centos操作系统为企业搭建稳固的SSL VPN服务

admin

一、OpenVPN是靠虚拟的TUN/TAP设备实现SSL VPN的，因此内核必须支持TUN/TAP设备模块，这个配置选项在2.6.x内核中，位于Device Drivers ->Network device support 菜单中，全称是Universal TUN/TAP device driver support ，通常在标准内核 中，会以模块方式提供，在Open VPN启动时，它会自动加载此模块，因此不需要手工加载此模块。
[root@www.linuxidc.com 2.6.18-238.12.1.el5-i686]# pwd
/usr/src/kernels/2.6.18-238.12.1.el5-i686
3 u8 p; R" e8 P; d' c[root@www.linuxidc.com 2.6.18-238.12.1.el5-i686]# make menuconfig  #打开内核菜单
Device Drivers  --->            
Network device support  --->      
. j: I4 f$ G8 E' k" b<M> Universal TUN/TAP device driver support     #<M>即表示以模块化加载到内核中

, |0 ~9 D/ a* x4 J( R二、在安装OpenVPN之前，还需要安装一些支持包，包括OpenSSL开发库和LZO压缩开发库
( h, @- j! H4 M9 p, {7 U( _1、可使用yum安装OpenSSL开发库，但需要手工下载并安装LZO开发包。
#yum install  openssl  
# yum install openssl-devel

#yum install pam-devel

2、可到 http://www.oberhumer.com/opensource/lzo/ 下载LZO
# tar -zxvf lzo-2.10.tar.gz
# cd lzo-2.10
#./configure
8 f9 S: _# I+ i# make
# make install

三、配置SSL VPN服务
1、到  http://openvpn.net/release/ 下载openvpn-2.0.9.tar.gz并安装
1 H8 S$ O2 l: b6 v. I  H/ k& {8 d, D. Q# tar -zxvf openvpn-2.1.1.tar.gz
# cd openvpn-2.1.1
0 C1 T- e; h: j: }( T6 h9 V7 l[root@webbs168x openvpn-2.1.1]# ./configure --prefix=/usr/local/openvpn
  S5 F. C- g! [[root@webbs168x openvpn-2.1.1]# make
[root@webbs168x openvpn-2.1.1]# make install
+ Z5 }! f# @& }4 H[root@webbs168x openvpn-2.1.1]#cp -p sample-scripts/openvpn.init /etc/init.d/openvpn
; n6 [6 N( R* T2 Y4 i$ F, y' _[root@webbs168x openvpn-2.1.1]# chkconfig --add openvpn
- t: D6 s" l  o8 S4 k4 f9 R[root@webbs168x openvpn-2.1.1]# service openvpn status  #查看服务状态
openvpn: service not started

+ V( _$ H: L7 l1 E! C# chkconfig --list openvpn
( \- K) g8 G; @openvpn         0:off   1:off   2:on    3:on    4:on    5:on    6:off

2、开启IP转发功能
#vi /etc/sysctl.conf
1 g/ p  B1 c* l9 x7 V' Y7 `net.ipv4.ip_forward = 1
2 ]1 z4 v* m0 A8 g& f# sysctl -p
3、定义OpenVPN的配置目录为/etc/openvpn，把服务器配置文件定义为/etc/openvpn/server.conf
; p: H/ p! Q' o& D, _$ L' s# IOpenVPN是一个SSL VPN实现，因此，认证中最重要的是服务器和客户端的SSL证书管理，如果管理员之前没有SSL证书发布机制，那么可以使用OpenVPN附带的一组工具来完成所有的工作。
在/root/openvpn-2.1.1中，有一个easy-rsa目录，这下面就是一些一成和管理SSL证书的工具，以下为生成证书操作。
#mkdir -p /etc/openvpn
& {: |* b# I5 e! e: l/ q#cp -p sample-config-files/server.conf /etc/openvpn/   #将样本配置文件复制到/etc/openvpn/，后面再做修改

4、修改vars文件变量，设置国家代码、省份、地市、机构名单、单位名称邮件等
8 O/ t1 ^( H1 t* D) i#cd easy-rsa/
( E1 B- Q9 T8 `4 S+ M# grep -v "#" vars
) L$ b) \( N- L: k' T) `! N+ D1 r. xexport D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
% b4 y5 u2 {/ j. Z6 sexport KEY_DIR=$D/keys
! G/ e# t/ e1 \$ @% j- g  yecho NOTE: when you run ./clean-all, I will be doing a rm -rf on $KEY_DIR
export KEY_SIZE=1024
2 U$ f) v- o$ w6 e( P/ Pexport KEY_COUNTRY=CN
2 k% _( C: x. C: V, G6 o0 B  p6 [export KEY_PROVINCE=GD
) G0 f, P. G$ X* M% o0 w' m2 y. T! ^export KEY_CITY=SZ
5 u/ @% P# ?! y3 l% c  E9 Xexport KEY_ORG="DIC"
6 z, r& L* h6 c% Q1 t, iexport KEY_EMAIL="tghfly222@126.com"
easy-rsa# source vars
* Z/ q0 f" l, Q% YNOTE: when you run ./clean-all, I will be doing a rm -rf on /usr/src/openvpn-2.0.9/easy-rsa/keys  #提示可使用./clean-all清除所有包括CA在内的所有证书

5、使用clean-all脚本清除包括CA在内的所有证书，再创建CA证书。
[root@www.linuxidc.com easy-rsa]# ./clean-all   #先清除证书，再创建证书
[root@www.linuxidc.com easy-rsa]# ./build-ca  #创建CA证书
Generating a 1024 bit RSA private key
..........++++++
................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
  z3 O) Y4 G& |5 Z( iIf you enter '.', the field will be left blank.
. ?' f9 J( Y* E: M% C3 E9 W-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
- ~' y( f+ d* N3 G" m# ]8 s* ]! TOrganizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:dic172   #服务器主机名
Email Address [tghfly222@126.com]:

6、创建服务器密钥。
[root@www.linuxidc.com easy-rsa]# ./build-key-server server  #创建服务器端密钥
Generating a 1024 bit RSA private key
+ A0 W7 k2 v  E+ l. t5 h- W............................................++++++
....++++++
4 T8 m6 @! U9 x: m* Cwriting new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
! C3 m3 L4 p3 }1 i& pWhat you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
9 G0 k# C' ]5 T3 q+ sFor some fields there will be a default value,
If you enter '.', the field will be left blank.
9 J, h( m/ \% w3 e-----
0 E; D  H/ S% ?Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
/ `# g# V3 E9 P9 Q7 l9 z" sLocality Name (eg, city) [SZ]:
# s6 w6 h4 R1 K) B7 ^: {Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:dic172  #服务器主机名
Email Address [tghfly222@126.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
0 u  h; W+ e8 z8 J3 {A challenge password []:dic172
An optional company name []:dic172
Using configuration from /usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'CN'
/ k  k) ?# B9 g! k* L, ystateOrProvinceName   :PRINTABLE:'GD'
localityName          :PRINTABLE:'SZ'
organizationName      :PRINTABLE:'DIC'
- \& c9 I- J/ |( p3 scommonName            :PRINTABLE:'dic172'
* m% K3 f/ u5 g6 s( Y' hemailAddress          :IA5STRING:'tghfly222@126.com'
9 V9 M% [; s3 f' mCertificate is to be certified until Jul 16 05:51:08 2021 GMT (3650 days)
Sign the certificate? [y/n]:y
1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
7、创建客户端密钥，客户端密钥名可随意命名。
: k! Z" M: o' A* O2 k* |0 b[root@www.linuxidc.com easy-rsa]# ./build-key client
Generating a 1024 bit RSA private key
.....++++++
.......................++++++
. f2 [3 w1 ]  b# z6 m" xwriting new private key to 'client.key'
-----
You are about to be asked to enter information that will be incorporated
8 _! ~! Y% z3 P4 [' X, v( D( {into your certificate request.
; W4 K8 W, _2 P7 K- k6 eWhat you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
8 y& `- q* A8 B$ d* S% iFor some fields there will be a default value,
! L, A& _% S+ [6 V/ q, j  vIf you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [DIC]:
Organizational Unit Name (eg, section) []:
9 [) Z$ r+ a$ V, YCommon Name (eg, your name or your server's hostname) []:tgh  #不同客户端，命名绝不能一样
( V/ g, `' \$ N- o* B7 y5 T* rEmail Address [tghfly222@126.com]:

Please enter the following 'extra' attributes
# M! o3 f& _4 I; k: S$ B8 Xto be sent with your certificate request
. r: I0 _, F' X8 ^) @! ]$ q9 VA challenge password []:dic172
6 C; H4 w0 y. V1 tAn optional company name []:dic172
4 H8 a% t( g: f% e$ m1 ^Using configuration from /usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
9 E# Y% m7 b% K6 g0 o8 Y- ~5 {, l- E7 p  fcountryName           :PRINTABLE:'CN'
stateOrProvinceName   :PRINTABLE:'GD'
& F/ C$ c  ]9 ]* plocalityName          :PRINTABLE:'SZ'
% Y9 q/ l1 n& C& F4 G+ zorganizationName      :PRINTABLE:'DIC'
2 J$ a# Z$ M" N- RcommonName            :PRINTABLE:'tgh'
6 E- z# {) g& \* FemailAddress          :IA5STRING:'tghfly222@126.com'
Certificate is to be certified until Jul 16 05:52:27 2021 GMT (3650 days)
# n' n: F9 X+ o; T/ m$ \Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
$ y* R  L6 ?4 B8 N# l! W3 ^" A% BWrite out database with 1 new entries
Data Base Updated

8、创建dhDiffie-Hellman ）密钥算法文件
[root@www.linuxidc.com easy-rsa]# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
3 d5 |' I6 ^4 j# p) F* @...+.......+.....+........................+......................+.....+...........................+..........+.......+.................................................+.....................+............+..............................................+..........................................................+..............................+...........................+..+.....+......++*++*++*

9、生成  tls-auth 密钥 ，tls-auth密钥可以为点对点的VPN连接提供了进一步的安全验证，如果选择使用这一方式，服务器端和客户端都必须拥有该密钥文件。
[root@www.linuxidc.com easy-rsa]# openvpn --genkey --secret keys/ta.key   
[root@www.linuxidc.com easy-rsa]# cp -rp keys/ /etc/openvpn/    #将证书文件复制到/etc/openvpn/   

10、修改server.conf配置文件
[root@www.linuxidc.com openvpn]# grep -v "#" server.conf

local 192.168.161.172     #服务器所使用的IP
port 1194                      #使用1194端口
proto udp                      #使用UDP协议
$ j  A# u, B3 d9 A) W9 h7 rdev tun                         #使用tun设备
9 }# V! P- u% p! b6 [3 }- \ca /etc/openvpn/keys/ca.crt    #指定CA证书文件路径
. J8 Z. |4 V/ z# B+ b" Scert /etc/openvpn/keys/server.crt
dh /etc/openvpn/keys/dh1024.pem
0 J3 s1 _! i" j; O+ i" c, u$ stls-auth /etc/openvpn/keys/ta.key 0
# S/ \5 E$ A' O" eserver 172.16.10.0 255.255.255.0   #VPN客户端拨入后，所获得的IP地址池
ifconfig-pool-persist ipp.txt
$ e' x7 A6 L% Q5 s* xpush "dhcp-option DNS 202.96.134.133"   #客户端所获得的DNS
client-to-client
4 W, J9 l2 h. ?! O. W5 o9 hkeepalive 10 120
8 t' {( S1 V$ G& i, Q" M8 q1 qcomp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
' b6 ~& {' y+ s1 {mute 20

[root@www.linuxidc.com openvpn-2.0.9]# service openvpn start
Starting openvpn: [  OK  ]
3 Z: ~. X* P7 U6 Q& a9 b: Z[root@www.linuxidc.com openvpn-2.0.9]# netstat -anp |grep :1194
udp        0      0 192.168.161.172:1194        0.0.0.0:*                               25162/openvpn   

四、在XP客户端配置SSL VPN（客户端IP 192.168.163.96）
1、到http://openvpn.se/files/install_packages/下载openvpn-2.0.9-gui-1.0.3-install.exe
+ o0 i: i5 z+ I2、安装openvpn-2.0.9-gui-1.0.3-install.exe，一路next。由于只是做客户端使用，不必安装OpenVPN Service

! ]# E+ e  E4 }1 Z% E# B# v- }$ z1 M

安装完成后，在任务栏会新增加一个OpenVPN GUI和本地连接图标。

https://www.linuxidc.com/upload/2011_08/110801143355492.png

3、配置客户端，把服务器上/etc/openvpn/keys/ca.*,client.*,ta.* 复制客户端C:\Program Files\OpenVPN\config下；再从C:\Program Files\OpenVPN\sample-config复制一个客户端配置样本文件client.ovpn到C:\Program Files\OpenVPN\config下。

& ?0 f4 A- q9 q- @: L+ `; X5 T

4、修改client.ovpn文件如下并保存。
client
dev tun
# ^* ]3 i  e: Zproto udp
6 E7 Q" |% V5 a$ {9 b9 {5 tremote 192.168.161.172 1194
9 ^, D; t( p  L! {resolv-retry infinite
nobind
! _9 m, [# G0 \2 wca ca.crt
cert client.crt
) U$ p" ~8 ~, k3 W% qkey client.key
tls-auth ta.key 1
6 v2 L; v6 j9 S9 N$ jcomp-lzo
verb 3
' Q8 m+ X+ H- P* `mute 20
5、启动连接。右击右下角的OpenVPN GUI图标，连接

https://www.linuxidc.com/upload/2011_08/110801143355494.png

6、连接成功后，图标如下。到此，SSL VPN服务就配置好了。

https://www.linuxidc.com/upload/2011_08/110801143355495.png

admin

lzo安装包