[Debian]Debian lennyで１からサーバーを作ってみる – OpenVPNをインストール

# aptitude install openvpn openssl

# mkdir /dev/net
# mknod /dev/net/tun c 10 200

# vi /etc/sysctl.conf

#net.ipv4.ip_forward=1
↓
net.ipv4.ip_forward=1

# sysctl -p /etc/sysctl.conf

1が表示されるかの確認

# cat /proc/sys/net/ipv4/ip_forward

1. CA証明書・秘密鍵作成

   # cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/ /etc/openvpn/easy-rsa
   # cd /etc/openvpn/easy-rsa/
   # chmod +x *
   # vi vars
   

   export KEY_COUNTRY="US"
   export KEY_PROVINCE="CA"
   export KEY_CITY="SanFrancisco"
   export KEY_ORG="Fort-Funston"
   export KEY_EMAIL="me@myhost.mydomain"
   ↓
   export KEY_COUNTRY="JP"
   export KEY_PROVINCE="Tokyo"
   export KEY_CITY="Edogawa"
   export KEY_ORG="saizensen.net"
   export KEY_EMAIL="root@saizensen.net"
   

   # source vars
   # ./clean-all
   # ./build-ca
   

   ↑を実行すると色々聞いてくるが全て空ENTERでおk。

   # cp keys/ca.crt /etc/openvpn/
   

2. サーバー証明書・秘密鍵作成

   # ./build-key-server server

   Generating a 1024 bit RSA private key
   ....................++++++
   ............................++++++
   writing new private key to 'server.key'
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [JP]: ← 空ENTER
   State or Province Name (full name) [Tokyo]: ← 空ENTER
   Locality Name (eg, city) [Edogawa]: ← 空ENTER
   Organization Name (eg, company) [saizensen.net]: ← 空ENTER
   Organizational Unit Name (eg, section) []: ← 空ENTER
   Common Name (eg, your name or your server's hostname) [server]: ← 空ENTER
   Email Address [root@saizensen.net]: ← 空ENTER
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []: ← 空ENTER
   An optional company name []: ← 空ENTER
   Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
   Check that the request matches the signature
   Signature ok
   The Subject's Distinguished Name is as follows
   countryName           : PRINTABLE:'JP'
   stateOrProvinceName   : PRINTABLE:'Tokyo'
   localityName          : PRINTABLE:'Edogawa'
   organizationName      : PRINTABLE:'saizensen.net'
   commonName            : PRINTABLE:'server'
   emailAddress          : IA5STRING:'root@saizensen.net'
   Certificate is to be certified until Aug 11 09:04:37 2019 GMT (3650 days)
   Sign the certificate? [y/n]:y ← yキー
   
   1 out of 1 certificate requests certified, commit? [y/n]y ← yキー
   Write out database with 1 new entries
   Data Base Updated
   

   # cp keys/server.crt /etc/openvpn/
   # cp keys/server.key /etc/openvpn/
   

3. DH(Diffie Hellman)パラメータ作成

   # ./build-dh
   # cp keys/dh1024.pem /etc/openvpn/
   

4. 証明書廃止リスト作成

   # ./build-key dmy

   enerating a 1024 bit RSA private key
   ..............................................................++++++
   ..++++++
   writing new private key to 'dmy.key'
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [JP]: ← 空ENTER
   State or Province Name (full name) [Tokyo]: ← 空ENTER
   Locality Name (eg, city) [Edogawa]: ← 空ENTER
   Organization Name (eg, company) [saizensen.net]: ← 空ENTER
   Organizational Unit Name (eg, section) []: ← 空ENTER
   Common Name (eg, your name or your server's hostname) [dmy]: ← 空ENTER
   Email Address [root@saizensen.net]: ← 空ENTER
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []: ← 空ENTER
   An optional company name []: ← 空ENTER
   Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
   Check that the request matches the signature
   Signature ok
   The Subject's Distinguished Name is as follows
   countryName           : PRINTABLE:'JP'
   stateOrProvinceName   : PRINTABLE:'Tokyo'
   localityName          : PRINTABLE:'Edogawa'
   organizationName      : PRINTABLE:'saizensen.net'
   commonName            : PRINTABLE:'dmy'
   emailAddress          : IA5STRING:'root@saizensen.net'
   Certificate is to be certified until Aug 11 09:09:41 2019 GMT (3650 days)
   Sign the certificate? [y/n]:y ← yキー
   
   1 out of 1 certificate requests certified, commit? [y/n]y ← yキー
   Write out database with 1 new entries
   Data Base Updated
   

5. openssl.cnfを編集

   # vi openssl.cnf

   [ pkcs11_section ]
   ↓
   #[ pkcs11_section ]
   
   engine_id = pkcs11
   ↓
   #engine_id = pkcs11
   
   dynamic_path = /usr/lib/engines/engine_pkcs11.so
   ↓
   #dynamic_path = /usr/lib/engines/engine_pkcs11.so
   
   MODULE_PATH = $ENV::PKCS11_MODULE_PATH
   ↓
   #MODULE_PATH = $ENV::PKCS11_MODULE_PATH
   
   PIN = $ENV::PKCS11_PIN
   ↓
   #PIN = $ENV::PKCS11_PIN
   
   init = 0
   ↓
   #init = 0
   

6. ./revoke-full dmyを実行すると↓みたいに表示されるけど無視して進む。

   Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
   Revoking Certificate 02.
   Data Base Updated
   Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
   dmy.crt: /C=JP/ST=Tokyo/L=Edogawa/O=saizensen.net/CN=dmy/emailAddress=root@saizensen.net
   error 23 at 0 depth lookup:certificate revoked
   

   # ./revoke-full dmy
   # cp keys/crl.pem /etc/openvpn/
   # cd
   

7. OpenVPN設定

   # openvpn --genkey --secret /etc/openvpn/ta.key
   # cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn
   # gunzip /etc/openvpn/server.conf.gz
   # vi /etc/openvpn/server.conf
   

   ;push "route 192.168.10.0 255.255.255.0"
   ;push "route 192.168.20.0 255.255.255.0"
   push "route 192.168.0.0 255.255.255.0" ← 追加(内部ネットワークアドレス)
   
   ;tls-auth ta.key 0 # This file is secret
   ↓
   tls-auth ta.key 0 # This file is secret
   
   ;user nobody
   ;group nogroup
   ↓
   user nobody
   group nogroup
   
   ;log-append  openvpn.log
   ↓
   log-append  /var/log/openvpn.log
   
   management localhost 7505 ← ファイル最終行へ追加
   crl-verify crl.pem ← ファイル最終行へ追加
   

8. iptables設定(/etc/openvpn/openvpn-startupを作成)

   # vi /etc/openvpn/openvpn-startup

   #!/bin/bash
   
   # VPNインタフェースiptablesルール削除スクリプト実行※必須
   /etc/openvpn/openvpn-shutdown
   
   # VPNサーバーからの送信を許可※必須
   iptables -I OUTPUT -o tun+ -j ACCEPT
   iptables -I FORWARD -o tun+ -j ACCEPT
   
   # VPNクライアントからVPNサーバーへのアクセスを許可する場合
   iptables -I INPUT -i tun+ -j ACCEPT
   
   # VPNクライアントからLANへのアクセスを許可する場合
   # (例としてVPNクライアントから192.168.0.0/24へのアクセスを許可する場合)
   iptables -I FORWARD -i tun+ -d 192.168.0.0/24 -j ACCEPT
   
   # VPNクライアントからLAN内特定マシンのみへのアクセスを許可する場合
   # (例としてVPNクライアントから192.168.0.3へのアクセスを許可する場合)
   #iptables -I FORWARD -i tun+ -d 192.168.0.3 -j ACCEPT
   

   # chmod +x /etc/openvpn/openvpn-startup

9. iptables設定(/etc/openvpn/openvpn-shutdownを作成)

   # vi /etc/openvpn/openvpn-shutdown

   #!/bin/bash
   
   # VPNインタフェース(tun+)用iptablesルール削除関数
   delete() {
       rule_number=`iptables -L $target --line-numbers -n -v|grep tun.|awk '{print $1}'|sort -r`
       for num in $rule_number
       do
           iptables -D $target $num
       done
   }
   
   # VPNインタフェース(tun+)用iptables受信ルール削除
   target='INPUT'
   delete
   
   # VPNインタフェース(tun+)用iptables転送ルール削除
   target='FORWARD'
   delete
   
   # VPNインタフェース(tun+)用iptables送信ルール削除
   target='OUTPUT'
   delete
   

   # chmod +x /etc/openvpn/openvpn-shutdown

10. openvpn起動 && iptablesスクリプト起動

    # /etc/init.d/openvpn start
    # ./iptables.sh
    

11. ルーター側で、宛先がVPN(例:10.8.0.0/24)のアクセスはVPNサーバー(例:192.168.0.2)を経由するようにルートを追加する。

1. クライアント証明書・秘密鍵作成

   # cd /etc/openvpn/easy-rsa/

2. 証明書／鍵作成用環境変数設定ファイル内容をシステムに反映

   # source vars

3. クライアント名saizensen_net-1※のクライアント証明書・秘密鍵作成
   ※クライアント名は一意であること＝既に作成済のクライアント名と重複しないこと

   # ./build-key-pass saizensen_net-1

   Generating a 1024 bit RSA private key
   .........................................++++++
   ..++++++
   writing new private key to 'saizensen_net-1.key'
   Enter PEM pass phrase: ← パスワードを設定する
   Verifying - Enter PEM pass phrase: ← パスワードを設定する(確認)
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [JP]: ← 空ENTER
   State or Province Name (full name) [Tokyo]: ← 空ENTER
   Locality Name (eg, city) [Edogawa]: ← 空ENTER
   Organization Name (eg, company) [saizensen.net]: ← 空ENTER
   Organizational Unit Name (eg, section) []: ← 空ENTER
   Common Name (eg, your name or your server's hostname) [saizensen_net-1]: ← 空ENTER
   Email Address [root@saizensen.net]: ← 空ENTER
   
   Please enter the following 'extra' attributes
   to be sent with your certificate request
   A challenge password []: ← 空ENTER
   An optional company name []: ← 空ENTER
   Using configuration from /etc/openvpn/easy-rsa/openssl.cnf
   Check that the request matches the signature
   Signature ok
   The Subject's Distinguished Name is as follows
   countryName           : PRINTABLE:'JP'
   stateOrProvinceName   : PRINTABLE:'Tokyo'
   localityName          : PRINTABLE:'Edogawa'
   organizationName      : PRINTABLE:'saizensen.net'
   commonName            : T61STRING:'seizensen_net-1'
   emailAddress          : IA5STRING:'root@saizensen.net'
   Certificate is to be certified until Aug 11 09:40:24 2019 GMT (3650 days)
   Sign the certificate? [y/n]:y ← yキー
   
   1 out of 1 certificate requests certified, commit? [y/n]y ← yキー
   Write out database with 1 new entries
   Data Base Updated
   

4. /etc/hosts.allowへVPN仮想IPを追加

   # echo "ALL: 10.8.0." >> /etc/hosts.allow

1. クライアント設定ファイルサンプル(C:\Program Files\OpenVPN\sample-config\client.ovpn)を設定ファイル格納フォルダ(C:\Program Files\OpenVPN\config)へコピーする。
2. クライアント設定ファイル(C:\Program Files\OpenVPN\config\client.ovpn)編集

   remote my-server-1 1194
   ↓
   remote saizensen.net 1194　←　VPNサーバー名を指定
   
   cert client.crt
   ↓
   cert saizensen_net-1.crt　←　クライアント証明書ファイル名を指定
   
   key client.key
   ↓
   key saizensen_net-1.key　←　クライアント秘密鍵ファイル名を指定
   
   ns-cert-type server　←　行頭の;を削除してコメント解除("Man-in-the-Middle"攻撃対策)
   
   tls-auth ta.key 1　←　行頭の;を削除してコメント解除(TLS認証有効化)
   

# cd /etc/openvpn/easy-rsa/
# source vars
# ./revoke-full saizensen_net-1
# /bin/cp keys/crl.pem /etc/openvpn/