On the server host, you must create a context
for server state in the form of a separate
account, whose name is vpns by
default. This account must not
be me, or you will lock yourself out
of the host! As a precaution,
open a separate terminal to SSH into
me@server, and get a root
prompt:
This ensures that, if the next step goes
wrong, you still have a way to clean up the
mess.
The following command creates the server
context:
sudo /usr/local/share/vpnmgr/installation vpnmgr.pub -m bloggs@localhost
It creates the account vpns if it
doesn't exist, and limits SSH access to it to
only keys from the sudo-capable
account with a comment matching
bloggs@localhost. You can also
specify a wildcard, e.g., -m bloggs\*,
and override the account name with -u
name.
Now check that you can still use
me@server by opening a third SSH
terminal, and executing:
If you can still sudo, you're okay.
If not, use your earlier root shell to fix the
problem. (installation writes a file
into /etc/sudoers.d/ so that the
vpns account can perform some
limited privileged operations. This is likely to
be the source of any sudo-related
problems.)
Static configuration goes in
/etc/vpnmgr.sh by default, and is
sourced by Bash upon each management operation.
This defines the (private) interfaces that
physically attach to the VLAN-carrying networks,
and the (public) interfaces that OpenVPN clients
connect through. Each mapping between a public
and private network is called a bank,
and the default settings assume a bank called
default.
At a bare minimum, you need to specify the
private interface and the UDP ports of the public
interface that a bank will use. The defaults for
the default bank are:
IFACE[default]=eth1
PORTRANGES[default]=12000-12100
VLANS[default]=1-4095
SERVERNAME[default]="$$HOSTNAME"
INTERNALNAME[default]="$${SERVERNAME[default]}"
Set IFACE to the private
interface. Set SERVERNAME to the IP
address or DNS name of the public interface. Set
PORTRANGES to the pool of UDP ports
that OpenVPN will listen on for clients. Set
VLANS to narrow down the range of
VLAN ids supported. IFACE and
PORTRANGES are required to define a
bank other than default.
VLANS and PORTRANGES
can be comma-separated ranges, e.g.,
100-200,556,1000-1200.
The OpenVPN servers that vpnmgr
sets up need Diffie Hellman parameters, a private
key and an identifying certificate installed on
the server to operate. vpnmgr also
needs the CA certificate of the CA that signs the
server's certificate (used only to build OpenVPN
client configuration files). Each bank may have
separate settings for these, though they all
default to what the default bank
uses:
DHFILE[default]=/etc/openvpn/dh1024.pem
SERVERCERT[default]=/etc/openvpn/server.crt
SERVERKEY[default]=/etc/openvpn/server.key
CACERT[default]=/etc/openvpn/ca.crt
The OpenVPN docs say to do the following to
create the DH parameters:
openssl dhparam -out dh2048.pem 2048
Consult OpenSSL docs about creating a private
key (server.key, with access mode
0600) and an associated certificate-signing
request from it (usually with a .csr
suffix). The .csr file should be
sent securely to a CA for signing, yielding a
certificate that can be used as
server.crt. The CA should also be
able to provide its CA-certificate, to be used as
ca.crt. I will try and summarize the
steps here at some point.
You'll need to generate a key pair
once:
openssl genrsa -nodes -out server.key 2048
server.key holds the
private key, and so it should be held
securely on the server. The public key can
be derived from the same file. You should
only need to repeat this step if you think
your private key has been compromised
(i.e., someone has
got it).
Generate a certificate signing request
(CSR) from the public key:
openssl req -new -key server.key -out server.csr
You'll be asked to fill in various
fields describing your organization that
will appear in the final certificate. The
common name is usually the most
important one, as it is typically the one
that is checked by the client to confirm
who it is talking to. The certificate will
also contain the public key, affirming that
the key pair belongs to the entity
described by these fields.
Securely send your CSR to the CA for
signing as a server, and they will send
back the certificate,
server.crt, which does not
need to be held securely. Also get the CA's
certificate, ca.crt.
easyrsa
3 can be used to create a Certificate
Authority.
Internally, when VPNs are created,
vpnmgr creates a number of software
bridges and interfaces within the server. Their
names in the default bank are
prefixed with vlanbr,
vlan and vlantap. For
other banks, the default replaces
vlan with the bank name. However, as
these names are tightly limited in length, you
might want to override them. For example:
BRIFACE[extra]=exbr
VLIFACE[extra]=ex
TAPIFACE[extra]=extap
When a client calls, the server process
displays a greeting, including the hostname. To
override the hostname displayed, set
SERVERTITLE:
SERVERTITLE="Example Corp."
![[GIT]](/gfx/ext/files/rox/Git-Icon-1788C.png){kind=icon}
