Настройка OpenVPN сервера

Исходная система:

root@ubuntu:~#  lsb_release -a
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.5 LTS
Release:	18.04
Codename:	bionic

root@ubuntu:~# lsb_release -a

No LSB modules are available.

Distributor ID: Ubuntu

Description: Ubuntu 18.04.5 LTS

Release: 18.04

Codename: bionic

Установить пакеты

Shell

root# apt install openvpn openvpn-auth-ldap easy-rsa

1

root# apt install openvpn openvpn-auth-ldap easy-rsa

Дополнительно рекомендую установить

Shell

root# apt install mc htop iftop snmpd

1

root# apt install mc htop iftop snmpd
Настроить Easy-RSA

Shell

root# cd /usr/share/easy-rsa root# cp openssl-1.0.0.cnf openssl.cnf

1
2

root# cd /usr/share/easy-rsa
root# cp openssl-1.0.0.cnf openssl.cnf

2.1 Указать требуемые параметры

root# nano vars

export KEY_COUNTRY="RU"
export KEY_PROVINCE="SMR"
export KEY_CITY="Samara"
export KEY_ORG="SPECNIX"
export KEY_EMAIL="admin@specnix.ru"
export KEY_OU="OIT"

2.2 Загрузить vars в переменную среду

root# cd /usr/share/easy-rsa
root# chmod +x vars
root# source ./vars

root# cd /usr/share/easy-rsa

root# chmod +x vars

root# source ./vars

Посмотреть что получилось можно командой: printenv
Вроде как надо все почистить, хотя ничего и так нет:
root# ./clean-al

Создать CA с паролём.

root# ./build-ca –pass
Can’t load /root/.rnd into RNG
140198780277184:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd
Generating a RSA private key
……………………….+++++
….+++++
writing new private key to ‘ca.key’

root# ./build-ca –pass

Can‘t load /root/.rnd into RNG

140198780277184:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

Generating a RSA private key

............................+++++

....+++++

writing new private key to ‘ca.key’

Дальше будет запрос пароля для нашего CA, придумать, запомнить, указать

Enter PEM pass phrase:
Verifying – Enter PEM pass phrase:
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [RU]:
State or Province Name (full name) [SMR]:
Locality Name (eg, city) [Samara]:
Organization Name (eg, company) [SPECNIX]:
Organizational Unit Name (eg, section) [OIT]:
Common Name (eg, your name or your server’s hostname) [SPECNIX CA]:
Name [EasyRSA]:
Email Address [admin@specnix.ru]:

Enter PEM pass phrase:

Verifying – Enter PEM pass phrase:

——–

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

——–

Country Name (2 letter code) [RU]:

State or Province Name (full name) [SMR]:

Locality Name (eg, city) [Samara]:

Organization Name (eg, company) [SPECNIX]:

Organizational Unit Name (eg, section) [OIT]:

Common Name (eg, your name or your server‘s hostname) [SPECNIX CA]:

Name [EasyRSA]:

Email Address [admin@specnix.ru]:

3.1 Создать запрос сертификата для сервера

(cd /usr/share/easy-rsa)

root# ./build-req –server server
Can’t load /root/.rnd into RNG
140578671763904:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd
Generating a RSA private key
…………………………………..+++++
….+++++
writing new private key to ‘server.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [RU]:
State or Province Name (full name) [SMR]:
Locality Name (eg, city) [Samara]:
Organization Name (eg, company) [SPECNIX]:
Organizational Unit Name (eg, section) [OIT]:
Common Name (eg, your name or your server’s hostname) [server]: VPNS
Name [EasyRSA]:
Email Address [admin@specnix.ru]:
	
Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

root# ./build-req –server server

Can‘t load /root/.rnd into RNG

140578671763904:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

Generating a RSA private key

.........................................+++++

....+++++

writing new private key to ‘server.key’

——–

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

——–

Country Name (2 letter code) [RU]:

State or Province Name (full name) [SMR]:

Locality Name (eg, city) [Samara]:

Organization Name (eg, company) [SPECNIX]:

Organizational Unit Name (eg, section) [OIT]:

Common Name (eg, your name or your server‘s hostname) [server]: VPNS

Name [EasyRSA]:

Email Address [admin@specnix.ru]:

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

3.2 Подписать, надо будет указать пароль, которые задавали при формировании CA в п.3.1

(cd /usr/share/easy-rsa)

root# ./sign-req –server server
Using configuration from /usr/share/easy-rsa/openssl.cnf
Can’t load /root/.rnd into RNG
139935090246080:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd
Enter pass phrase for /usr/share/easy-rsa/keys/ca.key:
Can’t open /usr/share/easy-rsa/keys/index.txt.attr for reading, No such file or directory
139935090246080:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:72:fopen(‘/usr/share/easy-rsa/keys/index.txt.attr’,’r’)
139935090246080:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:79:
Check that the request matches the signature
Signature ok
The Subject’s Distinguished Name is as follows
countryName           :PRINTABLE:’RU’
stateOrProvinceName   :PRINTABLE:’SMR’
localityName          :PRINTABLE:’Samara’
organizationName      :PRINTABLE:’SPECNIX’
organizationalUnitName:PRINTABLE:’OIT’
commonName            :PRINTABLE:’VPNS’
name                  :PRINTABLE:’EasyRSA’
emailAddress          :IA5STRING:’admind@specnix.ru’
Certificate is to be certified until Apr 11 05:53:37 2030 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

root# ./sign-req –server server

Using configuration from /usr/share/easy–rsa/openssl.cnf

Can‘t load /root/.rnd into RNG

139935090246080:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

Enter pass phrase for /usr/share/easy–rsa/keys/ca.key:

Can‘t open /usr/share/easy–rsa/keys/index.txt.attr for reading, No such file or directory

139935090246080:error:02001002:system library:fopen:No such file or directory:../crypto/bio/bss_file.c:72:fopen(‘/usr/share/easy-rsa/keys/index.txt.attr’,‘r’)

139935090246080:error:2006D080:BIO routines:BIO_new_file:no such file:../crypto/bio/bss_file.c:79:

Check that the request matches the signature

Signature ok

The Subject‘s Distinguished Name is as follows

countryName :PRINTABLE:‘RU’

stateOrProvinceName :PRINTABLE:‘SMR’

localityName :PRINTABLE:‘Samara’

organizationName :PRINTABLE:‘SPECNIX’

organizationalUnitName:PRINTABLE:‘OIT’

commonName :PRINTABLE:‘VPNS’

name :PRINTABLE:‘EasyRSA’

emailAddress :IA5STRING:‘admind@specnix.ru’

Certificate is to be certified until Apr 11 05:53:37 2030 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

3.3 Сформировать ключ Deffie-Hellman

root# ./build-dh
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time

root# ./build-dh

Generating DH parameters, 2048 bit long safe prime, generator 2

This is going to take a long time

Сертификаты для клиентов Можно сделать один сертификат на всех, а можно сделать для каждого индивидуальный, что позволит, например, в случае утери мобильного устройства (ноутбук, планшет, телефон) отозвать сертификат и прекратить доступ к нашему VPN.

(cd /usr/share/easy-rsa)

root# ./build-req client
Can’t load /root/.rnd into RNG
139943630385600:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd
Generating a RSA private key
….+++++
……+++++
writing new private key to ‘client.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [RU]:
State or Province Name (full name) [SMR]:
Locality Name (eg, city) [Samara]:
Organization Name (eg, company) [SPECNIX]:
Organizational Unit Name (eg, section) [OIT]:
Common Name (eg, your name or your server’s hostname) [client]:client
Name [EasyRSA]:
Email Address [admin@specnix.ru]:

Please enter the following ‘extra’ attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

root# ./build-req client

Can‘t load /root/.rnd into RNG

139943630385600:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

Generating a RSA private key

....+++++

......+++++

writing new private key to ‘client.key’

——–

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter ‘.’, the field will be left blank.

——–

Country Name (2 letter code) [RU]:

State or Province Name (full name) [SMR]:

Locality Name (eg, city) [Samara]:

Organization Name (eg, company) [SPECNIX]:

Organizational Unit Name (eg, section) [OIT]:

Common Name (eg, your name or your server‘s hostname) [client]:client

Name [EasyRSA]:

Email Address [admin@specnix.ru]:

Please enter the following ‘extra’ attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

4.2 Подписать сертификат клиента

(cd /usr/share/easy-rsa)

root# ./sign-req client
Using configuration from /usr/share/easy-rsa/openssl.cnf
Can’t load /root/.rnd into RNG
140604554564032:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd
Enter pass phrase for /usr/share/easy-rsa/keys/ca.key:
Check that the request matches the signature
Signature ok
The Subject’s Distinguished Name is as follows
countryName           :PRINTABLE:’RU’
stateOrProvinceName   :PRINTABLE:’SMR’
localityName          :PRINTABLE:’Samara’
organizationName      :PRINTABLE:’SPECNIX’
organizationalUnitName:PRINTABLE:’OIT’
commonName            :PRINTABLE:’client’
name                  :PRINTABLE:’EasyRSA’
emailAddress          :IA5STRING:’admin@specnix.ru’
Certificate is to be certified until Apr 11 06:44:02 2030 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

root# ./sign-req client

Using configuration from /usr/share/easy–rsa/openssl.cnf

Can‘t load /root/.rnd into RNG

140604554564032:error:2406F079:random number generator:RAND_load_file:Cannot open file:../crypto/rand/randfile.c:88:Filename=/root/.rnd

Enter pass phrase for /usr/share/easy–rsa/keys/ca.key:

Check that the request matches the signature

Signature ok

The Subject‘s Distinguished Name is as follows

countryName :PRINTABLE:‘RU’

stateOrProvinceName :PRINTABLE:‘SMR’

localityName :PRINTABLE:‘Samara’

organizationName :PRINTABLE:‘SPECNIX’

organizationalUnitName:PRINTABLE:‘OIT’

commonName :PRINTABLE:‘client’

name :PRINTABLE:‘EasyRSA’

emailAddress :IA5STRING:‘admin@specnix.ru’

Certificate is to be certified until Apr 11 06:44:02 2030 GMT (3650 days)

Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y

Write out database with 1 new entries

Data Base Updated

Выгрузить с сервера из каталога:

/usr/share/easy-rsa/keys следующие файлы ca.crt client.crt client.key

5.1 Создать каталог для копирования файлов

Shell

root# cd /usr/share/easy-rsa/ root# mkdir keys-share root# chmod 777 keys-share root# cp keys/ca.crt keys-share/ root# cp keys/client.crt keys-share/ root# cp keys/client.key keys-share/

1
2
3
4
5
6

root# cd /usr/share/easy-rsa/
root# mkdir keys-share
root# chmod 777 keys-share
root# cp keys/ca.crt keys-share/
root# cp keys/client.crt keys-share/
root# cp keys/client.key keys-share/

5.2 Подключиться к серверу через WinSCP и загрузить файлы из каталога keys-share на свой ПК

Настроить сервер OpenVPN 6.1 Сгенерировать ta.key и переместить в каталог keys-share для загрузки на ПК

Shell

root# cd /etc/openvpn/ root# openvpn –genkey –secret ta.key root# cp ta.key /usr/share/easy-rsa/keys-share/

1
2
3

root# cd /etc/openvpn/
root# openvpn –genkey –secret ta.key
root# cp ta.key /usr/share/easy-rsa/keys-share/

6.2 Скопировать дефолтный конфиг

root# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
root# gzip -d /etc/openvpn/server.conf.gz

1 2	root# cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/ root# gzip -d /etc/openvpn/server.conf.gz

6.3 Привести конфигурацию к виду

root# cat /etc/openvpn/server.conf  | grep -v ^# | grep -v ^$ | grep -v “;”
port 1194
proto udp
dev tun
ca /usr/share/easy-rsa/keys/ca.crt
cert /usr/share/easy-rsa/keys/server.crt
key /usr/share/easy-rsa/keys/server.key
dh /usr/share/easy-rsa/keys/dh2048.pem
server 10.255.249.0 255.255.255.0
ifconfig-pool-persist /var/log/openvpn/ipp.txt
push “route 10.0.0.0 255.0.0.0”
push “redirect-gateway def1 bypass-dhcp”
keepalive 10 120
tls-auth /etc/openvpn/ta.key 0 # This file is secret
cipher AES-256-CBC
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log         /var/log/openvpn/openvpn.log
log-append  /var/log/openvpn/openvpn.log
verb 3
explicit-exit-notify 1
username-as-common-name
# Указать плагин для дополнительной авторизации пользователей в домене, если требуется
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/ldap.conf

root# cat /etc/openvpn/server.conf | grep -v ^# | grep -v ^$ | grep -v “;”

port 1194

proto udp

dev tun

ca /usr/share/easy–rsa/keys/ca.crt

cert /usr/share/easy–rsa/keys/server.crt

key /usr/share/easy–rsa/keys/server.key

dh /usr/share/easy–rsa/keys/dh2048.pem

server 10.255.249.0 255.255.255.0

ifconfig–pool–persist /var/log/openvpn/ipp.txt

push “route 10.0.0.0 255.0.0.0”

push “redirect-gateway def1 bypass-dhcp”

keepalive 10 120

tls–auth /etc/openvpn/ta.key 0 # This file is secret

cipher AES–256–CBC

persist–key

persist–tun

status /var/log/openvpn/openvpn–status.log

log /var/log/openvpn/openvpn.log

log–append /var/log/openvpn/openvpn.log

verb 3

explicit–exit–notify 1

username–as–common–name

# Указать плагин для дополнительной авторизации пользователей в домене, если требуется

plugin /usr/lib/openvpn/openvpn–auth–ldap.so /etc/openvpn/ldap.conf

Настроить авторизацию в домене, если указан плагин в п. 6.3

root# touch /etc/openvpn/ldap.conf
root# nano /etc/openvpn/ldap.conf
	<LDAP>
        URL             ldap://192.168.1.3:389
#Учетная запись (BindDN) и пароль (Password) для доступа к AD
        BindDN          CN=opvpn,OU=users,DC=specnix,DC=local
        Password        указать_пароль_clear-text
        Timeout         15
        TLSEnable       no
        FollowReferrals yes
	</LDAP>
	<Authorization>
#Где искать пользователей (указать домен)
        BaseDN          “DC=specnix,DC=local”
#Только пользователи которые включены в группу op_vpn_emp
        SearchFilter    “(&(sAMAccountName=%u)(memberOf=CN=op_vpn_emp,OU=groups,DC=specnix,DC=local))”
        RequireGroup    false
	</Authorization>

root# touch /etc/openvpn/ldap.conf

root# nano /etc/openvpn/ldap.conf

<LDAP>

URL ldap://192.168.1.3:389

#Учетная запись (BindDN) и пароль (Password) для доступа к AD

BindDN CN=opvpn,OU=users,DC=specnix,DC=local

Password указать_пароль_clear–text

Timeout 15

TLSEnable no

FollowReferrals yes

</LDAP>

#Где искать пользователей (указать домен)

BaseDN “DC=specnix,DC=local”

#Только пользователи которые включены в группу op_vpn_emp

SearchFilter “(&(sAMAccountName=%u)(memberOf=CN=op_vpn_emp,OU=groups,DC=specnix,DC=local))”

RequireGroup false

</Authorization>

где: BindDN – учётная запись которой OpenVPN авторизуется в домене, в моем случае это учётная запись opvpn-dd-srv; Password – для BindDN BaseDN – домен SearchFilter – группа в AD куда добавляются пользователи для которым разрешён доступ к OpenVPN

Разрешаем серверу работать как роутер, что бы сеть за пределами VPN была доступна

Shell

root# echo 1 > /proc/sys/net/ipv4/ip_forward root# sysctl -p

1
2

root# echo 1 > /proc/sys/net/ipv4/ip_forward
root# sysctl -p

Что бы после перезагрузки сервер продолжил работать как роутер отредактировать файл /etc/sysctl.config, расcкоментировать параметр: net.ipv4.ip_forward = 1
Настроить клиент

Установить клиент openvpn-install-2.4.8-I602-Win10.exe Подложить файлы ca.crt client.crt client.key ta.key client.ovpn – предварительно настроить в каталог c:\Program Files\OpenVPN\config\ подложить преднастроенный файл конфигурации client.ovpn