{"id":19346,"date":"2016-12-23T06:19:49","date_gmt":"2016-12-22T22:19:49","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/12\/23\/%e5%9c%a8-ubuntu-16-04-1-server-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server\/"},"modified":"2021-03-18T17:24:52","modified_gmt":"2021-03-18T09:24:52","slug":"%e5%9c%a8-ubuntu-16-04-1-server-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2016\/12\/23\/%e5%9c%a8-ubuntu-16-04-1-server-%e4%b8%8a%e5%bb%ba%e7%bd%ae-openconnect-ssl-vpn-server\/","title":{"rendered":"\u5728 Ubuntu 16.04.1 Server \u4e0a\u5efa\u7f6e OpenConnect SSL VPN Server"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
\u6298\u817e\u7b14\u8bb0\uff1a\u67b6\u8bbeOpenConnect Server\u7ed9iPhone\u63d0\u4f9b\u66f4\u987a\u7545\u7684\u7f51\u7edc\u751f\u6d3b \u2013 \u6bd4\u7279\u5ba2\u6808\u7684\u6587\u827a\u590d\u5174<\/a>
Ubuntu ocserv\u642d\u5efa<\/a>
\u4f7f\u7528ocserv\u642d\u5efa Cisco Anyconnect \u670d\u52d9\u5668 | \u843d\u683c\u535a\u5ba2<\/a>
Setup OpenConnect VPN Server for Cisco AnyConnect on Ubuntu 14.04 x64 – Vultr.com<\/a><\/p>\n

1. \u5b89\u88dd ocserv
# apt-get install ocserv<\/span> <\/p>\n

2. \u5b89\u88dd\u5efa\u7acb\u6191\u8b49\u6642\u6240\u9700\u5957\u4ef6
# apt install gnutls-bin<\/span><\/p>\n

3. \u5efa\u7acb\u76ee\u9304\u53ca\u5207\u63db\u76ee\u9304
# mkdir certificates<\/span>
# cd certificates[@more@]<\/span>4. \u5efa\u7acb CA \u91d1\u9470
# certtool –generate-privkey –outfile ca-key.pem<\/span>
Generating a 3072 bit RSA private key…<\/span><\/p>\n

\u5efa\u7acb ca.tmpl
# cat ca.tmpl<\/span>
cn = “VPN CA”<\/span>
organization = “Home”<\/span>
serial = 1<\/span>
expiration_days = 3650<\/span>
ca<\/span>
signing_key<\/span>
cert_signing_key<\/span>
crl_signing_key<\/span><\/p>\n

# certtool –generate-self-signed –load-privkey ca-key.pem –template ca.tmpl –outfile ca-cert.pem<\/span><\/p>\n

\u8907\u88fd ca-cert.pem \u5230 \/etc\/ocserv<\/span> \u76ee\u9304
# cp ca-cert.pem \/etc\/ocserv<\/span><\/p>\n

5. \u5efa\u7acb\u672c\u6a5f Server \u8b49\u66f8
# certtool –generate-privkey –outfile server-key.pem<\/span>
Generating a 3072 bit RSA private key…<\/span><\/p>\n

\u5efa\u7acb server.tmpl
# cat server.tmpl<\/span>
cn = “nas.test.com”<\/span>
organization = “Home”<\/span>
serial = 2<\/span>
expiration_days = 3650<\/span>
encryption_key<\/span>
signing_key<\/span>
tls_www_server<\/span><\/p>\n

# certtool –generate-certificate –load-privkey server-key.pem –load-ca-certificate ca-cert.pem –load-ca-privkey ca-key.pem –template server.tmpl –outfile server-cert.pem<\/span><\/p>\n

\u5c07 server-cert.pem \u548c server-key.pem \u8907\u88fd\u5230 \/etc\/ocserv<\/span>
# cp server-cert.pem server-key.pem \/etc\/ocserv<\/span><\/p>\n

6. \u7522\u751f\u4f7f\u7528\u8005\u7aef\u8b49\u66f8(\u9023\u7dda\u6642\u53ef\u4ee5\u4e0d\u7528\u8f38\u5165\u5e33\u865f\u53ca\u5bc6\u78bc)
# cat gen-client-cert.sh<\/span>
#!\/bin\/bash<\/span>
USER=$1<\/span>
CA_DIR=$2<\/span>
SERIAL=`date +%s`<\/span>
certtool –generate-privkey –outfile $USER-key.pem<\/span>
cat << _EOF_ >user.tmpl<\/span>
cn = “$USER”<\/span>
unit = “users”<\/span>
serial = “$SERIAL”<\/span>
expiration_days = 3650<\/span>
signing_key<\/span>
tls_www_client<\/span>
_EOF_<\/span>
certtool –generate-certificate –load-privkey $USER-key.pem –load-ca-certificate $CA_DIR\/ca-cert.pem –load-ca-privkey $CA_DIR\/ca-key.pem –template user.tmpl –outfile $USER-cert.pem<\/span>
openssl pkcs12 -export -inkey $USER-key.pem -in $USER-cert.pem -name “$USER VPN Client Cert” -certfile $CA_DIR\/ca-cert.pem -out $USER.p12<\/span><\/p>\n

\u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod 700 gen-client-cert.sh<\/span><\/p>\n

\u5efa\u7acb\u76ee\u9304\u4f86\u5b58\u653e\u4f7f\u7528\u8005\u8b49\u66f8
# mkdir home<\/span>
# \u5207\u63db\u76ee\u9304
# cd home<\/span>
# home \u662f\u4f7f\u7528\u8005\u7684\u540d\u7a31\uff0c.. \u662f\u6307 ca \u8b49\u66f8\u6240\u5728\u7684\u76ee\u9304
# ..\/gen-client-cert.sh home ..<\/span>
\u53ef\u4ee5\u76f4\u63a5\u6309 Enter \u9375\u8df3\u904e\uff0c\u5c31\u4e0d\u7528\u8a2d\u5b9a\u5bc6\u78bc
Signing certificate…<\/span>
Enter Export Password:<\/span>
Verifying – Enter Export Password:<\/span><\/p>\n

\u7522\u751f\u4e4b\u5f8c\u53ef\u4ee5\u5c07 home.p12 \u8907\u88fd\u7d66\u4f7f\u7528\u8005\u7528\u6236\u7aef\u5c0e\u5165\u5373\u53ef<\/p>\n

7. \u4fee\u6539 \/etc\/ocserv\/ocserv.conf<\/span> \u8a2d\u5b9a\u6a94
# cp \/etc\/ocserv\/ocserv.conf \/etc\/ocserv\/ocserv.conf.$(date +%F)<\/span>
\u53d6\u6d88 pam \u8a8d\u8b49
# sed -i ‘s|^auth = “pam|#auth = “pam|’ \/etc\/ocserv\/ocserv.conf<\/span>
\u63a1\u7528 certificate \u8a8d\u8b49
# sed -i ‘s\/#auth = “certificate”\/auth = “certificate”\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a\u540c\u4e00\u500b\u7528\u6236\u6700\u591a\u7684\u767b\u5165\u6578
# sed -i ‘s\/max-same-clients = 2\/max-same-clients = 10\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a\u6191\u8b49\u6a94\u7684\u4f4d\u7f6e
# sed -i ‘s|server-cert = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem|server-cert = \/etc\/ocserv\/server-cert.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s|server-key = \/etc\/ssl\/private\/ssl-cert-snakeoil.key|server-key = \/etc\/ocserv\/server-key.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s|ca-cert = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem|ca-cert = \/etc\/ocserv\/ca-cert.pem|’ \/etc\/ocserv\/ocserv.conf<\/span>
\u5f9e\u8b49\u66f8\u4e2d\u63d0\u53d6\u7528\u6236\u540d\u7684\u65b9\u5f0f\uff0c\u9019\u88e1\u63d0\u53d6\u7684\u662f\u8b49\u66f8\u4e2d\u7684 CN \u6b04\u4f4d\u4f5c\u70ba\u7528\u6236\u540d
# sed -i ‘s\/cert-user-oid = 0.9.2342.19200300.100.1.1\/cert-user-oid = 2.5.4.3\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u5206\u914d\u7d66 VPN \u7528\u6236\u7aef\u7684 IP \u7db2\u6bb5
# sed -i ‘s\/ipv4-network = 192.168.1.0\/ipv4-network = 10.12.0.0\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a2d\u5b9a DNS
# sed -i ‘s\/dns = 192.168.1.2\/dns = 8.8.8.8\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u8a3b\u89e3 route\uff0c\u8b93 Ocserv \u4f3a\u670d\u5668\u6210\u70ba Gateway
# sed -i ‘s\/^route = 10.10.10.0\/# route = 10.10.10.0\/’ \/etc\/ocserv\/ocserv.conf<\/span>
# sed -i ‘s\/^route = 192.168.0.0\/# route = 10.10.10.0\/’ \/etc\/ocserv\/ocserv.conf<\/span>
\u512a\u5316 VPN \u7684\u7db2\u8def\u6027\u80fd
# sed -i ‘s\/^(try-mtu-discovery = ).*$\/1”true\/’ \/etc\/ocserv\/ocserv.conf<\/span><\/p>\n

For sed
# cat sed-script<\/span>
s|^auth = “pam|#auth = “pam|<\/span>
s\/#auth = “certificate”\/auth = “certificate”\/<\/span>
s\/max-same-clients = 2\/max-same-clients = 10\/<\/span>
s|server-cert = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem|server-cert = \/etc\/ocserv\/server-cert.pem|<\/span>
s|server-key = \/etc\/ssl\/private\/ssl-cert-snakeoil.key|server-key = \/etc\/ocserv\/server-key.pem|<\/span>
s|ca-cert = \/etc\/ssl\/certs\/ssl-cert-snakeoil.pem|ca-cert = \/etc\/ocserv\/ca-cert.pem|<\/span>
s\/cert-user-oid = 0.9.2342.19200300.100.1.1\/cert-user-oid = 2.5.4.3\/<\/span>
s\/ipv4-network = 192.168.1.0\/ipv4-network = 10.12.0.0\/<\/span>
s\/dns = 192.168.1.2\/dns = 8.8.8.8\/<\/span>
s\/^route = 10.10.10.0\/# route = 10.10.10.0\/<\/span>
s\/^route = 192.168.0.0\/# route = 10.10.10.0\/<\/span>
s\/^(try-mtu-discovery = ).*$\/1true\/<\/span><\/p>\n

# sed -i -f sed-script \/etc\/ocserv\/ocserv.conf<\/span><\/p>\n

8. \u8a2d\u5b9a\u7db2\u8def Forward
# sed -i ‘s\/#net.ipv4.ip_forward=1\/net.ipv4.ip_forward=1\/’ \/etc\/sysctl.conf<\/span>
# sysctl -p <\/span>\/etc\/sysctl.conf<\/span><\/p>\n

10. \u8a2d\u5b9a\u9632\u706b\u7246\u898f\u5247
# iptables -t nat -A POSTROUTING -s 10.12.0.0\/24 -o eth0 -j MASQUERADE<\/span>
# iptables -A FORWARD -i vpns+ -j ACCEPT<\/span>
# iptables -A FORWARD -o vpns+ -j ACCEPT<\/span><\/p>\n

11. \u5132\u5b58\u9632\u706b\u7246\u898f\u5247
# iptables-save > \/etc\/sysconfig\/iptables<\/span><\/p>\n

12. \u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5
# systemctl enable ocserv<\/span>
Synchronizing state of ocserv.service with SysV init with \/lib\/systemd\/systemd-sysv-install…<\/span>
Executing \/lib\/systemd\/systemd-sysv-install enable ocserv<\/span><\/p>\n

12. \u555f\u52d5 OpenConnect Server
# systemctl start ocserv<\/span>
# systemctl status ocserv<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a\u6298\u817e\u7b14\u8bb0\uff1a\u67b6\u8bbeOpenConnect Server\u7ed9iPhone\u63d0\u4f9b\u66f4\u987a\u7545\u7684\u7f51\u7edc\u751f\u6d3b \u2013 \u6bd4\u7279\u5ba2\u6808\u7684 … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5728 Ubuntu 16.04.1 Server \u4e0a\u5efa\u7f6e OpenConnect SSL VPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[189,119],"tags":[],"class_list":["post-19346","post","type-post","status-publish","format-standard","hentry","category-c-104469","category-c-78464"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["680210"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19346"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19346"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19346\/revisions"}],"predecessor-version":[{"id":20891,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19346\/revisions\/20891"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}