15:38:15 2020 GMT (90 days)
Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa/pki/issued/wangxiaochun.crt #证书文件 [root@centos8 easy-rsa]#tree pki pki ├── ca.crt ├── certs_by_serial │ ├── 5FE114ACC4FE6AB89D17E1B0EECF2B78.pem │ └── EDAEBAB8D65066D307AE58ADC1A56682.pem ├── dh.pem ├── index.txt ├── index.txt.attr ├── index.txt.attr.old ├── index.txt.old ├── issued │ ├── server.crt │ └── wangxiaochun.crt #生成客户端证书 ├── openssl-easyrsa.cnf ├── private │ ├── ca.key │ └── server.key │ └── wangxiaochun.key ├── renewed │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── reqs │ ├── server.req │ └── wangxiaochun.req ├── revoked │ ├── certs_by_serial │ ├── private_by_serial │ └── reqs_by_serial ├── safessl-easyrsa.cnf
├── serial └── serial.old [root@centos8 easy-rsa]#cat pki/index.txt V 201031091943Z EDAEBAB8D65066D307AE58ADC1A56682 unknown /CN=server V 201031153815Z 5FE114ACC4FE6AB89D17E1B0EECF2B78 unknown /CN=wangxiaochun [root@centos8 easy-rsa]#ll pki/issued/ total 16 -rw------- 1 root root 4608 Aug 2 17:19 server.crt -rw------- 1 root root 4506 Aug 2 23:38 wangxiaochun.crt [root@centos8 easy-rsa]#ll pki/certs_by_serial/ total 16 -rw------- 1 root root 4506 Aug 2 23:38 5FE114ACC4FE6AB89D17E1B0EECF2B78.pem -rw------- 1 root root 4608 Aug 2 17:19 EDAEBAB8D65066D307AE58ADC1A56682.pem [root@centos8 easy-rsa]#cat pki/issued/wangxiaochun.crt Certificate: Data: Version: 3 (0x2) Serial Number: 5f:e1:14:ac:c4:fe:6a:b8:9d:17:e1:b0:ee:cf:2b:78 Signature Algorithm: sha256WithRSAEncryption Issuer: CN=Easy-RSA CA Validity Not Before: Aug 2 15:38:15 2020 GMT Not After : Oct 31 15:38:15 2020 GMT Subject: CN=wangxiaochun Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public-Key: (2048 bit) Modulus: 00:c9:86:68:4d:2b:b6:4d:f7:e0:05:97:01:fa:e0: 8d:a8:83:4c:67:e4:59:16:a8:78:37:85:8b:cf:74: 29:ca:24:71:27:c6:ff:71:ac:e6:2f:66:93:62:fb: 28:6b:c3:4a:b6:5e:9f:e8:14:a3:73:f8:f5:27:7a: a3:80:4e:b3:51:e8:f8:92:63:a6:4a:f4:82:17:01: 26:a8:ad:ea:79:53:c0:51:ab:f6:82:d2:ae:26:27: cd:67:ef:65:a3:60:1a:3d:4f:09:8f:22:74:c7:79: b4:50:19:78:9c:4e:b3:d7:5f:ff:cb:3a:9a:b3:e5: 1c:75:b2:46:55:c4:c9:a5:8b:40:db:3d:75:a5:33: d0:cf:97:bb:bc:d8:f1:57:f1:60:e2:a6:b9:bb:6c: 30:fd:d2:15:c4:f8:56:b0:31:c8:c8:2f:36:96:e7: 45:12:17:05:dd:bf:f2:1d:37:7b:be:de:df:f1:4c: a9:e0:8a:a3:ea:96:6d:17:04:0b:1d:11:7f:96:97: 5e:f3:64:58:7c:8c:d8:f0:fa:20:31:9e:53:d4:1f: 7b:0b:39:2b:81:78:84:4e:81:34:42:c7:64:fb:ed: 9f:47:8b:34:10:80:56:f1:db:48:8f:f8:d4:49:a7: f0:1c:50:9f:7a:e7:38:e4:a5:0f:cf:5b:eb:23:17: 23:59 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Basic Constraints: CA:FALSE X509v3 Subject Key Identifier:
33:B6:15:7C:7B:F5:C4:5C:97:4D:1F:0E:94:2D:1C:79:64:36:2E:39 X509v3 Authority Key Identifier:
keyid:EC:81:00:F2:39:73:8B:18:EE:D7:57:6F:8E:80:BA:E5:49:5A:EA:B2 DirName:/CN=Easy-RSA CA
serial:7C:E0:68:54:3E:FB:55:8D:D6:23:A8:BE:5F:AB:54:6D:AC:AB:46:7A X509v3 Extended Key Usage: TLS Web Client Authentication X509v3 Key Usage: Digital Signature Signature Algorithm: sha256WithRSAEncryption 72:85:bf:0f:02:66:15:06:9d:60:8e:8f:99:54:63:4a:de:cc: 15:cb:a5:67:4b:15:90:09:c9:ff:bb:58:ec:c6:4d:39:b1:2b: 81:3c:cc:46:b8:0c:ab:10:b5:5a:1e:76:df:ed:56:1b:f5:77: 72:ff:b9:14:1e:9d:06:7d:a6:7a:04:6d:79:ab:25:38:36:67: 32:6b:ec:9b:95:67:7c:8b:3b:5a:e1:2d:97:85:a3:e5:91:da: c2:eb:28:2e:d3:98:10:25:34:d1:2d:99:b9:64:d3:96:fa:c7: 69:2e:f0:58:78:9e:63:03:89:86:04:3c:9c:7f:cb:33:0e:95: af:99:56:96:c9:73:9a:3a:ef:3b:7c:fc:92:f9:25:ac:63:46: 68:83:76:bf:4a:bf:8a:1d:6b:75:27:7a:40:3b:15:d2:53:29: 01:58:14:cf:9f:cb:25:81:47:ae:76:ba:1c:95:74:96:16:f5: ee:5f:71:a7:32:b1:6b:0a:e8:c5:c0:e9:29:b4:45:b5:71:91: 6e:8d:be:48:99:c5:33:97:12:db:cb:60:6c:06:ed:5c:a9:23: ee:40:a7:bc:00:bd:96:ed:9b:57:f0:49:b2:07:dc:dc:d7:06: ce:08:18:5e:28:13:24:e5:0b:8d:e9:d4:45:f0:11:30:70:2d: e4:a5:79:92 -----BEGIN CERTIFICATE-----
MIIDWjCCAkKgAwIBAgIQX+EUrMT+aridF+Gw7s8reDANBgkqhkiG9w0BAQsFADAW MRQwEgYDVQQDDAtFYXN5LVJTQSBDQTAeFw0yMDA4MDIxNTM4MTVaFw0yMDEwMzEx NTM4MTVaMBcxFTATBgNVBAMMDHdhbmd4aWFvY2h1bjCCASIwDQYJKoZIhvcNAQEB BQADggEPADCCAQoCggEBAMmGaE0rtk334AWXAfrgjaiDTGfkWRaoeDeFi890Kcok cSfG/3Gs5i9mk2L7KGvDSrZen+gUo3P49Sd6o4BOs1Ho+JJjpkr0ghcBJqit6nlT wFGr9oLSriYnzWfvZaNgGj1PCY8idMd5tFAZeJxOs9df/8s6mrPlHHWyRlXEyaWL QNs9daUz0M+Xu7zY8VfxYOKmubtsMP3SFcT4VrAxyMgvNpbnRRIXBd2/8h03e77e 3/FMqeCKo+qWbRcECx0Rf5aXXvNkWHyM2PD6IDGeU9Qfews5K4F4hE6BNELHZPvt n0eLNBCAVvHbSI/41Emn8BxQn3rnOOSlD89b6yMXI1kCAwEAAaOBojCBnzAJBgNV HRMEAjAAMB0GA1UdDgQWBBQzthV8e/XEXJdNHw6ULRx5ZDYuOTBRBgNVHSMESjBI gBTsgQDyOXOLGO7XV2+OgLrlSVrqsqEapBgwFjEUMBIGA1UEAwwLRWFzeS1SU0Eg Q0GCFHzgaFQ++1WN1iOovl+rVG2sq0Z6MBMGA1UdJQQMMAoGCCsGAQUFBwMCMAsG A1UdDwQEAwIHgDANBgkqhkiG9w0BAQsFAAOCAQEAcoW/DwJmFQadYI6PmVRjSt7M FculZ0sVkAnJ/7tY7MZNObErgTzMRrgMqxC1Wh523+1WG/V3cv+5FB6dBn2megRt easlODZnMmvsm5VnfIs7WuEtl4Wj5ZHawusoLtOYECU00S2ZuWTTlvrHaS7wWHie YwOJhgQ8nH/LMw6Vr5lWlslzmjrvO3z8kvklrGNGaIN2v0q/ih1rdSd6QDsV0lMp AVgUz5/LJYFHrna6HJV0lhb17l9xpzKxawroxcDpKbRFtXGRbo2+SJnFM5cS28tg bAbtXKkj7kCnvAC9lu2bV/BJsgfc3NcGzggYXigTJOULjenURfARMHAt5KV5kg== -----END CERTIFICATE-----
如果需要颁发的客户端证书较多,可以使用下面脚本实现客户端证书的批量颁发
客户端证书自动颁发脚本
[root@centos8 ~]#cat openvpn-user-crt.sh
#!/bin/bash
#
#Author: wangxiaochun #QQ: 29308620 #Date: 2020-08-02 #FileName： openvpn-user-crt.sh #URL: http://www.wangxiaochun.com #Description： The test script #Copyright (C): 2020 All rights reserved #******************************************************************** read -p "请输入用户的姓名拼音(如:${NAME}): " NAME cd /etc/openvpn/easy-rsa/ ./easyrsa gen-req ${NAME} nopass <<EOF EOF ./easyrsa sign client ${NAME} <<EOF yes EOF
2.3.6 将CA和服务器证书相关文件复制到服务器相应的目录
[root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/ca.crt /etc/openvpn/server/ [root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/issued/server.crt /etc/openvpn/server [root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/private/server.key /etc/openvpn/server [root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/dh.pem /etc/openvpn/server
[root@centos8 ~]#ll /etc/openvpn/server total 20 -rw------- 1 root root 1204 Aug 3 20:34 ca.crt -rw------- 1 root root 424 Aug 3 20:35 dh.pem -rw------- 1 root root 4608 Aug 3 20:34 server.crt -rw------- 1 root root 1704 Aug 3 20:35 server.key
2.3.7 将客户端私钥与证书相关文件复制到服务器相关的目录
[root@centos8 ~]#mkdir /etc/openvpn/client/wangxiaochun/
[root@centos8 ~]#find /etc/openvpn/easy-rsa -name "wangxiaochun.key" -o -name "wangxiaochun.crt" -o -name ca.crt /etc/openvpn/easy-rsa/pki/private/wangxiaochun.key /etc/openvpn/easy-rsa/pki/issued/wangxiaochun.crt /etc/openvpn/easy-rsa/pki/ca.crt
[root@centos8 ~]#find /etc/openvpn/easy-rsa ( -name "wangxiaochun.key" -o -name "wangxiaochun.crt" -o -name ca.crt ) -exec cp {} /etc/openvpn/client/wangxiaochun ; [root@centos8 ~]#ll /etc/openvpn/client/wangxiaochun/ total 16 -rw------- 1 root root 1204 Aug 3 21:05 ca.crt -rw------- 1 root root 4506 Aug 3 21:05 wangxiaochun.crt -rw------- 1 root root 1704 Aug 3 21:05 wangxiaochun.key
2.4 配置 OpenVPN 服务器并启动服务
2.4.1 服务器端配置文件说明
#生成服务器配置文件 [root@centos8 ~]#cp /usr/share/doc/openvpn/sample/sample-configfiles/server.conf /etc/openvpn/
#服务器配置文件server.conf文件中以#或;开头的行都为注释 [root@centos8 ~]#grep -Ev "^#|^$" /etc/openvpn/server.conf ;local a.b.c.d #本机监听IP,默认为本机所有IP port 1194 #端口 ;proto tcp #协议,生产推荐使用TCP proto udp #默认协议udp ;dev tap #创建以太网隧道设备，tap设备实现以太网帧通过Openvpn隧道，可提供非IP协议如 IPX和AppleTalk等的支持，tap等当于一个以太网设备，它操作第二层数据包如以太网数据帧。 dev tun #创建IP路由隧道，生产推存使用tun.互联网使用tun,一个tun设备大多时候被用于基于IP协议的通讯。tun模拟了网络层设备，操作第三层数据包比如IP数据封包。 ;dev-node MyTap #TAP-Win32的设备驱动。非windows系统不需要 ca ca.crt #ca证书文件 cert server.crt #服务器证书文件 key server.key #服务器私钥文件 dh dh2048.pem #dh参数文件 ;topology subnet server 10.8.0.0 255.255.255.0 #客户端连接后自动分配的IP网段，默认会给服务器分配此网段的第一个IP将做为客户端的网关,注意不要和内网网段相同 ifconfig-pool-persist ipp.txt #记录客户端和虚拟ip地址分配的文件 ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 #配置网桥模式，无需配置, 建议注释 ;server-bridge ;push "route 192.168.10.0 255.255.255.0" #推送给客户端的到达服务器后面网段的静态路由， 网关是服务器地址10.8.0.1 ;push "route 192.168.10.100 255.255.255.255" #用255.255.255.255可实现只能访问内网单个主机的功能,比如:jumpserver ;push "route 192.168.20.0 255.255.255.0" #推送路由信息到客户端，以允许客户端能够连接到服务器背后的其它私有网络 ;client-config-dir ccd #为特定客户端添加路由信息，此路由是客户端后面的网段而非服务端的网段，无需设置 ;route 192.168.40.128 255.255.255.248 ;client-config-dir ccd ;route 10.9.0.0 255.255.255.252 ;learn-address ./script #指定外部脚本文件，实现创建不同组的iptables规则，无需配置 ;push "redirect-gateway def1 bypass-dhcp" #启用此配置后客户端所有流量都将通过VPN服务器进行转发，因此生产一般无需配置此项 ;push "dhcp-option DNS 208.67.222.222" #推送DNS服务器地址，无需配置 ;push "dhcp-option DNS 208.67.220.220" ;client-to-client #允许不同的客户端直接通信,不安全,生产环境一般无需配置 ;duplicate-cn #多个用户共用一个证书，一般用于测试环境，生产环境建议一个用户一个证书,无需开启 keepalive 10 120 #设置服务端活动的检测的间隔和超时时间，每隔10秒ping一次，120秒没有回应则认为已经断线 tls-auth ta.key 0 #访止DoS等攻击的安全增强配置,服务器和每个客户端都需要拥有此密钥文件。第二个参数在服务器端为0，客户端为1 cipher AES-256-CBC #加密算法
;compress lz4-v2 #启用Openvpn2.4.X新版压缩算法 ;push "compress lz4-v2" #推送客户端使用新版压缩算法,和下面的comp-lzo不要同时使用 ;comp-lzo #旧户端兼容的压缩配置，需要客户端配置开启压缩,openvpn2.4.X等新版可以不用开启 ;max-clients 100 #最多支持的客户端数量 ;user nobody #指定openvpn服务的用户 ;group nobody #指定openvpn服务的组 persist-key #重启服务时默认会重新读取key文件，开启此配置后保持使用第一次的key文件,生产环境无需开启 persist-tun #Don’t close and reopen TUN/TAP device or run up/down scripts across SIGUSR1 or --ping-restart restarts,生产环境建议无需开启 status openvpn-status.log #服务器状态记录文件，每分钟记录一次相关信息 ;log openvpn.log #第一种日志记录方式,并指定日志路径，log会在openvpn启动的时候清空日志文件,不建议使用 ;log-append openvpn.log #第二种日志记录方式,并指定日志路径，重启openvpn后在之前的日志后面追加新的日志,生产环境建议使用 verb 3 #设置日志级别，0-9，级别越高记录的内容越详细,0 表示静默运行，只记录致命错误,4 表示合理的常规用法,5 和 6 可以帮助调试连接错误。9 表示极度冗余，输出非常详细的日志信息 ;mute 20 #对相同类别的信息只记录前20条到日志文件中 explicit-exit-notify 1 #当服务端重启后通知客户端自动重新连接服务器，此项配置仅能用于udp 模式，tcp模式无需配置即能实现重新连接功能,且开启此项后tcp配置后将导致openvpn服务无法启动,所以 tcp时必须不能开启此项
script-security 3 # 允许使用自定义脚本 auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env #指定自定义脚本路径 username-as-common-name #开启用户密码验证 client-cert-not-required #只支持用户和密码方式验证,不支持证书,无此配置表示需要证书和用户密码多种验证
2.4.2 修改服务器端配置文件
[root@centos8 ~]#vim /etc/openvpn/server.conf [root@centos8 ~]#grep '^[a-Z].*' /etc/openvpn/server.conf port 1194 proto tcp dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/server.crt key /etc/openvpn/server/server.key # This file should be kept secret dh /etc/openvpn/server/dh.pem server 10.8.0.0 255.255.255.0 push "route 172.30.0.0 255.255.255.0" keepalive 10 120 cipher AES-256-CBC compress lz4-v2 push "compress lz4-v2" max-clients 2048 user openvpn group openvpn status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log verb 3 mute 20
2.4.3 准备服务器日志相关目录
#安装包时,自动创建相关用户和组openvpn [root@centos8 ~]#getent passwd openvpn openvpn:x:993:990:OpenVPN:/etc/openvpn:/sbin/nologin [root@centos8 ~]#mkdir /var/log/openvpn [root@centos8 ~]#chown openvpn.openvpn /var/log/openvpn [root@centos8 ~]#ll -d /var/log/openvpn drwxr-xr-x 2 openvpn openvpn 6 Aug 3 23:07 /var/log/openvpn
2.4.4 启动 OpenVPN 服务
2.4.4.1 准备 OpenVPN 服务的service文件
[root@centos7 ~]#rpm -ql openvpn|grep systemd /usr/lib/systemd/system/openvpn-client@.service /usr/lib/systemd/system/openvpn-server@.service /usr/lib/systemd/system/openvpn@.service /usr/share/doc/openvpn-2.4.9/README.systemd
#CentOS8 缺失unit文件,从CentOS7复制文件 [root@centos8 ~]#rpm -ql openvpn|grep systemd /usr/lib/systemd/system/openvpn-client@.service /usr/lib/systemd/system/openvpn-server@.service /usr/share/doc/openvpn/README.systemd
[root@centos7 ~]#cat /usr/lib/systemd/system/openvpn@.service [Unit] Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I After=network.target
[Service] Type=notify PrivateTmp=true ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf
[Install] WantedBy=multi-user.target
[root@centos7 ~]#scp /lib/systemd/system/openvpn@.service 10.0.0.8:/lib/systemd/system/
#启动OpenVPN服务,注意service名称和文件名不一致 [root@centos8 openvpn]#systemctl daemon-reload [root@centos8 openvpn]#systemctl enable --now openvpn@server
2.4.4.2 查看服务状态
[root@centos8 openvpn]#systemctl status openvpn@server ● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
Active: active (running) since Tue 2020-08-04 00:30:12 CST; 31s ago
Main PID: 7340 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 5882) Memory: 2.4M CGroup: /system.slice/system-openvpn.slice/openvpn@server.service └─7340 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf
Aug 04 00:30:12 centos8.wangxiaochun.com systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application > Aug 04 00:30:12 centos8.wangxiaochun.com systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application
#注意端口号
[root@centos8 ~]#ss -ntlp State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 32 0.0.0.0:1194 0.0.0.0:* users: (("openvpn",pid=7340,fd=9)) LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users: (("sshd",pid=761,fd=4)) LISTEN 0 100 127.0.0.1:25 0.0.0.0:* users: (("master",pid=1093,fd=16)) LISTEN 0 128 [::]:22 [::]:* users: (("sshd",pid=761,fd=6)) LISTEN 0 100 [::1]:25 [::]:* users: (("master",pid=1093,fd=17))
[root@centos8 ~]#cat /var/log/openvpn/openvpn.log Tue Aug 4 00:30:12 2020 OpenVPN 2.4.9 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Apr 24 2020 Tue Aug 4 00:30:12 2020 library versions: OpenSSL 1.1.1c FIPS 28 May 2019, LZO 2.08
Tue Aug 4 00:30:12 2020 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail Tue Aug 4 00:30:12 2020 WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail Tue Aug 4 00:30:12 2020 Diffie-Hellman initialized with 2048 bit key Tue Aug 4 00:30:12 2020 ROUTE_GATEWAY 10.0.0.2/255.255.255.0 IFACE=eth0 HWADDR=00:0c:29:8a:51:21 Tue Aug 4 00:30:12 2020 TUN/TAP device tun0 opened Tue Aug 4 00:30:12 2020 TUN/TAP TX queue length set to 100 Tue Aug 4 00:30:12 2020 /sbin/ip link set dev tun0 up mtu 1500 Tue Aug 4 00:30:12 2020 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2 Tue Aug 4 00:30:12 2020 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2 Tue Aug 4 00:30:12 2020 Could not determine IPv4/IPv6 protocol. Using AF_INET Tue Aug 4 00:30:12 2020 Socket Buffers: R=[87380->87380] S=[16384->16384] Tue Aug 4 00:30:12 2020 Listening for incoming TCP connection on [AF_INET] [undef]:1194 Tue Aug 4 00:30:12 2020 TCPv4_SERVER link local (bound): [AF_INET][undef]:1194 Tue Aug 4 00:30:12 2020 TCPv4_SERVER link remote: [AF_UNSPEC] Tue Aug 4 00:30:12 2020 GID set to openvpn Tue Aug 4 00:30:12 2020 UID set to openvpn Tue Aug 4 00:30:12 2020 MULTI: multi_init called, r=256 v=256 Tue Aug 4 00:30:12 2020 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0 Tue Aug 4 00:30:12 2020 IFCONFIG POOL LIST Tue Aug 4 00:30:12 2020 MULTI: TCP INIT maxclients=2048 maxevents=2052 Tue Aug 4 00:30:12 2020 Initialization Sequence Completed
[root@centos8 ~]#ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 link/ether 00:0c:29:8a:51:21 brd ff:ff:ff:ff:ff:ff inet 10.0.0.8/24 brd 10.0.0.255 scope global noprefixroute eth0 valid_lft forever preferred_lft forever inet6 fe80::20c:29ff:fe8a:5121/64 scope link valid_lft forever preferred_lft forever 3: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100 link/none inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0 valid_lft forever preferred_lft forever inet6 fe80::c8db:a8ca:b492:a3e0/64 scope link stable-privacy valid_lft forever preferred_lft forever [root@centos8 ~]#route -n Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 0.0.0.0 172.30.0.253 0.0.0.0 UG 100 0 0 eth0 10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0 10.8.0.2 0.0.0.0 255.255.255.255 UH 0 0 0 tun0 172.30.0.0 0.0.0.0 255.255.255.0 U 100 0 0 eth0
验证tun网卡设备：
2.5 准备 OpenVPN 客户端配置文件
2.5.1 客户端默认范例配置文件说明
[root@centos8 ~]#grep '^[[:alpha:]].*' /usr/share/doc/openvpn/sample/sampleconfig-files/client.conf client #指明客户端 dev tun #指定和服务端一致的接口类型 proto udp #指定和服务端一致的协议类型 remote my-server-1 1194 #服务器端的ip或FQDN及端口 resolv-retry infinite #指定服务器端FQDN而非IP时，当客户端重新连接后会重新解FQDN对应的IP nobind #客户端不绑定监听端口，随机打开端口连接到服务端的端口
persist-key persist-tun ca ca.crt cert client.crt key client.key remote-cert-tls server #使用服务器证书校验方式 tls-auth ta.key 1 #安全加强 cipher AES-256-CBC verb 3
2.5.2 生成客户端用户的配置文件
#生成客户端文件,文件后缀必须为.ovpn
[root@centos8 ~]#grep '^[[:alpha:]].*' /usr/share/doc/openvpn/sample/sampleconfig-files/client.conf > /etc/openvpn/client/wangxiaochun/client.ovpn #修改配置文件,内容如下 [root@centos8 ~]#vim /etc/openvpn/client/wangxiaochun/client.ovpn [root@centos8 ~]#cat /etc/openvpn/client/wangxiaochun/client.ovpn client dev tun proto tcp remote openvpn-server 1194 #生产中为OpenVPN服务器的FQDN或者公网IP resolv-retry infinite nobind #persist-key #persist-tun ca ca.crt cert wangxiaochun.crt key wangxiaochun.key remote-cert-tls server #tls-auth ta.key 1 cipher AES-256-CBC verb 3 #此值不能随意指定,否则无法通信 compress lz4-v2 #此项在OpenVPN2.4.X版本使用,需要和服务器端保持一致,如不指定,默认使用 comp-lz压缩
2.6 实现 OpenVPN 客户端
2.6.1 配置部署Windows 的 OpenVPN 客户端
2.6.1.1 Windows 安装 OpenVPN 客户端
官方客户端下载地址：
https://openvpn.net/community-downloads/
openvpn客户端安装过程：
2.6.1.2 Windows 客户端配置准备
保存证书到openvpn 客户端安装目录
#在服务器打包证书并下载发送给windows客户端
[root@centos8 ~]#cd /etc/openvpn/client/wangxiaochun/ [root@centos8 wangxiaochun]#pwd /etc/openvpn/client/wangxiaochun [root@centos8 wangxiaochun]#tar cf wangxiaochun.tar ./ tar: ./wangxiaochun.tar: file is the archive; not dumped [root@centos8 wangxiaochun]#ll total 40 -rw------- 1 root root 1204 Aug 3 21:05 ca.crt -rw-r--r-- 1 root root 231 Aug 3 23:31 client.ovpn -rw------- 1 root root 4506 Aug 3 21:05 wangxiaochun.crt -rw------- 1 root root 1704 Aug 3 21:05 wangxiaochun.key -rw-r--r-- 1 root root 20480 Aug 4 10:48 wangxiaochun.tar [root@centos8 wangxiaochun]#tar tf wangxiaochun.tar ./ ./wangxiaochun.key ./wangxiaochun.crt ./ca.crt ./client.ovpn
放置到windows客户端默认安装目录下 C:\Program Files\OpenVPN\config 目录
2.6.1.3 Windows 客户端建立OpenVPN连接
在windows 中打开 OpenVPN GUI 工具
稍等一会儿,在状态栏显示以下图标,右键点连接
2.6.1.4 Windows 客户端验证通信
2.6.1.4.1 在Windows 客户端测试访问OpenVPN后端服务器
后端服务器显示是来自于OpenVPN服务器的连接
2.6.1.4.2 观察OpenVPN服务器日志
[root@centos8 ~]#tail /var/log/openvpn/openvpn.log -f -n0 Tue Aug 4 11:57:44 2020 TCP connection established with [AF_INET]10.0.0.1:6913 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 TLS: Initial packet from [AF_INET]10.0.0.1:6913, sid=6b727fec 8459dc55 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 VERIFY OK: depth=1, CN=Easy-RSA CA Tue Aug 4 11:57:45 2020 10.0.0.1:6913 VERIFY OK: depth=0, CN=wangxiaochun Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_VER=2.4.9 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_PLAT=win Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_PROTO=2 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_NCP=2 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_LZ4=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_LZ4v2=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_LZO=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_COMP_STUB=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_COMP_STUBv2=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_TCPNL=1 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 peer info: IV_GUI_VER=OpenVPN_GUI_11 Tue Aug 4 11:57:45 2020 10.0.0.1:6913 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1559' Tue Aug 4 11:57:45 2020 10.0.0.1:6913 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Tue Aug 4 11:57:45 2020 10.0.0.1:6913 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA Tue Aug 4 11:57:45 2020 10.0.0.1:6913 [wangxiaochun] Peer Connection Initiated with [AF_INET]10.0.0.1:6913
Tue Aug 4 11:57:45 2020 wangxiaochun/10.0.0.1:6913 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled) Tue Aug 4 11:57:45 2020 wangxiaochun/10.0.0.1:6913 MULTI: Learn: 10.8.0.6 -> wangxiaochun/10.0.0.1:6913
Tue Aug 4 11:57:45 2020 wangxiaochun/10.0.0.1:6913 MULTI: primary virtual IP for wangxiaochun/10.0.0.1:6913: 10.8.0.6
Tue Aug 4 11:57:46 2020 wangxiaochun/10.0.0.1:6913 PUSH: Received control message: 'PUSH_REQUEST'
Tue Aug 4 11:57:46 2020 wangxiaochun/10.0.0.1:6913 SENT CONTROL [wangxiaochun]: 'PUSH_REPLY,route 172.30.0.0 255.255.0.0,compress lz4-v2,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES256-GCM' (status=1) Tue Aug 4 11:57:46 2020 wangxiaochun/10.0.0.1:6913 Data Channel: using negotiated cipher 'AES-256-GCM' Tue Aug 4 11:57:46 2020 wangxiaochun/10.0.0.1:6913 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Tue Aug 4 11:57:46 2020 wangxiaochun/10.0.0.1:6913 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
[root@centos8 ~]#cat /var/log/openvpn/openvpn-status.log OpenVPN CLIENT LIST Updated,Tue Aug 4 13:26:45 2020 Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since wangxiaochun,10.0.0.1:6913,87125,41765,Tue Aug 4 11:57:44 2020 ROUTING TABLE Virtual Address,Common Name,Real Address,Last Ref 10.8.0.6,wangxiaochun,10.0.0.1:6913,Tue Aug 4 12:52:44 2020 GLOBAL STATS Max bcast/mcast queue length,1 END
2.6.1.4.3 验证OpenVPN服务器连接状态
[root@centos8 ~]#ss -nt State Recv-Q Send-Q Local Address:Port Peer Address:Port ESTAB 0 52 10.0.0.8:22 10.0.0.1:14009 ESTAB 0 0 10.0.0.8:1194 10.0.0.1:6913
2.6.1.4.4 验证 Windows 客户端的 IP地址
2.6.1.4.5 验证Windows 客户端的路由表
2.6.2 配置部署 Linux 的 OpenVPN 客户端
2.6.2.1 客户端安装 o p e n
[root@openvpn-client ~]# yum -y install openvpn
2.6.2.2 下载客户端公钥与私钥以及Ca证书至客户端
[root@openvpn-client ~]# ls /etc/openvpn/ ca.crt wangxiaochun.crt wangxiaochun.key
2.6.2.3 客户端有了公钥和私钥后，还需要准备对应的客户端配置文件
[root@openvpn-client ~]# cat /etc/openvpn/client.ovpn client #指定当前VPN是客户端 dev tun #使用tun隧道传输协议 proto tcp #使用tcp协议传输数据 remote OpenVPN服务器地址 1194 #openvpn服务器IP地址端口号 resolv-retry infinite #断线自动重新连接，在网络不稳定的情况下非常有用 nobind #不绑定本地特定的端口号 ca ca.crt #指定CA证书的文件路径 cert client.crt #指定当前客户端的证书文件路径 key client.key #指定当前客户端的私钥文件路径 verb 3 #指定日志文件的记录详细级别，可选0-9，等级越高日志内容越详细 persist-key #重启服务时默认会重新读取key文件，开启此配置后保持使用第一次的key 文件 persist-tun #重新启动VPN时，仍会一直保持tun是up状态
2.6.2.4 启动 openvpn 客户端
[root@openvpn-client ~]# openvpn --daemon --cd /etc/openvpn --config client.ovpn --log-append /var/log/openvpn.log
--daemon #openvpn以daemon方式启动 --cd dir #配置文件的目录，openvpn初始化前，先切换到此目录 --config file #客户端配置文件的路径 --log-append file #日志文件路径，如果文件不存在会自动创建
2.6.3 配置部署 Mac OS 的 OpenVPN 客户端
由于官方并没有提供基于Mac OS的OpenVPN的客户端软件,,可以使用第三方 OpenVPN 客户端
参考链接: https://tunnelblick.net/downloads.html
需要科学访问
2.7 实现访问VPN服务器的内网主机
当前客户端只能连接OpenVPN服务器,无法连接OpenVPN服务器网络的中其它主机,还需要做如下配置才能实现
2.7.1 OpenVPN服务器打开 ip_forward功能
#在服务器开启ip_forward转发功能 [root@centos8 ~]#echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf [root@centos8 ~]#sysctl -p net.ipv4.ip_forward = 1
2.7.2 配置实现内网服务器回应外网的请求的路由
可以使用下面三种方法实现OpenVPN服务器网段中的其它主机的访问
2.7.2.1 在内网每个主机上添加路由
此方式比较麻烦,不太推荐
#阿里云服务器不支持修改路由
[root@rocky8 ~]#route add -net 10.8.0.0/24 gw 172.30.0.1
2.7.2.2 在内网主机指定的路由器上添加路由
[root@router ~]#route add -net 10.8.0.0/24 gw 172.30.0.1
2.7.2.3 在OpenVPN服务器配置 iptables 规则
#添加SNAT规则 #方法1 [root@centos8 ~]#echo 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j MASQUERADE' >> /etc/rc.d/rc.local #方法2 [root@centos8 ~]#echo 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to-source 172.30.0.1' >> /etc/rc.d/rc.local [root@centos8 ~]#chmod +x /etc/rc.d/rc.local [root@centos8 ~]#/ etc/rc.d/rc.local [root@centos8 ~]#iptables -vnL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [root@centos8 ~]#iptables -vnL -t nat Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- * * 10.8.0.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
3 OpenVPN 管理
OpenVPN的管理功能主要关于安全加强及客户端的证书管理,用户密码验证等
3.1 启用安全增强功能
启用防止DoS攻击的安全增强配置
[root@centos8 ~]#openvpn --genkey --secret /etc/openvpn/server/ta.key [root@centos8 ~]#cat /etc/openvpn/server/ta.key # # 2048 bit OpenVPN static key # -----BEGIN OpenVPN Static key V1----44a78a4b16b8fb4fa85f1c8af7bcae82 3b014ab75f50a24e13f8de798af070d3 7d29863fac94a6a4b28952bfeacb14b0 4e79a3ab790ce3d99eec0a6fdfbdb24d c6bfca666e63de6d768aa25d145bd388 5dabb2b05ad27245eb37aa27f78e81b1 b8bcfd0d4e280bc02a51afb528d20955 d72d3578d269be2682ca468249888f3e 80c642d49238510ae6c50f8849739f75 b31d915ea4178977e246b5ec5e3298a5 822a74575c17348ae87e81f27732a325 8655a3d9aa0ee6aac3f68f6a45987561 cb1aed7be16824d56676ba406ea85f66 ad847f45dffff7b3e19bd6d6dd4406f1 3e0ad44f4f6ef9850e1556edad4b4280 49724f63a30780b91ecb0eddb07dfebc -----END OpenVPN Static key V1-----
[root@centos8 ~]#ll /etc/openvpn/server/ total 24 -rw------- 1 root root 1204 Aug 3 20:34 ca.crt -rw------- 1 root root 424 Aug 3 20:35 dh.pem -rw------- 1 root root 4608 Aug 3 20:34 server.crt -rw------- 1 root root 1704 Aug 3 20:35 server.key -rw------- 1 root root 636 Aug 4 15:53 ta.key
[root@centos8 ~]#vim /etc/openvpn/server.conf #tls-auth ta.key 0 # This file is secret tls-auth /etc/openvpn/server/ta.key 0 #客户端为1,服务器端为0
[root@centos8 ~]#systemctl restart openvpn@server.service
#日志提示出错
root@centos8 ~]#tail -n 20 /var/log/openvpn/openvpn.log -f Tue Aug 4 15:56:30 2020 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]10.0.0.1:59743 Tue Aug 4 15:56:39 2020 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]10.0.0.1:59743 Tue Aug 4 15:56:45 2020 TLS Error: cannot locate HMAC in incoming packet from [AF_INET]10.0.0.1:59073
客户端无法直接连接
将ta.key 传到客户端相关目录下
修改客户端配置文件clent.ovpn,添加一行
tls-auth ta.key 1 #客户端为1,服务器端为0
客户端重新连接成功
3.2 设置客户端的私钥密码增强安全性
新建一个账户magedu，并且设置证书密码，提高证书及登录VPN的安全性。
3.2.1 创建新用户对应的有密码的私钥和证书申请
[root@centos8 easy-rsa]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/
[root@centos8 easy-rsa]#./easyrsa gen-req magedu
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key ...............................................................+++++ ................+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa35371.iJfHbs/tmp.9lGUMy' Enter PEM pass phrase: #输入两遍密码 Verifying - Enter PEM pass phrase: #输入两遍密码 ----You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----Common Name (eg: your user, host, or server name) [magedu]: #接受默认值,直接回车 Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/magedu.req key: /etc/openvpn/easy-rsa/pki/private/magedu.key
3.2.2 给新用户颁发用户证书
[root@centos8 easy-rsa]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#pwd /etc/openvpn/easy-rsa/
#确保证书有效期是合理值 [root@centos8 easy-rsa]#grep EASYRSA_CERT_EXPIRE vars set_var EASYRSA_CERT_EXPIRE 90 #颁发证书 [root@centos8 easy-rsa]#./easyrsa sign client magedu
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender. Request subject, to be signed as a client certificate for 90 days: subject= commonName = magedu Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes #输入yes Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa36053.IQvyRq/tmp.5GkGy2 Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'magedu' Certificate is to be certified until Nov 2 08:30:43 2020 GMT (90 days) #有效期 Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa/pki/issued/magedu.crt [root@centos8 ~]#cat /etc/openvpn/easy-rsa/pki/index.txt V 201031091943Z EDAEBAB8D65066D307AE58ADC1A56682 unknown /CN=server V 201031153815Z 5FE114ACC4FE6AB89D17E1B0EECF2B78 unknown /CN=wangxiaochun V 201102083043Z C971227DA77824C8ACB7D655D09D4081 unknown /CN=magedu
3.2.3 将用户的证书相关文件放在指定的目录中
[root@centos8 ~]#mkdir /etc/openvpn/client/magedu
[root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/issued/magedu.crt /etc/openvpn/client/magedu [root@centos8 ~]#cp /etc/openvpn/easy-rsa/pki/private/magedu.key /etc/openvpn/client/magedu
[root@centos8 ~]#cp /etc/openvpn/server/{ca.crt,ta.key} /etc/openvpn/client/magedu/ [root@centos8 ~]#cp /etc/openvpn/client/wangxiaochun/client.ovpn /etc/openvpn/client/magedu/ [root@centos8 ~]#ll /etc/openvpn/client/magedu/ total 28 -rw------- 1 root root 1204 Aug 4 16:41 ca.crt -rw-r--r-- 1 root root 231 Aug 4 16:44 client.ovpn -rw------- 1 root root 4492 Aug 4 16:38 magedu.crt -rw------- 1 root root 1854 Aug 4 16:38 magedu.key -rw------- 1 root root 636 Aug 4 16:41 ta.key [root@centos8 ~]#cd /etc/openvpn/client/magedu/ #根据服务器端修改下面配置,需要和服务器同步 [root@centos8 magedu]#vim client.ovpn [root@centos8 magedu]#cat client.ovpn client dev tun proto tcp remote OpenVPN服务器地址 1194 resolv-retry infinite nobind #persist-key #persist-tun ca ca.crt cert magedu.crt key magedu.key remote-cert-tls server tls-auth ta.key 1 cipher AES-256-CBC verb 3 compress lz4-v2 [root@centos8 magedu]#tar cf magedu.tar * [root@centos8 magedu]#tar tvf magedu.tar -rw------- root/root 1204 2020-08-04 16:41 ca.crt -rw-r--r-- root/root 225 2020-08-04 16:47 client.ovpn -rw------- root/root 4492 2020-08-04 16:38 magedu.crt -rw------- root/root 1854 2020-08-04 16:38 magedu.key -rw------- root/root 636 2020-08-04 16:41 ta.key
3.2.4 将相关文件传给客户端主机相应目录
放置到windows客户端的 C:\Program Files\OpenVPN\config 目录下
3.2.5 Windows 客户端重新连接
查看日志
[root@centos8 ~]#tail -n0 /var/log/openvpn/openvpn.log -f
Tue Aug 4 17:31:39 2020 TCP connection established with [AF_INET]10.0.0.1:6915 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 TLS: Initial packet from [AF_INET]10.0.0.1:6915, sid=32d69aea a611c78d Tue Aug 4 17:31:40 2020 10.0.0.1:6915 VERIFY OK: depth=1, CN=Easy-RSA CA Tue Aug 4 17:31:40 2020 10.0.0.1:6915 VERIFY OK: depth=0, CN=magedu Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_VER=2.4.9 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_PLAT=win Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_PROTO=2 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_NCP=2 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_LZ4=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_LZ4v2=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_LZO=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_COMP_STUB=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_COMP_STUBv2=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_TCPNL=1 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 peer info: IV_GUI_VER=OpenVPN_GUI_11 Tue Aug 4 17:31:40 2020 10.0.0.1:6915 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Tue Aug 4 17:31:40 2020 10.0.0.1:6915 [magedu] Peer Connection Initiated with [AF_INET]10.0.0.1:6915 Tue Aug 4 17:31:40 2020 magedu/10.0.0.1:6915 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=(Not enabled) Tue Aug 4 17:31:40 2020 magedu/10.0.0.1:6915 MULTI: Learn: 10.8.0.10 -> magedu/10.0.0.1:6915 Tue Aug 4 17:31:40 2020 magedu/10.0.0.1:6915 MULTI: primary virtual IP for magedu/10.0.0.1:6915: 10.8.0.10
Tue Aug 4 17:31:41 2020 magedu/10.0.0.1:6915 PUSH: Received control message: 'PUSH_REQUEST'
Tue Aug 4 17:31:41 2020 magedu/10.0.0.1:6915 SENT CONTROL [magedu]: 'PUSH_REPLY,route 172.30.0.0 255.255.0.0,compress lz4-v2,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9,peer-id 0,cipher AES256-GCM' (status=1)
Tue Aug 4 17:31:41 2020 magedu/10.0.0.1:6915 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Aug 4 17:31:41 2020 magedu/10.0.0.1:6915 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Aug 4 17:31:41 2020 magedu/10.0.0.1:6915 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
3.3 账户证书管理
对新员工的入职和老员工的离职,会涉及到证书的创建和吊销
3.3.1 证书自动过期
前面颁发的证书都有有一定的有效期,过期后就需要重新颁发新证书
#过期时间由以下设置决定
[root@centos8 ~]#grep EASYRSA_CERT_EXPIRE /etc/openvpn/easy-rsa/vars set_var EASYRSA_CERT_EXPIRE 90
如果证书过期,在服务器端可以看到以下日志
#让服务器时间改为2年后时间 [root@centos8 ~]#date -s '2 year' Thu Aug 4 17:41:04 CST 2022
#服务器端日志中会显示用户证书过期
[root@centos8 ~]#tail -n0 /var/log/openvpn/openvpn.log -f Thu Aug 4 17:42:22 2022 TCP connection established with [AF_INET]10.0.0.1:11324 Thu Aug 4 17:42:23 2022 10.0.0.1:11324 TLS: Initial packet from [AF_INET]10.0.0.1:11324, sid=a2957674 874cf1f7 Thu Aug 4 17:42:24 2022 10.0.0.1:11324 VERIFY OK: depth=1, CN=Easy-RSA CA Thu Aug 4 17:42:24 2022 10.0.0.1:11324 VERIFY ERROR: depth=0, error=certificate has expired: CN=magedu
Thu Aug 4 17:42:24 2022 10.0.0.1:11324 OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed Thu Aug 4 17:42:24 2022 10.0.0.1:11324 TLS_ERROR: BIO read tls_read_plaintext error
Thu Aug 4 17:42:24 2022 10.0.0.1:11324 TLS Error: TLS object -> incoming plaintext read error Thu Aug 4 17:42:24 2022 10.0.0.1:11324 TLS Error: TLS handshake failed Thu Aug 4 17:42:24 2022 10.0.0.1:11324 Fatal TLS error (check_tls_errors_co), restarting
Thu Aug 4 17:42:24 2022 10.0.0.1:11324 SIGUSR1[soft,tls-error] received, client-instance restarting
3.3.2 证书手动注销
3.3.2.1 查看当前证书的有效性
#证书有效为V,无效为R [root@centos8 ~]#cat /etc/openvpn/easy-rsa/pki/index.txt V 201031091943Z EDAEBAB8D65066D307AE58ADC1A56682 unknown /CN=server V 201031153815Z 5FE114ACC4FE6AB89D17E1B0EECF2B78 unknown /CN=wangxiaochun V 201102083043Z C971227DA77824C8ACB7D655D09D4081 unknown /CN=magedu
3.3.2.2 吊销指定的用户的证书
[root@centos8 ~]# cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#./easyrsa revoke magedu
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
Please confirm you wish to revoke the certificate with the following subject:
subject= commonName = magedu
Type the word 'yes' to continue, or any other input to abort. Continue with revocation: yes Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa3787.Q2lnW6/tmp.18ZdMO Revoking Certificate C971227DA77824C8ACB7D655D09D4081. Data Base Updated
IMPORTANT!!!
Revocation was successful. You must run gen-crl and upload a CRL to your infrastructure in order to prevent the revoked cert from being accepted. #查看当前证书的有效性,有效为V,无效为R [root@centos8 easy-rsa]#cat /etc/openvpn/easy-rsa/pki/index.txt V 201031091943Z EDAEBAB8D65066D307AE58ADC1A56682 unknown /CN=server V 201031153815Z 5FE114ACC4FE6AB89D17E1B0EECF2B78 unknown /CN=wangxiaochun R 201102083043Z 200805123127Z C971227DA77824C8ACB7D655D09D4081 unknown /CN=magedu
#当前断开客户端连接,magedu用户仍然能连接成功
3.3.2.3 生成证书吊销列表
#每次吊销证书后都需要更新证书吊销列表文件,并且需要重启OpenVPN服务 [root@centos8 easy-rsa]#./easyrsa gen-crl
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Using configuration from /etc/openvpn/easy-rsa/pki/easy-rsa4323.gUt4WS/tmp.ybAcAU
An updated CRL has been created. CRL file: /etc/openvpn/easy-rsa/pki/crl.pem [root@centos8 easy-rsa]#cat pki/crl.pem -----BEGIN X509 CRL----MIIB3DCBxQIBATANBgkqhkiG9w0BAQsFADAWMRQwEgYDVQQDDAtFYXN5LVJTQSBD QRcNMjAwODA1MTIzNTUwWhcNMjEwMjAxMTIzNTUwWjAkMCICEQDJcSJ9p3gkyKy3 1lXQnUCBFw0yMDA4MDUxMjMxMjdaoFUwUzBRBgNVHSMESjBIgBTsgQDyOXOLGO7X V2+OgLrlSVrqsqEapBgwFjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0GCFHzgaFQ++1WN 1iOovl+rVG2sq0Z6MA0GCSqGSIb3DQEBCwUAA4IBAQCMpTte/0ffpnC/ClU8GnBl vnRLOmPZjvYHSoldZxZ+8PA1tKisu0r5k+V41oRxIpZeyvzwOI2SEqqqjN1BLcGj
4LX5exu49QlDYtAhJQ029nTQjtj5AqpcaEvID5eRTQqaX94Ykw3MVxdOqNRVjt46 AUTbAFrWmgAtcMbByZYtmd2h9kNwfSaJFEnJHgAqIdGJq+LnNJuHxuBWPXArtjyN o5aUdhfSzEOnbRLgdwaRnsrW4K5EOFpETB7t0CQ9b+9X8fV5hqZmm6MlgI2dhLha dsRkCZmdlMKvP8LjlFfy8E0rSss1jFmyvm/HRhqoIdOuQXWayryyfn6hfNyp5GMT
-----END X509 CRL-----
- #传到windows上,修改文件后缀为crl,双击就可以打开此文件,看到下面显示信息
3.3.2.4 将吊销列表文件发布
#第一次吊销证时需要编辑配置文件调用吊销证书的文件,后续吊销无需此步 [root@openvpn-server ~]# vim /etc/openvpn/server.conf crl-verify /etc/openvpn/easy-rsa/pki/crl.pem
#每次吊销证书后,都需要重新启动才能生效
[root@centos8 ~]#systemctl restart openvpn@server.service
3.3.2.5 再次测试连接失败
用户端再次连接失败
#观察OpenVPN目志 [root@centos8 easy-rsa]#tail -f /var/log/openvpn/openvpn.log -n0 Wed Aug 5 21:13:25 2020 TCP connection established with [AF_INET]10.0.0.1:7419 Wed Aug 5 21:13:26 2020 10.0.0.1:7419 TLS: Initial packet from [AF_INET]10.0.0.1:7419, sid=169fe75b 63908b79 Wed Aug 5 21:13:26 2020 10.0.0.1:7419 WARNING: Failed to stat CRL file, not (re)loading CRL. Wed Aug 5 21:13:26 2020 10.0.0.1:7419 VERIFY ERROR: depth=0, error=certificate revoked: CN=magedu Wed Aug 5 21:13:26 2020 10.0.0.1:7419 OpenSSL: error:1417C086:SSL routines:tls_process_client_certificate:certificate verify failed
3.3.3 账户重名证书颁发
对于员工重名的情况,可以为新员工指定新的名称,或者删除不再使用的重名用户证书,重新创建新证书
3.3.3.1 手动重新颁发证书
#删除已被吊销的账户证书 [root@centos8 ~]#cd /etc/openvpn/easy-rsa/ [root@centos8 easy-rsa]#rm -f pki/private/magedu.key [root@centos8 easy-rsa]#rm -f pki/reqs/magedu.req [root@centos8 easy-rsa]#rm -f /etc/openvpn/client/magedu/* [root@centos8 easy-rsa]#rm -f /etc/openvpn/easy-rsa/pki/reqs/magedu.req [root@centos8 easy-rsa]#rm -f /etc/openvpn/easy-rsa/pki/issued/magedu.crt #删除之前的带R的吊销记录,此为可选项 [root@centos8 easy-rsa]#vim /etc/openvpn/easy-rsa/pki/index.txt
#重新生成新的账户证书申请和私钥 [root@centos8 easy-rsa]#cd /etc/openvpn//easy-rsa/
[root@centos8 easy-rsa]#./easyrsa gen-req magedu
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key ..................................+++++ .........+++++ writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa26582.hrORzD/tmp.bTOf5p' Enter PEM pass phrase: Verifying - Enter PEM pass phrase: ----You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----Common Name (eg: your user, host, or server name) [magedu]:#直接回车
Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/magedu.req key: /etc/openvpn/easy-rsa/pki/private/magedu.key
#CA颁发证书
[root@centos8 easy-rsa]#cd /etc/openvpn/easy-rsa [root@centos8 easy-rsa]#./easyrsa import-req /etc/openvpn/easyrsa/pki/reqs/magedu.req magedu [root@centos8 easy-rsa]#./easyrsa sign client magedu ...... Type the word 'yes' to continue, or any other input to abort. Confirm request details: yes #输入yes ...... Write out database with 1 new entries Data Base Updated Certificate created at: /etc/openvpn/easy-rsa/pki/issued/magedu.crt
#生成相关文件
[root@centos8 easy-rsa]#cp /etc/openvpn/easy-rsa/pki/issued/magedu.crt /etc/openvpn/client/magedu/ [root@centos8 easy-rsa]#cp /etc/openvpn/easy-rsa/pki/private/magedu.key /etc/openvpn/client/magedu/ [root@centos8 easy-rsa]#cp /etc/openvpn/server/{ca.crt,ta.key} /etc/openvpn/client/magedu/ [root@centos8 easy-rsa]#cp /etc/openvpn/client/wangxiaochun/client.ovpn /etc/openvpn/client/magedu/
#修改客户端配置文件
[root@centos8 easy-rsa]#vim /etc/openvpn/client/magedu/client.ovpn client dev tun proto tcp remote 10.0.0.8 1194 resolv-retry infinite
nobind #persist-key #persist-tun ca ca.crt cert magedu.crt key magedu.key remote-cert-tls server tls-auth ta.key 1 cipher AES-256-CBC verb 3 compress lz4-v2
[root@centos8 ~]#tree /etc/openvpn/client/magedu /etc/openvpn/client/magedu ├── ca.crt ├── client.ovpn ├── dh.pem ├── magedu.crt ├── magedu.key └── ta.key 0 directories, 6 files #将/etc/openvpn/client/magedu所有文件打包传到客户端使用
3.3.3.2 自动化的证书颁发脚本
通过脚本实现自动化的证书颁发
3.3.3.2.1 脚本内容
[root@centos8 ~]#cat openvpn-user-crt.sh #!/bin/bash # #******************************************************************** #Author: wangxiaochun #QQ: 29308620 #Date: 2020-08-02 #FileName: openvpn-user-crt.sh #URL: http://www.wangxiaochun.com #Description: The test script #Copyright (C): 2020 All rights reserved #******************************************************************** OPENVPN_SERVER=openvpn.wangxiaochun.com PASS=123456
remove_cert () { rm -rf /etc/openvpn/client/${NAME} find /etc/openvpn/ -name "$NAME.*" -delete } create_cert () { cd /etc/openvpn/easy-rsa ./easyrsa gen-req ${NAME} nopass <<EOF
EOF
cd /etc/openvpn/easy-rsa ./easyrsa import-req /etc/openvpn/easy-rsa/pki/reqs/${NAME}.req ${NAME} ./easyrsa sign client ${NAME} <<EOF yes EOF mkdir /etc/openvpn/client/${NAME} cp /etc/openvpn/easy-rsa/pki/issued/${NAME}.crt /etc/openvpn/client/${NAME} cp /etc/openvpn/easy-rsa/pki/private/${NAME}.key /etc/openvpn/client/${NAME} cp /etc/openvpn/server/{ca.crt,ta.key} /etc/openvpn/client/${NAME} cat > /etc/openvpn/client/${NAME}/client.ovpn <<EOF client dev tun proto tcp remote $OPENVPN_SERVER 1194 resolv-retry infinite nobind #persist-key #persist-tun ca ca.crt cert $NAME.crt key $NAME.key remote-cert-tls server tls-auth ta.key 1 cipher AES-256-CBC verb 3 compress lz4-v2 EOF echo "证书存放路径:/etc/openvpn/client/${NAME},证书文件如下:" echo -e "\E[1;32m******************************************************************\E[0m " ls -l /etc/openvpn/client/${NAME} echo -e "\E[1;32m******************************************************************\E[0m " cd /etc/openvpn/client/${NAME} zip -qP "$PASS" /root/${NAME}.zip * echo "证书的打包文件已生成: /root/${NAME}.zip" } read -p "请输入用户的姓名拼音(如:wangxiaochun): " NAME remove_cert create_cert
3.3.3.2.2 执行脚本
[root@centos8 ~]#bash openvpn-user-crt.sh 请输入用户的姓名拼音(如:): magedu
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019 Generating a RSA private key ................................................................................ ................................................................................ ............................+++++ ............................................................................++++ + writing new private key to '/etc/openvpn/easy-rsa/pki/easy-rsa13504.eqdKk5/tmp.kowkjQ' ----You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----Common Name (eg: your user, host, or server name) [magedu]: Keypair and certificate request completed. Your files are: req: /etc/openvpn/easy-rsa/pki/reqs/magedu.req key: /etc/openvpn/easy-rsa/pki/private/magedu.key
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
The request has been successfully imported with a short name of: magedu You may now use this name to perform signing operations on this request.
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/vars Using SSL: openssl OpenSSL 1.1.1c FIPS 28 May 2019
You are about to sign the following certificate. Please check over the details shown below for accuracy. Note that this request has not been cryptographically verified. Please be sure it came from a trusted source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 90 days:
subject= commonName = magedu Type the word 'yes' to continue, or any other input to abort. Confirm request details: Using configuration from /etc/openvpn/easyrsa/pki/easy-rsa-13552.TvELex/tmp.Gx7dds Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows commonName :ASN.1 12:'magedu' Certificate is to be certified until Nov 3 13:50:50 2020 GMT (90 days)
Write out database with 1 new entries Data Base Updated
Certificate created at: /etc/openvpn/easy-rsa/pki/issued/magedu.crt
证书存放路径:/etc/openvpn/client/magedu,证书文件如下: ****************************************************************** total 28 -rw------- 1 root root 1204 Aug 5 21:50 ca.crt -rw-r--r-- 1 root root 225 Aug 5 21:50 client.ovpn -rw------- 1 root root 424 Aug 5 21:50 dh.pem -rw------- 1 root root 4492 Aug 5 21:50 magedu.crt -rw------- 1 root root 1704 Aug 5 21:50 magedu.key -rw------- 1 root root 636 Aug 5 21:50 ta.key ****************************************************************** 证书的打包文件已生成: /root/magedu.zip [ OK ]
3.3.3.3 在Windows客户端用新证书连接登录
3.4 实现用户密码认证
基于证书验证的基础上再加上用户名密码验证可以实现更高的安全性
3.4.1 修改服务端配置
[root@centos8 ~]# vim /etc/openvpn/server.conf # 添加三行，实现服务端支持密码认证方式 script-security 3 # 允许使用自定义脚本 auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env #指定自定义脚本路径 username-as-common-name #开启用户密码验证
3.4.2 创建自定义脚本
官方脚本下载
http://openvpn.se/files/other/checkpsw.sh
范例:
[root@centos8 ~]# vim /etc/openvpn/checkpsw.sh #!/bin/sh ########################################################### # checkpsw.sh (C) 2004 Mathias Sundman mathias@openvpn.se # # This script will authenticate OpenVPN users against # a plain text file. The passfile should simply contain # one row per user with the username first followed by # one or more space(s) or tab(s) and then the password. ########################################################### PASSFILE="/etc/openvpn/psw-file" LOG_FILE="/var/log/openvpn-password.log" TIME_STAMP=date "+%Y-%m-%d %T"
if [ ! -r "${PASSFILE}" ]; then
echo "${TIME_STAMP}: Could not open password file "${PASSFILE}" for reading." >> ${LOG_FILE}
exit 1 fi
CORRECT_PASSWORD=awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}
if [ "${CORRECT_PASSWORD}" = "" ]; then echo "${TIME_STAMP}: User does not exist: username="${username}", password="${password}"." >> ${LOG_FILE} exit 1 fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then echo "${TIME_STAMP}: Successful authentication: username="${username}"." >> ${LOG_FILE} exit 0 fi
echo "${TIME_STAMP}: Incorrect password: username="${username}", password="${password}"." >> ${LOG_FILE} exit 1
#增加执行权限
[root@centos8 ~]# chmod +x /etc/openvpn/checkpsw.sh
3.4.3 创建用户密码文件
创建用户和密码认证文件,每行是一个用户和密码 [root@centos8 ~]# cat > /etc/openvpn/psw-file <<EOF wang 123456 test 654321 EOF
[root@centos8 ~]# systemctl restart openvpn@server
3.4.4 修改客户端配置
修改客户端配置文件client.ovpn文件，增加下面一行,使其支持用户名/密码与服务器进行身份验证.
[root@centos8 ~]#vim /etc/openvpn/client/wangxiaochun/client.ovpn #加下面一行,可以支持用户密码认证 auth-user-pass
3.4.5 客户端连接验证
