OpenVPN服務(wù)搭建與管理

2019.09.11

關(guān)注

擼了今年阿里、頭條和美團(tuán)的面試，我有一個(gè)重要發(fā)現(xiàn).......>>>

引言：

本文利用OpenVPN搭建VPN服務(wù)，并利用pam_sqlite3插件實(shí)現(xiàn)用戶認(rèn)證；通過(guò)openvpn_web進(jìn)行用戶管理與日志系統(tǒng)。

一、安裝OpenVPN服務(wù)

基礎(chǔ)環(huán)境：

服務(wù)端： CentOS 7.6

客戶端：Windows 7

OpenVPN: openvpn-2.4.7 (https://github.com/OpenVPN/openvpn)

easy-rsa：easy-rsa 3.0.6 (https://github.com/OpenVPN/easy-rsa)

OpenVPN GUI: openvpn gui (https://gitee.com/lang13002/openvpn-portable)

1.1 安裝openvpn

安裝依賴包

# yum install lz4-devel lzo-devel pam-devel openssl-devel systemd-devel sqlite-devel

從github上下載openvpn源代碼包并解壓

# wget https://github.com/OpenVPN/openvpn/archive/v2.4.7.tar.gz# tar -xvf v2.4.7.tar.gz

編譯openvpn并安裝

# cd openvpn-2.4.7# ./configure --prefix=/usr/local/openvpn --enable-lzo --enable-lz4 --enable-crypto --enable-server --enable-plugins --enable-port-share --enable-iproute2 --enable-pf --enable-plugin-auth-pam --enable-pam-dlopen --enable-systemd# make && make install

參照sample/sample-config-files/server.conf文件生成配置文件

# vim /etc/openvpn/server/server.conf

port 1194proto tcp-server;proto udpdev tuntopology subnetca /etc/openvpn/server/ca.crtcert /etc/openvpn/server/server.crtkey /etc/openvpn/server/server.keydh /etc/openvpn/server/dh.pemtls-auth /etc/openvpn/server/ta.key 0user nobodygroup nobodyserver 10.8.0.0 255.255.255.0;ifconfig-pool-persist ipp.txt;push 'redirect-gateway def1 bypass-dhcp'push 'dhcp-option DNS 114.114.114.114'push 'route 192.168.133.0 255.255.255.0'push 'route-gateway 10.200.227.114';client-to-clientkeepalive 10 120comp-lzocompress 'lz4'persist-keypersist-tuncipher AES-256-CBCstatus /var/log/openvpn-status.loglog /var/log/openvpn.logverb 3

配置系統(tǒng)服務(wù)

# cp distro/systemd/openvpn-server@.service /usr/lib/systemd/system/# systemctl enable openvpn

1.2 生成證書

下載easy-rsa3并解壓

# wget https://github.com/OpenVPN/easy-rsa/archive/v3.0.6.tar.gz# tar -xvf v3.0.6.tar.gz

根據(jù)easy-rsa-3.0.6/easyrsa3/vars.example文件生成全局配置文件vars

# cd easy-rsa-3.0.6/easyrsa3/# cp vars.samples vars

修改vars文件，根據(jù)需要去掉注釋，并修改對(duì)應(yīng)值

set_var EASYRSA_REQ_COUNTRY 'CN'set_var EASYRSA_REQ_PROVINCE 'HUBEI'set_var EASYRSA_REQ_CITY 'WUHAN'set_var EASYRSA_REQ_ORG 'ZJ'set_var EASYRSA_REQ_EMAIL 'zj@test.com'set_var EASYRSA_REQ_OU 'ZJ'set_var EASYRSA_KEY_SIZE 2048set_var EASYRSA_ALGO rsa

生成服務(wù)端證書

# ./easyrsa init-pki    # 初始化，生成一系列文件與目錄# ./easyrsa build-ca    # 生成根證書，記住ca密碼# ./easyrsa build-server-full server nopass # 生成服務(wù)端證書，nopass參數(shù)生成一個(gè)無(wú)密碼的證書# ./easyrsa gen-dh      # 生成Diffie-Hellman

生成客戶端證書

# ./easy-rsa build-client-full client1 nopass

注：可生成client1, client2, client3或?qū)?yīng)姓名的客戶端證書

整理服務(wù)端證書

# cp pki/ca.crt /etc/openvpn/server/# cp pki/private/server.key /etc/openvpn/server/# cp pki/issued/server.crt /etc/openvpn/server/# cp pki/dh.pem /etc/openvpn/server/

1.3 開啟路由轉(zhuǎn)發(fā)功能與防火墻

# 路由轉(zhuǎn)發(fā)# vim /etc/sysctl.confnet.ipv4.ip_forward = 1# 臨時(shí)啟用# echo 1 > /proc/sys/net/ipv4/ip_forward# 防火墻# firewall-cmd --zone=public --add-service=openvpn

二、添加SQLite認(rèn)證

下載pam_sqlite3并安裝

# git clone https://gitee.com/lang13002/pam_sqlite3.git# cd pam_sqlite3# make && make install

添加pam認(rèn)證文件

# vim /etc/pam.d/openvpnauth        required    pam_sqlite3.so db=/etc/openvpn/openvpn.db table=t_user user=username passwd=password active=1 expire=expire crypt=1account     required    pam_sqlite3.so db=/etc/openvpn/openvpn.db table=t_user user=username passwd=password active=1 expire=expire crypt=1

創(chuàng)建sqlite3數(shù)據(jù)庫(kù)文件

# sqlite3 /etc/openvpn/openvpn.dbsqlite> create table t_user ( username text not null, password text not null, active int, expire text);sqlite> .quit

在服務(wù)端配置添加認(rèn)證插件

verify-client-cert noneusername-as-common-nameplugin /usr/local/openvpn/lib/openvpn/plugins/openvpn-plugin-auth-pam.so openvpn

三、客戶端配置

3.1 下載客戶端程序：

從https://gitee.com/lang13002/openvpn-portable/repository/archive/v1.0下載程序，并安裝網(wǎng)卡驅(qū)動(dòng)；

3.2 安裝驅(qū)動(dòng)：

運(yùn)行openvpn-portable/tap-windows.exe

3.3 設(shè)置客戶端證書

將上面生成的ca.crt, client1.crt, client1.key放到openvpn-portable的data/config下，并修改客戶端配置

ca ca.crtcert client1.crtkey client1.keyremote-cert-tls serverauth-user-passauth-nocache

注：當(dāng)有多個(gè)客戶端時(shí)，有多個(gè)文件(ca.crt, client1.crt, client1.key, client.ovpn)需要分發(fā)給客戶，勢(shì)必會(huì)很麻煩；可以將證書嵌入到客戶端配置文件中； ;ca ca.crt         // 將這行注釋掉;cert client.crt   // 將這行注釋掉;key client.key    // 將這行注釋掉 <ca>-----BEGIN CERTIFICATE-----MIIDGDCCAgCgAwIBAgIJAI9Ld4PlKEiOMA0GCSqGSIb3DQEBCwUAMA0xCzAJBgNV....OCeTQvQ4WhyIvVgURV3ITcAKYFKUQ1sPbpjuZg==-----END CERTIFICATE---</ca><cert>-----BEGIN CERTIFICATE-----MIIDODCCAiCgAwIBAgIRAIZoEQ5PvHDs9xpTLMP3RqMwDQYJKoZIhvcNAQELBQAw......nCpzC3l8sVezxk2r-----END CERTIFICATE-----</cert> <key>-----BEGIN PRIVATE KEY-----MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDw1iq3HBe1otCU......ullaNc6mu3N/wTPZoQhDOKAO-----END PRIVATE KEY-----</key>

四. 連接VPN

啟動(dòng)openvpn服務(wù)

# systemctl start openvpn

啟動(dòng)openvpn-porable

五、OpenVPN用戶管理與日志

5.1 安裝依賴

# pip2 install peewee tornado

5.2 下載openvpn-web

# git clone https://gitee.com/lang13002/openvpn_web.git

5.3 創(chuàng)建相應(yīng)的數(shù)據(jù)庫(kù)表

# sqlite3 /etc/openvpn/openvpn.dbsqlite> .import openvpn_web/model/openvpn.sql

5.4 OpenVPN運(yùn)行腳本寫日志

服務(wù)端配置添加運(yùn)行腳本

script-security 2client-connect /etc/openvpn/server/connect.pyclient-disconnect /etc/openvpn/server/disconnect.py

connect.py

#!/usr/bin/pythonimport osimport timeimport sqlite3username = os.environ['common_name']trusted_ip = os.environ['trusted_ip']trusted_port = os.environ['trusted_port']local = os.environ['ifconfig_local']remote = os.environ['ifconfig_pool_remote_ip']timeunix= os.environ['time_unix']logintime = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(time.time()))conn = sqlite3.connect('/etc/openvpn/openvpn.db')cursor = conn.cursor()query = 'insert into t_logs(username, timeunix, trusted_ip, trusted_port, local, remote, logintime) values('%s','%s', '%s', '%s', '%s', '%s', '%s')' %  (username, timeunix, trusted_ip, trusted_port, local, remote, logintime)cursor.execute(query)conn.commit()conn.close()

5.5 啟動(dòng)服務(wù)

# python myapp.py

5.6 管理界面