{"id":19345,"date":"2016-12-22T06:05:53","date_gmt":"2016-12-21T22:05:53","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/12\/22\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server\/"},"modified":"2021-03-18T17:24:52","modified_gmt":"2021-03-18T09:24:52","slug":"%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/12\/22\/%e5%9c%a8-centos-7-x-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server\/","title":{"rendered":"\u5728 CentOS 7.x \u4e0a\u5efa\u7f6e OpenConnect SSL VPN Server"},"content":{"rendered":"

\u95dc\u65bc OpenConnect \u53ef\u4ee5\u53c3\u8003\uff1a
\u7528\u6a39\u8393\u6d3e\u67b6\u8a2dSSL VPN \u6700\u4f4e\u6210\u672c\u6253\u9020\u7aae\u4eba\u7ffb\u7246\u68af – \u6280\u8853\u5c08\u6b04 – \u7db2\u7ba1\u4ebaNetAdmin<\/a>
\u672c\u7bc7\u6587\u7ae0\u53c3\u8003\uff1a
CentOS 7 \u5b89\u88c5 ocserv (OpenConnect Server) \u5e76\u5b9e\u73b0\u8bc1\u4e66\u767b\u5f55 \u2013 \u5947\u9047\u00b7\u5947\u7389<\/a>
\u5728 CentOS 7 \u4e0a\u642d\u5efa Cisco AnyConnect VPN \u00b7 ifreedomlife<\/a>
\u8001\u5929\u5c0a\u7684\u6b7b\u671f: Linode CentOS 7\u4e3b\u6a5f\u642d\u5efaCisco AnyConnect VPN<\/a><\/p>\n

1. \u65b0\u589e epel\u00a0 \u5957\u4ef6\u5eab
# yum install epel-release<\/span><\/p>\n

2. \u66f4\u65b0\u5957\u4ef6\u5eab
# yum update<\/span>[@more@]3. \u5b89\u88dd ocserv \u5957\u4ef6
# yum install ocserv<\/span><\/p>\n

4. \u5efa\u7acb\u76ee\u9304\u53ca\u5207\u63db\u76ee\u9304
# mkdir certificates<\/span>
# cd certificates<\/span><\/p>\n

5. \u5efa\u7acb CA \u91d1\u9470
# certtool –generate-privkey –outfile ca-key.pem<\/span>
Generating a 2048 bit RSA private key…<\/span><\/p>\n

\u5efa\u7acb ca.tmpl
# cat ca.tmpl<\/span>
cn = “VPN CA”<\/span>
organization = “Home”<\/span>
serial = 1<\/span>
expiration_days = 3650<\/span>
ca<\/span>
signing_key<\/span>
cert_signing_key<\/span>
crl_signing_key<\/span><\/p>\n

# certtool –generate-self-signed –load-privkey ca-key.pem –template ca.tmpl –outfile ca-cert.pem<\/span><\/p>\n

\u8907\u88fd ca-cert.pem \u5230 \/etc\/ocserv<\/span> \u76ee\u9304
# cp ca-cert.pem \/etc\/ocserv<\/span><\/p>\n

6. \u5efa\u7acb\u672c\u6a5f Server \u8b49\u66f8
# certtool –generate-privkey –outfile server-key.pem<\/span>
Generating a 2048 bit RSA private key…<\/span><\/p>\n

\u5efa\u7acb server.tmpl
# cat server.tmpl<\/span>
cn = “nas.test.com”<\/span>
organization = “Home”<\/span>
serial = 2<\/span>
expiration_days = 3650<\/span>
encryption_key<\/span>
signing_key<\/span>
tls_www_server<\/span><\/p>\n

# certtool –generate-certificate –load-privkey server-key.pem –load-ca-certificate ca-cert.pem –load-ca-privkey ca-key.pem –template server.tmpl –outfile server-cert.pem<\/span><\/p>\n

\u5c07 server-cert.pem \u548c server-key.pem \u8907\u88fd\u5230 \/etc\/ocserv<\/span>
# cp server-cert.pem server-key.pem \/etc\/ocserv<\/span><\/p>\n

7. \u7522\u751f\u4f7f\u7528\u8005\u7aef\u8b49\u66f8(\u9023\u7dda\u6642\u53ef\u4ee5\u8f38\u5165\u5e33\u865f\u53ca\u5bc6\u78bc)
# cat gen-client-cert.sh<\/span>
#!\/bin\/bash<\/span>
USER=$1<\/span>
CA_DIR=$2<\/span>
SERIAL=`date +%s`<\/span>
certtool –generate-privkey –outfile $USER-key.pem<\/span>
cat << _EOF_ >user.tmpl<\/span>
cn = “$USER”<\/span>
unit = “users”<\/span>
serial = “$SERIAL”<\/span>
expiration_days = 9999<\/span>
signing_key<\/span>
tls_www_client<\/span>
_EOF_<\/span>
certtool –generate-certificate –load-privkey $USER-key.pem –load-ca-certificate $CA_DIR\/ca-cert.pem –load-ca-privkey $CA_DIR\/ca-key.pem –template user.tmpl –outfile $USER-cert.pem<\/span>
openssl pkcs12 -export -inkey $USER-key.pem -in $USER-cert.pem -name “$USER VPN Client Cert” -certfile $CA_DIR\/ca-cert.pem -out $USER.p12<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod 700 gen-client-cert.sh<\/span><\/p>\n

\u5efa\u7acb\u76ee\u9304\u4f86\u5b58\u653e\u4f7f\u7528\u8005\u8b49\u66f8
# mkdir home<\/span>
# \u5207\u63db\u76ee\u9304
# cd home<\/span>
# home \u662f\u4f7f\u7528\u8005\u7684\u540d\u7a31\uff0c.. \u662f\u6307 ca \u8b49\u66f8\u6240\u5728\u7684\u76ee\u9304
# ..\/gen-client-cert.sh home ..<\/span>
\u53ef\u4ee5\u76f4\u63a5\u6309 Enter \u9375\u8df3\u904e\uff0c\u5c31\u4e0d\u7528\u8a2d\u5b9a\u5bc6\u78bc
Signing certificate…<\/span>
Enter Export Password:<\/span>
Verifying – Enter Export Password:<\/span><\/p>\n

\u7522\u751f\u4e4b\u5f8c\u53ef\u4ee5\u5c07 home.p12 \u8907\u88fd\u7d66\u4f7f\u7528\u8005\u7528\u6236\u7aef\u5c0e\u5165\u5373\u53ef<\/p>\n

8. \u4fee\u6539 \/etc\/ocserv\/ocserv.conf<\/span> \u8a2d\u5b9a\u6a94
# cp \/etc\/ocserv\/ocserv.conf \/etc\/ocserv\/ocserv.conf.$(date +%F)<\/span>
\u53d6\u6d88 pam \u8a8d\u8b49
# sed -i ‘s\/auth = “pam”\/#auth = “pam”\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u63a1\u7528 certificate \u8a8d\u8b49
# sed -i ‘s\/#auth = “certificate”\/auth = “certificate”\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a\u540c\u4e00\u500b\u7528\u6236\u6700\u591a\u7684\u767b\u5165\u6578
# sed -i ‘s\/max-same-clients = 2\/max-same-clients = 10\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a\u6191\u8b49\u6a94\u7684\u4f4d\u7f6e
# sed -i ‘s|#server-cert = \/etc\/pki\/ocserv\/public\/server.crt|server-cert = \/etc\/ocserv\/server-cert.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s|#server-key = \/etc\/pki\/ocserv\/private\/server.key|server-key = \/etc\/ocserv\/server-key.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s|#ca-cert = \/etc\/pki\/ocserv\/cacerts\/ca.crt|ca-cert = \/etc\/ocserv\/ca-cert.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
\u5f9e\u8b49\u66f8\u4e2d\u63d0\u53d6\u7528\u6236\u540d\u7684\u65b9\u5f0f\uff0c\u9019\u88e1\u63d0\u53d6\u7684\u662f\u8b49\u66f8\u4e2d\u7684 CN \u6b04\u4f4d\u4f5c\u70ba\u7528\u6236\u540d
# sed -i ‘s\/cert-user-oid = 0.9.2342.19200300.100.1.1\/cert-user-oid = 2.5.4.3\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u5206\u914d\u7d66 VPN \u7528\u6236\u7aef\u7684 IP \u7db2\u6bb5
# sed -i ‘s\/#ipv4-network = 192.168.1.0\/ipv4-network = 10.12.0.0\/’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s\/#ipv4-netmask = 255.255.255.0\/ipv4-netmask = 255.255.255.0\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a DNS
# sed -i ‘s\/#dns = 192.168.1.2\/dns = 8.8.8.8\/’ \/etc\/ocserv\/ocserv.conf<\/span>
# \u89e3\u6c7a GnuTLS error (at worker-vpn.c \u554f\u984c
# sed -i ‘s\/isolate-workers = true\/isolate-workers = false\/’<\/span> \/etc\/ocserv\/ocserv.conf<\/span><\/p>\n

9. \u8a2d\u5b9a\u7db2\u8def Forward
# echo “net.ipv4.ip_forward = 1” >> \/etc\/sysctl.conf<\/span>
# sysctl -p <\/span>\/etc\/sysctl.conf<\/span><\/p>\n

10. \u8a2d\u5b9a\u9632\u706b\u7246\u898f\u5247
# iptables -t nat -A POSTROUTING -s 10.12.0.0\/24 -o eth0 -j MASQUERADE<\/span>
# iptables -A FORWARD -i vpns+ -j ACCEPT<\/span>
# iptables -A FORWARD -o vpns+ -j ACCEPT<\/span><\/p>\n

11. \u5132\u5b58\u9632\u706b\u7246\u898f\u5247
# iptables-save > \/etc\/sysconfig\/iptables<\/span><\/p>\n

12. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5
# systemctl enable ocserv<\/span>
Created symlink from \/etc\/systemd\/system\/multi-user.target.wants\/ocserv.service to \/usr\/lib\/systemd\/system\/ocserv.service.<\/span><\/p>\n

12. \u555f\u52d5 OpenConnect Server
# systemctl start ocserv<\/span>
# systemctl status ocserv<\/span><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u95dc\u65bc OpenConnect \u53ef\u4ee5\u53c3\u8003\uff1a\u7528\u6a39\u8393\u6d3e\u67b6\u8a2dSSL VPN \u6700\u4f4e\u6210\u672c\u6253\u9020\u7aae\u4eba\u7ffb\u7246\u68af – \u6280 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 CentOS 7.x \u4e0a\u5efa\u7f6e OpenConnect SSL VPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,189],"tags":[],"class_list":["post-19345","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-104469"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["680195"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19345"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19345"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19345\/revisions"}],"predecessor-version":[{"id":20890,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19345\/revisions\/20890"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19345"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19345"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19345"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}