1、CentOS6.5 安装Open×××
1、实验拓扑http://s3.运维网.com/wyfs02/M00/73/1D/wKiom1X1P_WhO4K6AAJZEB6rXvw063.jpg
2、实验目的
S1为Open***服务器端，C1、C2为Open***客户端，通过配置Open***实现C1、C2访问S1所在网段的所有主机。
3、实验环境
GNS3 0.8.7 CentOS6.5
4、安装配置Open***服务器端
4.1、在服务器S1上安装lzo和open***
# rpm -ivh lzo-2.04-3.2.i386.rpm
warning: lzo-2.04-3.2.i386.rpm: Header V3 DSA/SHA1 Signature, key ID d164ce99: NOKEY
Preparing... ###########################################
file /usr/lib/liblzo2.so.2.0.0 from install of lzo-2.04-3.2.i386 conflicts with file from package lzo-2.03-3.1.el6.i686
# rpm -ivh open***-2.1-0.20.rc4.el5.kb.i386.rpm
error: Failed dependencies:
libcrypto.so.6 is needed by open***-2.1-0.20.rc4.el5.kb.i386
libssl.so.6 is needed by open***-2.1-0.20.rc4.el5.kb.i386
# yum -y install openssl098e
# rpm -ivh open***-2.1-0.20.rc4.el5.kb.i386.rpm
Preparing... ###########################################
1:open*** ###########################################
# cp -r /usr/share/open***/easy-rsa/2.0/ /etc/open***/
# cp /usr/share/doc/open***-2.1/sample-config-files/server.conf /etc/open***/
4.2、初始化PKI
# cd /etc/open***/2.0/
# vim vars
export KEY_COUNTRY="CN"
export KEY_PROVINCE="GD"
export KEY_CITY="SZ"
export KEY_ORG="***"
export KEY_EMAIL="test@163.com"
# source ./vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /etc/open***/2.0/keys
# ./clean-all
# ./build-ca
Generating a 1024 bit RSA private key
..................................................++++++
..............................................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) [***]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [*** CA]:server
Email Address :
#
4.3、生成server key
# ./build-key-server server
Generating a 1024 bit RSA private key
......................................++++++
...........++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) [***]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) :
Email Address :
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:root123
An optional company name []:
Using configuration from /etc/open***/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'***'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'test@163.com'
Certificate is to be certified until Sep 10 17:25:36 2025 GMT (3650 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
4.4、生成client key
# ./build-key C1
Generating a 1024 bit RSA private key
.......................++++++
.....++++++
writing new private key to 'C1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) [***]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) :
Email Address :
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:root123
An optional company name []:
Using configuration from /etc/open***/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'***'
commonName :PRINTABLE:'C1'
emailAddress :IA5STRING:'test@163.com'
Certificate is to be certified until Sep 10 17:27:38 2025 GMT (3650 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
#
# ./build-key C2
Generating a 1024 bit RSA private key
.......++++++
........++++++
writing new private key to 'C2.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) :
State or Province Name (full name) :
Locality Name (eg, city) :
Organization Name (eg, company) [***]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) :
Email Address :
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:root123
An optional company name []:
Using configuration from /etc/open***/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'CN'
stateOrProvinceName :PRINTABLE:'GD'
localityName :PRINTABLE:'SZ'
organizationName :PRINTABLE:'***'
commonName :PRINTABLE:'C2'
emailAddress :IA5STRING:'test@163.com'
Certificate is to be certified until Sep 10 17:28:16 2025 GMT (3650 days)
Sign the certificate? :y
1 out of 1 certificate requests certified, commit? y
Write out database with 1 new entries
Data Base Updated
#
4.5、生成 Diffie Hellman 参数、创建服务端配置文件
# ./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
......+...................+.............................................+................................................................+......................................+..................................................................................................................+............+....................................+......................+................+...................+..............................................++*++*++*
# cd keys/
# cp ca.crtserver.crtserver.keydh1024.pem/etc/open***/
4.6、修改服务器端配置文件
# cd ../../
# vim server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status open***-status.log
verb 4
push "dhcp-option DNS 114.114.114.114"
4.7、启动Open***
# chkconfig open*** on
# service open*** restart
Shutting down open***:
Starting open***:
# ifconfig tun0
tun0 Link encap:UNSPECHWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.1P-t-P:10.8.0.2Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICASTMTU:1500Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b)TX bytes:0 (0.0 b)
#
5、安装配置Open***客户端
5.1、C1客户端安装
# rpm -ivh lzo-2.04-3.2.i386.rpm
warning: lzo-2.04-3.2.i386.rpm: Header V3 DSA/SHA1 Signature, key ID d164ce99: NOKEY
Preparing... ###########################################
file /usr/lib/liblzo2.so.2.0.0 from install of lzo-2.04-3.2.i386 conflicts with file from package lzo-2.03-3.1.el6.i686
# rpm -ivh open***-2.1-0.20.rc4.el5.kb.i386.rpm
error: Failed dependencies:
libcrypto.so.6 is needed by open***-2.1-0.20.rc4.el5.kb.i386
libssl.so.6 is needed by open***-2.1-0.20.rc4.el5.kb.i386
# yum -y install openssl098e
# rpm -ivh open***-2.1-0.20.rc4.el5.kb.i386.rpm
Preparing... ###########################################
1:open*** ###########################################
#
将在S1服务器端生成的client证书等文件拷贝到/etc/open***目录下
# cd /etc/open***/
# ll
total 12
-rw-r--r--. 1 root root 3577 Sep 13 13:56 C1.crt
-rw-------. 1 root root912 Sep 13 13:56 C1.key
-rw-r--r--. 1 root root 1119 Sep 13 13:56 ca.crt
# vim client.conf
client
dev tun
proto udp
remote 8.8.8.10 1194
persist-key
persist-tun
ca ca.crt
cert C1.crt
key C1.key
ns-cert-type server
comp-lzo
verb 3
redirect-gateway def1
# service open*** restart
Shutting down open***:
Starting open***:
# ifconfig tun0
tun0 Link encap:UNSPECHWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.8.0.5P-t-P:10.8.0.6Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICASTMTU:1500Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:0 (0.0 b)TX bytes:0 (0.0 b)
#
5.2、C2客户端安装
将在S1服务器端生成的client证书等文件拷贝到C:\Program Files\Open***\config目录下，并将C:\Program Files\Open***\sample-config目录下的client一并拷贝过来
http://s3.运维网.com/wyfs02/M02/73/18/wKioL1X1Jt3AYv3zAAJq0N1ixE8885.jpgclient的内容修改如下
client
dev tun
proto udp
remote 8.8.8.10 1194
persist-key
persist-tun
ca ca.crt
cert C2.crt
key C2.key
ns-cert-type server
comp-lzo
verb 4
redirect-gateway def1
http://s3.运维网.com/wyfs02/M02/73/18/wKioL1X1J_2DH_EOAAIkfhKNo44839.jpg
6、解决无法上外网和只能访问S1问题
此时C1、C2已经和S1成功建立了***。但C1、C2无法PING8.8.8.20、8.8.8.30，即无法访问外网,也无法访问除了S1外的其他主机。此时我们需要在S1上开启IP转发、添加路由。
# vim /etc/rc.d/rc.local
#!/bin/sh
#
# This script will be executed *after* all the other init scripts.
# You can put your own initialization stuff in here if you don't
# want to do the full Sys V style init stuff.
touch /var/lock/subsys/local
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source 10.1.1.1
#
至此，C1、C2不仅可以上外网，而且可以访问S1所在网络的所有主机了
页:
[1]