From 19577f2942c8ea689e2f1e1bc6cf25591c55a8d4 Mon Sep 17 00:00:00 2001 From: DeadFire Date: Tue, 29 Oct 2013 16:23:19 +0800 Subject: [PATCH] =?UTF-8?q?20131029-3=20=E9=80=89=E9=A2=98?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- ...etworking with OpenVPN on Linux, Part 1.md | 107 ++++++++++++++++++ ...etworking with OpenVPN on Linux, Part 2.md | 93 +++++++++++++++ 2 files changed, 200 insertions(+) create mode 100644 sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 1.md create mode 100644 sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2.md diff --git a/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 1.md b/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 1.md new file mode 100644 index 0000000000..6b9b6eb324 --- /dev/null +++ b/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 1.md @@ -0,0 +1,107 @@ +How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 1 +================================================================================ +It's always been prudent to wrap a warm comfy layer of encryption over your Internet travels to foil snoops of all kinds, and with our own government slurping up every bit wholesale it's more crucial than ever. OpenVPN is the top choice for protecting networking over untrusted networks. Today we'll learn a quick way to set up OpenVPN so you can securely access your home server when you're on the road. + +A quick note on VPNs: there are many commercial VPNs that aren't worth the bits they're printed on. They're little better than SSL-protected Web sites, because they trust all clients. A true VPN (virtual private network) connects two trusted endpoints over untrusted networks. You can't just log in from whatever random PC you find, and this is good because (presumably) you understand that logging in to your private network from an infected host is a bad thing to do, no matter how secure the connection is. So you have to configure both your server and client. + +### OpenVPN Quickstart ### + +You need two computers on different subnets, like a wired and wireless PC on the same network (or a couple of Linux guests in Virtualbox), and you need to know the IP addresses of both PCs. Let's call our example computers Studio and Shop. Install OpenVPN on both of them. OpenVPN is included in most Linux distributions, so you can install it with your favorite package manager. This example is for Debian, Ubuntu, and their myriad descendants: + + $ sudo apt-get install openvpn openvpn-blacklist + +That installs the server and a little program to check the blacklist of compromised keys. You must install the blacklist checker! Because once upon a time Debian distributed a [broken version of OpenSSL][1] which had a broken random number generator, so keys created with this are assumed to be too vulnerable to trust. The random number generator was not really random, but predictable. This happened way back in 2008, and everyone who used the defective OpenSSL was supposed to hunt down and replace their weak keys. Even though it's been over five years, it's cheap insurance to use the blacklist checker. + +Now let's test it by creating an unencrypted tunnel between our two PCs. First ping each machine to make sure they're talking to each other. Then make sure that OpenVPN is not running, because we're going to start it manually: + + $ ps ax|grep openvpn + +If it is, kill it. Let's say that Studio's IP address is 192.168.1.125, and Shop's is 192.168.2.125. Open an unencrypted tunnel from Studio to Shop: + +$ sudo openvpn --remote 192.168.2.125 --dev tun0 --ifconfig 10.0.0.1 10.0.0.2 + +Then from Shop to Studio: + + $ sudo openvpn --remote 192.168.1.125 --dev tun0 --ifconfig 10.0.0.2 10.0.0.1 + +When you make a successful connection you'll see something like this: + + Wed Oct 16 2013 ******* WARNING *******: all encryption and authentication + features disabled -- all data will be tunnelled as cleartext + Wed Oct 16 2013 TUN/TAP device tun0 opened + Wed Oct 16 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 + Wed Oct 16 2013 /sbin/ifconfig tun0 10.0.0.1 pointopoint 10.0.0.2 mtu 1500 + Wed Oct 16 2013 UDPv4 link local (bound): [undef] + Wed Oct 16 2013 UDPv4 link remote: [AF_INET]192.168.2.125:1194 + Wed Oct 16 2013 Peer Connection Initiated with [AF_INET]192.168.2.125:1194 + Wed Oct 16 2013 Initialization Sequence Completed + +"Initialization Sequence Completed" are the magic words that confirm you did it right. You should be able to ping back and forth with the tunnel addresses, ping 10.0.0.1 and ping 10.0.0.2. When you build your tunnel you may use whatever IP addresses you want that don't overlap with your existing network. To close your tunnel press Ctrl+c. + +Just for fun open an SSH session over your tunnel. Figure 1 shows a successful SSH login over a VPN tunnel, and it also demonstrates the fancy Message of the Day from [Put a Talking Cow in Your Linux Message of the Day][1]: + + $ ssh carla@10.0.0.2 + +![](http://www.linux.com/images/stories/41373/SSH-OpenVPN.jpg) + +*Figure 1: A successful SSH session over a VPN tunnel, and a fancy MOTD.* + +Hurrah, it works! + +### Encrypted VPN Tunnel ### + +This is all fun and exciting, but pointless without encryption, so we'll set up a simple static key configuration. It's not as strong as a proper public key infrastructure (PKI) with root certificates and revocations and all that good stuff, but it's a good-enough solution for the lone nerd needing to call home from the road. OpenVPN helpfully includes a command to create the static key, so create a directory to store the key in, create the key, and make it read-only for the file owner: + + $ sudo mkdir /etc/openvpn/keys/ + $ sudo openvpn --genkey --secret /etc/openvpn/keys/static.key + $ sudo chmod 0400 /etc/openvpn/keys/static.key + +This is a plain-text key that you can open in a text editor and look at if you're curious, and you can name it anything you want; you don't have to call it "static.key". Copy this key to both computers-- yes, the same key. It's not a private-public key pair, but just one single shared key. + +Now we'll create some simple barebones configuration files for each computer. (On Debuntu etc. there are no default configuration files, but rather a wealth of example files in/usr/share/doc/openvpn/.) In my little test tab Studio is the server, and Shop is the wandering laptop that will log into the server. My server configuration file is/etc/openvpn/studio.conf, and this is all it has: + + # config for Studio + dev tun + ifconfig 10.0.0.1 10.0.0.2 + secret /etc/openvpn/keys/static.key + +Make this file readable and writable only to the file owner: + + $ sudo chmod 0600 /etc/openvpn/studio.conf + +The configuration file on the client is similar, with the addition of the IP address of the server: + + # config for Shop + dev tun + ifconfig 10.0.0.2 10.0.0.1 + secret /etc/openvpn/keys/static.key + remote 192.168.1.125 + +Mind the order of your IP addresses on the ifconfig line, because they need to be in the order of local > remote. Now fire up OpenVPN on the server, specifying the server configuration file, and do the same on your client: + + $ sudo openvpn /etc/openvpn/studio.conf + $ sudo openvpn /etc/openvpn/shop.conf + +You'll see the same "Initialization Sequence Completed" message for a successful connection, and you must also look for the absence of this message, which should have appeared when you created your un-encrypted tunnel: + + ******* WARNING *******: all encryption and authentication features disabled + +Firewalls and Dynamic IP Addresses + +OpenVPN itself is simple to configure. The biggest hassles are dealing with firewalls and dynamic IP addresses. There are a skillion different firewalls in the world, so I shall leave it as your homework to figure out how to get through it safely. OpenVPN wants port 1194, and then you'll want to have a forwarding rule that points to the computer you want to access. + +Dynamic IP addresses are another hassle. [Dyn.com][3] is an inexpensive way to manage dynamic IP assignment from your ISP. Or you might be able to pay your ISP a few bucks to get a static address. + +At this point you could stop and call it good, because you can manually start OpenVPN on your server and leave it waiting for you, take your laptop out into the world, and connect to your server whenever you want. However, there are some refinements we can add such as daemonizing OpenVPN on the server, using Network Manager to make the connection automatically, and the biggest missing piece in OpenVPN howtos: how to access your remote resources. So come back next week for the rest of the story. + +-------------------------------------------------------------------------------- + +via: http://www.linux.com/learn/tutorials/743590-secure-remote-networking-with-openvpn-on-linux + +译者：[译者ID](https://github.com/译者ID) 校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出 + +[1]:http://www.debian.org/security/2008/dsa-1571 +[2]:http://www.linux.com/learn/tutorials/741573-put-a-talking-cow-in-your-linux-message-of-the-day +[3]:http://dyn.com/dns/ \ No newline at end of file diff --git a/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2.md b/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2.md new file mode 100644 index 0000000000..1e3f50b214 --- /dev/null +++ b/sources/How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2.md @@ -0,0 +1,93 @@ +How to Set Up Secure Remote Networking with OpenVPN on Linux, Part 2 +================================================================================ +Greetings fellow Linux users, and welcome to the second part of our glorious OpenVPN series. When last we met we learned how to set up a [simple OpenVPN encrypted tunnel][1] between a home server and a remote node, such as a laptop. Today we're adding refinements such as how to daemonize OpenVPN so we don't have to start it manually, use Network Manager for easy connecting to our remote server, and access services. + +### Network Manager Integration ### + +Network Manager is a nice OpenVPN client; just make sure you have the network-manager-openvpn plugin installed. We'll use our example configurations from part 1. Open your Network Manager configuration and find the window where you set up a new VPN connection. This looks different on KDE and GNOME, but the information you'll need is the same. When you start you need to see an OpenVPN connection type, like in figure 1; if you don't see this then the plugin is missing. (The figures are from GNOME.) + +![](http://www.linux.com/images/stories/41373/figu-1-openvpn-nm.jpg) + +*Figure 1: Creating a new OpenVPN client config in Network Manager.* + +Figure 2 shows the main configuration screen. Starting from the top: + +- Whatever name you want for this connection. +- The Gateway is the IP address of your remote server. +- Select Static Key from the dropdown menu, +- Then use the filepicker to find the key you want to use. +- This is not a directional key, so select None. +- The remote and local IP addresses are your virtual OpenVPN addresses, from your /etc/openvpn/foo.conf files. +- We did not set a password. +- "Available to all users" or just you, whichever you want. + +![](http://www.linux.com/images/stories/41373/fig-2-openvpn-nm-1.jpg) + +*Figure 2: Main Network Manager configuration for OpenVN client.* + +Save, and then use Network Manager to connect. Easy peasey! Now you can connect and disconnect with the click of a button (figure 3). + +![](http://www.linux.com/images/stories/41373/fig-3-openvpn-nm-3.jpg) + +### Run OpenVPN Automatically ### + +It's simple to start up OpenVPN manually, but you might want to daemonize it on your server for convenience, and to survive accidental reboots. On Debian/Ubuntu/great-thundering-herd-of-spawn distros this is handled automatically: when you install OpenVPN it's configured to automatically start at boot. So, after installation you need to reboot, or start the daemon with one of these commands: + + $ sudo /etc/init.d/openvpn start + $ sudo service openvpn start + +The first command is the old-fashioned way, and the second command uses the service command. service first appeared in Red Hat Linux back in the olden days, and if your distro doesn't install it by default it's probably lurking in the repos if you want to use it. + +Fedora uses the systemd init system, in contrast to Ubuntu which uses Upstart, and Debian still uses good old SysV init. If you have multiple OpenVPN configurations in /etc/openvpn you can start each one selectively in systemd, like this: + + # systemctl start systemctl start openvpn@studio.service + +Where "studio.service" references our example /etc/openvpn/studio.conf file from part one. This invocation does not survive a reboot, so it's just like running openvpn /etc/openvpn/studio.conf, which is how we started OpenVPN sessions manually in part 1. You should be able to daemonize OpenVPN on systemd with chkconfig: + + # service openvpn start + # chkconfig openvpn on + +That should daemonize OpenVPN in the usual way, which is as a monolithic daemon and not individually per .conf file in /etc/openvpn/. systemd supports the chkconfig and servicecommands so it should work. However, the distros that use systemd are quite variable, so if yours is different please let us know in the comments. + +### Strengthening Your Connection ### + +OpenVPN is robust and is good at maintaining a persistent connection, even with service interruptions. You can make your connection even stronger by adding these lines to your .conf files on clients and server: + + persist-tun + persist-key + +These are helpful for laptop users who disrupt their connection a lot with power-save and being on the move. + +### Now What? ### + +Now that you have this all set up and working, what do you do with it? If you're used to using OpenSSH for remote operations you might be stuck in the SSH mindset of being able to log into specific machines and run applications. It doesn't work that way. Rather, think of OpenVPN as a virtual Ethernet cable to your server or LAN, all wrapped in a nice stout layer of encryption. You can run unencrypted and encrypted services over the same tunnel, and you only have to open a single hole in your firewall. + +So you can run SSH in the way you're used to over your OpenVPN tunnel, and do remote administration and run applications. You can access network resources such as fileshares and Web applications. You can force all networking on the client to go through your VPN tunnel, but for this series I've assumed that you want to be able to use both your native and VPN networks. + +So there you are on your trusty laptop and you can surf the Web, run SSH, do whatever you want on whatever network you're connected to. Then when you want to run something over your OpenVPN tunnel open it up and specify the IP address, like this: + + $ ssh carla@10.0.0.1 + +Web applications are easy: point your Web browser to the virtual IP address of your OpenVPN server and log in as usual. For example, I run various Web services for testing on my home server. So I access Drupal at [http://10.0.0.1/drupal][2] and OwnCloud at [http://10.0.0.1/owncloud][3]. I use the nice gFTP graphical FTP client, so all I need to connect is the virtual IP address on the Host line, username, and password. Or use the command line: + + $ ftp 10.0.0.1 21 + +You can administer your MySQL database from afar, using your own username and password: + + $ mysql -h 10.0.0.1 -u admin -p + +So the main thing you need to know is how to add the host specification to whatever command you want to run. + +Obviously, this would all be easier with name services instead of having to use IP addresses, so one of these days we'll learn how to implement name services in OpenVPN. Meanwhile, please enjoy your nice secure OpenVPN tunnel. + +-------------------------------------------------------------------------------- + +via: http://www.linux.com/learn/tutorials/745233-how-to-set-up-secure-remote-networking-with-openvpn-on-linux-part-2 + +译者：[译者ID](https://github.com/译者ID) 校对：[校对者ID](https://github.com/校对者ID) + +本文由 [LCTT](https://github.com/LCTT/TranslateProject) 原创翻译，[Linux中国](http://linux.cn/) 荣誉推出 + +[1]:http://www.linux.com/learn/tutorials/743590-secure-remote-networking-with-openvpn-on-linux +[2]:http://10.0.0.1/drupal +[3]:http://10.0.0.1/owncloud \ No newline at end of file