Linux系統安裝配置OpenV*N教程

ch256mony56 8年前發布 | 35K 次閱讀 Linux

來自： http://my.oschina.net/foundation00523wuxi/blog/616105

OpenV*N在安全性上比PPTP，L2TP和IPsec都高，因為它通過三個證書的安全驗證，實現了整個通信鏈路的完整加密。

安裝步驟：

一、首先檢查VPS上的tun設備是否可用，如果不可用需要聯系客服打開，否則OpenV*N無法啟用。
通過root用戶登陸，執行

代碼如下:

1 2	#cat /dev/net/tun cat: /dev/net/tun: File descriptor in bad state

如果現實結果如上所示，則表示tun設備可用，其它則表示設備異常，無法安裝OpenV*N。

二、下載安裝所需軟件包：

代碼如下:

wget ftp://rpmfind.net/linux/epel/5/i386/pkcs11-helper-devel-1.07-2.el5.1.i386.rpm

wget ftp://rpmfind.net/linux/epel/5/i386/pkcs11-helper-1.07-2.el5.1.i386.rpm

wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.04.tar.gz

wget http://swupdate.openV*N.net/community/releases/openV*N-2.1.4.tar.gz

三、使用yum安裝程序所需開發包

代碼如下:

1	yum install -y openssl openssl-devel automake pkgconfig iptables

四、安裝OpenV*N服務端
1.安裝pkcs11-helper RPM包

代碼如下:

1 2	rpm -ivh pkcs11-helper-1.07-2.el5.1.i386.rpm rpm -ivh pkcs11-helper-devel-1.07-2.el5.1.i386.rpm

2.安裝 LZO

代碼如下:

tar zxvf lzo-2.04.tar.gz

cd lzo-2.04/

./configure –prefix=/opt/lzo

make

make check

make install

cd ../

3.安裝 OpenV*N

代碼如下:

tar zxvf openV*N-2.1.4.tar.gz

cd openV*N-2.1.4

./configure –prefix=/opt/openV*N –with-lzo-headers=/opt/lzo/include –with-lzo-lib=/opt/lzo/lib –with-ssl-headers=/usr/include/openssl –with-ssl-lib=/usr/lib

make

make install

然后，下面就開始key證書文件的創建，總共需要創建三個，即ca，server key，client key。

4.生成證書Key

代碼如下:

cp -r easy-rsa /opt/openV*N/
cd /opt/openV*N/easy-rsa/2.0/
vim export_new_var

export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=CN #國家
export KEY_PROVINCE=BJ #省份
export KEY_CITY=BJ #城市
export KEY_ORG=”btschina.com” #組織
export KEY_EMAIL=”root@btschina.com” #郵箱
source export_new_var
./clean-all

./build-ca

Generating a 1024 bit RSA private key
..++++++...........++++++
writing new private key to 'ca.key'
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
—–
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [btschina.com]:
Organizational Unit Name (eg, section) []:btschina
Common Name (eg, your name or your server's hostname) [btschina.com CA]:btschina
.com
Name []:btschina
Email Address [root@btschina.com]:

5.建立 server key

代碼如下:

[root@centos 2.0]# ./build-key-server server
Generating a 1024 bit RSA private key............................++++++..........++++++
writing new private key to 'server.key'
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
—–
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [btschina.com]:
Organizational Unit Name (eg, section) []:btschina
Common Name (eg, your name or your server's hostname) [server]:btschina.com
Name []:btschina
Email Address [root@btschina.com]:</p> <p>Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:btschina.com
Using configuration from /etc/openV*N/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName RINTABLE:'CN'
stateOrProvinceName  RINTABLE:'BJ'
localityName  RINTABLE:'BJ'
organizationName  RINTABLE:'btschina.com'
organizationalUnitName:PRINTABLE:'btschina'
commonName  RINTABLE:'btschina.com'
name  RINTABLE:'btschina'
emailAddress :IA5STRING:'root@btschina.com'
Certificate is to be certified until Apr 12 08:21:52 2021 GMT (3650 days)
Sign the certificate? [y/n]:y

6.生成客戶端 key

代碼如下:

[root@centos 2.0]# ./build-key client1
Generating a 1024 bit RSA private key

.........................................................................................++++++......................++++++
writing new private key to 'client1.key'
—–
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
—–
Country Name (2 letter code) [CN]:
State or Province Name (full name) [BJ]:
Locality Name (eg, city) [BJ]:
Organization Name (eg, company) [btschina.com]:
Organizational Unit Name (eg, section) []:btschina
Common Name (eg, your name or your server's hostname) [client1]:
Name []:btschina
Email Address [root@btschina.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:123456
An optional company name []:btschina.com
Using configuration from /etc/openV*N/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName  RINTABLE:'CN'
stateOrProvinceName  RINTABLE:'BJ'
localityName  RINTABLE:'BJ'
organizationName  RINTABLE:'btschina.com'
organizationalUnitName:PRINTABLE:'btschina'
commonName  RINTABLE:'client1′
name  RINTABLE:'btschina'
emailAddress :IA5STRING:'root@btschina.com'
Certificate is to be certified until Apr 12 08:24:33 2021 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

如果想生成多個client key的話，重復以上步驟，修改client1為client2，client3......即可。

至此，所有的key都已經生成完畢，如果你想刪除這些key，重新生成的話，執行以下命令。

代碼如下:

source var
./clean-all

7.生成 Diffie Hellman 參數

代碼如下:

./build-dh

8.將 keys 下的所有文件打包下載到本地

代碼如下:

tar -cf keys.tar keys

9.創建服務端配置文件

代碼如下:

vi /opt/openV*N/etc/server.conf

內容如下：
port 1194
proto udp

dev tun

ca /opt/openV*N/easy-rsa/2.0/keys/ca.crt
cert /opt/openV*N/easy-rsa/2.0/keys/server.crt
key /opt/openV*N/easy-rsa/2.0/keys/server.key
dh /opt/openV*N/easy-rsa/2.0/keys/dh1024.pem

server 10.10.20.0 255.255.255.0

client-to-client
keepalive 10 120

comp-lzo

persist-key
persist-tun
status /opt/openV*N/easy-rsa/2.0/keys/openV*N-status.log
verb 4

push “dhcp-option DNS 10.10.20.1″
push “dhcp-option DNS 8.8.8.8″
push “dhcp-option DNS 8.8.4.4″

10.創建客戶端配置文件

代碼如下:

vi /opt/openV*N/etc/client.conf

內容如下
client

dev tun
proto udp

remote 204.74.215.57 1194 #請換成自己ip
persist-key
persist-tun
ca /opt/openV*N/easy-rsa/2.0/keys/ca.crt
cert /opt/openV*N/easy-rsa/2.0/keys/client1.crt
key /opt/openV*N/easy-rsa/2.0/keys/client1.key
ns-cert-type server
comp-lzo
verb 3

redirect-gateway def1
route-method exe
route-delay 2

12.設置 OpenV*N 服務器 reboot后自動啟動 openV*N

代碼如下:

vi /etc/rc.local

加入：

代碼如下:

/opt/openV*N/sbin/openV*N –config /opt/openV*N/etc/server.conf > /dev/null 2>&1 &

運行OpenV*N服務端

代碼如下:

/opt/openV*N/sbin/openV*N –config /opt/openV*N/etc/server.conf > /dev/null 2>&1 &

檢查服務端是否啟動
執行

代碼如下:

netstat -lnp

如果看到有 0.0.0.0:1194 則證明服務端已經成功啟動。

五、防火墻規則設置
1.開放OpenV*N服務器端口

代碼如下:

iptables -A INPUT -p udp -m state –state NEW -m udp –dport 1194 -j ACCEPT

2.啟用NAT映射，實現共享上網

代碼如下:

iptables -t nat -A POSTROUTING -s 10.10.20.0/255.255.255.0 -o eth0 -j MASQUERADE

3.開啟數據轉發

代碼如下:

sysctl -w net.ipv4.ip_forward=1

六、OpenV*N GUI for Windows 客戶端安裝
1.下載并安裝 .NET Framwork 3.5 SP1
由于OpenV*N客戶端需要 .NET Framwork 3.5 SP1 以上的支持，所以很遺憾，我們不得不先安裝它。
下載地址：http://www.microsoft.com/downloads/zh-cn/details.aspx?FamilyID=333325fd-ae52-4e35-b531-508d977d32a6&DisplayLang=zh-cn

2.下載并安裝OpenV*N客戶端
下載地址：http://swupdate.openV*N.net/downloads/openV*N-client.msi

3.創建客戶端配置文件

進入程序目錄，C:/Program Files/OpenV*N Technologies/OpenV*N Client/etc/profile
創建配置文件client.oV*N，內容如下：
client

dev tun
proto udp

remote 204.74.215.57 1194 #請換成自己ip

persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

redirect-gateway def1
route-method exe
route-delay 2
4.將所需的證書等文件放入客戶端目錄
將之前壓縮的keys.tar壓縮文件解壓，并將目錄下的所有文件移動到目錄：
C:/Program Files/OpenV*N Technologies/OpenV*N Client/etc/profile

至此，整個OpenV*N的安裝過程就已經完成了，如果你也是國外的VPS主機的話，那就開始體驗翻過GFW的快樂吧。

七、卸載OpenV*N
如果你覺得OpenV*N用起來太過于麻煩或其它原因想卸載OpenV*N，那么，請執行以下操作。

代碼如下:

killall openV*N
rpm -e pkcs11-helper-1.07-2.el5.1.i386.rpm
rpm -e pkcs11-helper-devel-1.07-2.el5.1.i386.rpm
rm -rf /opt/lzo
rm -rf /opt/openV*N

本文由用戶 ch256mony56 自行上傳分享，僅供網友學習交流。所有權歸原作者，若您的權利被侵害，請聯系管理員。

轉載本站原創文章，請注明出處，并保留原始鏈接、圖片水印。

本站是一個以用戶分享為主的開源技術平臺，歡迎各類分享！

本文地址：http://www.baiduhome.net/lib/view/open1455718485980.html

Linux

Linux系統安裝配置OpenV*N教程

相關經驗

相關資訊

相關文檔

目錄