Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/3.0.7/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating RSA private key, 2048 bit long modulus ..........................................+++ ........................................................................................................................................+++ e is 65537 (0x10001) You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [Easy-RSA CA]: #直接回车
CA creation complete and you may now import and sign cert requests. Your new CA certificate file for publishing is at: /etc/openvpn/easy-rsa/3.0.7/pki/ca.crt
密钥交换方法，由惠特菲尔德·迪菲（Bailey Whitfield Diffie）、马丁·赫尔曼（Martin Edward Hellman）于1976年发表。它是一种安全协议，让双方在完全没有对方任何预先信息的条件下通过不安全信道建立起一个密钥，这个密钥一般作为“对称加密”的密钥而被双方在后续数据传输中使用。DH数学原理是base离散对数问题。做类似事情的还有非对称加密类算法，如：RSA。其应用非常广泛，在SSH、VPN、Https…都有应用，勘称现代密码基石。
init-pki complete; you may now create a CA or requests. Your newly created PKI dir is: /etc/openvpn/client/easy-rsa/3.0.7/pki # 验证PKI目录 [root@vpn 3.0.7]# ll ./pki/ total 24 -rw------- 1 root root 4616 Sep 21 11:50 openssl-easyrsa.cnf drwx------ 2 root root 4096 Sep 21 11:50 private drwx------ 2 root root 4096 Sep 21 11:50 reqs -rw------- 1 root root 4770 Sep 21 11:50 safessl-easyrsa.cnf [root@vpn 3.0.7]# ll ./pki/private/ total 0 # 生成客户端证书 [root@vpn 3.0.7]# pwd /etc/openvpn/client/easy-rsa/3.0.7 [root@vpn 3.0.7]# ./easyrsa gen-req quhui nopass #用户名quhui，不设置密码 Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 Generating a 2048 bit RSA private key ................................................................+++ ....................................................................................+++ writing new private key to '/etc/openvpn/client/easy-rsa/3.0.7/pki/easy-rsa-26662.y3oE1K/tmp.Od73e6' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Common Name (eg: your user, host, or server name) [quhui]:
Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa/3.0.7/vars Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017
The request has been successfully imported with a short name of: quhui You may now use this name to perform signing operations on this request. # 签发 ./easyrsa sign client quhui
port 1194 proto udp dev tun ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/server.crt key /etc/openvpn/certs/server.key dh /etc/openvpn/certs/dh.pem # OpenVPN Server Certificate - CA, server key and certificate #注意本文没有跳过了丢消证书的检测 #crl-verify /etc/openvpn/server/crl.pem
# Redirect all Connection through OpenVPN Server server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp"
# 服务端配置 # 修改服务端配置文件，文件最后追加几行 vim /etc/openvpn/server.conf
script-security 3 auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env username-as-common-name client-cert-not-required # 如果加上client-cert-not-required则代表只使用用户名密码方式验证登录，如果不加，则代表需要证书和用户名密码双重验证登录！ # /etc/openvpn/checkpsw.sh 文件内容： #!/bin/sh ########################################################### # checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se> # # This script will authenticate OpenVPN users against # a plain text file. The passfile should simply contain # one row per user with the username first followed by # one or more space(s) or tab(s) and then the password.
if [ "${CORRECT_PASSWORD}" = "" ]; then echo"${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE} exit 1 fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then echo"${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE} exit 0 fi
port 1194 proto udp dev tun ca /etc/openvpn/certs/ca.crt cert /etc/openvpn/certs/server.crt key /etc/openvpn/certs/server.key dh /etc/openvpn/certs/dh.pem
server 10.8.0.0 255.255.255.0 push "redirect-gateway def1 bypass-dhcp"