OpenVPN and VisionSOM-6ULL - Revision history

Pawelzbysinski at 11:57, 11 July 2018

2018-07-11T11:57:40Z

← Older revision		Revision as of 11:57, 11 July 2018
Line 6:		Line 6:
	== Prerequisites ==		== Prerequisites ==
	This tutorial is based on a pre-prepared image for VisionSOM-6ULL module. The image is available here: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].		This tutorial is based on a pre-prepared image for VisionSOM-6ULL module. The image is available here: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].

			For testing purposes user '''root''' has a password '''somlabs'''.

	Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]]. Please remember to use a proper image file: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].		Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]]. Please remember to use a proper image file: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].
Line 293:		Line 295:

	You need to download the image file:		You need to download the image file:
	[http://ftp.somlabs.com/VisionSOM-6ULL/~~somlabs~~-~~openvpn~~-~~for~~-~~visionsom-6ull~~.zip ~~somlabs-openvpn~~-~~for~~-~~visionsom~~-~~6ull~~.zip]		[http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip]

	Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]].		Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]].

	For testing purposes user '''root''' has a password '''somlabs'''.		For testing purposes user '''root''' has a password '''somlabs'''.

Pawelzbysinski: /* Prerequisites */

2018-07-11T11:50:53Z

Prerequisites

← Older revision		Revision as of 11:50, 11 July 2018
Line 5:		Line 5:

	== Prerequisites ==		== Prerequisites ==
	This tutorial based on ~~Debian 9.2~~ image for VisionSOM-6ULL module. ~~Please visit~~ [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]] ~~for more detailed instruction how~~ to ~~create~~ a ~~bootable microSD card~~.		This tutorial is based on a pre-prepared image for VisionSOM-6ULL module. The image is available here: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].

			Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]]. Please remember to use a proper image file: [http://ftp.somlabs.com/VisionSOM-6ULL/SoMLabs-VisionSOM-6ULL-OpenVPN.zip SoMLabs-VisionSOM-6ULL-OpenVPN.zip].

	== Kernel configuration – TUN/TAP device support ==		== Kernel configuration – TUN/TAP device support ==

Pawelzbysinski: /* Ready to use image file */

2018-07-05T18:16:11Z

Ready to use image file

← Older revision		Revision as of 18:16, 5 July 2018
Line 291:		Line 291:

	You need to download the image file:		You need to download the image file:
	[http://ftp.somlabs.com/~~visionsom~~-~~6ull~~/somlabs-openvpn-for-visionsom-6ull.zip somlabs-openvpn-for-visionsom-6ull.zip]		[http://ftp.somlabs.com/VisionSOM-6ULL/somlabs-openvpn-for-visionsom-6ull.zip somlabs-openvpn-for-visionsom-6ull.zip]

	Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]].		Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]].

	For testing purposes user '''root''' has a password '''somlabs'''.		For testing purposes user '''root''' has a password '''somlabs'''.

Pawelzbysinski at 17:00, 5 July 2018

2018-07-05T17:00:49Z

← Older revision		Revision as of 17:00, 5 July 2018
Line 2:		Line 2:
	__FORCETOC__		__FORCETOC__

	''OpenVPN'' [1] is an open-source software application that implements virtual private network (VPN) techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. In other words, ''OpenVPN'' allows you to create a private network over the public Internet and tunnels your network connection securely. This tutorial describes the steps to setup a ''OpenVPN'' server on ''~~SoMLabs~~'' module.		''OpenVPN'' [1] is an open-source software application that implements virtual private network (VPN) techniques to create secure point-to-point or site-to-site connections in routed or bridged configurations and remote access facilities. In other words, ''OpenVPN'' allows you to create a private network over the public Internet and tunnels your network connection securely. This tutorial describes the steps to setup the ''OpenVPN'' server on ''VisionSOM-6ULL'' module.

	== Prerequisites ==		== Prerequisites ==
Line 285:		Line 285:

	[4] [https://wiki.archlinux.org/index.php/OpenVPN https://wiki.archlinux.org/index.php/OpenVPN]		[4] [https://wiki.archlinux.org/index.php/OpenVPN https://wiki.archlinux.org/index.php/OpenVPN]


			== Ready to use image file ==
			You can also use a prepared image file.

			You need to download the image file:
			[http://ftp.somlabs.com/visionsom-6ull/somlabs-openvpn-for-visionsom-6ull.zip somlabs-openvpn-for-visionsom-6ull.zip]

			Then you need to write the image file to microSD card. More information you can find in manuals: [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Linux]] or [[How to prepare SD Card with Debian 9.2 for VisionSOM-6ULL on Windows]].

			For testing purposes user '''root''' has a password '''somlabs'''.

Anna Kubacka: /* Configure the OpenVPN Service */

2018-07-01T11:16:35Z

Configure the OpenVPN Service

Anna Kubacka at 11:14, 1 July 2018

2018-07-01T11:14:17Z

Pawelzbysinski at 11:11, 1 July 2018

2018-07-01T11:11:54Z

← Older revision		Revision as of 11:11, 1 July 2018
Line 133:		Line 133:

	root@somlabs:/etc/openvpn/rsa# '''./build-key-server server'''		root@somlabs:/etc/openvpn/rsa# '''./build-key-server server'''
	…		...
	Generating a 2048 bit RSA private key		Generating a 2048 bit RSA private key
	...		...

Anna Kubacka at 11:10, 1 July 2018

2018-07-01T11:10:34Z

Anna Kubacka at 11:01, 1 July 2018

2018-07-01T11:01:09Z

Show changes

Anna Kubacka at 10:43, 1 July 2018

2018-07-01T10:43:54Z

← Older revision		Revision as of 10:43, 1 July 2018
Line 23:		Line 23:
	<*> Universal TUN/TAP device driver support		<*> Universal TUN/TAP device driver support

	~~{{clear}}~~
	[[~~Image~~:~~Image1~~.png\|center]]		[[File:Img 1.png\|center\|700px]]

	After all these options have been selected, save your configuration, exit the ''menuconfig'' tool and build a new kernel image:		After all these options have been selected, save your configuration, exit the ''menuconfig'' tool and build a new kernel image:

← Older revision		Revision as of 11:16, 1 July 2018
Line 227:		Line 227:
	group nobody</pre>		group nobody</pre>

	As a option, you can uncomment:		As an option, you can uncomment:

	push "redirect-gateway def1 bypass-dhcp"		push "redirect-gateway def1 bypass-dhcp"
Line 235:		Line 235:
	To start OpenVPN server:		To start OpenVPN server:

	~~<pre>~~root@somlabs:/etc/openvpn# '''openvpn /etc/openvpn/server.conf'''		root@somlabs:/etc/openvpn# '''openvpn /etc/openvpn/server.conf'''
	...		...
	Wed Jun 27 08:04:19 2018 TUN/TAP device tun0 opened		Wed Jun 27 08:04:19 2018 TUN/TAP device tun0 opened
	Wed Jun 27 08:04:19 2018 TUN/TAP TX queue length set to 100		Wed Jun 27 08:04:19 2018 TUN/TAP TX queue length set to 100
	Wed Jun 27 08:04:19 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0		Wed Jun 27 08:04:19 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
	Wed Jun 27 08:04:19 2018 /sbin/ip link set dev tun0 up mtu 1500		Wed Jun 27 08:04:19 2018 /sbin/ip link set dev tun0 up mtu 1500
	...		...
	Wed Jun 27 08:04:19 2018 UDPv4 link remote: [AF_UNSPEC]		Wed Jun 27 08:04:19 2018 UDPv4 link remote: [AF_UNSPEC]
	Wed Jun 27 08:04:19 2018 GID set to nogroup		Wed Jun 27 08:04:19 2018 GID set to nogroup
	Wed Jun 27 08:04:19 2018 UID set to nobody		Wed Jun 27 08:04:19 2018 UID set to nobody
	Wed Jun 27 08:04:19 2018 MULTI: multi_init called, r=256 v=256		Wed Jun 27 08:04:19 2018 MULTI: multi_init called, r=256 v=256
	Wed Jun 27 08:04:19 2018 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0		Wed Jun 27 08:04:19 2018 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
	Wed Jun 27 08:04:19 2018 IFCONFIG POOL LIST		Wed Jun 27 08:04:19 2018 IFCONFIG POOL LIST
	Wed Jun 27 08:04:19 2018 '''Initialization Sequence Completed'''~~</pre>~~		Wed Jun 27 08:04:19 2018 '''Initialization Sequence Completed'''

	To connect to the ''OpenVPN'' server, the client requires a key and certificate that we created already:		To connect to the ''OpenVPN'' server, the client requires a key and certificate that we created already:

← Older revision		Revision as of 11:14, 1 July 2018
Line 165:		Line 165:
	This is going to take a long time		This is going to take a long time

	(it will take some time to generate ~~the~~ the files)		(it will take some time to generate the files)

	For additional security, user can also generate optional ''Hash-based Message Authentication Code'' - HMAC key ('''''ta.key''''' file):		For additional security, user can also generate optional ''Hash-based Message Authentication Code'' - HMAC key ('''''ta.key''''' file):
Line 180:		Line 180:
	root@somlabs:/etc/openvpn/rsa/keys# cp ta.key /etc/openvpn/server</pre>		root@somlabs:/etc/openvpn/rsa/keys# cp ta.key /etc/openvpn/server</pre>

	== 'Generating Keys and Certificates - Client ==		== Generating Keys and Certificates - Client ==

	In this example we will generate key and certificate pair for one client – you can repeat below steps for each new client, but please remember to set up unique name for all new clients. Please also remember that in production environments - for security purposes – keys should be generated on client machine and signed by the CA machine (it is recommended that the CA machine be separate from the machine running OpenVPN - do not store the ''easy-rsa'' CA files on the OpenVPN server!) – in this example we will generate the signed key on the server:		In this example we will generate key and certificate pair for one client – you can repeat below steps for each new client, but please remember to set up unique name for all new clients. Please also remember that in production environments - for security purposes – keys should be generated on client machine and signed by the CA machine (it is recommended that the CA machine be separate from the machine running OpenVPN - do not store the ''easy-rsa'' CA files on the OpenVPN server!) – in this example we will generate the signed key on the server:

	~~<pre>~~root@somlabs:/etc/openvpn/rsa# '''./build-key client1'''		root@somlabs:/etc/openvpn/rsa# '''./build-key client1'''
	Generating a 2048 bit RSA private key		Generating a 2048 bit RSA private key
	...		...
	writing new private key to 'client1.key'		writing new private key to 'client1.key'
	...		...
	Certificate is to be certified until Jun 24 07:39:23 2028 GMT (3650 days)		Certificate is to be certified until Jun 24 07:39:23 2028 GMT (3650 days)
	Sign the certificate? [y/n]:y		Sign the certificate? [y/n]:y

	1 out of 1 certificate requests certified, commit? [y/n]y		1 out of 1 certificate requests certified, commit? [y/n]y
	Write out database with 1 new entries		Write out database with 1 new entries
	Data Base Updated~~</pre>~~		Data Base Updated

	Copy the necessary key files to client, via a secure way (such as SSH), including:		Copy the necessary key files to client, via a secure way (such as SSH), including:

← Older revision		Revision as of 11:10, 1 July 2018
Line 38:		Line 38:
	''OpenVPN'' package – which is available in Debian's default repositories - provides both server and client mode. To update server's package repository and install ''openvpn'' software:		''OpenVPN'' package – which is available in Debian's default repositories - provides both server and client mode. To update server's package repository and install ''openvpn'' software:

	~~<pre>~~root@somlabs:~# '''apt-get update'''		root@somlabs:~# '''apt-get update'''
	root@somlabs:~# '''apt-get install openvpn'''		root@somlabs:~# '''apt-get install openvpn'''
	Reading package lists... Done		Reading package lists... Done
	Building dependency tree		Building dependency tree
	Reading state information... Done		Reading state information... Done
	The following additional packages will be installed:		The following additional packages will be installed:
	easy-rsa libccid liblzo2-2 libpcsclite1 libpkcs11-helper1 libusb-1.0-0 opensc opensc-pkcs11 openssl pcscd		easy-rsa libccid liblzo2-2 libpcsclite1 libpkcs11-helper1 libusb-1.0-0 opensc opensc-pkcs11 openssl pcscd
	Suggested packages:		Suggested packages:
	pcmciautils ca-certificates resolvconf		pcmciautils ca-certificates resolvconf
	The following NEW packages will be installed:		The following NEW packages will be installed:
	easy-rsa libccid liblzo2-2 libpcsclite1 libpkcs11-helper1 libusb-1.0-0 opensc opensc-pkcs11 openssl openvpn pcscd		easy-rsa libccid liblzo2-2 libpcsclite1 libpkcs11-helper1 libusb-1.0-0 opensc opensc-pkcs11 openssl openvpn pcscd
	...~~</pre>~~		...

	Above'' ''command will also install additional packages, like for example ''easy-rsa'', which we will use to set up our internal ''Certificate Authority'' (CA) infrastructure.		Above'' ''command will also install additional packages, like for example ''easy-rsa'', which we will use to set up our internal ''Certificate Authority'' (CA) infrastructure.

	== 'Generating Keys and Certificates - Server ==		== Generating Keys and Certificates - Server ==

	To encrypt traffic between the server and clients, ''OpenVPN'' utilizes set of certificates and keys. A functional ''OpenVPN'' server requires the following certificates/keys:		To encrypt traffic between the server and clients, ''OpenVPN'' utilizes set of certificates and keys. A functional ''OpenVPN'' server requires the following certificates/keys:
Line 79:		Line 79:
	To configure ''Certificate Authority ''values which will be placed in the certificate, we need to edit the ''/etc/openvpn/rsa/vars'' file and update the following fields:		To configure ''Certificate Authority ''values which will be placed in the certificate, we need to edit the ''/etc/openvpn/rsa/vars'' file and update the following fields:

	~~<pre>~~root@somlabs:/etc/openvpn/rsa# '''vim vars'''		root@somlabs:/etc/openvpn/rsa# '''vim vars'''
	...		...
	export KEY_COUNTRY="US"		export KEY_COUNTRY="US"
	export KEY_PROVINCE="CA"		export KEY_PROVINCE="CA"
	export KEY_CITY="SanFrancisco"		export KEY_CITY="SanFrancisco"
	export KEY_ORG="Fort-Funston"		export KEY_ORG="Fort-Funston"
	export KEY_EMAIL="me@myhost.mydomain"		export KEY_EMAIL="me@myhost.mydomain"
	export KEY_OU="MyOrganizationalUnit"		export KEY_OU="MyOrganizationalUnit"
	...~~</pre>~~		...

	For example:		For example:
Line 108:		Line 108:
	Let’s finally generate a certificate authority - '''''ca.crt''''' file (druing this process all of the values should be populated automatically from ''vars'' file - just confirm default values):		Let’s finally generate a certificate authority - '''''ca.crt''''' file (druing this process all of the values should be populated automatically from ''vars'' file - just confirm default values):

	~~<pre>~~root@somlabs:/etc/openvpn/rsa# '''./build-ca'''		root@somlabs:/etc/openvpn/rsa# '''./build-ca'''
	Generating a 2048 bit RSA private key		Generating a 2048 bit RSA private key
	.............................+++		.............................+++
	..........+++		..........+++
	writing new private key to 'ca.key'		writing new private key to 'ca.key'
	<nowiki>-----</nowiki>		<nowiki>-----</nowiki>
	You are about to be asked to enter information that will be incorporated		You are about to be asked to enter information that will be incorporated
	into your certificate request.		into your certificate request.
	What you are about to enter is what is called a Distinguished Name or a DN.		What you are about to enter is what is called a Distinguished Name or a DN.
	There are quite a few fields but you can leave some blank		There are quite a few fields but you can leave some blank
	For some fields there will be a default value,		For some fields there will be a default value,
	If you enter '.', the field will be left blank.		If you enter '.', the field will be left blank.
	<nowiki>-----</nowiki>		<nowiki>-----</nowiki>
	Country Name (2 letter code) [PL]:		Country Name (2 letter code) [PL]:
	State or Province Name (full name) [Masovian]:		State or Province Name (full name) [Masovian]:
	Locality Name (eg, city) [Warsaw]:		Locality Name (eg, city) [Warsaw]:
	Organization Name (eg, company) [SoMLabs]:		Organization Name (eg, company) [SoMLabs]:
	Organizational Unit Name (eg, section) [SoMLabs]:		Organizational Unit Name (eg, section) [SoMLabs]:
	Common Name (eg, your name or your server's hostname) [SoMLabs CA]:		Common Name (eg, your name or your server's hostname) [SoMLabs CA]:
	Name [EasyRSA]:		Name [EasyRSA]:
	Email Address [somlabs@somlabs.com]:~~</pre>~~		Email Address [somlabs@somlabs.com]:

	Now generate a server key and certificate ('''''server.crt''''' and '''''server.key''''' files):		Now generate a server key and certificate ('''''server.crt''''' and '''''server.key''''' files):

	~~<pre>~~root@somlabs:/etc/openvpn/rsa# '''./build-key-server server'''		root@somlabs:/etc/openvpn/rsa# '''./build-key-server server'''
	…		…
	Generating a 2048 bit RSA private key		Generating a 2048 bit RSA private key
	...		...
	Please enter the following 'extra' attributes		Please enter the following 'extra' attributes
	to be sent with your certificate request		to be sent with your certificate request
	A challenge password []:'''somlabs'''		A challenge password []:'''somlabs'''
	An optional company name []:		An optional company name []:
	Using configuration from /etc/openvpn/rsa/openssl.cnf		Using configuration from /etc/openvpn/rsa/openssl.cnf
	Check that the request matches the signature		Check that the request matches the signature
	Signature ok		Signature ok
	The Subject's Distinguished Name is as follows		The Subject's Distinguished Name is as follows
	countryName :PRINTABLE:'PL'		countryName :PRINTABLE:'PL'
	stateOrProvinceName :PRINTABLE:'Masovian'		stateOrProvinceName :PRINTABLE:'Masovian'
	localityName :PRINTABLE:'Warsaw'		localityName :PRINTABLE:'Warsaw'
	organizationName :PRINTABLE:'SoMLabs'		organizationName :PRINTABLE:'SoMLabs'
	organizationalUnitName:PRINTABLE:'SoMLabs'		organizationalUnitName:PRINTABLE:'SoMLabs'
	commonName :PRINTABLE:'server'		commonName :PRINTABLE:'server'
	name :PRINTABLE:'EasyRSA'		name :PRINTABLE:'EasyRSA'
	emailAddress :IA5STRING:'somlabs@somlabs.com'		emailAddress :IA5STRING:'somlabs@somlabs.com'
	Certificate is to be certified until Jun 24 07:08:08 2028 GMT (3650 days)		Certificate is to be certified until Jun 24 07:08:08 2028 GMT (3650 days)
	Sign the certificate? [y/n]:y		Sign the certificate? [y/n]:y

	1 out of 1 certificate requests certified, commit? [y/n]y		1 out of 1 certificate requests certified, commit? [y/n]y
	Write out database with 1 new entries		Write out database with 1 new entries
	Data Base Updated~~</pre>~~		Data Base Updated

	To build a Diffie-Hellman key exchange ('''''dh2048.pem''''' file):		To build a Diffie-Hellman key exchange ('''''dh2048.pem''''' file):