「OpenVPNのインストール」の版間の差分
ナビゲーションに移動
検索に移動
Rin-scrooge (トーク | 投稿記録) (→鍵の準備) |
Rin-scrooge (トーク | 投稿記録) |
||
| 10行目: | 10行目: | ||
=== 認証局の設立（認証局サーバー） === | === 認証局の設立（認証局サーバー） === | ||
| − | + | 認証局にするサーバーに以下のコマンドを実行して「Easy-RSA」をインストールします。 | |
| − | + | {{bc|# pacman -S easy-rsa}} | |
| − | + | インストールしたら「easy-rsa」に移動しておきます。 | |
| − | + | {{bc|# cd /etc/easy-rsa}} | |
| − | init-pki complete; you may now create a CA or requests. | + | 認証局の構築をしていきます。<br/> |
| − | Your newly created PKI dir is: /etc/easy-rsa/pki | + | 以下のコマンドで認証局の初期化を行います。 |
| + | {{hc|# easyrsa init-pki|init-pki complete; you may now create a CA or requests. | ||
| + | Your newly created PKI dir is: /etc/easy-rsa/pki}} | ||
| − | + | 完了したら、認証局の鍵ペアを生成します。 | |
| − | easyrsa build-ca | + | <pre style="margin-bottom: 0; border-bottom:none; padding-bottom:0.8em;"># easyrsa build-ca</pre> |
| − | Using SSL: | + | <pre style="margin-top: 0; border-top-style:dashed; padding-top: 0.8em;">Using SSL: opensslOpenSSL 1.1.1d 10 Sep 2019 |
| − | + | ||
| − | Enter New CA Key Passphrase: | + | Enter New CA Key Passphrase: ［任意のパスフレーズを入力］ |
| − | Re-Enter New CA Key Passphrase: | + | Re-Enter New CA Key Passphrase: ［任意のパスフレーズを入力］ |
Generating RSA private key, 2048 bit long modulus (2 primes) | Generating RSA private key, 2048 bit long modulus (2 primes) | ||
...........................+++++ | ...........................+++++ | ||
| 38行目: | 40行目: | ||
If you enter '.', the field will be left blank. | If you enter '.', the field will be left blank. | ||
----- | ----- | ||
| − | Common Name (eg: your user, host, or server name) [Easy-RSA CA]: | + | Common Name (eg: your user, host, or server name) [Easy-RSA CA]:［任意の名前を入力］ |
| − | + | ||
CA creation complete and you may now import and sign cert requests. | CA creation complete and you may now import and sign cert requests. | ||
Your new CA certificate file for publishing is at: | Your new CA certificate file for publishing is at: | ||
| − | /etc/easy-rsa/pki/ca.crt</ | + | /etc/easy-rsa/pki/ca.crt</pre> |
| − | + | 作成された認証局の証明書をVPNサーバーに移します。<br/> | |
| − | < | + | 証明書なのでまぁ適当に移せば良いかと思います。<br/> |
| − | chown foo /tmp/ca.crt | + | 下の例ではSCPを使用していますが…私はSFTPを使用しました。 |
| − | scp /tmp/ca.crt foo@hostname-of-openvpn-server:/tmp | + | {{bc|# cp /etc/easy-rsa/pki/ca.crt /tmp |
| + | # chown foo /tmp/ca.crt | ||
| + | $ scp /tmp/ca.crt foo@hostname-of-openvpn-server:/tmp}} | ||
== VPNサーバー == | == VPNサーバー == | ||
2019年12月26日 (木) 13:50時点における版
Raspberry piのArchlinux化をもくろみ、ArchlinuxでVPNサーバーを立ち上げようかと思っています。
そこで、まずはVirtualBoxでOpenVPNを使用して、VPNサーバーを立ち上げてみました。
VPNサーバーと認証局サーバーを分離している前提で、手順を上げています。
もし、一緒にしているなら上手いこと読み替えてください。
目次
鍵の準備
VPNを使用するにあたり、認証局の設立やら共通鍵の作成やら鍵ペアの作成やら色々していきます。
認証局の設立（認証局サーバー）
認証局にするサーバーに以下のコマンドを実行して「Easy-RSA」をインストールします。
# pacman -S easy-rsa
インストールしたら「easy-rsa」に移動しておきます。
# cd /etc/easy-rsa
認証局の構築をしていきます。
以下のコマンドで認証局の初期化を行います。
# easyrsa init-pki
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/easy-rsa/pki
完了したら、認証局の鍵ペアを生成します。
# easyrsa build-ca
Using SSL: opensslOpenSSL 1.1.1d 10 Sep 2019 Enter New CA Key Passphrase: ［任意のパスフレーズを入力］ Re-Enter New CA Key Passphrase: ［任意のパスフレーズを入力］ Generating RSA private key, 2048 bit long modulus (2 primes) ...........................+++++ .....................................+++++ e is 65537 (0x010001) Can't load /etc/easy-rsa/pki/.rnd into RNG 139748243150080:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]:［任意の名前を入力］ CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/easy-rsa/pki/ca.crt
作成された認証局の証明書をVPNサーバーに移します。
証明書なのでまぁ適当に移せば良いかと思います。
下の例ではSCPを使用していますが…私はSFTPを使用しました。
# cp /etc/easy-rsa/pki/ca.crt /tmp # chown foo /tmp/ca.crt $ scp /tmp/ca.crt foo@hostname-of-openvpn-server:/tmp
VPNサーバー
mv /tmp/ca.crt /etc/openvpn/server/
chown root:root /etc/openvpn/server/ca.crt
pacman -S easy-rsa
cd /etc/easy-rsa
easyrsa init-pki
init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/easy-rsa/pki
easyrsa gen-req ［サーバー名？］ nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/servername.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [servername]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/servername.req
key: /etc/easy-rsa/pki/private/servername.key
cp /etc/easy-rsa/pki/private/servername.key /etc/openvpn/server/
openssl dhparam -out /etc/openvpn/server/dh.pem 2048
openvpn --genkey --secret /etc/openvpn/server/ta.key
クライアントファイルの作成
初期化してなかったら…
# cd /etc/easy-rsa
# easyrsa init-pki
# cd /etc/easy-rsa
# easyrsa gen-req client1 nopass
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
Can't load /etc/easy-rsa/pki/.rnd into RNG
139780419302656:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/easy-rsa/pki/.rnd
Generating a RSA private key
..................................................+++++
.................................................................+++++
writing new private key to '/etc/easy-rsa/pki/private/client1.key.TUQccMn1qp'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [client1]:yyyyyyyy
Keypair and certificate request completed. Your files are:
req: /etc/easy-rsa/pki/reqs/client1.req
key: /etc/easy-rsa/pki/private/client1.key
# cp /etc/easy-rsa/pki/reqs/*.req /tmp
# chown foo /tmp/*.req
$ scp /tmp/*.req foo@hostname-of-CA:/tmp
認証局サーバー
# cd /etc/easy-rsa
# easyrsa import-req /tmp/servername.req servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: servername
You may now use this name to perform signing operations on this request.
# easyrsa import-req /tmp/client1.req client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
The request has been successfully imported with a short name of: client1
You may now use this name to perform signing operations on this request.
# easyrsa sign-req server servername
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a server certificate for 1080 days:
subject=
commonName = xxxxxxxx
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'xxxxxxxx'
Certificate is to be certified until Dec 9 05:16:12 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/servername.crt
# easyrsa sign-req client client1
Using SSL: openssl OpenSSL 1.1.1d 10 Sep 2019
You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.
Request subject, to be signed as a client certificate for 1080 days:
subject=
commonName = yyyyyyyy
Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes
Using configuration from /etc/easy-rsa/pki/safessl-easyrsa.cnf
Enter pass phrase for /etc/easy-rsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'yyyyyyyy'
Certificate is to be certified until Dec 9 05:17:51 2022 GMT (1080 days)
Write out database with 1 new entries
Data Base Updated
Certificate created at: /etc/easy-rsa/pki/issued/client1.crt
認証局からVPNサーバーとクライアントに返却
# cp /etc/easy-rsa/pki/issued/*.crt /tmp
# chown foo /tmp/*.crt
$ scp /tmp/*.crt foo@hostname-of-openvpn_server:/tmp
VPNサーバー
# mv /tmp/servername.crt /etc/openvpn/server/
# chown root:root /etc/openvpn/server/servername.crt
VPNクライアント
ぶっちゃけどこでも構わない
# mkdir /etc/easy-rsa/pki/signed
# mv /tmp/client1.crt /etc/easy-rsa/pki/signed
VPNサーバー
pacman -S openvpn
VPNサーバー設定ファイル
cp /usr/share/openvpn/examples/server.conf /etc/openvpn/server/server.conf
# nano /etc/openvpn/server/server.conf
ポート番号
port 1194
↓
port xxxx
プロトコル（基本udpだけど、proxy越えしたい場合はtcp）
;proto tcp
proto udp
↓
proto tcp
;proto udp
プロトコルをTCPにした場合は以下も…
explicit-exit-notify 1
↓
;explicit-exit-notify 1
認証局の公開鍵（変える必要ないはず）
ca ca.crt
↓
ca ca.crt
サーバーの公開鍵
cert server.crt
↓
cert servername.crt
サーバーの（署名された）秘密鍵
key server.key # This file should be kept secret
↓
key servername.key # This file should be kept secret
暗号通信用のパラメータファイル
dh dh2048.pem
↓
dh dh.pem
HMAC共通鍵（変えなくてもいいはず）
tls-auth ta.key 0
↓
tls-auth ta.key 0
プロセスのユーザーとグループ
;user nobody
;group nobody
↓
user nobody
group nobody
よくわからん！（変えなくてもいいはず）
cipher AES-256-CBC
↓
cipher AES-256-CBC
以下追記
auth SHA512
tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-128-GCM-SHA256:TLS-DHE-RSA-WITH-AES-256-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-256-CBC-SHA:TLS-DHE-RSA-WITH-AES-128-CBC-SHA:TLS-DHE-RSA-WITH-CAMELLIA-128-CBC-SHA
サービス起動！
systemctl start openvpn-server@server
VPNクライアント設定ファイル
「ovpngen」のインストール
cd ~
wget https://github.com/graysky2/ovpngen/archive/v1.28.tar.gz
tar -xvf v1.28.tar.gz
cd ovpngen-1.28
chmod +x ovpngen
VPNクライアント用設定ファイルの生成
./ovpngen ［VPNサーバーのIPアドレスまたはURL］ /etc/openvpn/server/ca.crt /etc/easy-rsa/pki/signed/client1.crt /etc/easy-rsa/pki/private/client1.key /etc/openvpn/server/ta.key 1194 tcp > client.conf
このファイルをクライアントに持って行って接続？？？
