How to Use OpenVPN and PrivacyIDEA to establish two-factor authentication Remote Access
For the company, IT has become a trend to allow employees to access the company's IT resources at home or on a business trip through the VPN remote access system. However, weak employee password management awareness and attacks by attackers using social engineering libraries often provide convenient channels for attacker
The first bottleneck of openvpn is that the Tun character device reads and writes frames at one link layer. The reason why the user-mode openvpn process must have the same link-MTU on both ends, it is because each time openvpn reads a complete Ethernet frame from the/dev/NET/TUN character device, there are not many, and the library interface: ssize_t read (int fd
) [PD]: Organization Name (eg, company) [zyfmaster]: Organizational Unit Name (eg, section) []: zyfmasterCommon Name (eg, your name or your server's hostname) [server]: serverName []: email Address [905407204 @ q Q.com]: Please enter the following 'Extra 'attributesto be sent with your certificate requestA challenge password []: abcd1234An optional company name []: zyfmasterUsing configuration from/etc/openvpn
following 'extra 'attributes To be sent with your certificate request A challenge password []: An optional company name []: Using configuration from/soft_dir/openvpn-2.0.9/easy-rsa/openssl. cnf Check that the request matches the signature Signature OK The Subject's Distinguished Name is as follows CountryName: PRINTABLE: 'cn' StateOrProvinceName: PRINTABLE: 'beijing' LocalityName: PRINTABLE: 'bishkek' Orga
: \ Program Files \ openvpn \ easy-RSA> build-key-server.bat server01Using configuration from OpenSSL. CNFGenerating a 1024 bit RSA private key...... ++Writing new private key to 'keys \ server01.key'-----You are about to be asked to enter information that will be ininitializedInto your certificate request.What you are about to enter is what is called a distinguished name or a DN.There are quite a few fields but you can leave some blankFor some fields
conflict.Auth-user-pass-verify The following four lines is to configure the client can use user name password authentication, special attention must add script-security 3 system, the following system also can not be less, I just wasted a lot of time on this.
The contents of the checkpsw.sh script are as follows:
#!/bin/shPassfile= "/etc/openvpn/auth/psw-file"Log_file= "/etc/
. OpenVPN is configured as the client. OpenVPN does not have a specific configuration file, but is provided by the server provider. OpenVPN provides two authentication methods: user name/password-based authentication and SSL certificate authentication. The user name/password
to have a copy of the key.# The second parameter should be ' 0 ' on the server side and the client should be ' 1 '.Tls-auth Ta.key 0 # The file should be kept confidential.
# Select a password encryption algorithm.# This configuration item must also be replicated to each client configuration file.; cipher BF-CBC # Blowfish (default); Cipher AES-128-CBC # AES; Cipher DES-EDE3-CBC # Triple-des
# Enable compression on the VPN connection.# If you have
OpenVPN-ng: The application-layer tunnel for Mobile Life, And openvpn-ng Application LayerVPN makes people think that it is always a good thing and a way to escape from supervision. In fact, VPN has become the only synonym for escaping from supervision. You see, no matter what technology, IPSec, or WEB Proxy, as long as it is the technology that encrypts the original information, it can all be called VPN, s
You need to turn on SSH to connect your cloud server as root or user using sudo to access SSH connections. This guide assumes that users use sudo access. But you can take things using roots only by stripping "sudo" from the start of each command. If you are running Linux or Mac on your system, you can use the SSH terminal program. If you are using Windows, you can use putty to login to SSH. Once the terminal is open, assuming you are using the LINUX/MAC system, you can login to enter the followi
required by openvpn. After the installation is complete, it should appear
/Etc/openvpn/
Folder.Configure OpenVPN
As a client, OpenVPN does not have a specific configuration file, but a configuration file is provided by the server provider. OpenVPN provides two authenticatio
easy-rsa3
Generate Certificate
# Configuration file directories are generally in a similar directory cp/usr/share/doc/openvpn-2.3.6/sample-config-files/server. conf/etc/openvpn/#2.3 needs to download an easy-rsa package independently. This package is used to create ca certificates and server certificates, client certificate wget-c https://github.com/OpenVPN/easy
OpenVPN server configuration file description (transfer), openvpn configuration file
This article describes how to configure the configuration file on the OpenVPN server. In Windows, this configuration file is generally called server. ovpn. in Linux/BSD, this configuration file is generally called server. conf. Although the configuration file name is different, t
Server
The http Proxy Server and OpenVPN server can be installed on the same machine.Configure the OpenVPN server (see the previous blog post for installation ):
Cat/etc/openvpn/server. conf
Port 9091
Proto tcp # Enable tcp
Dev tap
Ca. crt
Cert server. crt
Key server. key
Dh dh1024.pem
Server 10.9.0.0 255.255.255.0
# Ifconfig-pool-persist ipp.txt
Clie
-1.8.4-ubuntu10.i386.deb
Ubuntu Ten 64bit:http://swupdate.openvpn.org/as/openvpn-as-1.8.4-ubuntu10.amd_64.deb
Ubuntu 10 corresponds to the Debian 6 system; others open the above page to download.
"Software Installation Commands"
Debian and Ubuntu Software Installation commands: Dpkg-i Openvpn-as-1.8.4-ubuntu10.i386.deb
CentOS Software Installation command: RPM-IVH
OpenVPN client configuration tutorial in Ubuntu generally, Linux servers that provide Web Services seldom need to connect to OpenVPN, but personal Linux computers often need to connect to OpenVPN. For example, if you use Linux as the development environment, you need to connect to the company's OpenVPN. This document u
1.
Environment 1.1. server environment
Centos6, kernel version: 2.6.32-71. el6The IP address is 192.168.122.180, and the tunnel IP address is 10.8.0.1.
Kernel must support Tun devices and must load iptablesCheck whether Tun is installed:
# Modinfo Tun
Filename:/lib/modules/2.6.32-71. el6.i686/kernel/Drivers/NET/TUN. KoAlias: Char-Major-10-200License: GPLAuthor: (c) 1999-2004 Max kranyansky maxk@qualcomm.comDescription: Universal tun/TAP Device DriverSrcversion: 7d2aaef89c71c83bbffa0deDe
-- with-lzo-headers =/usr/local/include/-- with-lzo-lib =/usr/local/lib
Make make installConfigure OPENVPN Server
Cd easy-rsa/2.0/
Open the vars file and modify the following behavior information.
Export KEY_COUNTRY = "CN"
Export KEY_PROVINCE = "CA"
Export KEY_CITY = "ZheJiang"
Export KEY_ORG = "NingBo"
Export KEY_EMAIL = "lustlost@foxmail.com"
Read the variable in vars
. Vars
Reinitialize the keys folder
./Clean-all
Generate CA root certificate
./B
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.