最新の投稿

[解決]「ダイエー 特売 クーポンアプリ」がAndroid11で起動しない。

 「ダイエー 特売 クーポンアプリ」の最新版(バージョン 3.2.1)をAndroid 11で初期登録しようとすると先に進まず、利用規約に同意し、「はじめる」をクリックしても、TOP画面ではなく初期設定の画面に戻ってしまう。 レビューにも同じ問題が指摘されているが、いつまでも治り...

2020/05/01

OpenVPN on Gentoo

GentooでOpenVPNをセットアップしたときのメモ。

# emerge openvpn easy-rsa


初期化(OpenVPNインストール後に1回だけ実施)

# mkdir -p /etc/openvpn/easyrsa/
# cd /etc/openvpn/easyrsa/
# /usr/share/easy-rsa/easyrsa init-pki

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/easyrsa/pki


CA証明書・秘密鍵作成

# /usr/share/easy-rsa/easyrsa build-ca

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus (2 primes)
...+++++
..........................................................................+++++
e is 65537 (0x010001)
Can't load /etc/openvpn/easyrsa/pki/.rnd into RNG
140240369948480:error:2406F079:random number generator:RAND_load_file:Cannot open file:crypto/rand/randfile.c:98:Filename=/etc/openvpn/easyrsa/pki/.rnd
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easyrsa/pki/ca.crt

# cp -a pki/ca.crt /etc/openvpn/


サーバ証明書・秘密鍵作成

# /usr/share/easy-rsa/easyrsa build-server-full server nopass

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
............................+++++
.............................+++++
writing new private key to '/etc/openvpn/easyrsa/pki/private/server.key.E4llUsB6Vr'
-----
Using configuration from /usr/share/easy-rsa/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easyrsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'server'
Certificate is to be certified until Apr 16 13:54:51 2023 GMT (1080 days)

Write out database with 1 new entries
Data Base Updated

# cp -a pki/issued/server.crt /etc/openvpn/
# cp -a pki/private/server.key /etc/openvpn/


DH(Diffie Hellman)パラメータ作成

# /usr/share/easy-rsa/easyrsa gen-dh

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...............................................+.......................................
~~~~~~
.................................................+........++*++*++*++*

DH parameters of size 2048 created at /etc/openvpn/easyrsa/pki/dh.pem


# cp -a pki/dh.pem /etc/openvpn/


証明書廃止リスト作成
(ダミーで証明書を作成し削除することで作成)
※ CRLのデフォルトの有効期限が180日しか無いので、サーバ証明書やクライアント証明書と同じ3650日にする。


# /usr/share/easy-rsa/easyrsa build-client-full dummy nopass

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
.....+++++
........................+++++
writing new private key to '/etc/openvpn/easyrsa/pki/private/dummy.key.fISgzJPxey'
-----
Using configuration from /usr/share/easy-rsa/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easyrsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'dummy'
Certificate is to be certified until Apr 16 14:07:16 2023 GMT (1080 days)

Write out database with 1 new entries
Data Base Updated

# /usr/share/easy-rsa/easyrsa revoke dummy

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020


Please confirm you wish to revoke the certificate with the following subject:

subject=
commonName = dummy


Type the word 'yes' to continue, or any other input to abort.
Continue with revocation: yes
Using configuration from /usr/share/easy-rsa/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easyrsa/pki/private/ca.key:
Revoking Certificate 841C87A17F97C7572B818156630443C9.
Data Base Updated

IMPORTANT!!!

Revocation was successful. You must run gen-crl and upload a CRL to your
infrastructure in order to prevent the revoked cert from being accepted.





# EASYRSA_CRL_DAYS=3650 /usr/share/easy-rsa/easyrsa gen-crl

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Using configuration from /usr/share/easy-rsa/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easyrsa/pki/private/ca.key:

An updated CRL has been created.
CRL file: /etc/openvpn/easyrsa/pki/crl.pem

# cp -a pki/crl.pem /etc/openvpn/
# chmod o+r /etc/openvpn/crl.pem
# rm pki/issued/dummy.crt pki/private/dummy.key pki/reqs/dummy.req


CRLの有効期限が見たければ、下記コマンドで見られる。

# openssl crl -inform pem -in pki/crl.pem -text


tls-authを使用するための共有静的鍵を生成

# openvpn --genkey --secret /etc/openvpn/ta.key


VPNクライアントのすべての通信をVPNゲートウェイを通したいので、ポートの転送を設定する。

# echo 1 > /proc/sys/net/ipv4/ip_forward
# iptables -t nat -A POSTROUTING -s 10.9.0.0/24 -o br0 -j MASQUERADE

※ 10.9.0.0/24は、サーバ側のServerディレクティブの設定が「server 10.9.0.0 255.255.255.0」なっている場合。
※ br0は、サーバのEthernetインターフェースがbr0の場合。eth0のときもある。


openvpnサーバの設定

# cat /etc/openvpn/openvpn.conf
tls-server
port 1194
proto tcp
dev tun0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
server 10.9.0.0 255.255.255.0
persist-key
persist-tun
ifconfig-pool-persist ipp.txt
push "redirect-gateway autlocal"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 120
comp-lzo
user openvpn
group openvpn
status openvpn-status.log
log-append /var/log/openvpn.log
verb 4
crl-verify crl.pem
client-to-client
auth SHA256





=============================================
クライアント証明書の作成

# /usr/share/easy-rsa/easyrsa build-client-full client1 nopass

Using SSL: openssl OpenSSL 1.1.1g 21 Apr 2020
Generating a RSA private key
.....+++++
.............................................+++++
writing new private key to '/etc/openvpn/easyrsa/pki/private/client1.key.9y3UUqlVoW'
-----
Using configuration from /usr/share/easy-rsa/safessl-easyrsa.cnf
Enter pass phrase for /etc/openvpn/easyrsa/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName :ASN.1 12:'client1'
Certificate is to be certified until Apr 16 15:12:27 2023 GMT (1080 days)

Write out database with 1 new entries
Data Base Updated




opvnファイルを作る

# cat << EOF > /etc/openvpn/client1.ovpn
> client
> dev tun0
> proto tcp
> remote 1194
> remote-cert-tls server
> auth SHA256
> cipher BF-CBC
> comp-lzo adaptive
> EOF
# echo '' >> /etc/openvpn/client1.ovpn
# grep -A 30 'BEGIN CERTIFICATE' pki/ca.crt >> /etc/openvpn/client1.ovpn
# echo '
' >> /etc/openvpn/client1.ovpn
# echo '' >> /etc/openvpn/client1.ovpn
# cat pki/private/client1.key >> /etc/openvpn/client1.ovpn
# echo '
' >> /etc/openvpn/client1.ovpn
# echo '' >> /etc/openvpn/client1.ovpn
# grep -A 30 'BEGIN CERTIFICATE' pki/issued/client1.crt >> /etc/openvpn/client1.ovpn
# echo '
' >> /etc/openvpn/client1.ovpn
# echo 'key-direction 1' >> /etc/openvpn/client1.ovpn
# echo '' >> /etc/openvpn/client1.ovpn
# grep -A 30 'BEGIN OpenVPN Static key V1' /etc/openvpn/ta.key >> /etc/openvpn/client1.ovpn
# echo '
' >> /etc/openvpn/client1.ovpn


作成したclient1.ovpnをVPNクライアントに転送する。


=============================================
テストをして、うまくいくことがわかったら、VPNサーバ側のポート転送の設定を保存させる。

/etc/sysctl.conf に
net.ipv4.ip_forward = 1
を追加

iptablesの保存

# cat /var/lib/iptables/rules-save
cat: /var/lib/iptables/rules-save: No such file or directory

# /etc/init.d/iptables save
* Saving iptables state ... [ ok ]

# cat /var/lib/iptables/rules-save
# Generated by iptables-save v1.6.1 on Sat May 2 12:43:10 2020
*filter
:INPUT ACCEPT [15341:2273915]
:FORWARD ACCEPT [1151:705989]
:OUTPUT ACCEPT [15290:3209579]
COMMIT
# Completed on Sat May 2 12:43:10 2020
# Generated by iptables-save v1.6.1 on Sat May 2 12:43:10 2020
*nat
:PREROUTING ACCEPT [1747:453695]
:INPUT ACCEPT [446:46187]
:OUTPUT ACCEPT [7812:706619]
:POSTROUTING ACCEPT [7812:706619]
[341:88404] -A POSTROUTING -s 10.9.0.0/24 -o br0 -j MASQUERADE
COMMIT
# Completed on Sat May 2 12:43:10 2020

# rc-update add iptables default
* service iptables added to runlevel default


0 件のコメント:

コメントを投稿