You are heresoftware / OpenVPN
OpenVPN
Checklist servermigratie
Deze server verhuist binnenkort naar een nieuwe fysieke machine met volgende specs:
- Disk: 10 GiB / , 175 GiB /home , 512 MiB swap
- Memory: 2 GiB RAM
- CPU: 1 VCPU Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz
Deze pagina is vooral bedoeld als documentatie voor mezelf.
Planning:
DONE 20090610: DNS TTL verlagen van amedee.be, vangasse.eu, dhertefelt.be bij Gandi.- BUSY 20090618: configuratie van intrepid².
DONE 20090620: configuratie testenDONE 20090621: migratie data van intrepid naar intrepid².DONE 20090622: DNS records aanpassen + TTL verhogen van amedee.be, vangasse.eu, dhertefelt.be, alle andere domeinen.DONE 20090622: web + mail testenDONE 20090629: services down op intrepid
Te installeren/configureren op de nieuwe server (intrepid²):
- admin
- IPv6
- firewall
- ssh
- openvpn
- backup: backup2l
- logging/monitoring
- web
- apache
- mysql
- php5
- phpmyadmin
- drupal
- mail
- postfix
- postgrey
- dovecot
- procmail
- fetchmail
Zie ook logging configuratiewijzigingen.
OpenVPN configureren
Zowel op de server als op de client
$ sudo -i
$ aptitude install openvpn
$ mkdir -p /etc/openvpn/keys
$ aptitude install openvpn
$ mkdir -p /etc/openvpn/keys
$ nano /etc/init.d/openvpn-tun
#! /bin/sh
# /etc/init.d/openvpn-tun
#
# Prepare tun device for openvpn connection
mkdir -p /dev/net
mknod /dev/net/tun c 10 200
chmod 600 /dev/net/tun
modprobe tun
exit
# /etc/init.d/openvpn-tun
#
# Prepare tun device for openvpn connection
mkdir -p /dev/net
mknod /dev/net/tun c 10 200
chmod 600 /dev/net/tun
modprobe tun
exit
tun toevoegen aan /etc/modules
$ chmod +x /etc/init.d/openvpn-tun
$ update-rc.d openvpn-tun defaults 15
$ /etc/init.d/openvpn-tun
$ update-rc.d openvpn-tun defaults 15
$ /etc/init.d/openvpn-tun
Openvpn is S16, dus de device node moet al vroeger aangemaakt worden, vandaar defaults 15.
Op de server
$ nano /etc/openvpn/server.conf
port 1194
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
proto udp
dev tun
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
$ cd /usr/share/doc/openvpn/examples/easy-rsa/2.0
$ nano vars
$ nano vars
# Onderstaande vars invullen
export KEY_COUNTRY=" "
export KEY_PROVINCE=""
export KEY_CITY=" "
export KEY_ORG=""
export KEY_EMAIL=""
export KEY_COUNTRY=" "
export KEY_PROVINCE=""
export KEY_CITY=" "
export KEY_ORG=""
export KEY_EMAIL=""
. ./vars
./clean-all
./build-ca
./build-key-server server --> geen password, sign certificate
./build-key client1 --> voor iedere client uit te voeren
./build-dh
cd keys
cp ca.key ca.crt dh2048.pem server.key server.crt /etc/openvpn/keys/
/etc/init.d/openvpn restart
./clean-all
./build-ca
./build-key-server server --> geen password, sign certificate
./build-key client1 --> voor iedere client uit te voeren
./build-dh
cd keys
cp ca.key ca.crt dh2048.pem server.key server.crt /etc/openvpn/keys/
/etc/init.d/openvpn restart
Op de client
nano /etc/openvpn/client.conf
client
proto udp
dev tun
remote remote.server 1194
persist-key
persist-tun
ca keys/ca.crt
cert keys/client1.crt
key keys/client1.key
cipher aes-128-cbc
comp-lzo
user nobody
group nogroup
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
proto udp
dev tun
remote remote.server 1194
persist-key
persist-tun
ca keys/ca.crt
cert keys/client1.crt
key keys/client1.key
cipher aes-128-cbc
comp-lzo
user nobody
group nogroup
status openvpn-status.log
log-append openvpn.log
verb 3
mute 20
cd /etc/openvpn/keys
scp user@remote.server:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.* .
scp user@remote.server:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/client1.* .
/etc/init.d/openvpn restart
scp user@remote.server:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/ca.* .
scp user@remote.server:/usr/share/doc/openvpn/examples/easy-rsa/2.0/keys/client1.* .
/etc/init.d/openvpn restart
