一、服务器程序安装：
1、安装依赖程序：
因为OpenVPN软件包不在CentOS标准Yum源里，所以需要安装先通过yum安装epel源才能正常安装相关软件包！
[[email protected]~]# yum install epel-release
[[email protected]~]# yum -y install lzo lzo-devel [[email protected] ~]# rpm -qa | grep "lzo" lzo-devel-2.06-8.el7.x86_64 lzo-2.06-8.el7.x86_64 lzo-minilzo-2.06-8.el7.x86_64 [[email protected] ~]# yum -y install openssl openssl-devel [[email protected] ~]# rpm -qa | grep openssl openssl-libs-1.0.1e-60.el7_3.1.x86_64 openssl-devel-1.0.1e-60.el7_3.1.x86_64 openssl-1.0.1e-60.el7_3.1.x86_64
2、openvpn服务器端程序安装：
[[email protected] ~]# yum install openvpn -y [[email protected] ~]# rpm -qa | grep"openvpn" openvpn-2.4.3-1.el7.x86_64 安装完成涉及目录如下： [[email protected] ~]# whereis openvpn openvpn: /usr/sbin/openvpn /usr/lib64/openvpn /etc/openvpn /usr/share/man/man8/openvpn.8.gz
[[email protected] ~]# yum -y install easy-rsa [[email protected] ~]# rpm -qa | grep easy easy-rsa-2.2.2-1.el7.noarch
二、配置生成openvpn运行所需证书文件：
OpenVPN服务器与客户端双方基于PKI(公钥基础设施)验证双方身份并进行认证，所以开始配置时首先要建立认证所需的证书以及密钥。
1、证书、密钥生成流程（推荐）：http://www.softown.cn/post/146.html
[[email protected] ~]# mkdir -p/etc/openvpn/easy-rsa/keys [[email protected]~]# cp -rf /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa/ [[email protected] easy-rsa]# ll total 116 -rwxr-xr-x 1 root root 119 Aug 22 03:08 build-ca #创建CA证书和密钥 -rwxr-xr-x 1 root root 352 Aug 22 03:08 build-dh # -rwxr-xr-x 1 root root 188 Aug 22 03:08 build-inter -rwxr-xr-x 1 root root 163 Aug 22 03:08 build-key #用于创建客户端证书及私钥 -rwxr-xr-x 1 root root 157 Aug 22 03:08 build-key-pass -rwxr-xr-x 1 root root 249 Aug 22 03:08 build-key-pkcs12 -rwxr-xr-x 1 root root 268 Aug 22 03:08 build-key-server #用于创建服务器端证书及私钥 -rwxr-xr-x 1 root root 213 Aug 22 03:08 build-req -rwxr-xr-x 1 root root 158 Aug 22 03:08 build-req-pass -rwxr-xr-x 1 root root 449 Aug 22 03:08 clean-all #用于清空服务器端已经生成端证书及密钥 -rwxr-xr-x 1 root root 1471 Aug 22 03:08 inherit-inter drwx------ 2 root root 4096 Aug 22 03:22 keys -rwxr-xr-x 1 root root 302 Aug 22 03:08 list-crl -rw-r--r-- 1 root root 7791 Aug 22 03:08 openssl-0.9.6.cnf -rw-r--r-- 1 root root 8348 Aug 22 03:08 openssl-0.9.8.cnf -rw-r--r-- 1 root root 8245 Aug 22 03:08 openssl-1.0.0.cnf -rwxr-xr-x 1 root root 12966 Aug 22 03:08 pkitool -rwxr-xr-x 1 root root 928 Aug 22 03:08 revoke-full -rwxr-xr-x 1 root root 178 Aug 22 03:08 sign-req -rw-r--r-- 1 root root 2057 Aug 22 03:11 vars #用于存储服务器/客户端生成证书、密钥过程中需要的参数信息 -rwxr-xr-x 1 root root 740 Aug 22 03:08 whichopensslcnf
1.1 修改vars文件，配置生成证书所需的信息（可以安自己需求修改，或保持默认）：
[[email protected] ~]# vi/etc/openvpn/easy-rsa/vars # These are the default values forfields # which will be placed in thecertificate. # Don‘t leave any of these fieldsblank. export KEY_COUNTRY="CN" exportKEY_PROVINCE="BeiJing" export KEY_CITY="BeiJing" export KEY_ORG="YunWei" exportKEY_EMAIL="[email protected]" exportKEY_OU="YunWeiUnit"
1.2 开始生成ca证书、密钥；服务器端证书、密钥；客户端证书、密钥；
[[email protected] openvpn]# cd /etc/openvpn/easy-rsa/ [[email protected] easy-rsa]# source vars #让上面修改端参数文件生效 NOTE: If you run ./clean-all, Iwill be doing a rm -rf on /etc/openvpn/easy-rsa/keys [[email protected] easy-rsa]# ./clean-all [[email protected] easy-rsa]# ./build-ca # 1、生成CA证书及密钥 Generating a 2048 bit RSA privatekey ..........................................+++ ...........................................+++ writing new private key to ‘ca.key‘ ----- You are about to be asked to enterinformation that will be incorporated into your certificate request. What you are about to enter is whatis called a Distinguished Name or a DN. There are quite a few fields butyou can leave some blank For some fields there will be adefault value, If you enter ‘.‘, the field will beleft blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name)[BeiJing]: Locality Name (eg, city) [BeiJing]: Organization Name (eg, company)[YunWei]: Organizational Unit Name (eg,section) [YunWeiUnit]: Common Name (eg, your name or yourserver‘s hostname) [YunWei CA]: Name [EasyRSA]: Email Address [[email protected]]: [[email protected] easy-rsa]# ll keys/ total 12 -rw-r--r-- 1 root root 1712 Aug 22 03:15 ca.crt #生成的CA证书 -rw------- 1 root root 1704 Aug 22 03:15 ca.key #生成的CA密钥 -rw-r--r-- 1 root root 0 Aug 22 03:14 index.txt -rw-r--r-- 1 root root 3 Aug 22 03:14 serial
1.3 生成服务器端证书及对应端密钥：
[[email protected] easy-rsa]# ./build-key-server server [[email protected] easy-rsa]# ll keys/ total 48 -rw-r--r-- 1 root root 5457 Aug 22 03:16 server.crt #生成的服务器端证书 -rw-r--r-- 1 root root 1074 Aug 22 03:16 server.csr -rw------- 1 root root 1704 Aug 22 03:16 server.key #生成的服务器端密钥
1.4 生成客户端用户对应的证书及密钥：
[[email protected]]# ./build-key client -rw-r--r-- 1 root root 5339 Aug 22 03:17 client.crt #生成的客户端证书 -rw-r--r-- 1 root root 1074 Aug 22 03:17 client.csr -rw------- 1 root root 1708 Aug 22 03:17 client.key #生成的客户端密钥
1.5 生成迪菲·赫尔曼参数（必须生成）：
[[email protected] easy-rsa]# openvpn--genkey --secret /etc/openvpn/easy-rsa/keys/ta.key -rw------- 1 root root 636 Aug 22 03:22 ta.key
2、服务器/客户端配置文件构建：
示例配置文件路径如下，可以在此基础上做修改：
[[email protected] ~]# ll /usr/share/doc/openvpn-2.4.3/sample/sample-config-files/client.conf /usr/share/doc/openvpn-2.4.3/sample/sample-config-files/server.conf -rw-r--r-- 1 root root 3584 Jun 20 08:48 /usr/share/doc/openvpn-2.4.3/sample/sample-config-files/client.conf -rw-r--r-- 1 root root 10782 Jun 20 08:48 /usr/share/doc/openvpn-2.4.3/sample/sample-config-files/server.conf
2.1 服务器端：
[[email protected] ~]# more openvpn-server.conf local 0.0.0.0 port 1194 proto udp dev tun ca /etc/openvpn/server/ca.crt cert /etc/openvpn/server/server.crt key /etc/openvpn/server/server.key # This file should be kept secret dh /etc/openvpn/server/dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 10.8.0.0 255.255.255.0" push "route 192.168.20.0 255.255.255.0" push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 180.76.76.76" push "dhcp-option DNS 114.114.114.114" keepalive 10 120 tls-auth /etc/openvpn/server/ta.key 0 # This file is secret cipher AES-256-CBC comp-lzo max-clients 100 user nobody group nobody persist-key persist-tun status openvpn-status.log log openvpn.log log-append openvpn.log verb 3
2.2 客户端：
2.2.1 默认值配置文件（5个文件）：
[[email protected] client]# more client.conf_normal client dev tun proto udp remote my-server-1 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt #单独以一个文件存在 cert client.crt #单独以一个文件存在 key client.key #单独以一个文件存在 remote-cert-tls server tls-auth ta.key 1 #单独以一个文件存在 cipher AES-256-CBC verb 3
上面默认的客户端配置文件，管理起来很不方便，为便于客户端用户使用可以整合成一个文件来进行配置！
2.2.2 整合后的配置文件（1个文件）：
模版：
[[email protected] client]# more client.conf_normal client dev tun proto udp remote my-server-1 1194 resolv-retry infinite nobind persist-key persist-tun <ca> ca ca.crt #本行以ca.crt文件内容替换 </ca> <cert> cert client.crt #本行以client.crt文件内容替换 </cert> <key> key client.key #本行以client.key文件内容替换 </key> <tls-auth> tls-auth ta.key 1 #本行以ta.key文件内容替换 </tls-auth> key-direction 1 #需要增加本行，指定上面参数1对应的配置 remote-cert-tls server cipher AES-256-CBC verb 3 comp-lzo
3、使用MySQL-PAM模块进行用户认证：
待补充。。。
4、使用Radius-PAM模块进行用户认证：
待补充。。。
5、配置启动服务器，客户端程序并进行测试：
[[email protected] ~]# systemctl restart [email protected]
[[email protected] ~]# ss -lnup
State Recv-Q Send-Q Local Address:Port Peer Address:Port
Cannot open netlink socket: Protocol not supported
UNCONN 0 0 *:1194 *:* users:(("openvpn",pid=15933,fd=6))
时间： 2024-10-27 18:54:50