Redes/VPNyTuneles/OpenVPN
De ProyectoFedora
"Borrador"
Tabla de contenidos |
Instalación Servidor OpenVPN
http://openvpn.net/
yum install openvpn
Autenticación con Certificado
Principio, cada usuario y/o pc cliente tiene su certificado para autenticarse y para ello debe erigirse como autoridad que emita dicho certificados. Abajo le ofrecemos una "receta" breve ya que no es un tema particular de OpenVPN del cómo se gestionan los certificados.
Creación del Servidor de Certificados
# su - # mkdir /etc/openvpn/easyrsa # cp -ar /usr/share/openvpn/easy-rsa/2.0/* /etc/openvpn/easyrsa/
# cd /etc/openvpn/easyrsa # vi vars # These are the default values for fields # which will be placed in the certificate. # Don't leave any of these fields blank. export KEY_COUNTRY="VE" export KEY_PROVINCE="DC" export KEY_CITY="Caracas" export KEY_ORG="gomix.org" export KEY_EMAIL="guillermo.gomez@gmail.com"
# cd /etc/openvpn/easyrsa # . vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easyrsa/keys # ./clean-all # ./build-ca Generating a 1024 bit RSA private key ...++++++ ................................................++++++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [VE]: State or Province Name (full name) [DC]: Locality Name (eg, city) [Caracas]: Organization Name (eg, company) [gomix.org]: Organizational Unit Name (eg, section) []:Ingenieria Common Name (eg, your name or your server's hostname) [Gomix Org]: Email Address [guillermo.gomez@gmail.com]: #
Generación de Parámetros Diffie Hellman
# ./build-dh Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ............+................................................... ................................................................ ................................................................ ..................+............................................. ................................................................ ........................+....................................... ..............+............................................+...+ ................................................................ ............................................+.........++*++*++* #
Llaves del Servidor
./build-key-server mi.servidor.com Generating a 1024 bit RSA private key ..................++++++ ...............................++++++ writing new private key to 'mi.servidor.com.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [VE]: State or Province Name (full name) [DC]: Locality Name (eg, city) [Caracas]: Organization Name (eg, company) [Gomix Org]: Organizational Unit Name (eg, section) []:Seguridad Common Name (eg, your name or your server's hostname) [mi.servidor.com]: Email Address [guillermo.gomez@gmail.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easyrsa/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'VE' stateOrProvinceName :PRINTABLE:'DC' localityName :PRINTABLE:'Caracas' organizationName :PRINTABLE:'Gomix Org' organizationalUnitName:PRINTABLE:'Seguridad' commonName :PRINTABLE:'mi.servidor.com' emailAddress :IA5STRING:'guillermo.gomez@gmail.com' Certificate is to be certified until Aug 19 23:57:44 2018 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
Llaves Para Clientes
# ./vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/openvpn/easyrsa/keys # ./build-key cmartinez Generating a 1024 bit RSA private key ................++++++ ....++++++ writing new private key to 'cmartinez.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [VE]: State or Province Name (full name) [DC]: Locality Name (eg, city) [Caracas]: Organization Name (eg, company) [Gomix Org]: Organizational Unit Name (eg, section) []:Soporte Common Name (eg, your name or your server's hostname) [cmartinez]: Email Address [guillermo.gomez@gmail.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/openvpn/easyrsa/openssl.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'VE' stateOrProvinceName :PRINTABLE:'DC' localityName :PRINTABLE:'Caracas' organizationName :PRINTABLE:'Gomix Org' organizationalUnitName:PRINTABLE:'Soporte' commonName :PRINTABLE:'cmartinez' emailAddress :IA5STRING:'guillermo.gomez@gmail.com' Certificate is to be certified until Aug 20 00:01:09 2018 GMT (3650 days) Sign the certificate? [y/n]:y 1 out of 1 certificate requests certified, commit? [y/n]y Write out database with 1 new entries Data Base Updated
Configuración
En Fedora los archivos de configuración de muestra están en /usr/share/doc/openvpn-2.1/sample-config-files .
Configuración Servidor
Partiremos del archivo de configuración de muestra server.conf, y sólo mostraremos los cambios más importantes.
# cp /usr/share/doc/openvpn-2.1/sample-config-files/server.conf /etc/openvpn/
Ajuste las rutas que apuntan a los archivos de los certificados tanto de la autoridad como del servidor.
Customización por Cliente
Una de las preguntas típicas es como por ejemplo asignar direcciones IP fijas a nuestros clientes VPN con la intención de implementar políticas de filtrado de paquetes para dichas conexiones, este tipo de requerimientos es fácilmente resoluble implementando configuraciones específicas por cliente, es decir, por certificado del cliente, veamos como.
La solución es crear un directorio dentro del directorio de configuración de OpenVPN y colocar allí la configuración por cliente. Asumamos que ese directorio se llama “dcc” de “Directorio de Configuraciones de Clientes”. Entonces necesita agregar la línea de configuración “client-config-dir dcc” a su archivo de configuración server.conf.
Agregue client-config-dir dcc a su configuración de servidor (server.conf)
Dentro de dcc usted crea un archivo por cada cliente que desea configurar y le llama exactamente de acuerdo al common name del certificado del cliente. En estos archivos puede utilizar declaraciones ordinarias de OpenVPN. Para asignar direcciónes ip fijas usted usaría entonces “ipconfig-push 10.8.0.X 10.8.0.0″ si utiliza la subred sugerida “10.8.0.0″.
Configuración Cliente
Linux
Opción 1: NetworkManager-openvpn
yum install NetworkManager-openvpn
Mac
Ver http://code.google.com/p/tunnelblick/
