{"id":374,"date":"2016-01-31T21:09:52","date_gmt":"2016-02-01T00:09:52","guid":{"rendered":"http:\/\/wordpress.jpcorp.eti.br\/?p=374"},"modified":"2021-12-26T12:31:33","modified_gmt":"2021-12-26T15:31:33","slug":"openvpn-site-to-client-por-usuario-e-senha-no-centos-7","status":"publish","type":"post","link":"https:\/\/wordpress.jpcorp.eti.br\/?p=374","title":{"rendered":"OpenVPN Site-To-Client por usu\u00e1rio e senha no CentOS 7"},"content":{"rendered":"

1 - Instalando pacotes e preparando o ambiente<\/h3>\n
[root@centos7 ~]# cat \/etc\/redhat-release\r\nCentOS Linux release 7.2.1511 (Core)<\/pre>\n
[root@centos7 ~]# yum -y install epel-release\r\n<\/pre>\n
[root@centos7 ~]# yum -y install openvpn easy-rsa\r\n<\/pre>\n
[root@centos7 ~]# cp -Rfv \/usr\/share\/easy-rsa\/2.0\/ \/etc\/openvpn\/easy-rsa\r\n<\/pre>\n
[root@centos7 ~]# firewall-cmd --add-port=1194\/udp --permanent\r\nsuccess\r\n[root@centos7 ~]# firewall-cmd --reload\r\nsuccess\r\n[root@centos7 ~]# firewall-cmd --list-port\r\n1194\/udp\r\n[root@centos7 ~]# firewall-cmd --list-service\r\ndhcpv6-client ssh\r\n<\/pre>\n
2 - Gerando certificados CA\/CA-SERVER\/DH<\/h3>\n
[root@centos7 easy-rsa]# cd \/etc\/openvpn\/easy-rsa\/\r\n[root@centos7 easy-rsa]# vi vars\r\n\r\n# These are the default values for fields\r\n# which will be placed in the certificate.\r\n# Don't leave any of these fields blank.\r\nexport KEY_COUNTRY=\"BR\"\r\nexport KEY_PROVINCE=\"SP\"\r\nexport KEY_CITY=\"RIBEIRAOPRETO\"\r\nexport KEY_ORG=\"JPCORP\"\r\nexport KEY_EMAIL=\"JHONES@JPCORP.ETI.BR\"\r\nexport KEY_OU=\"JPCORP\"\r\n\r\n# X509 Subject Field\r\nexport KEY_NAME=\"CA-JPCORP\"<\/pre>\n
[root@centos7 easy-rsa]# source .\/vars\r\nNOTE: If you run .\/clean-all, I will be doing a rm -rf on \/etc\/openvpn\/easy-rsa\/keys<\/pre>\n
[root@centos7 easy-rsa]# .\/clean-all\r\n<\/pre>\n
[root@centos7 easy-rsa]# .\/build-ca\r\nGenerating a 2048 bit RSA private key\r\n............................................+++\r\n.........+++\r\nwriting new private key to 'ca.key'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [BR]:\r\nState or Province Name (full name) [SP]:\r\nLocality Name (eg, city) [RIBEIRAOPRETO]:\r\nOrganization Name (eg, company) [JPCORP]:\r\nOrganizational Unit Name (eg, section) [JPCORP]:\r\nCommon Name (eg, your name or your server's hostname) [JPCORP CA]:\r\nName [CA-JPCORP]:\r\nEmail Address [JHONES@JPCORP.ETI.BR]:<\/pre>\n
[root@centos7 easy-rsa]# .\/build-key-server server\r\nGenerating a 2048 bit RSA private key\r\n.........+++\r\n...........+++\r\nwriting new private key to 'server.key'\r\n-----\r\nYou are about to be asked to enter information that will be incorporated\r\ninto your certificate request.\r\nWhat you are about to enter is what is called a Distinguished Name or a DN.\r\nThere are quite a few fields but you can leave some blank\r\nFor some fields there will be a default value,\r\nIf you enter '.', the field will be left blank.\r\n-----\r\nCountry Name (2 letter code) [BR]:\r\nState or Province Name (full name) [SP]:\r\nLocality Name (eg, city) [RIBEIRAOPRETO]:\r\nOrganization Name (eg, company) [JPCORP]:\r\nOrganizational Unit Name (eg, section) [JPCORP]:\r\nCommon Name (eg, your name or your server's hostname) [server]:\r\nName [CA-JPCORP]:\r\nEmail Address [JHONES@JPCORP.ETI.BR]:\r\n\r\nPlease enter the following 'extra' attributes\r\nto be sent with your certificate request\r\nA challenge password []:\r\nAn optional company name []:\r\nUsing configuration from \/etc\/openvpn\/easy-rsa\/openssl-1.0.0.cnf\r\nCheck that the request matches the signature\r\nSignature ok\r\nThe Subject's Distinguished Name is as follows\r\ncountryName           :PRINTABLE:'BR'\r\nstateOrProvinceName   :PRINTABLE:'SP'\r\nlocalityName          :PRINTABLE:'RIBEIRAOPRETO'\r\norganizationName      :PRINTABLE:'JPCORP'\r\norganizationalUnitName:PRINTABLE:'JPCORP'\r\ncommonName            :PRINTABLE:'server'\r\nname                  :PRINTABLE:'CA-JPCORP'\r\nemailAddress          :IA5STRING:'JHONES@JPCORP.ETI.BR'\r\nCertificate is to be certified until Jan 28 23:35:47 2026 GMT (3650 days)\r\nSign the certificate? [y\/n]:y\r\n\r\n\r\n1 out of 1 certificate requests certified, commit? [y\/n]y\r\nWrite out database with 1 new entries\r\nData Base Updated<\/pre>\n
[root@centos7 easy-rsa]# .\/build-dh\r\nGenerating DH parameters, 2048 bit long safe prime, generator 2\r\n................+............<\/pre>\n
[root@centos7 easy-rsa]# ll keys\/\r\ntotal 52\r\n-rw-r--r-- 1 root root 5492 Jan 31 20:35 01.pem\r\n-rw-r--r-- 1 root root 1732 Jan 31 20:35 ca.crt\r\n-rw------- 1 root root 1704 Jan 31 20:35 ca.key\r\n-rw-r--r-- 1 root root  424 Jan 31 20:39 dh2048.pem\r\n-rw-r--r-- 1 root root  134 Jan 31 20:35 index.txt\r\n-rw-r--r-- 1 root root   21 Jan 31 20:35 index.txt.attr\r\n-rw-r--r-- 1 root root    0 Jan 31 20:35 index.txt.old\r\n-rw-r--r-- 1 root root    3 Jan 31 20:35 serial\r\n-rw-r--r-- 1 root root    3 Jan 31 20:35 serial.old\r\n-rw-r--r-- 1 root root 5492 Jan 31 20:35 server.crt\r\n-rw-r--r-- 1 root root 1078 Jan 31 20:35 server.csr\r\n-rw------- 1 root root 1708 Jan 31 20:35 server.key<\/pre>\n
[root@centos7 easy-rsa]# cd ..\r\n[root@centos7 openvpn]# ln -s \/etc\/openvpn\/easy-rsa\/keys\/ \/etc\/openvpn\/ca-server<\/pre>\n
\u00a03 - Criando o .conf<\/h3>\n
[root@centos7 openvpn]# vi site-to-client.conf\r\n\r\nport 1194\r\nproto udp\r\ndev tun\r\nca \/etc\/openvpn\/ca-server\/ca.crt\r\ncert \/etc\/openvpn\/ca-server\/server.crt\r\nkey \/etc\/openvpn\/ca-server\/server.key\r\ndh \/etc\/openvpn\/ca-server\/dh2048.pem\r\nifconfig-pool-persist \/var\/log\/ipp_site-to-client.log\r\n;push \"route 172.16.1.1 255.255.255.0\"\r\nclient-cert-not-required\r\ntls-server\r\nusername-as-common-name\r\nserver 10.10.10.0 255.255.255.0\r\nkeepalive 10 120\r\ncomp-lzo\r\nuser nobody\r\ngroup nobody\r\nplugin \/usr\/lib64\/openvpn\/plugins\/openvpn-plugin-auth-pam.so login\r\npersist-key\r\npersist-tun\r\nstatus \/var\/log\/status_site-to-client.log\r\nlog-append \/var\/log\/site-to-client.log\r\nverb 3\r\n<\/pre>\n
\u00a04 - Ativando o servi\u00e7o, o @site-to-client deve ser o mesmo nome do arquivo .conf criado, aqui neste caso site-to-client.conf<\/h3>\n
[root@centos7 openvpn]# systemctl enable openvpn@site-to-client\r\nCreated symlink from \/etc\/systemd\/system\/multi-user.target.wants\/openvpn@site-to-client.service to \/usr\/lib\/systemd\/system\/openvpn@.service.\r\n[root@centos7 openvpn]# systemctl start openvpn@site-to-client\r\n[root@centos7 openvpn]# systemctl status openvpn@site-to-client\r\n\u25cf openvpn@site-to-client.service - OpenVPN Robust And Highly Flexible Tunneling Application On site\/to\/client\r\n   Loaded: loaded (\/usr\/lib\/systemd\/system\/openvpn@.service; enabled; vendor preset: disabled)\r\n   Active: active (running) since Dom 2016-01-31 20:45:09 BRT; 4s ago\r\n  Process: 1795 ExecStart=\/usr\/sbin\/openvpn --daemon --writepid \/var\/run\/openvpn\/%i.pid --cd \/etc\/openvpn\/ --config %i.conf (code=exited, status=0\/SUCCESS)\r\n Main PID: 1796 (openvpn)\r\n   CGroup: \/system.slice\/system-openvpn.slice\/openvpn@site-to-client.service\r\n           \u251c\u25001796 \/usr\/sbin\/openvpn --daemon --writepid \/var\/run\/openvpn\/site-to-client.pid --cd \/etc\/openvpn\/ --config site-to-cli...\r\n           \u2514\u25001797 \/usr\/sbin\/openvpn --daemon --writepid \/var\/run\/openvpn\/site-to-client.pid --cd \/etc\/openvpn\/ --config site-to-cli...\r\n\r\nJan 31 20:45:09 centos7 systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On site\/to\/client...\r\nJan 31 20:45:09 centos7 systemd[1]: PID file \/var\/run\/openvpn\/site-to-client.pid not readable (yet?) after start.\r\nJan 31 20:45:09 centos7 systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On site\/to\/client.<\/pre>\n
5 - Criando usu\u00e1rio local<\/h3>\n
[root@centos7 openvpn]# adduser -M -s \/sbin\/nologin jhonespetter\r\n[root@centos7 openvpn]# passwd jhonespetter\r\nMudando senha para o usu\u00e1rio jhonespetter.\r\nNova senha:\r\nSENHA INCORRETA: A senha \u00e9 menor do que 8 caracteres\r\nRedigite a nova senha:\r\npasswd: todos os tokens de autentica\u00e7\u00f5es foram atualizados com sucesso.<\/pre>\n
6 - Criando o cliente<\/h3>\n
No par\u00e2metro \"remote\" alterar para o ip do server, o arquivo pass.txt deve possuir o usuario e senha, no campo \"<ca>\" coloque o conteudo do CA gerado \"cat \/etc\/openvpn\/ca-server\/ca.crt\". Estes par\u00e2metros para o cliente serve tanto para Linux quanto para rodar no cliente de Windows.<\/p>\n
[root@centos7 openvpn]# vi client_model.ovpn\r\n\r\nclient\r\nremote 192.168.1.123 1194\r\nproto udp\r\ndev tun\r\npersist-tun\r\npersist-key\r\nauth-user-pass pass.txt\r\nping 10\r\ncomp-lzo\r\nverb 3\r\nmute 10\r\ntls-client\r\n<ca>\r\n-----BEGIN CERTIFICATE-----\r\nMIIE0zCCA7ugAwIBAgIJAMZ5uHRs0zB7MA0GCSqGSIb3DQEBCwUAMIGhMQswCQYD\r\nVQQGEwJCUjELMAkGA1UECBMCU1AxFjAUBgNVBAcTDVJJQkVJUkFPUFJFVE8xDzAN\r\nBgNVBAoTBkpQQ09SUDEPMA0GA1UECxMGSlBDT1JQMRIwEAYDVQQDEwlKUENPUlAg\r\nQ0ExEjAQBgNVBCkTCUNBLUpQQ09SUDEjMCEGCSqGSIb3DQEJARYUSkhPTkVTQEpQ\r\nQ09SUC5FVEkuQlIwHhcNMTYwMTMxMjMzNTIyWhcNMjYwMTI4MjMzNTIyWjCBoTEL\r\nMAkGA1UEBhMCQlIxCzAJBgNVBAgTAlNQMRYwFAYDVQQHEw1SSUJFSVJBT1BSRVRP\r\nMQ8wDQYDVQQKEwZKUENPUlAxDzANBgNVBAsTBkpQQ09SUDESMBAGA1UEAxMJSlBD\r\nIftjAcY3ulrpcRadDH6neY8hdAbueHZlIqBkCG4kthKYaHNlp9n5NEEWRWty6oL+\r\nwcAbeMAU9B0wPldtX4667D6jESKLPV0OvgVJIQKsgk7xjdpeUlXLc\/KMVEoed+bg\r\n7sHRrhYx72aVA28EEFDK7Tl39XlqZAvUgb1LptMCN4\/un2foLdJFtiGODizF\/Iyp\r\nTmtBTYYoFFwCg\/GK3Aah7\/zzA3MHyXNTwFokDBhC8VkmL0ghszU9YUsNX3g5BZnu\r\nOd3U8932zXjWSoN8xCB\/YPqhhD2zL487vv6\/phIYDGBLRmhWpbpJ\r\n-----END CERTIFICATE-----\r\n<\/ca><\/pre>\n
[root@centos7 openvpn]# vi pass.txt\r\n\r\njhonespetter\r\n123456\r\n<\/pre>\n
Log cliente Windows:<\/p>\n
Sun Jan 31 22:04:46 2016 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015\r\nSun Jan 31 22:04:46 2016 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08\r\nEnter Management Password:\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341\r\nSun Jan 31 22:04:46 2016 Need hold release from management interface, waiting...\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: CMD 'state on'\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: CMD 'log all on'\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: CMD 'hold off'\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: CMD 'hold release'\r\nSun Jan 31 22:04:46 2016 WARNING: No server certificate verification method has been enabled.  See http:\/\/openvpn.net\/howto.html#mitm for more info.\r\nSun Jan 31 22:04:46 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]\r\nSun Jan 31 22:04:46 2016 UDPv4 link local (bound): [undef]\r\nSun Jan 31 22:04:46 2016 UDPv4 link remote: [AF_INET]192.168.1.123:1194\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: >STATE:1454285086,WAIT,,,\r\nSun Jan 31 22:04:46 2016 MANAGEMENT: >STATE:1454285086,AUTH,,,\r\nSun Jan 31 22:04:46 2016 TLS: Initial packet from [AF_INET]192.168.1.123:1194, sid=75cc05c4 bf99cbcf\r\nSun Jan 31 22:04:46 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this\r\nSun Jan 31 22:04:46 2016 VERIFY OK: depth=1, C=BR, ST=SP, L=RIBEIRAOPRETO, O=JPCORP, OU=JPCORP, CN=JPCORP CA, name=CA-JPCORP, emailAddress=JHONES@JPCORP.ETI.BR\r\nSun Jan 31 22:04:46 2016 VERIFY OK: depth=0, C=BR, ST=SP, L=RIBEIRAOPRETO, O=JPCORP, OU=JPCORP, CN=server, name=CA-JPCORP, emailAddress=JHONES@JPCORP.ETI.BR\r\nSun Jan 31 22:04:46 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key\r\nSun Jan 31 22:04:46 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication\r\nSun Jan 31 22:04:46 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key\r\nSun Jan 31 22:04:46 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication\r\nSun Jan 31 22:04:46 2016 Control Channel: TLSv1.2, cipher TLSv1\/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA\r\nSun Jan 31 22:04:46 2016 [server] Peer Connection Initiated with [AF_INET]192.168.1.123:1194\r\nSun Jan 31 22:04:48 2016 MANAGEMENT: >STATE:1454285088,GET_CONFIG,,,\r\nSun Jan 31 22:04:49 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)\r\nSun Jan 31 22:04:49 2016 PUSH: Received control message: 'PUSH_REPLY,route 10.10.10.1,topology net30,ping 10,ping-restart 120,ifconfig 10.10.10.6 10.10.10.5'\r\nSun Jan 31 22:04:49 2016 OPTIONS IMPORT: timers and\/or timeouts modified\r\nSun Jan 31 22:04:49 2016 OPTIONS IMPORT: --ifconfig\/up options modified\r\nSun Jan 31 22:04:49 2016 OPTIONS IMPORT: route options modified\r\nSun Jan 31 22:04:49 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0\r\nSun Jan 31 22:04:49 2016 MANAGEMENT: >STATE:1454285089,ASSIGN_IP,,10.10.10.6,\r\nSun Jan 31 22:04:49 2016 open_tun, tt->ipv6=0\r\nSun Jan 31 22:04:49 2016 TAP-WIN32 device [Ethernet 3] opened: \\\\.\\Global\\{EDBEF909-0B38-4329-9E9B-37699CBF7E59}.tap\r\nSun Jan 31 22:04:49 2016 TAP-Windows Driver Version 9.21 \r\nSun Jan 31 22:04:49 2016 Notified TAP-Windows driver to set a DHCP IP\/netmask of 10.10.10.6\/255.255.255.252 on interface {EDBEF909-0B38-4329-9E9B-37699CBF7E59} [DHCP-serv: 10.10.10.5, lease-time: 31536000]\r\nSun Jan 31 22:04:49 2016 Successful ARP Flush on interface [6] {EDBEF909-0B38-4329-9E9B-37699CBF7E59}\r\nSun Jan 31 22:04:54 2016 TEST ROUTES: 1\/1 succeeded len=1 ret=1 a=0 u\/d=up\r\nSun Jan 31 22:04:54 2016 MANAGEMENT: >STATE:1454285094,ADD_ROUTES,,,\r\nSun Jan 31 22:04:54 2016 C:\\WINDOWS\\system32\\route.exe ADD 10.10.10.1 MASK 255.255.255.255 10.10.10.5\r\nSun Jan 31 22:04:54 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4\r\nSun Jan 31 22:04:54 2016 Route addition via IPAPI succeeded [adaptive]\r\nSun Jan 31 22:04:54 2016 Initialization Sequence Completed\r\nSun Jan 31 22:04:54 2016 MANAGEMENT: >STATE:1454285094,CONNECTED,SUCCESS,10.10.10.6,192.168.1.123\r\n<\/pre>\n
5 - Troubleshooting<\/h3>\n