Install openvpn using the rpm
Installing OpenVPN from a binary RPM package has these dependencies:
- openssl
- lzo
- pamInstall rpms as root:# rpm -ivh openvpn-2.0.5-1.el4.rf.i386.rpm
installing rpm
rpm -ivh lzo-1.08-4.2.el4.rf.i386.rpm
The main configuration directory for open vpn is /etc/openvpn
Setting up your Certificate Authority (CA) and generating certificates and keys for an OpenVPN server and multiple clients
The first step in building an OpenVPN 2.0 configuration is to establish a PKI (public key infrastructure). The PKI consists of:
- A separate certificate (also known as a public key) and private key for the server and each client, and
- A master Certificate Authority (CA) certificate and key which is used to sign each of the server and client certificates
Copy the /usr/share/doc/openvpn-2.0.7/easy-rsa/2.0/ directory to /etc/openvpn/easy-rsa
cp -r /usr/share/doc/openvpn-2.0.7/easy-rsa/2.0/ /etc/openvpn/easy-rsa
Configure easy-rsa
Now edit the vars file and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don’t leave any of these parameters blank.
Next, initialize the PKI. on Linux:
./vars
./clean-all
./build-ca
The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:
Generating a 1024 bit RSA private key
…………++++++
………..++++++
writing new private key to ‘ca.key’
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [KG]:IN
State or Province Name (full name) [NA]:KERALA
Locality Name (eg, city) [BISHKEK]:KOCHI
Organization Name (eg, company) [OpenVPN-TEST]:company name
Organizational Unit Name (eg, section) []:company name
Common Name (eg, your name or your server’s hostname) []:company name
Email Address [Riyesh@linuxbuddies.com]
Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above.
Generate certificate & key for server
Next, we will generate a certificate and private key for the server. On Linux:
./build-key-server server
As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter “server”. Two other queries require positive responses, “Sign the certificate? [y/n]” and “1 out of 1 certificate requests certified, commit? [y/n]“.
Generate certificates & keys for clients
Generating client certificates is very similar to the previous step. On Linux:
./build-key client1
./build-key client2 and so on…
Generate Diffie Hellman parameters
Diffie Hellman parameters must be generated for the OpenVPN server. On Linux:
./build-dh
./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
……………..+…………………………………….
……………….+………….+……………..+………
………………………………..
Creating TLS Key
The tls-auth directive adds an additional HMAC signature to all SSL/TLS handshake packets for integrity verification. Any UDP packet not bearing the correct HMAC signature can be dropped without further processing. The tls-auth HMAC signature provides an additional level of security above and beyond that provided by SSL/TLS.
Using tls-auth requires that you generate a shared-secret key that is used in addition to the standard RSA certificate/key:
openvpn –genkey –secret ta.key
This command will generate an OpenVPN static key and write it to the file ta.key. This key should be copied over a pre-existing secure channel to the server and all client machines. It can be placed in the same directory as the RSA .key and .crt files.
In the server configuration, add:
tls-auth ta.key 0
In the client configuration, add:
tls-auth ta.key 1
Creating configuration files for server and clients
remote ekm1.dyndns.org 1194
#remote ekm2.linuxbuddies.com 1194/etc/openvpn/server.conf
port 1194 ; Port for OpenVpn traffic
proto tcp ; TCP protocol
dev tun ; use Tun device
ca ca.crt ; Certificate file of signing Authority
cert server.crt ; Server certificate
key server.key ; Server Key
dh dh2048.pem ;Diffie Hellman parameters
server 10.2.100.0 255.255.255.0 ; Openvpn subnet should be different from the local network of server and client
ifconfig-pool-persist ipp.txt
push “route 10.2.1.0 255.255.255.0“ ; Pushing routes to client
push “route 10.1.1.0 255.255.255.0“
client-config-dir ccd
route 10.2.100.0 255.255.255.0
push “dhcp-option DNS 10.2.1.11“ ; Pushing DNS server to client
client-to-client ; Clients can communicate eatch other
duplicate-cn
keepalive 10 120
tls-auth ta.key 0 ; tls key
comp-lzo ; Use lzo compression Algo
max-clients 10
user nobody ; Run openvpn as user nobody -
group nobody ; group nobody for security
persist-key
persist-tun
tun-mtu 1500
status openvpn-status.log
log-append /var/log/openvpn.log
verb 6
mute 20
client.conf
client
dev tun
proto tcp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
comp-lzo
verb 3
mute 20
ns-cert-type server
auth-user-pass
pull
mssfix 1450
############
