{"id":19407,"date":"2017-02-04T06:24:15","date_gmt":"2017-02-03T22:24:15","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/02\/04\/%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8-ldap-server-%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server\/"},"modified":"2017-02-04T06:24:15","modified_gmt":"2017-02-03T22:24:15","slug":"%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8-ldap-server-%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/02\/04\/%e5%bb%ba%e7%bd%ae%e4%bd%bf%e7%94%a8-ldap-server-%e8%aa%8d%e8%ad%89%e7%9a%84-openvpn-server\/","title":{"rendered":"\u5efa\u7f6e\u4f7f\u7528 LDAP Server \u8a8d\u8b49\u7684 OpenVPN Server"},"content":{"rendered":"

\u50c5\u5217\u51fa\u8207\u4e4b\u524d\u4e0d\u540c\u7684\u5730\u65b9
1. \u5b89\u88dd\u00a0 openvpn-auth-ldap \u5957\u4ef6
Ubuntu 16.04
# apt-get install openvpn-auth-ldap<\/span>
CentOS 6.x\/7.x
# yum install openvpn-auth-ldap<\/span> <\/p>\n

2. \u4fee\u6539 \/etc\/openvpn\/server.conf<\/span>
\u5728\u6a94\u6848\u6700\u5f8c\u9762\u52a0\u5165\u4e0b\u9762\u7684\u8a2d\u5b9a
# vim \/etc\/openvpn\/server.conf<\/span>
client-cert-not-required<\/span>
username-as-common-name<\/span>
plugin \/usr\/lib\/openvpn\/openvpn-auth-ldap.so \/etc\/openvpn\/auth\/auth-ldap.conf<\/span> <\/p>\n

# CentOS 7
plugin \/usr\/lib64\/openvpn\/plugin\/lib\/openvpn-auth-ldap.so \/etc\/openvpn\/auth\/ldap.conf<\/span> <\/p>\n

\u8acb\u78ba\u8a8d openvpn-auth-ldap.so \u6a94\u7684\u4f4d\u7f6e[@more@]3. \u5efa\u7acb\u76ee\u9304 \/etc\/openvpn\/auth\/<\/span>
# mkdir \/etc\/openvpn\/auth\/<\/span> <\/p>\n

4. \u5efa\u7acb \/etc\/openvpn\/auth\/auth-ldap.conf<\/span> \u8a2d\u5b9a\u6a94
# egrep -v ‘^#|^$’ \/etc\/openvpn\/auth\/auth-ldap.conf<\/span>
<LDAP><\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # LDAP server URL<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #URL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ldap:\/\/ldap1.example.org<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 URL\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ldap:\/\/192.168.1.20<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Bind DN (If your LDAP server doesn’t support anonymous binds)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BindDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 cn=admin,dc=bpim3,dc=test,dc=org<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Bind Password<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Password\u00a0\u00a0\u00a0\u00a0\u00a0 SecretPassword<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Password\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 123456<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Network timeout (in seconds)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Timeout\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 15<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Enable Start TLS<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Follow LDAP Referrals (anonymously)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # TLS CA Certificate File<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # TLS CA Certificate Directory<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Client Certificate and key<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # If TLS client authentication is required<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Cipher Suite<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # The defaults are usually fine here<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # TLSCipherSuite\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ALL:!ADH:@STRENGTH<\/span>
<\/LDAP><\/span>
<Authorization><\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Base DN<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 BaseDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 “ou=People,dc=example,dc=com”<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # User Search Filter<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SearchFilter\u00a0\u00a0\u00a0 “(&(uid=%u))”<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Require Group Membership<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 RequireGroup\u00a0\u00a0\u00a0 false<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 # Add non-group members to a PF table (disabled)<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 #PFTable\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ips_vpn_users<\/span>
<\/Authorization><\/span> <\/p>\n

5. \u6aa2\u67e5 OpenVPN \u8a2d\u5b9a\u6a94\u662f\u5426\u6b63\u78ba
# openvpn –config \/etc\/openvpn\/server.conf<\/span> <\/p>\n

6. \u91cd\u65b0\u555f\u52d5 OpenVPN Server\uff0c\u4e26\u6aa2\u67e5\u662f\u5426\u6709\u6b63\u5e38\u555f\u52d5
# systemctl restart openvpn@server.service;systemctl status openvpn@server.service<\/span><\/p>\n

7. Client \u7aef\u8a2d\u5b9a\u6a94\u52a0\u5165
auth-user-pass<\/span><\/p>\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u50c5\u5217\u51fa\u8207\u4e4b\u524d\u4e0d\u540c\u7684\u5730\u65b9 1. \u5b89\u88dd\u00a0 openvpn-auth-ldap \u5957\u4ef6 Ubuntu 16.04 # … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008\u5efa\u7f6e\u4f7f\u7528 LDAP Server \u8a8d\u8b49\u7684 OpenVPN Server\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,115,168,119],"tags":[],"class_list":["post-19407","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78460","category-c-84780","category-c-78464"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["681805"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19407"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19407"}],"version-history":[{"count":0,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19407\/revisions"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}