info

  • OpenVPN
  • Google Authenticator
  • pam

install OpenVPN

yum install openvpn

install Google Authenticator

  1. yum install -y gcc make autoconf automake libtool pam-devel git
  2. git clone https://github.com/google/google-authenticator-libpam.git
  3. cd google-authenticator-libpam
  4. ./bootstrap.sh && ./configure && make && make install
  5. cp -a /usr/local/lib/security/pam_google_authenticator.so /lib64/security/pam_google_authenticator.so

Google Authenticator for user(default user openvpn)

  1. mkdir /etc/google-auth
  2. google-authenticator
  3. # set up as you wish, save image and/or codes.Entor to yes by default
  4. mv ~/.google_authenticator /etc/google-auth/openvpn
  5. chown -R openvpn /etc/google-auth

Add pam.conf

vim /etc/pam.d/openvpn

  1. auth    requisite       /usr/local/lib/security/pam_google_authenticator.so secret=/etc/google-auth/${USER}  user=openvpn
  2. account [success=2 new_authtok_reqd=done default=ignore]    pam_unix.so  
  3. account [success=1 new_authtok_reqd=done default=ignore]    pam_winbind.so  
  4. account requisite          pam_deny.so  
  5. account required           pam_permit.so

config the openvpn

config firewalld

  1. #disable firewalld
  2. systemctl stop firewalld
  3. systemctl mask firewalld
  5. #use iptables
  6. systemctl enable iptables
  7. systemctl start iptables
  8. iptables -F                           #clear all rule
  9. iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
  10. iptables-save > /etc/sysconfig/iptables   # iptables 规则持久化保存
  12. #enable ip forward
  13. echo net.ipv4.ip_forward = 1 >> /etc/sysctl.conf
  14. sysctl -p # 这一步一定得执行，否则不会立即生效。

config certificate

  1. yum -y install easy-rsa
  2. cp -r /usr/share/easy-rsa/ /etc/openvpn/
  4. cd /etc/openvpn/easy-rsa/<easy-rsa 版本号>/  # 查看 easy-rsa 版本号：yum info easy-rsa
  5. vim vars  # 没这个文件的话新建，填写如下内容（变量值根据实际情况随便填写）:
  6. export KEY_COUNTRY="***"
  7. export KEY_PROVINCE="***"
  8. export KEY_CITY="***"
  9. export KEY_ORG="***"
  10. export KEY_EMAIL="***"
  11. source ./vars   # 使变量生效
  13. ./easyrsa init-pki    #初始化 pki 相关目录
  14. ./easyrsa build-ca nopass  #生成 CA 根证书, 输入 Common Name，名字随便起。
  16. ./easyrsa build-server-full server nopass
  17. ./easyrsa gen-dh  #创建Diffie-Hellman，这可能得等一小会儿
  18. openvpn --genkey --secret ta.key #creat tls key
  20. mkdir /etc/openvpn/server/certs && cd /etc/openvpn/server/certs/
  21. cp /etc/openvpn/easy-rsa/3/pki/dh.pem ./     # SSL 协商时 Diffie-Hellman 算法需要的 key
  22. cp /etc/openvpn/easy-rsa/3/pki/ca.crt ./        # CA 根证书
  23. cp /etc/openvpn/easy-rsa/3/pki/issued/server.crt ./    # open VPN 服务器证书
  24. cp /etc/openvpn/easy-rsa/3/pki/private/server.key ./   # open VPN 服务器证书 key
  25. cp /etc/openvpn/easy-rsa/3/ta.key ./   # tls-auth key

config server.conf

  1. port 1194   # 监听的端口号
  2. proto udp   # 服务端用的协议，udp 能快点，所以我选择 udp
  3. dev tun
  4. ca /etc/openvpn/server/certs/ca.crt  #   CA 根证书路径
  5. cert /etc/openvpn/server/certs/server.crt  # open VPN 服务器证书路径
  6. key /etc/openvpn/server/certs/server.key  # open VPN 服务器密钥路径，This file should be kept secret
  7. dh /etc/openvpn/server/certs/dh.pem  # Diffie-Hellman 算法密钥文件路径
  8. tls-auth /etc/openvpn/server/certs/ta.key 0 #  tls-auth key，参数 0 可以省略，如果不省略，那么客户端
  9. # 配置相应的参数该配成 1。如果省略，那么客户端不需要 tls-auth 配置
  10. server 10.8.0.0 255.255.255.0   # 该网段为 open VPN 虚拟网卡网段，不要和内网网段冲突即可。open VPN 默认为 10.8.0.0/24
  11. push "dhcp-option DNS 8.8.8.8"  # DNS 服务器配置，可以根据需要指定其他 ns
  12. push "dhcp-option DNS 8.8.4.4"
  13. push "redirect-gateway def1"   # 客户端所有流量都通过 open VPN 转发，类似于代理开全局
  14. compress lzo
  15. duplicate-cn   # 允许一个用户多个终端连接
  16. keepalive 10 120
  17. comp-lzo
  18. persist-key
  19. persist-tun
  20. user openvpn  # open VPN 进程启动用户，openvpn 用户在安装完 openvpn 后就自动生成了
  21. group openvpn
  22. log /var/log/openvpn/server.log  # 指定 log 文件位置
  23. log-append /var/log/openvpn/server.log
  24. status /var/log/openvpn/status.log
  25. verb 3
  26. explicit-exit-notify 1

start & Test The status

  1. systemctl start openvpn@server
  2. netstat -nlp                     #ensure The udp port 1194 be opening

config Client

  1. client
  2. proto udp
  3. dev tun
  4. remote ***.***.***.*** 1194
  5. ca "C:\\path\\ca.crt"
  6. #cert "C:\\path\\test.crt"
  7. #key "C:\\path\\test.key"
  8. tls-auth "C:\\path\\ta.key" 1
  9. remote-cert-tls server
  10. persist-tun
  11. persist-key
  12. comp-lzo
  13. verb 3
  14. cipher AES-256-CBC  
  15. remote-cert-tls server  
  16. comp-lzo
  17. auth-user-pass  
  18. auth-nocache
  19. reneg-sec 0

now just for fun