Linux: 企业级 VPN 服务 OpenVPN

[11:58:01 root@openvpn-server ~]#yum list openvpn
openvpn.x86_64                                    2.4.10-1.el8                                     epel
[12:03:21 root@openvpn-server ~]#yum list easy-rsa
easy-rsa.noarch                                    3.0.8-1.el8                                     epel

[root@ubuntu1804 ~]#apt list openvpn
openvpn/bionic-proposed 2.4.4-2ubuntu1.4 amd64
N: There are 2 additional versions. Please use the '-a' switch to see the
[root@ubuntu1804 ~]#apt-cache madison openvpn
[root@ubuntu1804 ~]#apt-cache madison easy-rsa

#OpenVPN服务器端
[12:03:52 root@openvpn-server ~]#yum install -y openvpn
#证书管理工具,签发服务端和客户端证书
[12:05:19 root@openvpn-server ~]#yum install -y easy-rsa

[12:06:00 root@openvpn-server ~]#rpm -ql openvpn
/etc/openvpn/client  # 客户端配置文件
/etc/openvpn/server  # server配置文件
/usr/lib/systemd/system/[email protected]
/usr/lib/systemd/system/[email protected]     # server启动脚本 
/usr/sbin/openvpn
/usr/share/doc/openvpn/sample/sample-config-files/client.conf  # 模板，客户端配置
/usr/share/doc/openvpn/sample/sample-config-files/server.conf  # 模板，服务端配置
/var/lib/openvpn

[12:06:08 root@openvpn-server ~]#rpm -ql easy-rsa
/usr/share/doc/easy-rsa/vars.example         # 变量配置文件，用于配置证书有效性
/usr/share/easy-rsa/3
/usr/share/easy-rsa/3.0.8/easyrsa            # 签发证书的程序

#生成服务器配置文件
cp /usr/share/doc/openvpn/sample/sample-config-files/server.conf /etc/openvpn/
#准备证书签发相关文件
cp -r /usr/share/easy-rsa/ /etc/openvpn/easy-rsa-server
#准备签发证书相关变量的配置文件
cp /usr/share/doc/easy-rsa/vars.example /etc/openvpn/easy-rsa-server/3/vars    # 文件名vars

#建议修改给CA和OpenVPN服务器颁发的证书的有效期,可适当加长
[root@openvpn-server ~]#vim /etc/openvpn/easy-rsa-server/3/vars
#CA的证书有效期默为为10年,可以适当延长,比如:100年
#set_var EASYRSA_CA_EXPIRE  3650
set_var EASYRSA_CA_EXPIRE   36500
#服务器证书默为为825天,可适当加长,比如:3650天
#set_var EASYRSA_CERT_EXPIRE    825
set_var EASYRSA_CERT_EXPIRE 3650

[root@openvpn-server ~]#tree /etc/openvpn/
/etc/openvpn/
├── client
├── easy-rsa-server
│   ├── 3 -> 3.0.8
│   ├── 3.0 -> 3.0.8
│   └── 3.0.8
│       ├── easyrsa
│       ├── openssl-easyrsa.cnf
│       ├── vars
│       └── x509-types
│           ├── ca
│           ├── client
│           ├── code-signing
│           ├── COMMON
│           ├── email
│           ├── kdc
│           ├── server
│           └── serverClient
├── server
└── server.conf

cd /etc/openvpn/easy-rsa-server/3

[root@openvpn-server 3]#./easyrsa build-ca nopass  # 创建CA证书，不带密码，一路回车 。加 --batch 不需要回车

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating RSA private key, 2048 bit long modulus (2 primes)
...................................................................................................................................................................................................+++++
....................................................................+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----------------------------------------------

Common Name (eg: your user, host, or server name) [Easy-RSA CA]:  #接受默认值，直接回车

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa-server/3/pki/ca.crt    #生成自签名的证书文件

[root@openvpn-server 3]#tree pki/
pki/
├── ca.crt              #生成自签名的证书文件
├── certs_by_serial
├── index.txt
├── index.txt.attr
├── issued
├── openssl-easyrsa.cnf
├── private
│   └── ca.key         #生成私钥文件
├── renewed
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── reqs
├── revoked
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── safessl-easyrsa.cnf
└── serial

#查看一下生成CA相关的文件
[root@openvpn-server 3]#cat pki/serial
01
[root@openvpn-server 3]#ll pki/index.txt
-rw------- 1 root root 0 Jan 26 12:17 pki/index.txt
[root@openvpn-server 3]#ll pki/ca.crt pki/private/ca.key
-rw------- 1 root root 1204 Jan 26 12:17 pki/ca.crt
-rw------- 1 root root 1679 Jan 26 12:17 pki/private/ca.key
[root@openvpn-server 3]#cat pki/ca.crt
[root@openvpn-server 3]#openssl x509 -in pki/ca.crt -noout -text

#创建服务器证书申请文件，其中server是文件前缀
cd /etc/openvpn/easy-rsa-server/3
[root@openvpn-server 3]#./easyrsa gen-req server nopass  # 生成服务端证书，不使用密码

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating a RSA private key
writing new private key to '/etc/openvpn/easy-rsa-server/3/pki/easy-rsa-11496.syBWUN/tmp.KB9HvC'
------------------------------------------------------------------------------------------------

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----------------------------------------------

Common Name (eg: your user, host, or server name) [server]:   接受Common Name，可以使用默认

Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa-server/3/pki/reqs/server.req     #生成的申请文件
key: /etc/openvpn/easy-rsa-server/3/pki/private/server.key  #生成的私钥文件

[12:29:17 root@openvpn-server 3]#tree pki/
pki/
├── ca.crt
├── certs_by_serial
├── index.txt
├── index.txt.attr
├── issued
├── openssl-easyrsa.cnf
├── private
│   ├── ca.key
│   └── server.key   #私钥文件
├── renewed
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── reqs
│   └── server.req  #申请文件
├── revoked
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── safessl-easyrsa.cnf
└── serial

cd /etc/openvpn/easy-rsa-server/3
[root@openvpn-server 3]#./easyrsa help sign

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars

sign-req  
Sign a certificate request of the defined type.  must be a known
type such as 'client', 'server', 'serverClient', or 'ca' (or a user-added type.)

This request file must exist in the reqs/ dir and have a .req file
extension. See import-req below for importing reqs from other sources.

#将上面server.req的申请,颁发server类型的证书
cd /etc/openvpn/easy-rsa-server/3
[root@openvpn-server 3]#./easyrsa sign server server #签发服务端证书

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a server certificate for 3650 days: #可以看到vars文件指定的有效期

subject=
commonName                = server

Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes  #输入yes回车
Using configuration from /etc/openvpn/easy-rsa-server/3/pki/easy-rsa-11533.UjZ9m9/tmp.xGm4NL
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server'
Certificate is to be certified until Jan 24 04:31:32 2031 GMT (3650 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /etc/openvpn/easy-rsa-server/3/pki/issued/server.crt
#生成服务器证书文件

[root@openvpn-server 3]#cd /etc/openvpn/easy-rsa-server/3
[root@openvpn-server 3]#tree pki/
pki/
├── ca.crt
├── certs_by_serial
│   └── 5D3B930AA9D6B0AF69E65FA76C6251C4.pem   #服务器证书文件
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── issued
│   └── server.crt          #服务器证书文件
├── openssl-easyrsa.cnf
├── private
│   ├── ca.key
│   └── server.key
├── renewed
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── reqs
│   └── server.req
├── revoked
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── safessl-easyrsa.cnf
├── serial
└── serial.old

[root@openvpn-server 3]#diff pki/certs_by_serial/5D3B930AA9D6B0AF69E65FA76C6251C4.pem pki/issued/server.crt
[root@openvpn-server 3]#ll !*
ll pki/certs_by_serial/5D3B930AA9D6B0AF69E65FA76C6251C4.pem pki/issued/server.crt
-rw------- 1 root root 4608 Jan 26 12:31 pki/certs_by_serial/5D3B930AA9D6B0AF69E65FA76C6251C4.pem
-rw------- 1 root root 4608 Jan 26 12:31 pki/issued/server.crt

#证书相关文件
[root@openvpn-server 3]#cat pki/serial
5D3B930AA9D6B0AF69E65FA76C6251C5
[12:35:09 root@openvpn-server 3]#cat pki/index.txt
V   310124043132Z       5D3B930AA9D6B0AF69E65FA76C6251C4    unknown /CN=server
[root@openvpn-server 3]#cat pki/serial.old
5d3b930aa9d6b0af69e65fa76c6251c4

cd /etc/openvpn/easy-rsa-server/3

#创建Diffie-Hellman密钥
#方法1
[root@openvpn-server 3]#./easyrsa gen-dh

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
...................+  #需要等一会
DH parameters of size 2048 created at /etc/openvpn/easy-rsa-server/3/pki/dh.pem
#查看生成的文件
[root@openvpn-server 3]#ll pki/dh.pem
-rw------- 1 root root 424 Jan 26 12:37 pki/dh.pem
[root@openvpn-server 3]#cat pki/dh.pem
-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEAypLcHbOieMk67cANDM+IBDD0w6SP3vJ9vY4Bz58SX017qLI9qLSD
CCRWIF7Y57zVHkqrXHsVJpSXZPBGTWPKg6LsMYrSrQctxajikAzkA2xqlezJquFz
oGkhR9P1xkA7Kbj0+w0/0lOxkPuVq6WbqSa2JBNaYmOzXRz1I4BZnR0CCKoI/WMB
WZ2cTeQcVI1AYqN9prOwWZwXZks420RUmnDXAL7BtvfElyKtgiZXPzQpiF4Psjhb
gNAwBnHJiV1vj1dTLg6CtU9e+yuk7nuz+74OhF3y2jfF3odg+7ZGWNlkoMP1wq6Z
eONjJO9n3cxLInPXDhJ4NfbwTh6LOKQ6YwIBAg==
-----END DH PARAMETERS-----
#方法2
[root@openvpn-server 3]#openssl dhparam -out /root/dh2048.pem 2048

cp -r /usr/share/easy-rsa/ /etc/openvpn/easy-rsa-client

#可选
cp /usr/share/doc/easy-rsa/vars.example /etc/openvpn/easy-rsa-client/3/vars

cd /etc/openvpn/easy-rsa-client/3

#初始化数据,在当前目录下生成pki目录及相关文件,同时会读取当前目录的vars文件
./easyrsa init-pki
#生成证书申请所需目录pki和文件
[root@openvpn-server 3]#tree
.
├── easyrsa
├── openssl-easyrsa.cnf
├── pki
│   ├── openssl-easyrsa.cnf
│   ├── private
│   ├── reqs
│   └── safessl-easyrsa.cnf
├── vars
└── x509-types
├── ca
├── client
├── code-signing
├── COMMON
├── email
├── kdc
├── server
└── serverClient

4 directories, 13 files

[root@openvpn-server 3]#cd /etc/openvpn/easy-rsa-client/3
[root@openvpn-server 3]#pwd
/etc/openvpn/easy-rsa-client/3

#生成客户端用户的证书申请
[root@openvpn-server 3]#./easyrsa gen-req client-x nopass

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-client/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating a RSA private key
....+++++
......+++++
writing new private key to '/etc/openvpn/easy-rsa-client/3/pki/easy-rsa-11853.FRpJUj/tmp.Jr13E6'
------------------------------------------------------------------------------------------------

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----------------------------------------------

Common Name (eg: your user, host, or server name) [client-x]:  #接受默认回车

Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa-client/3/pki/reqs/client-x.req       #申请证书文件
key: /etc/openvpn/easy-rsa-client/3/pki/private/client-x.key    #私钥文件

#生成两个新文件
[root@openvpn-server 3]#tree
.
├── easyrsa
├── openssl-easyrsa.cnf
├── pki
│   ├── openssl-easyrsa.cnf
│   ├── private
│   │   └── client-x.key
│   ├── reqs
│   │   └── client-x.req
│   └── safessl-easyrsa.cnf
├── vars
└── x509-types
├── ca
├── client
├── code-signing
├── COMMON
├── email
├── kdc
├── server
└── serverClient

[root@openvpn-server 3]#cd /etc/openvpn/easy-rsa-server/3
[root@openvpn-server 3]#pwd
/etc/openvpn/easy-rsa-server/3

#导入客户端证书请求文件到CA的工作目录，让CA能识别到这个请求文件
[root@openvpn-server 3]#./easyrsa import-req /etc/openvpn/easy-rsa-client/3/pki/reqs/client-x.req client-x

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020

The request has been successfully imported with a short name of: client-x
You may now use this name to perform signing operations on this request.

[root@openvpn-server 3]#tree pki/
pki/
├── ca.crt
├── certs_by_serial
│   └── 5D3B930AA9D6B0AF69E65FA76C6251C4.pem
├── dh.pem
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── issued
│   └── server.crt
├── openssl-easyrsa.cnf
├── private
│   ├── ca.key
│   └── server.key
├── renewed
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── reqs
│   ├── server.req
│   └── client-x.req    #导入的文件
├── revoked
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── safessl-easyrsa.cnf
├── serial
└── serial.old

[root@openvpn-server 3]#ll pki/reqs/client-x.req /etc/openvpn/easy-rsa-client/3/pki/reqs/client-x.req
-rw------- 1 root root 891 Jan 26 13:53 /etc/openvpn/easy-rsa-client/3/pki/reqs/client-x.req
-rw------- 1 root root 891 Jan 26 13:55 pki/reqs/client-x.req

#修改给客户端颁发的证书的有效期
[root@openvpn-server 3]#vim vars
#建议修改给客户端颁发证书的有效期,可适当减少,比如:90天
set_var EASYRSA_CERT_EXPIRE 180    #修改之前的3650为180

#签发客户端证书
[root@openvpn-server 3]#./easyrsa sign client client-x

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-server/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020

You are about to sign the following certificate.
Please check over the details shown below for accuracy. Note that this request
has not been cryptographically verified. Please be sure it came from a trusted
source or that you have verified the request checksum with the sender.

Request subject, to be signed as a client certificate for 180 days:

subject=
commonName                = client-x

Type the word 'yes' to continue, or any other input to abort.
Confirm request details: yes    #输入yes后回车
Using configuration from /etc/openvpn/easy-rsa-server/3/pki/easy-rsa-11993.LhxZXn/tmp.Fl00WC
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'client-x'
Certificate is to be certified until Jul 25 05:59:46 2021 GMT (180 days)

Write out database with 1 new entries
Data Base Updated

Certificate created at: /etc/openvpn/easy-rsa-server/3/pki/issued/client-x.crt
#证书文件

[root@openvpn-server 3]#tree pki/
pki/
├── ca.crt
├── certs_by_serial
│   ├── 5D3B930AA9D6B0AF69E65FA76C6251C4.pem
│   └── 8EB7E418B1FE1715BCBB73A513498893.pem
├── dh.pem
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── issued
│   ├── server.crt
│   └── client-x.crt     #生成客户端证书
├── openssl-easyrsa.cnf
├── private
│   ├── ca.key
│   └── server.key
├── renewed
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── reqs
│   ├── server.req
│   └── client-x.req
├── revoked
│   ├── certs_by_serial
│   ├── private_by_serial
│   └── reqs_by_serial
├── safessl-easyrsa.cnf
├── serial
└── serial.old

[root@openvpn-server 3]#cat pki/index.txt
V   310124043132Z       5D3B930AA9D6B0AF69E65FA76C6251C4    unknown /CN=server
V   210725055946Z       8EB7E418B1FE1715BCBB73A513498893    unknown /CN=client-x
[root@openvpn-server 3]#ll pki/issued/
total 16
-rw------- 1 root root 4608 Jan 26 12:31 server.crt
-rw------- 1 root root 4499 Jan 26 13:59 client-x.crt
[root@openvpn-server 3]#ll pki/certs_by_serial/
total 16
-rw------- 1 root root 4608 Jan 26 12:31 5D3B930AA9D6B0AF69E65FA76C6251C4.pem
-rw------- 1 root root 4499 Jan 26 13:59 8EB7E418B1FE1715BCBB73A513498893.pem

[root@centos8 ~]#cat openvpn-user-crt.sh
#!/bin/bash

read -p "请输入用户的姓名拼音(如:${NAME}): " NAME
cd /etc/openvpn/easy-rsa-client/3
./easyrsa gen-req ${NAME} nopass <<EOF
EOF
cd /etc/openvpn/easy-rsa-server/3
./easyrsa import-req /etc/openvpn/easy-rsa-client/3/pki/reqs/${NAME}.req ${NAME}
./easyrsa sign client ${NAME} <<EOF
yes
EOF

# 文件归类，放到统一目录方便使用
mkdir /etc/openvpn/certs
cp /etc/openvpn/easy-rsa-server/3/pki/ca.crt /etc/openvpn/certs/
cp /etc/openvpn/easy-rsa-server/3/pki/issued/server.crt /etc/openvpn/certs/
cp /etc/openvpn/easy-rsa-server/3/pki/private/server.key /etc/openvpn/certs/
cp /etc/openvpn/easy-rsa-server/3/pki/dh.pem /etc/openvpn/certs/

[root@openvpn-server ~]#ll /etc/openvpn/certs/
-rw------- 1 root root 1204 Jan 26 14:03 ca.crt
-rw------- 1 root root  424 Jan 26 14:04 dh.pem
-rw------- 1 root root 4608 Jan 26 14:04 server.crt
-rw------- 1 root root 1704 Jan 26 14:04 server.key

[root@openvpn-server ~]#mkdir /etc/openvpn/client/client-x
[root@openvpn-server ~]#find /etc/openvpn/ -name "client-x.key" -o -name "client-x.crt" -o -name "ca.crt"
/etc/openvpn/easy-rsa-server/3.0.8/pki/issued/client-x.crt
/etc/openvpn/easy-rsa-server/3.0.8/pki/ca.crt
/etc/openvpn/easy-rsa-client/3.0.8/pki/private/client-x.key
/etc/openvpn/certs/ca.crt

[root@openvpn-server ~]#find /etc/openvpn/ \( -name "client-x.key" -o -name "client-x.crt" -o -name "ca.crt" \) -exec cp {} /etc/openvpn/client/client-x \;
[14:09:08 root@openvpn-server ~]#ll /etc/openvpn/client/client-x/
total 16
-rw------- 1 root root 1204 Jan 26 14:09 ca.crt
-rw------- 1 root root 4499 Jan 26 14:09 client-x.crt
-rw------- 1 root root 1704 Jan 26 14:09 client-x.key

#server.conf文件中以#或;开头的行都为注释

[root@centos8 ~]#grep -Ev "^#|^$" /etc/openvpn/server.conf
;local a.b.c.d                            #本机监听IP,默认注释监听本机所有IP，也可local 0.0.0.0
port 1194                                 #端口
;proto tcp                                #协议,生产推荐使用TCP
proto udp                                 #默认协议，速度快，数据包不做校验
;dev tap                                  #创建一个以太网隧道，以太网使用tap,一个tap设备允许完整的以太网帧通过Openvpn隧道，
                                              可提供非ip协议的支持，比如IPX协议和AppleTalk协议,tap等同于一个以太网设备，它操作第二层数据包如以太网数据帧。
dev tun                                   #创建一个路由IP隧道，生产推存使用tun.互联网使用tun,一个tun设备大多时候，
                                              被用于基于IP协议的通讯。tun模拟了网络层设备，操作第三层数据包比如IP数据封包。
;dev-node MyTap                           #TAP-Win32适配器。非windows不需要配置
ca ca.crt                                 #ca证书文件
cert server.crt                           #服务器证书文件
key server.key                            #服务器私钥文件
dh dh2048.pem                             #dh参数文件，如果dh none代表不需要dh文件
;topology subnet                          #通知子网拓扑，不需要配置
server 10.8.0.0 255.255.255.0             #客户端连接后分配IP的地址池，服务器默认会占用第一个IP10.8.0.1将做为客户端的网关
ifconfig-pool-persist ipp.txt             #为客户端分配固定IP，不需要配置,建议注释。如有就在文件中写固定ip
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100  #配置网桥模式，不需要配置,建议注释
;server-bridge
;push "route 192.168.10.0 255.255.255.0"  #给客户端生成的到达服务器后面网段的静态路由，下一跳为openvpn服务器的10.8.0.1。windows输入route PRINT
;push "route 192.168.20.0 255.255.255.0"  #推送路由信息到客户端，以允许客户端能够连接到服务器背后的其它私有子网。要提前考虑多机房地址不冲突
;client-config-dir ccd                    #为指定的客户端添加路由，此路由通常是客户端后面的内网网段而不是服务端的，也不需要设置，无法保证客户端网络不冲突
;route 192.168.40.128 255.255.255.248     #同上，不需要设置
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script                   #运行外部脚本，创建不同组的iptables规则，无需配置
;push "redirect-gateway def1 bypass-dhcp" #启用后，客户端所有流量都将通过VPN服务器，因此生产一般无需配置此项
;push "dhcp-option DNS 208.67.222.222"    #推送DNS服务器，不需要配置
;push "dhcp-option DNS 208.67.220.220"
;client-to-client                         #允许不同的client直接通信,不安全,生产环境一般无需要配置
;duplicate-cn                             #多个用户共用一个证书，一般用于测试环境，生产环境都是一个用户一个证书,无需开启
keepalive 10 120                          #设置服务端检测的间隔和超时时间，默认为每10秒ping一次，如果 120秒没有回应则认为对方已经down
tls-auth ta.key 0                         #访止DoS等攻击的安全增强配置,可以使用以下命令来生成：openvpn --genkey --secret ta.key 
                                              服务器和每个客户端都需要拥有该密钥的一个拷贝。第二个参数在服务器端应该为’0’，在客户端应该为’1’
cipher AES-256-CBC                        #加密算法
;compress lz4-v2                          #启用Openvpn2.4.X新版压缩算法
;push "compress lz4-v2"                   #推送客户端使用新版压缩算法,和下面的comp-lzo不要同时使用
;comp-lzo                                 #旧户端兼容的压缩配置，需要客户端配置开启压缩,openvpn2.4.X等新版可以不用开启
;max-clients 100                          #最大客户端数
;user nobody                              #运行openvpn服务的用户和组
;group nobody
persist-key                               #重启VPN服务时默认会重新读取key文件，开启此配置后保留使用第一次的key文件,生产环境无需开启
persist-tun                               #启用此配置后,当重启vpn服务时，一直保持tun或者tap设备是up的，否则会先down然后再up,生产环境无需开启
status openvpn-status.log                 #openVPN状态记录文件，每分钟会记录一次
;log         openvpn.log                  #第一种日志记录方式,并指定日志路径，log会在openvpn启动的时候清空日志文件,不建议使用
;log-append openvpn.log                   #第二种日志记录方式,并指定日志路径，重启openvpn后在之前的日志后面追加新的日志,生产环境建议使用
verb 3                                    #设置日志级别，0-9，级别越高记录的内容越详细,0 表示静默运行，只记录致命错误,4 表示合理的常规用法,
                                              5 和 6 可以帮助调试连接错误。9 表示极度冗余，输出非常详细的日志信息
;mute 20                                  #相同类别的信息只有前20条会输出到日志文件中
explicit-exit-notify 1                    #通知客户端，在服务端重启后自动重新连接，仅能用于udp模式，tcp模式不需要配置即可实现断开重新连接,
                                              且开启此项后tcp配置后将导致openvpn服务无法启动,所以tcp时必须不能开启此项
;crl-verify /etc/openvpn/easy-rsa-server/3/pki/crl.pem # 第一次吊销证时需要编辑配置文件调用吊销证书的文件

[root@openvpn-server ~]#vim /etc/openvpn/server.conf
port 1194                                   #开启端口
proto tcp                                   #使用的协议还可以使用udp
dev tun                                     #创建一个路由IP隧道
ca /etc/openvpn/certs/ca.crt                #ca证书文件位置
cert /etc/openvpn/certs/server.crt          #服务证书文件位置
key /etc/openvpn/certs/server.key           #服务私钥文件位置
dh /etc/openvpn/certs/dh.pem                #dh参数文件，也就是密钥交换算法文件
server 10.0.0.0 255.255.255.0               #客户端连接后分配IP的地址池

push "route 172.30.0.0 255.255.255.0"       #给客户端生成的到达服务器后面网段的静态路由

keepalive 10 120                            #设置服务端检测的间隔和超时时间
cipher AES-256-CBC                          #加密算法
compress lz4-v2                             #启用Openvpn2.4.X新版压缩算法
push "compress lz4-v2"                      #推送客户端使用新版压缩算法
max-clients 2048                            #最大客户端数
user openvpn                                #运行openvpn服务的用户和组
group openvpn
status /var/log/openvpn/openvpn-status.log  #openVPN状态记录文件，每分钟会记录一次
log-append /var/log/openvpn/openvpn.log     #第二种日志记录方式
verb 3                                      #设置日志级别
mute 20                                     #相同类别的信息只有前20条会输出到日志文件中

#准备目志相关目录
getent passwd openvpn
mkdir /var/log/openvpn
chown openvpn: /var/log/openvpn

[root@openvpn-server ~]#ll -d /var/log/openvpn/
drwxr-xr-x 2 openvpn openvpn 6 Jan 26 14:23 /var/log/openvpn/

[root@centos7 ~]#rpm -ql openvpn | grep systemd
/usr/lib/systemd/system/[email protected]
/usr/lib/systemd/system/[email protected]
/usr/lib/systemd/system/[email protected]
/usr/share/doc/openvpn-2.4.10/README.systemd

#centos8缺失unit文件，从Centos7复制文件
[root@openvpn-server ~]#rpm -ql openvpn | grep systemd
/usr/lib/systemd/system/[email protected]
/usr/lib/systemd/system/[email protected]
/usr/share/doc/openvpn/README.systemd

[root@centos7 ~]#cat /usr/lib/systemd/system/[email protected]
[Unit]
Description=OpenVPN Robust And Highly Flexible Tunneling Application On %I
After=network.target

[Service]
Type=notify
PrivateTmp=true
ExecStart=/usr/sbin/openvpn --cd /etc/openvpn/ --config %i.conf

[Install]
WantedBy=multi-user.target
[root@centos7 ~]#scp /lib/systemd/system/[email protected] 39.98.146.209:/lib/systemd/system/

#启动OpenVPN服务,注意service名称和文件名不一致
[root@openvpn-server ~]#systemctl daemon-reload
[root@openvpn-server ~]#systemctl enable --now openvpn@server
Created symlink /etc/systemd/system/multi-user.target.wants/[email protected] → /usr/lib/systemd/system/[email protected].

[root@openvpn-server ~]#systemctl status openvpn@server
● [email protected] - OpenVPN Robust And Highly Flexible Tunneling Application On server
Loaded: loaded (/usr/lib/systemd/system/[email protected]; enabled; vendor preset: disabled)
Active: active (running) since Tue 2021-01-26 14:54:42 CST; 29s ago
Main PID: 13647 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 22788)
Memory: 1.3M
CGroup: /system.slice/system-openvpn.slice/[email protected]
└─13647 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf

Jan 26 14:54:42 openvpn-server systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Applicati>
Jan 26 14:54:42 openvpn-server systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Applicatio>

#注意端口号
[root@openvpn-server ~]#ss -ntlp
State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port
LISTEN  0       32             0.0.0.0:1194        0.0.0.0:*     users:(("openvpn",pid=13647,fd=7))
LISTEN  0       128            0.0.0.0:5355        0.0.0.0:*     users:(("systemd-resolve",pid=963,fd=13))
LISTEN  0       128            0.0.0.0:111         0.0.0.0:*     users:(("systemd",pid=1,fd=59))
LISTEN  0       128            0.0.0.0:22          0.0.0.0:*     users:(("sshd",pid=1009,fd=5))
LISTEN  0       128               [::]:5355           [::]:*     users:(("systemd-resolve",pid=963,fd=15))
LISTEN  0       128               [::]:111            [::]:*     users:(("systemd",pid=1,fd=66))

[root@openvpn-server ~]#cat /var/log/openvpn/openvpn.log

[root@openvpn-server ~]#ip a
4: tun0:  mtu 1500 qdisc fq_codel state UNKNOWN group default qlen 100
inet 10.8.0.1 peer 10.8.0.2/32 scope global tun0


[root@openvpn-server ~]#route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         172.30.0.253    0.0.0.0         UG    100    0        0 eth0
10.8.0.0        10.8.0.2        255.255.255.0   UG    0      0        0 tun0
10.8.0.2        0.0.0.0         255.255.255.255 UH    0      0        0 tun0
172.30.0.0      0.0.0.0         255.255.255.0   U     100    0        0 eth0

[root@openvpn-server ~]#grep -Ev "^(#|;)|^$" /usr/share/doc/openvpn/sample/sample-config-files/client.conf
client                  #声明自己是个客户端
dev tun                 #接口类型，必须和服务端保持一致
proto udp               #协议类型，必须和服务端保持一致
remote my-server-1 1194 #server端的ip和端口，可以写域名但是需要可以解析成IP
resolv-retry infinite   #如果是写的server端的域名，那么就始终解析，如果域名发生变化，会重新连接到新的域名对应的IP
nobind                  #本机不绑定监听端口，客户端是随机打开端口连接到服务端的1194
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server   #指定采用服务器证书校验方式
tls-auth ta.key 1
cipher AES-256-CBC
verb 3

#生成客户端文件,文件后缀必须为.ovpn
[root@openvpn-server ~]#grep -Ev "^(#|;)|^$" /usr/share/doc/openvpn/sample/sample-config-files/client.conf >/etc/openvpn/client/client-x/client.ovpn

#修改配置文件,内容如下
[root@openvpn-server ~]#vim /etc/openvpn/client/client-x/client.ovpn
[root@openvpn-server ~]#cat /etc/openvpn/client/client-x/client.ovpn
client
dev tun
proto tcp
remote 39.98.146.209 1194    #生产中为OpenVPN公网IP
resolv-retry infinite
nobind
#persist-key
#persist-tun
ca ca.crt
cert client-x.crt
key client-x.key
remote-cert-tls server
#tls-auth ta.key 1
cipher AES-256-CBC
verb 3                 #此值不能随意指定，否则无法通信
compress lz4-v2        #此项在OpenVPN2.4.X版本使用，需要和服务器端保持一致，不指定默认comp-lz压缩

#在服务器打包证书并下载发送给windows客户端
[root@openvpn-server ~]#cd /etc/openvpn/client/client-x/
[root@openvpn-server client-x]#pwd
/etc/openvpn/client/client-x
[root@openvpn-server client-x]#tar cf client-x.tar ./
tar: ./client-x.tar: file is the archive; not dumped
[root@openvpn-server client-x]#ll
total 40
-rw------- 1 root root  1204 Jan 26 14:09 ca.crt
-rw-r--r-- 1 root root   237 Jan 26 15:04 client.ovpn
-rw------- 1 root root  4499 Jan 26 14:09 client-x.crt
-rw------- 1 root root  1704 Jan 26 14:09 client-x.key
-rw-r--r-- 1 root root 20480 Jan 26 15:09 client-x.tar

[root@openvpn-server client-x]#tar -tf client-x.tar
./
./client-x.crt
./ca.crt
./client-x.key
./client.ovpn

cd /etc/openvpn/easy-rsa-client/3
#./easyrsa gen-req cy  nopass # 不带密码的证书
./easyrsa gen-req cy         # 带密码的证书 123456
[root@openvpn-server 3]#./easyrsa gen-req cy  

Note: using Easy-RSA configuration from: /etc/openvpn/easy-rsa-client/3.0.8/vars
Using SSL: openssl OpenSSL 1.1.1g FIPS  21 Apr 2020
Generating a RSA private key
..............+++++
....................+++++
writing new private key to '/etc/openvpn/easy-rsa-client/3/pki/easy-rsa-14457.v8A2IC/tmp.k97esu'
Enter PEM pass phrase:              #输入2遍密码
Verifying - Enter PEM pass phrase:
----------------------------------

You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----------------------------------------------

Common Name (eg: your user, host, or server name) [cy]:   #默认确认

Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa-client/3/pki/reqs/cy.req
key: /etc/openvpn/easy-rsa-client/3/pki/private/cy.key

#cd /etc/openvpn/easy-rsa-server/3
./easyrsa import-req /etc/openvpn/easy-rsa-client/3/pki/reqs/cy.req cy
ll /etc/openvpn/easy-rsa-server/3/pki/reqs/cy.req

#确保证书有效期是合理值
[root@centos8 3]#grep EASYRSA_CERT_EXPIRE vars
set_var EASYRSA_CERT_EXPIRE 90

#颁发证书
[root@openvpn-server 3]#./easyrsa sign client cy
Confirm request details: yes
Certificate created at: /etc/openvpn/easy-rsa-server/3/pki/issued/cy.crt

mkdir /etc/openvpn/client/cy
cp /etc/openvpn/easy-rsa-server/3/pki/issued/cy.crt /etc/openvpn/client/cy
cp /etc/openvpn/easy-rsa-server/3/pki/private/cy.key /etc/openvpn/client/cy
cp /etc/openvpn/certs/{ca.crt,dh.pem,ta.key} /etc/openvpn/client/cy
cp /etc/openvpn/client/client-x/client.ovpn /etc/openvpn/client/cy

[root@openvpn-server 3]#ll /etc/openvpn/client/cy/
total 28
-rw------- 1 root root 1204 Jan 26 15:55 ca.crt
-rw-r--r-- 1 root root  255 Jan 26 15:56 client.ovpn
-rw------- 1 root root 4484 Jan 26 15:53 cy.crt
-rw------- 1 root root 1854 Jan 26 16:00 cy.key
-rw------- 1 root root  424 Jan 26 15:55 dh.pem
-rw------- 1 root root  636 Jan 26 15:55 ta.key

[root@openvpn-server 3]#cd /etc/openvpn/client/cy/

#根据服务器端修改下面配置,需要和服务器同步
[root@openvpn-server cy]#vim client.ovpn
client
dev tun
proto tcp
remote 39.98.146.209 1194
resolv-retry infinite
nobind
#persist-key
#persist-tun
ca ca.crt
cert cy.crt
key cy.key
remote-cert-tls server
#tls-auth ta.key 1
cipher AES-256-CBC
verb 3
compress lz4-v2
tls-auth ta.key 1

# 归档压缩
tar cf cy.tar.gz ./

#过期时间由以下设置决定
[root@centos8 ~]#grep EASYRSA_CERT_EXPIRE /etc/openvpn/easy-rsa-server/3/vars
set_var EASYRSA_CERT_EXPIRE 90

[root@openvpn-server ~]# cat /etc/openvpn/server.conf
port 1194
proto tcp
#pexplicit-exit-notify 1
dev tun
ca /etc/openvpn/certs/ca.crt
cert /etc/openvpn/certs/server.crt
key /etc/openvpn/certs/server.key
dh /etc/openvpn/certs/dh.pem
server 10.0.0.0 255.255.255.0
push "route 172.30.0.0 255.255.255.0"
keepalive 10 120
cipher AES-256-CBC
compress lz4-v2
push "compress lz4-v2"
;comp-lzo
max-clients 2048
user openvpn
group openvpn
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
verb 3
mute 200
tls-auth /etc/openvpn/certs/ta.key 0
crl-verify /etc/openvpn/easy-rsa-server/3/pki/crl.pem # 第一次吊销证时需要编辑配置文件调用吊销证书的文件

[root@openvpn-server ~]# cat /etc/openvpn/client-file/client.ovpn
client
dev tun
proto tcp
remote 39.98.146.209 1194
resolv-retry infinite
nobind
#persist-key
#persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
#tls-auth ta.key 1
cipher AES-256-CBC
verb 3
compress lz4-v2
tls-auth ta.key 1

auth-user-pass-verify auth-pam.pl via-file

#1.首先我们需要编写一个用户认证的脚本 (脚本是由openvpn官网提供的)
cat <<\EOF >> /etc/openvpn/checkpsw.sh 
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman 
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/etc/openvpn/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
  exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then 
  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
  exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then 
  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
  exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1
EOF

chmod 755 /etc/openvpn/checkpsw.sh # 脚本加执行权限


#2.现在我们配置用户密码文件
cat /etc/openvpn/psw-file 
abcdocker 123456
abc 123456
test test
#前面为用户名，后面为密码。 中间使用空格分开

#3.配置openvpn的server.conf
cat >>/etc/openvpn/server.conf<<EOF
script-security 3 system             #允许通过环境变量将密码传递给脚本   
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env    #指定用户认证脚本
client-cert-not-required             #不使用客户端证书，使用密码对
username-as-common-name              #使用认证用户名，不使用证书的common name
EOF
#在service.conf最后一行添加

#4.修改client.ovpn
client
dev tun
proto tcp
remote 192.168.0.11 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
;cert cyh.crt      #注释
;key cyh.key       #注释
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
auth-user-pass              #使用用户名密码登录openvpn服务器
#主要是注释crt和key路径，以及添加一行auth-user-pass

#5.重启openvpn
systemctl restart openvpn@server

#1.创建mysql库表
mysql> create database openvpn;
mysql> use openvpn;
#创建用户表
mysql> create table vpnuser (
   name         char (100) not null,
   password     char (255) default null,
   active       int (10) not null default 1,
   primary key  (name)
   );
mysql> desc vpnuser;
#创建登录表
mysql> create table logtable (
   msg     char (254),
   user    char (100),
   pid     char (100),
   host    char (100),
   rhost   char (100),
   time    char (100)
   );
mysql> desc logtable;
#插入一条用户数据，用户名test1 密码test1
mysql> insert into vpnuser (name,password) values ('test1',password('test1'));
#创建库授权连接账号
mysql> grant all on openvpn.* to vpn@'localhost' identified by 'vpn';
mysql> flush privileges;

#2.安装pam_mysql模块
yum install pam_mysql -y
#配置pam_mysql模块
vim /etc/pam.d/openvpn
auth sufficient pam_mysql.so user=vpn passwd=vpn host=localhost db=openvpn table=vpnuser usercolumn=name passwdcolumn=password [where=vpnuser.active=1] sqllog=0 crypt=2 sqllog=true logtable=logtable logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=time
account required pam_mysql.so user=vpn passwd=vpn host=localhost db=openvpn table=vpnuser usercolumn=name passwdcolumn=password [where=vpnuser.active=1] sqllog=0 crypt=2 sqllog=true logtable=logtable logmsgcolumn=msg logusercolumn=user logpidcolumn=pid loghostcolumn=host logrhostcolumn=rhost logtimecolumn=time
#使用testsaslauthd验证登录情况，如果出现下面的情况，说明我们的配置是正确的
[root@iosvpn ~]# saslauthd -a pam
[root@iosvpn ~]# testsaslauthd -u test1 -p test1 -s openvpn
0: OK "Success."

#3.安装Openvpn服务器auth-pam插件
yum install pam_devel -y
wget http://pkgs.fedoraproject.org/repo/pkgs/openvpn/openvpn-2.0.7.tar.gz/93528233f1f6d02fc18e2c00f82e0aca/openvpn-2.0.7.tar.gz 
tar xf openvpn-2.0.7.tar.gz 
cd openvpn-2.0.7/plugin/auth-pam/
make

cp openvpn-auth-pam.so /etc/openvpn/

#4.配置openvpn的server.conf
cat >>/etc/openvpn/server.conf<<EOF
script-security 3 system             #允许通过环境变量将密码传递给脚本   
plugin /etc/openvpn/openvpn-auth-pam.so openvpn  #指定用户认证脚本
client-cert-not-required             #不使用客户端证书，使用密码对
username-as-common-name              #使用认证用户名，不使用证书的common name
EOF
#在service.conf最后一行添加

#5.客户端配置文件client.ovpn
client
dev tun
proto tcp
remote 192.168.0.11 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
;cert cyh.crt      #注释
;key cyh.key       #注释
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
auth-user-pass              #使用用户名密码登录openvpn服务器
#主要是注释crt和key路径，以及添加一行auth-user-pass

#6.重启openvpn
systemctl restart openvpn@server

#7.登录验证
查看vpn用户登录表
select from * logtable;

#8.禁用某个用户登录
只要把用户表里面的对应用户的active改为0，用户就无法登录

#1.安装openvpn-auth-ldap
yum install openvpn-auth-ldap -y

#2.修改ldap.conf认证配置
# 进入openvpn服务器认证配置文件夹
cd /etc/openvpn/auth/
# 备份默认配置文件
cp ldap.conf  ldap.conf.bak
# 开始修改配置，清空内容进行编辑
echo > ldap.conf
cat <<\EOF >/etc/openvpn/auth/ldap.conf
<LDAP>
 URL ldap://10.16.202.178:389
 BindDN "cn=admin,dc=ienglsh,dc=cn"
 Password  Ta9FIjsrlMXcWo
 Timeout 15
 TLSEnable no
 FollowReferrals no
</LDAP>
<LDAP>
    # AD服务器地址
    URL        ldap://192.168.xxx.xxx:389
    # 管理员DN
    BindDN  CN=Administrator,CN=Users,DC=XXX,DC=com
    # 管理员密码
    Password    Y%G@$%^F^#UGH
    # 超时时间
    Timeout        15
    # 是否允许启用TLS
    TLSEnable    no
    # 是否允许匿名
    FollowReferrals no

    ##开启TLS
    #TLSEnable    yes
    ## TLS CA证书文件
    #TLSCACertFile    /usr/local/etc/ssl/ca.pem
    ## TLS CA证书目录
    #TLSCACertDir    /etc/ssl/certs
    ## 客户证书和密钥
    ## 如果需要TLS客户端身份验证
    #TLSCertFile    /usr/local/etc/ssl/client-cert.pem
    #TLSKeyFile    /usr/local/etc/ssl/client-key.pem
    ## 密码套件，默认就好
    ## TLSCipherSuite    ALL:!ADH:@STRENGTH
</LDAP>

<Authorization>
    # 基础DN
    BaseDN        "OU=xxxx,DC=going-link,DC=com"
    # 用户搜索过滤条件 我们用uid并且有vpn属性作为AD用户登录名
    SearchFilter "(&(uid=%u)(ou=vpn)"
    # 需要组成员身份
    RequireGroup    false
    # 将非组成员添加到PF表（禁用）
    ##PFTable    ips_***_users
    #<Group>
    #    BaseDN        "ou=Groups,dc=example,dc=com"
    #    SearchFilter    "(|(cn=ops)(cn=artists))"
    #    MemberAttribute    uniqueMember
    ##   Add group members to a PF table (disabled)
    ##   PFTable    ips_***_eng
    #</Group>
</Authorization>
EOF

#3.配置openvpn的server.conf
cat >>/etc/openvpn/server.conf<<EOF
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf cn=%u"
client-cert-not-required             #不使用客户端证书，使用密码对
username-as-common-name              #使用认证用户名，不使用证书的common name
EOF
#在service.conf最后一行添加

#4.客户端配置文件client.ovpn
client
dev tun
proto tcp
remote 192.168.0.11 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
;cert cyh.crt      #注释
;key cyh.key       #注释
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
auth-user-pass              #使用用户名密码登录openvpn服务器
#主要是注释crt和key路径，以及添加一行auth-user-pass

#5.重启openvpn
systemctl restart openvpn@server

#6.登录验证
#测试连接
#安装 openldap-clients
yum install -y openldap-clients
# 搜索实验 并输入密码
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "DC=GOING-LINK,DC=com" -h 192.168.1.62 -s one dn -LLL
#输入密码，能看到域内一些OU组织则成功
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "DC=going-link,DC=com" -h 192.168.1.62 
ldapsearch -x -W -D "CN=Administrator,CN=Users,DC=GOING-LINK,DC=com" -b "OU=disabled,DC=going-link,DC=com" -h 192.168.1.62

#1.安装LDAP+GoogleAuthenticator
#安装LDAP插件
git clone https://github.com/threerings/openvpn-auth-ldap
cd openvpn-auth-ldap
yum install re2c libtool openldap openldap-devel openvpn-devel gcc-objc -y #安装依赖
./regen.sh 
./configure --with-openldap=/usr/ --with-openvpn=/usr/ CFLAGS="-fPIC" OBJCFLAGS="-std=gnu11"
make 
make install

#安装OTP插件
git clone https://github.com/evgeny-gridasov/openvpn-otp
cd openvpn-otp
yum install autoconf automake libtool* -y
./autogen.sh
./configure 
make
make install

#插件位置
#/usr/local/lib/openvpn-auth-ldap.so
#/usr/local/lib/openvpn/openvpn-otp.so

#2.修改ldap.conf认证配置
# 进入openvpn服务器认证配置文件夹
cd /etc/openvpn/auth/
# 备份默认配置文件
cp ldap.conf  ldap.conf.bak
# 开始修改配置，清空内容进行编辑
echo > ldap.conf
cat <<\EOF >/etc/openvpn/auth/ldap.conf
<LDAP>
 URL ldap://10.16.202.178:389
 BindDN "cn=admin,dc=ienglish,dc=cn"
 Password  Ta9FIjsrlMXcWo
 Timeout 15
 TLSEnable no
 FollowReferrals no
</LDAP>
<LDAP>
    URL        ldap://192.168.xxx.xxx:389
    BindDN  CN=Administrator,CN=Users,DC=XXX,DC=com
    Password    Y%G@$%^F^#UGH
    Timeout        15
    TLSEnable    no
    FollowReferrals no
</LDAP>

<Authorization>
    BaseDN        "OU=xxxx,DC=going-link,DC=com"
    SearchFilter "(&(uid=%u)(ou=vpn)"
    RequireGroup    false

    PasswordIsCR   true  

    #<Group>
    #    BaseDN        "ou=Groups,dc=example,dc=com"
    #    SearchFilter    "(|(cn=ops)(cn=artists))"
    #    MemberAttribute    uniqueMember
    #</Group>
</Authorization>
EOF

#3.配置openvpn的server.conf
cat >>/etc/openvpn/server.conf<<EOF
plugin /usr/local/lib/openvpn-auth-ldap.so  "/etc/openvpn/auth/ldap.conf cn=%u"
plugin /usr/local/lib/openvpn/openvpn-otp.so "password_is_cr=1 otp_secrets=/etc/openvpn/auth/otp-secrets"
client-cert-not-required             #不使用客户端证书，使用密码对
username-as-common-name              #使用认证用户名，不使用证书的common name
#调用验证脚本，生成OTP共享密钥
script-security 2
auth-user-pass-verify /etc/openvpn/scripts/check_cn_on_connect.sh via-env
#服务器端会定期检查认证情况，默认3600秒一小时，使用OTP的话尽量时间长一些，否则客户端需要重新输入用户名密码和OTP一次性密码。
reneg-sec 0
EOF
#在service.conf最后一行添加

#4.配置OTP相关内容/etc/openvpn/auth/otp-secrets
#格式：bob otp totp:sha1:base32:LJYHR64TUI7IL3RD::xxx *
#中间那串LJYHR64TUI7IL3RD就是密钥，熟悉GoogleAuthenticator原理的，可以直接生成专用字符串和二维码。用手机端扫一下就可以用了

#4.客户端配置文件client.ovpn
client
dev tun
proto tcp
remote 192.168.0.11 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
;cert cyh.crt      #注释
;key cyh.key       #注释
tls-auth ta.key 1
cipher AES-256-CBC
comp-lzo
verb 3
auth-user-pass              #使用用户名密码登录openvpn服务器
auth-nocache
static-challenge "Enter Google Authenticator Token" 1
#@弹出验证框，1表示明文显示，0表示密文显示

#5.重启openvpn
systemctl restart openvpn@server

#1.安装监控工具
yum install -y epel-release
virtualenv + pip + gunicorn
# apt-get install python-virtualenv geoip-database-extra geoipupdate      # (debian/ubuntu)
# yum install python-virtualenv GeoIP-update geolite2-city python2-geoip2 # (centos/rhel)
mkdir /data/openvpn-monitor
cd /data/openvpn-monitor
virtualenv .
. bin/activate
pip install --upgrade pip
pip install openvpn-monitor gunicorn
gunicorn openvpn-monitor -b 0.0.0.0:80


# cat /data/openvpn-monitor/openvpn-monitor.conf 
[openvpn-monitor]
site=Top_Learning
#logo=logo.jpg
#latitude=40.72
#longitude=-74
maps=False
#geoip_data=/var/lib/GeoIP/GeoLite2-City.mmdb
geoip_data=/data/openvpn-monitor/GeoIP/GeoLite2-City.mmdb
datetime_format=%d/%m/%Y %H:%M:%S

[VPN1]
host=localhost
port=5555
name=TOPE-VPN
show_disconnect=False

#2.配置openvpn的server.conf
cat >>/etc/openvpn/server.conf<<EOF
management 127.0.0.1 5555  #本地管理
EOF
#在service.conf最后一行添加

#3.重启openvpn
systemctl restart openvpn@server