Linux教程之CentOS下使用openvpn 搭建ssl-vpn Network,support,服务器,files,任务栏

小女巫 发表于 2015-1-14 20:45:19

Linux教程之CentOS下使用openvpn 搭建ssl-vpn

如果您觉得本篇CentOSLinux教程讲得好，请记得点击右边漂浮的分享程序，把好文章分享给你的小伙伴们！1、OpenVPN是靠假造的TUN/TAP装备完成SSLVPN的，因而内核必需撑持TUN/TAP装备模块，这个设置选项在2.6.x内核中，位于DeviceDrivers->Networkdevicesupport菜单中，全称是UniversalTUN/TAPdevicedriversupport，一般在尺度内核中，会以模块体例供应，在OpenVPN启动时，它会主动加载此模块，因而不必要手工加载此模块。
#pwd
/usr/src/kernels/2.6.18-238.12.1.el5-i686
#makemenuconfig#翻开内核菜单
DeviceDrivers--->
Networkdevicesupport--->
<M>UniversalTUN/TAPdevicedriversupport#<M>即暗示以模块化加载到内核中

2、在装置OpenVPN之前，还必要装置一些撑持包，包含OpenSSL开辟库和LZO紧缩开辟库
1、可以使用yum装置OpenSSL开辟库，但必要手工下载并装置LZO开辟包。
#yuminstallopenssl
#yuminstallopenssl-devel
2、可到http://www.oberhumer.com/opensource/lzo/下载LZO
#tarzxvflzo-2.03.tar.gz
#cdlzo-2.03
#./configure
#make
#makeinstall
3、设置SSLVPN办事
1、到http://openvpn.net/release/下载openvpn-2.0.9.tar.gz并装置
#tarzxvfopenvpn-2.0.9.tar.gz
#cdopenvpn-2.0.9/
#./configure
#make
#makeinstall
#cp-psample-scripts/openvpn.init/etc/init.d/openvpn
#chkconfig--addopenvpn
#serviceopenvpnstatus#检察办事形态
openvpn:servicenotstarted
#chkconfig--level235openvpnon
#chkconfig--listopenvpn
openvpn0:off1:off2:on3:on4:on5:on6:off
2、开启IP转发功效
#vi/etc/sysctl.conf
net.ipv4.ip_forward=1
#sysctl-p
3、界说OpenVPN的设置目次为/etc/openvpn，把办事器设置文件界说为/etc/openvpn/server.conf
OpenVPN是一个SSLVPN完成，因而，认证中最主要的是办事器和客户真个SSL证书办理，假如***之前没有SSL证书公布机制，那末可使用OpenVPN附带的一组工具来完成一切的事情。
在/usr/src/openvpn-2.0.9/中，有一个easy-rsa目次，这上面就是一些一成和办理SSL证书的工具，以下为天生证书操纵。
#mkdir-p/etc/openvpn
#cp-psample-config-files/server.conf/etc/openvpn/#将样本设置文件复制到/etc/openvpn/，前面再做修正
4、修正vars文件变量，设置国度代码、省分、地市、机构名单、单元称号邮件等
#cdeasy-rsa/
#grep-v"#"vars
exportD=`pwd`
exportKEY_CONFIG=$D/openssl.cnf
exportKEY_DIR=$D/keys
echoNOTE:whenyourun./clean-all,Iwillbedoingarm-rfon$KEY_DIR
exportKEY_SIZE=1024
exportKEY_COUNTRY=CN
exportKEY_PROVINCE=GD
exportKEY_CITY=SZ
exportKEY_ORG="DIC"
exportKEY_EMAIL="tghfly222@126.com"
#sourcevars
NOTE:whenyourun./clean-all,Iwillbedoingarm-rfon/usr/src/openvpn-2.0.9/easy-rsa/keys#提醒可以使用./clean-all扫除一切包含CA在内的一切证书
5、利用clean-all剧本扫除包含CA在内的一切证书，再创立CA证书。
#./clean-all#先扫除证书，再创立证书
#./build-ca#创立CA证书
Generatinga1024bitRSAprivatekey
..........++++++
................++++++
writingnewprivatekeytoca.key
-----
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter.,thefieldwillbeleftblank.
-----
CountryName(2lettercode):
StateorProvinceName(fullname):
LocalityName(eg,city):
OrganizationName(eg,company):
OrganizationalUnitName(eg,section)[]:
CommonName(eg,yournameoryourservershostname)[]:dic172#办事器主机名
EmailAddress:
6、创立办事器密钥。
#./build-key-serverserver#创立办事器端密钥
Generatinga1024bitRSAprivatekey
............................................++++++
....++++++
writingnewprivatekeytoserver.key
-----
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter.,thefieldwillbeleftblank.
-----
CountryName(2lettercode):
StateorProvinceName(fullname):
LocalityName(eg,city):
OrganizationName(eg,company):
OrganizationalUnitName(eg,section)[]:
CommonName(eg,yournameoryourservershostname)[]:dic172#办事器主机名
EmailAddress:
Pleaseenterthefollowingextraattributes
tobesentwithyourcertificaterequest
Achallengepassword[]:dic172
Anoptionalcompanyname[]:dic172
Usingconfigurationfrom/usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Checkthattherequestmatchesthesignature
Signatureok
TheSubjectsDistinguishedNameisasfollows
countryName:PRINTABLE:CN
stateOrProvinceName:PRINTABLE:GD
localityName:PRINTABLE:SZ
organizationName:PRINTABLE:DIC
commonName:PRINTABLE:dic172
emailAddress:IA5STRING:tghfly222@126.com
CertificateistobecertifieduntilJul1605:51:082021GMT(3650days)
Signthecertificate?:y
1outof1certificaterequestscertified,commit?y
Writeoutdatabasewith1newentries
DataBaseUpdated
7、创立客户端密钥，客户端密钥名可随便定名。
#./build-keyclient
Generatinga1024bitRSAprivatekey
.....++++++
.......................++++++
writingnewprivatekeytoclient.key
-----
Youareabouttobeaskedtoenterinformationthatwillbeincorporated
intoyourcertificaterequest.
WhatyouareabouttoenteriswhatiscalledaDistinguishedNameoraDN.
Therearequiteafewfieldsbutyoucanleavesomeblank
Forsomefieldstherewillbeadefaultvalue,
Ifyouenter.,thefieldwillbeleftblank.
-----
CountryName(2lettercode):
StateorProvinceName(fullname):
LocalityName(eg,city):
OrganizationName(eg,company):
OrganizationalUnitName(eg,section)[]:
CommonName(eg,yournameoryourservershostname)[]:tgh#分歧客户端，定名毫不能一样
EmailAddress:
Pleaseenterthefollowingextraattributes
tobesentwithyourcertificaterequest
Achallengepassword[]:dic172
Anoptionalcompanyname[]:dic172
Usingconfigurationfrom/usr/src/openvpn-2.0.9/easy-rsa/openssl.cnf
Checkthattherequestmatchesthesignature
Signatureok
TheSubjectsDistinguishedNameisasfollows
countryName:PRINTABLE:CN
stateOrProvinceName:PRINTABLE:GD
localityName:PRINTABLE:SZ
organizationName:PRINTABLE:DIC
commonName:PRINTABLE:tgh
emailAddress:IA5STRING:tghfly222@126.com
CertificateistobecertifieduntilJul1605:52:272021GMT(3650days)
Signthecertificate?:y

1outof1certificaterequestscertified,commit?y
Writeoutdatabasewith1newentries
DataBaseUpdated
8、创立dhDiffie-Hellman）密钥算法文件
#./build-dh
GeneratingDHparameters,1024bitlongsafeprime,generator2
Thisisgoingtotakealongtime
...+.......+.....+........................+......................+.....+...........................+..........+.......+.................................................+.....................+............+..............................................+..........................................................+..............................+...........................+..+.....+......++*++*++*
9、天生tls-auth密钥，tls-auth密钥能够为点对点的VPN毗连供应了进一步的宁静考证，假如选择利用这一体例，办事器端和客户端都必需具有该密钥文件。
#openvpn--genkey--secretkeys/ta.key
#cp-rpkeys//etc/openvpn/#将证书文件复制到/etc/openvpn/
10、修正server.conf设置文件
#grep-v"#"server.conf
local192.168.161.172#办事器所利用的IP
port1194#利用1194端口端口必要修正
protoudp#利用UDP协定可同时利用TCPUDP搭建多历程ssl-VPN办事
devtun#利用tun装备
ca/etc/openvpn/keys/ca.crt#指定CA证书文件路径
cert/etc/openvpn/keys/server.crt
dh/etc/openvpn/keys/dh1024.pem
tls-auth/etc/openvpn/keys/ta.key0
server172.16.10.0255.255.255.0#VPN客户端拨进后，所取得的IP地点池
ifconfig-pool-persistipp.txt
push"dhcp-optionDNS202.96.134.133"#客户端所取得的DNS
client-to-client
keepalive10120
comp-lzo
persist-key
persist-tun
statusopenvpn-status.log
verb3
mute20
#serviceopenvpnstart
Startingopenvpn:
#netstat-anp|grep:1194
udp00192.168.161.172:11940.0.0.0:*25162/openvpn
4、在XP客户端设置SSLVPN（客户端IP192.168.163.96）
1、到http://openvpn.se/files/install_packages/下载openvpn-2.0.9-gui-1.0.3-install.exe
2、装置openvpn-2.0.9-gui-1.0.3-install.exe，一起next。因为只是做客户端利用，不用装置OpenVPNService

装置完成后，在义务栏会新增添一个OpenVPNGUI和当地毗连图标。

3、设置客户端，把办事器上/etc/openvpn/keys/ca.*,client.*,ta.*复制客户端C:ProgramFilesOpenVPNconfig下；再从C:ProgramFilesOpenVPNsample-config复制一个客户端设置样本文件client.ovpn到C:ProgramFilesOpenVPNconfig下。

4、修正client.ovpn文件以下并保留。
client
devtun
protoudp#prototcp
remote192.168.161.1721194
resolv-retryinfinite
nobind
caca.crt
certclient.crt
keyclient.key
tls-authta.key1
comp-lzo
verb3
mute20
5、启动毗连。右击右下角的OpenVPNGUI图标，毗连

6、毗连乐成后，图标以下。到此，SSLVPN办事就设置好了。

如果您觉得本篇CentOSLinux教程讲得好，请记得点击右边漂浮的分享程序，把好文章分享给你的小伙伴们！

再现理想 发表于 2015-1-16 22:13:19