{"id":19397,"date":"2017-01-26T06:08:52","date_gmt":"2017-01-25T22:08:52","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/26\/%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8%e5%b8%b3%e8%99%9f%e5%8f%8a%e5%af%86%e7%a2%bc%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server\/"},"modified":"2021-03-18T17:24:54","modified_gmt":"2021-03-18T09:24:54","slug":"%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8%e5%b8%b3%e8%99%9f%e5%8f%8a%e5%af%86%e7%a2%bc%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/01\/26\/%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8%e5%b8%b3%e8%99%9f%e5%8f%8a%e5%af%86%e7%a2%bc%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server\/","title":{"rendered":"\u5efa\u7f6e\u4f7f\u7528\u5e33\u865f\u53ca\u5bc6\u78bc\u8a8d\u8b49\u7684 OpenVPN Server"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
CentOS7 \u642d\u5efaOpenVPN | HuaChao’s Blog<\/a><\/p>\n

\u4e4b\u524d\u7684\u8a2d\u5b9a\u53ef\u4ee5\u53c3\u8003\u00a0 \u982d\u57ce\u570b\u5c0f\u8cc7\u8a0a\u7d44 | \u8a66\u7528 Banana Pi R1 – Ubuntu minimal 16.04 \u4e0a\u5b89\u88dd OpenVPN<\/a>\uff0c\u9019\u88e1\u53ea\u91dd\u5c0d\u5269\u9918\u7684\u90e8\u4efd\u505a\u4fee\u6539
1. \u4fee\u6539 \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94
\u00a0\u00a0\u00a0\u00a0 auth-user-pass-verify \u6307\u5b9a\u8981\u8a8d\u8b49\u7684\u7a0b\u5f0f\u78bc\uff0c\u53ca\u4f7f\u7528\u4f55\u7a2e\u5e33\u5bc6\u50b3\u905e\u7684\u65b9\u5f0f
\u00a0\u00a0\u00a0\u00a0 client-cert-not-required
\u00a0\u00a0\u00a0\u00a0 username-as-common-name
# echo -e “n# \u4f7f\u7528\u5e33\u865f\u5bc6\u78bc\u505a\u8a8d\u8b49nscript-security 3 systemnauth-user-pass-veri<\/span>
fy \/etc\/openvpn\/checkpsw.sh via-envn;client-cert-not-requirednusername-as-comm<\/span>
on-name” >> \/etc\/openvpn\/server.conf<\/span>
[@more@]2. \u5efa\u7acb\u5bc6\u78bc\u6aa2\u67e5\u7a0b\u5f0f
# vim \/etc\/openvpn\/checkpsw.sh<\/span><\/p>\n

#!\/bin\/sh<\/span>\n<\/span>###########################################################<\/span>\n<\/span># checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se><\/span>\n<\/span>#<\/span>\n<\/span># This script will authenticate OpenVPN users against<\/span>\n<\/span># a plain text file. The passfile should simply contain<\/span>\n<\/span># one row per user with the username first followed by<\/span>\n<\/span># one or more space(s) or tab(s) and then the password.<\/span>\n\nPASSFILE<\/span>=<\/span>\"\/etc\/openvpn\/psw-file\"<\/span>\nLOG_FILE<\/span>=<\/span>\"\/etc\/openvpn\/openvpn-password.log\"<\/span>\nTIME_STAMP<\/span>=<\/span>`date \"+%Y-%m-%d %T\"`<\/span>\n\n<\/span>###########################################################<\/span>\n\n<\/span>if<\/span> <\/span>[<\/span> <\/span>!<\/span> <\/span>-<\/span>r <\/span>\"${PASSFILE}\"<\/span> <\/span>];<\/span> <\/span>then<\/span>\n  echo <\/span>\"${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading.\"<\/span> <\/span>>><\/span> $<\/span>{<\/span>LOG_FILE<\/span>}<\/span>\n  <\/span>exit<\/span> <\/span>1<\/span>\n<\/span>fi<\/span>\n\nCORRECT_PASSWORD<\/span>=<\/span>`awk '!\/^;\/&&!\/^#\/&&$1==\"'${username}'\"{print $2;exit}' ${PASSFILE}`<\/span>\n\n<\/span>if<\/span> <\/span>[<\/span> <\/span>\"${CORRECT_PASSWORD}\"<\/span> <\/span>=<\/span> <\/span>\"\"<\/span> <\/span>];<\/span> <\/span>then<\/span> \n  echo <\/span>\"${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\".\"<\/span> <\/span>>><\/span> $<\/span>{<\/span>LOG_FILE<\/span>}<\/span>\n  <\/span>exit<\/span> <\/span>1<\/span>\n<\/span>fi<\/span>\n\n<\/span>if<\/span> <\/span>[<\/span> <\/span>\"${password}\"<\/span> <\/span>=<\/span> <\/span>\"${CORRECT_PASSWORD}\"<\/span> <\/span>];<\/span> <\/span>then<\/span> \n  echo <\/span>\"${TIME_STAMP}: Successful authentication: username=\"${username}\".\"<\/span> <\/span>>><\/span> $<\/span>{<\/span>LOG_FILE<\/span>}<\/span>\n  <\/span>exit<\/span> <\/span>0<\/span>\n<\/span>fi<\/span>\n\necho <\/span>\"${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\".\"<\/span> <\/span>>><\/span> $<\/span>{<\/span>LOG_FILE<\/span>}<\/span>\n<\/span>exit<\/span> <\/span>1<\/span><\/code><\/span><\/pre>\n
3. \u66f4\u6539\u6a94\u6848\u6b0a\u9650
# chmod +x \/etc\/openvpn\/checkpsw.sh<\/span><\/p>\n
4. \u5efa\u7acb\u5bc6\u78bc\u6a94 \/etc\/openvpn\/psw-file<\/span>
\u683c\u5f0f\uff1a\u5e33\u865f \u5bc6\u78bc
# cat \/etc\/openvpn\/psw-file<\/span>
test 123123<\/span><\/p>\n
5. \u6aa2\u67e5 \/etc\/openvpn\/server.conf<\/span> \u8a2d\u5b9a\u6a94\u662f\u5426\u6b63\u78ba
# openvpn –config \/etc\/openvpn\/server.conf<\/span><\/p>\n
6. \u91cd\u65b0\u555f\u52d5 OpenVPN Server
# systemctl restart openvpn@server.service<\/span><\/p>\n
7. \u4fee\u6539\u4f7f\u7528\u7aef\u6a94\u6848 xxx.ovpn \u52a0\u5165\u4e0b\u9762\u5e7e\u884c
resolv-retry infinite<\/span>
nobind<\/span>
auth-user-pass
<\/span>auth-nocache<\/span>
mute-replay-warnings<\/span>
ns-cert-type server<\/span>
reneg-sec 0<\/span><\/p>\n
\u7d93\u904e\u6e2c\u8a66\uff0c\u4f3c\u4e4e\u5e33\u865f\u8a8d\u8b49\u7121\u6cd5\u8207\u6191\u8b49\u8a8d\u8b49\u4f75\u5b58\uff01\uff1f<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"
\u53c3\u8003\u7db2\u7ad9\uff1aCentOS7 \u642d\u5efaOpenVPN | HuaChao’s Blog \u4e4b\u524d\u7684\u8a2d\u5b9a\u53ef\u4ee5\u53c3\u8003 … <\/p>\n
\u95b1\u8b80\u5168\u6587\u3008\u5efa\u7f6e\u4f7f\u7528\u5e33\u865f\u53ca\u5bc6\u78bc\u8a8d\u8b49\u7684 OpenVPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[168],"tags":[],"class_list":["post-19397","post","type-post","status-publish","format-standard","hentry","category-c-84780"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["681288"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19397"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19397"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19397\/revisions"}],"predecessor-version":[{"id":20935,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19397\/revisions\/20935"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19397"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19397"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19397"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
8. \u6e2c\u8a66
\"\"<\/a><\/p>\n