index.html (24112B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> 5 <meta name="viewport" content="width=device-width, initial-scale=1" /> 6 <title>Construcción de servidor OpenVPN propio</title> 7 <link rel="icon" type="image/png" href="/favicon.png" /> 8 <link rel="stylesheet" type="text/css" href="../article.css" /> 9 </head> 10 <body> 11 <header> 12 <p class="title">Construcción de servidor OpenVPN propio</p> 13 <p class="date">2 de abril de 2016 • fjbalon</p> 14 </header> 15 <p>Antes de realizar cualquier comprobación es necesario tener claros unos conceptos teóricos referentes a las interfaces de redes virtuales TUN y TAP, interfaces de red virtuales a nivel de kernel.</p> 16 <p>Aunque TUN y TAP tienen el mismo propósito de «tunneling» divergen en su funcionamiento técnico. TUN simula un dispositivo de capa de red y opera en la capa 3 del modelo OSI transportando paquetes IP mientras que TAP simula un dispositivo en la capa de enlace y opera en la capa 2 del modelo OSI, creando un puente (bridge) de red.</p> 17 <p>Los paquetes enviados por un sistema operativo a través de un dispositivo TUN/TAP son entregados a un programa de espacio de usuario que se conecta al dispositivo. Un programa de espacio de usuario también puede pasar paquetes en un dispositivo TUN/TAP. En este caso el dispositivo TUN/TAP inyecta estos paquetes a la pila de red del sistema operativo simulando así su recepción desde una fuente externa.</p> 18 <p>En el caso de sistemas Linux, el soporte a TUN puede habilitarse de forma nativa en el kernel desde la versión <a href="https://github.com/torvalds/linux/blob/master/Documentation/networking/tuntap.txt">2.1.60</a>. Debemos pues, comprobar si el kernel de nuestro servidor tiene habilitado este soporte, ya que al utilizar un servicio VPS algunas capas de virtualización vServers y OpenVZ requieren que TUN esté habilitado en la máquina host y podría ser necesario contactar con el administrador o proveedor del servicio para ser habilitado y así poder continuar. Debemos asegurar pues que el módulo CONFIG\_TUN está habilitado en el kernel, esto lo podemos ver rápidamente con la siguiente línea de comandos:</p> 19 <pre><code>test ! -c /dev/net/tun && echo openvpn requires tun support || echo tun is available</code></pre> 20 <p>Entonces, para OpenVPN debemos crear:</p> 21 <ul> 22 <li>Una clave privada y un certificado para la autoridad de certificación (CA) de firma.</li> 23 <li>Una clave privada y un certificado firmado para el servidor.</li> 24 <li>Una clave privada y un certificado firmado para cada cliente.</li> 25 <li>Un grupo <i>Diffie-Hellman</i> para el servidor.</li> 26 </ul> 27 <p>Descarga de <emb>easy-rsa</emb>:</p> 28 <pre><code>wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.6/EasyRSA-unix-v3.0.6.tgz 29 tar xvf EasyRSA-unix-v3.0.6.tgz 30 cd EasyRSA-v3.0.6/</code></pre> 31 <p>En el directorio <emb>easy-rsa</emb> crearemos el subderectorio <emb>vars</emb>:</p> 32 <pre><code>cp vars.example vars</code></pre> 33 <p>Con el contenido:</p> 34 <pre><code># vars 35 set_var EASYRSA_REQ_COUNTRY "AR" 36 set_var EASYRSA_REQ_PROVINCE "Arrakis" 37 set_var EASYRSA_REQ_CITY "Arrakeen" 38 set_var EASYRSA_REQ_ORG "Dune" 39 set_var EASYRSA_REQ_EMAIL "paul_muaddib@atreides" 40 set_var EASYRSA_REQ_OU "arrakis"</code></pre> 41 <p>Posteriormente, realizaremos las distintas acciones de inicialización y generación de claves RSA y certificados para servidor y clientes.</p> 42 <pre><code>./easyrsa init-pki # Inicialización del entorno PKI de EasyRSA 43 ./easyrsa gen-dh # Generación de parámetros de Diffie-Hellman 44 ./easyrsa build-ca nopass # RSA key and CA certificate 45 46 # Clave RSA y certificado de servidor (arrakis) 47 ./easyrsa gen-req arrakis nopass 48 ./easyrsa sign-req server arrakis 49 50 # Clave RSA y cliente de servidor (oldscizor) 51 ./easyrsa gen-req oldscizor nopass 52 ./easyrsa sign-req client oldscizor 53 54 openvpn --genkey --secret ta.key # Generación de clave TLS</code></pre> 55 <h1>Distribución de claves</h1> 56 <p>En este punto ya tenemos estos archivos generados y listos para usar:</p> 57 <ul> 58 <li>pki/dh.pem (para el servidor arrakis)</li> 59 <pre><code>-----BEGIN DH PARAMETERS----- 60 MIIBCAKCAQEApjAQiuMycSId2FAZ4NE0XV7df7dr7dpBdnknV7Qlm4j8U2P5RAIM 61 XRGkvcNotsMU+7KlNGDpb3IpUwI7PqyWDXqMbDxnSD2dQEIhUWKNGf7M44HOPlRZ 62 68nv0mtMjKVFTs6dR54Ls1Vtn8hGRtYR37w7+ZGUDHj09pZbu6H0DMbgV8xa3w40 63 rAqLntOsWRfCmnQFUSo5WsKMyZo6muYuWaAk6CCezB9s4hYHj1rCEktyc+bzYNUl 64 bOXvqGKQpLSGTSlxD4jpm4JQkmy8YZbhzs2c9SDeJAbCEg6d6s+uPs5uPF6Db4Ig 65 yR0TYXnzxhrduR3913F8ObnH5RpS/1aj2wIBAg== 66 -----END DH PARAMETERS----- 67 </code></pre> 68 <li>pki/ca.crt (para el servidor arrakis y sus clientes)</li> 69 <pre><code>-----BEGIN CERTIFICATE----- 70 MIIDPzCCAiegAwIBAgIUUsznqWLj39zqrv/7zzjKxXGOy24wDQYJKoZIhvcNAQEL 71 BQAwEjEQMA4GA1UEAwwHYm9ycmFtZTAeFw0yMTExMTkyMjU4MzNaFw0zMTExMTcy 72 MjU4MzNaMBIxEDAOBgNVBAMMB2JvcnJhbWUwggEiMA0GCSqGSIb3DQEBAQUAA4IB 73 DwAwggEKAoIBAQDUKxAELgW2HIfcR1XUmmnbMm+5zuP9Vr8EJK48QAA4e2fxkKgT 74 bKeAp9Qvf70vXwZSHy1R6GB4cgL8WTQK+MlWkbpSqAOQnDA+00k4PLWYgAH1igKz 75 aC2DAo/vKGquTNw8s+6iXj6+mD9qoCNI7EQdhhLDVlpRZuTY0XVqLYe/b59RTZgD 76 JsDIrZBAbdmekJvAxZS2WLTPR3OqMQee3bX83mMGZWvEB2FBoIGFqTFGeKmoBWNa 77 8jGqKO79Ctu70NhZmYcWo9jjMS7u8IumgbXWnGUs9Ls6Az59uqBEzW/nNjicZedm 78 EdwRBZwjvWC4Jd00ycJXgAoZraVAL+l2IsEVAgMBAAGjgYwwgYkwHQYDVR0OBBYE 79 FK/VNL2AA5kYY5iIJdBRhq5gl9H4ME0GA1UdIwRGMESAFK/VNL2AA5kYY5iIJdBR 80 hq5gl9H4oRakFDASMRAwDgYDVQQDDAdib3JyYW1lghRSzOepYuPf3Oqu//vPOMrF 81 cY7LbjAMBgNVHRMEBTADAQH/MAsGA1UdDwQEAwIBBjANBgkqhkiG9w0BAQsFAAOC 82 AQEAd9h22YXkgNrmzYOSVoE3oL8VoFZ7PwWvZ5FOPL9GjzO8YIRjCEO+LRVCFawX 83 qfIMZMN6usG05TNnHHPMj0bLs24wE3TQYCK4hJazH+sZQVUqr8nsU2Z4N3TYBAgq 84 7DMZrBI6I+LKk1BWYv7z3idYA+cWDY9b3b8bDbezugp9k+truAke0U8X7vSeiVlV 85 Gdm9510W43YpnTuXALkl/S1WDwQWl8035ZfMdcukdUWjM/TD2euwdd29Aj4BKpv9 86 tk9fpoxef/Ju0YbHRcgtXJc9VHodc4cq+zCSGq1j7eJ27hFGn4rIOAF6eTFT/lK7 87 QbrEG1umBi/qSosL9vtOKV85aQ== 88 -----END CERTIFICATE----- 89 </code></pre> 90 <li>pki/private/ca.key (para firmar en la máquina de la CA)</li> 91 <pre><code>-----BEGIN RSA PRIVATE KEY----- 92 MIIEpAIBAAKCAQEA1CsQBC4FthyH3EdV1Jpp2zJvuc7j/Va/BCSuPEAAOHtn8ZCo 93 E2yngKfUL3+9L18GUh8tUehgeHIC/Fk0CvjJVpG6UqgDkJwwPtNJODy1mIAB9YoC 94 s2gtgwKP7yhqrkzcPLPuol4+vpg/aqAjSOxEHYYSw1ZaUWbk2NF1ai2Hv2+fUU2Y 95 AybAyK2QQG3ZnpCbwMWUtli0z0dzqjEHnt21/N5jBmVrxAdhQaCBhakxRnipqAVj 96 WvIxqiju/Qrbu9DYWZmHFqPY4zEu7vCLpoG11pxlLPS7OgM+fbqgRM1v5zY4nGXn 97 ZhHcEQWcI71guCXdNMnCV4AKGa2lQC/pdiLBFQIDAQABAoIBAGxckhGQb9pTOBCJ 98 Xoz3UJljaSy9PjRl2amEEnkzNumiHbSC7VT+aY6MKRMZasaHAfNvePYceSkLEftQ 99 lAQGjM5qH3+X0DpLi1iLERpn51e8CUQe+MIosxX2eQzs14+uMc3PGFJVUDaIC9up 100 blwQT7nEgFDECd0JcFhMomtYVbyvl8qvJvGAAy4K38A2lGrb9Ju7QXcLvj54ss6n 101 zCF0bK3XGfjsujsnpb0ZvGNDG5mUyrJinVFMvyn7jI2W2JsA3sZ6lgJ2W7pN6kwy 102 IgiNqoms46i3jNUb2SGSFAf1qXJmkUOxfmacbRV96XwLYE1xY97LcS1LPk5jzV3a 103 KTmeQQECgYEA7ykfmrKdYQql467lMwCxFYbixLQoout2G6IxDwPLS0M28TkFID5h 104 +puczQD6dwImk4yykJeZQ2d16FHbhZwzRw7UYDevt5Mr+l4i5eoa1z9vqZlOi0/+ 105 FBtIh4GDl3isWAA6KUf1zcu9aKQInALnYlnYgxeNlklHCRqwRWmD2OcCgYEA4xtm 106 Y9tAhwnK32PXTMkRNgOtPEoKdifs3hfzCigJ/NGcIGzliGcJ+6j0lLmM9kEDfdKI 107 i+FfqFXUYiHb1QINN6kL6LqjImiqXvN2Km066ijcmaMaw6QzzWcCku9Ekp5isM6R 108 DL154tB0wIQyWVI7p8OTJN+L0RwCiwB8KQmgaqMCgYBFScnBPNxBoB8djq8SjrG/ 109 RdvvFy7qvIL0UJIcAoJkZK3HRzjH9arXOzw7XHwz/GiGuO2G3JTnpVLQot6RoAZv 110 IMnAsoFzEu1b1OgRajiqgdNs9GCAFgXLd3gU4h3oxWpQ+IfhK9r3634NkfB4mpLE 111 uLj0id9YWhR9e8Dz6zTqowKBgQCrN+AUzpqydDaH/py2HiyknVcAyg1jESyqMEIi 112 WRdWjKz5YUAXex9ypOloKw/UJCW+uXgKhWp53eOV7FLxH2/Zk9APsI4HBgPUPBbN 113 W7Z8DTxrdCVcdDI93Dh7kHoRU+mxxLpkcYEv99rdvYy7/JxPGcqYlRSzHTvpkf8J 114 bWGMowKBgQDr86QJkIx614U5uXh7cf+b7fLL9cfdtt2Niyhlvjn9Qb+F9ohhW4qO 115 mWLiGcNTzCcC/kC/Ao+aWeHwwEdW1OXOIMmqW1gEhTD4s1/TgszpOWStBiNsyABz 116 L3FdzCbX6aERkx/vZHJ7XWuvfcEMc+/36H7JeRfZzB1ZPyK8d2Jrww== 117 -----END RSA PRIVATE KEY----- 118 </code></pre> 119 <li>pki/private/arrakis.key (para el servidor arrakis)</li> 120 <pre><code>-----BEGIN PRIVATE KEY----- 121 MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDKePacVhI1vkgF 122 wpHFLe9FfnNbopgscMA2w2aAsPvXOA2ATwvTLFxXccqtfx3A4BrWD+LmOU6WXU41 123 3uofi15Wq2RCNb1q5exHnFHeHol15UOjpHvarZYAmYuAJ47HnSu3QXwuLeNuvE5x 124 muJLisP2hBh2bggIxm8aGapbjJdyPi4ri6WRwFScIcxQLmOethzDRbVUemGXbwhK 125 UQLhYtmcx0Y0KXiuzqECZgh7S6M2+vSEzDYTHT+fXa+N/0QGvPYQm2cZjcHUp5hs 126 gPCAk4/T4A76kaAowJSB/rHFsyPXzjHpiwBqBZL805OLJhSo1w9iXdaUCCpfZRgE 127 BaJ+KVvFAgMBAAECggEBAL/G4XdlAyyKhfeGusG0Z41AX42tLUvyo+17GUzN1kyd 128 GBSvSnkD7Jca/illXM5CtsiJFZaRM0GzMRBPixzDymB3SKh59GcbTrjpdJXaAMN9 129 m5qVgoa3onwA86Q4U8H4ud6DFVc8Oc66Z+atGKkKz+BgcDdEszF0muly4+yA9zXJ 130 w6XMqBYUndbPulE+pljegmSEW2CJgGh6dE81uv3/d+B3svOBTcV0DpMXXyN7+l/u 131 UQ91GGu21A7zOyt1ta2eCu9ixDoPFNfB5aFSOpxIlwpx0FhWZAjXC/cRMQu7Czbh 132 Y3oBimX2LtQOEeqQ9Q1PtU0mBnH+cL0g8qjMRy92KkUCgYEA/xqCq/jp2gfazEf/ 133 PsnTouHk0fou+Mzn9tm+nl7wp9kvjlbfmEy4bqru+7woVCkIxSTnTj3wjC5jhzH7 134 Cj3csCY9HIC2YYRo/bdslQFnyh/Wp7OKr1oM8tjC+mACHmTCCASeYHfJrx9av0DO 135 dRgOTFFqgqvFxqV2992DbsBrRLsCgYEAyy8bOGDgMgXs5tBFQBwoMBa5WFs8P+Sg 136 CCZPXins+uTWm7AnbFAdZakgHS+Hriv6hRCc54hON82sD2XbYn7yC6MKQ/7C+7VE 137 qCWOHa740YGSSAMwDC6PhJ58QMpBhAAHknY8I4i9D2S3XtjufZpbbD07roERZ7+/ 138 EjVE0Nf0GX8CgYB8+xQCBRUtCKQdaTiYHnFdX6anaRcSNfF/cvZ8yK7GzRULe2xY 139 RV4megBTvL9VXDU7wPTB1H7Bbwi797SyM9SnSFSwXi78X87AXtkHt4SN9kNILiJH 140 /qpRX/lGiTsAgQS+wOSHBqj87zOad7mujHaU1V6FXnqq8+3xSclWvVbQeQKBgQCx 141 U9pw2POyFMPOKeTWb/yPA7YdK/soVDNrCWxpZTPjQEcgt5ugh0cwy2swraO/2bgZ 142 3Abkd2y0fTb2dVID44EBsPiroTOxFGHoUmZ295dG2cu+N7H+X8B34Q3WSe7l8lSp 143 ebFA3f0K6z6yc6epTUcO714gDZsQLiPnE0CM+HycpwKBgQC6Cuygg8TFFdT2Cg4K 144 bUmNPVRPeE/klijZCcSCfUnlAFU1Y0NIJxGnY+o+293GZRRzwyee6yeptc27AMH6 145 5XLwiciqCKq6y0XBN3dRRWG4pJNFXZ/mfdHy6eTC5lgjS1oaQO5Zc3HY1/TNbZsn 146 RIEjfcJGNOyjQeW5QYx9zE3ebQ== 147 -----END PRIVATE KEY----- 148 </code></pre> 149 <li>pki/issued/arrakis.crt (para el servidor arrakis)</li> 150 <pre><code>Certificate: 151 Data: 152 Version: 3 (0x2) 153 Serial Number: 154 92:05:11:0c:a7:1d:b2:3e:bb:24:93:e9:8a:82:09:d7 155 Signature Algorithm: sha256WithRSAEncryption 156 Issuer: CN=borrame 157 Validity 158 Not Before: Nov 19 22:58:59 2021 GMT 159 Not After : Feb 22 22:58:59 2024 GMT 160 Subject: CN=borrame 161 Subject Public Key Info: 162 Public Key Algorithm: rsaEncryption 163 RSA Public-Key: (2048 bit) 164 Modulus: 165 00:ca:78:f6:9c:56:12:35:be:48:05:c2:91:c5:2d: 166 ef:45:7e:73:5b:a2:98:2c:70:c0:36:c3:66:80:b0: 167 fb:d7:38:0d:80:4f:0b:d3:2c:5c:57:71:ca:ad:7f: 168 1d:c0:e0:1a:d6:0f:e2:e6:39:4e:96:5d:4e:35:de: 169 ea:1f:8b:5e:56:ab:64:42:35:bd:6a:e5:ec:47:9c: 170 51:de:1e:89:75:e5:43:a3:a4:7b:da:ad:96:00:99: 171 8b:80:27:8e:c7:9d:2b:b7:41:7c:2e:2d:e3:6e:bc: 172 4e:71:9a:e2:4b:8a:c3:f6:84:18:76:6e:08:08:c6: 173 6f:1a:19:aa:5b:8c:97:72:3e:2e:2b:8b:a5:91:c0: 174 54:9c:21:cc:50:2e:63:9e:b6:1c:c3:45:b5:54:7a: 175 61:97:6f:08:4a:51:02:e1:62:d9:9c:c7:46:34:29: 176 78:ae:ce:a1:02:66:08:7b:4b:a3:36:fa:f4:84:cc: 177 36:13:1d:3f:9f:5d:af:8d:ff:44:06:bc:f6:10:9b: 178 67:19:8d:c1:d4:a7:98:6c:80:f0:80:93:8f:d3:e0: 179 0e:fa:91:a0:28:c0:94:81:fe:b1:c5:b3:23:d7:ce: 180 31:e9:8b:00:6a:05:92:fc:d3:93:8b:26:14:a8:d7: 181 0f:62:5d:d6:94:08:2a:5f:65:18:04:05:a2:7e:29: 182 5b:c5 183 Exponent: 65537 (0x10001) 184 X509v3 extensions: 185 X509v3 Basic Constraints: 186 CA:FALSE 187 X509v3 Subject Key Identifier: 188 E0:66:B9:0A:80:55:5E:38:F8:F4:E4:48:05:03:01:91:C8:DF:31:AB 189 X509v3 Authority Key Identifier: 190 keyid:AF:D5:34:BD:80:03:99:18:63:98:88:25:D0:51:86:AE:60:97:D1:F8 191 DirName:/CN=borrame 192 serial:52:CC:E7:A9:62:E3:DF:DC:EA:AE:FF:FB:CF:38:CA:C5:71:8E:CB:6E 193 194 X509v3 Extended Key Usage: 195 TLS Web Server Authentication 196 X509v3 Key Usage: 197 Digital Signature, Key Encipherment 198 X509v3 Subject Alternative Name: 199 DNS:borrame 200 Signature Algorithm: sha256WithRSAEncryption 201 20:50:34:d1:0a:7c:21:d4:ba:ac:82:34:c2:bf:95:56:15:e3: 202 f1:24:b6:a1:4a:48:8a:f8:eb:12:8b:a7:58:6a:a0:77:a0:67: 203 66:1a:0f:b0:b0:e0:04:ef:59:38:54:10:46:8b:35:18:c3:92: 204 b8:79:cb:c1:0b:96:f1:b9:81:8a:8e:00:01:07:4d:f4:b1:cf: 205 7b:35:36:1d:78:c2:42:28:06:0e:9f:c9:28:1b:c7:a7:a1:d3: 206 24:c0:07:d1:d4:3d:a5:8e:f2:fa:fc:87:e7:c6:54:0c:bb:48: 207 14:8d:5a:cf:7c:d7:91:1d:4f:a1:bf:8e:a9:3f:45:f2:98:b1: 208 8b:cc:75:dc:b1:47:8f:1e:ca:4f:51:21:f4:c5:e3:bd:ff:e1: 209 0f:b1:e2:29:35:c5:17:ef:5e:7a:3d:d0:88:af:47:4b:9e:33: 210 bd:20:15:56:a8:09:64:83:2b:ec:67:f6:4b:fd:7c:ca:80:07: 211 ef:8c:f8:d1:e2:64:4a:48:0d:a2:88:f1:df:9c:14:3b:83:a7: 212 3f:2a:99:b4:42:76:17:23:89:24:07:ad:38:d0:7a:5b:95:bb: 213 62:dc:a4:84:6a:1d:95:32:d7:ec:21:0f:62:c0:03:fe:00:c7: 214 db:3c:da:9e:49:2e:61:a3:54:94:86:27:48:04:35:c6:d9:c9: 215 72:6f:52:28 216 -----BEGIN CERTIFICATE----- 217 MIIDYjCCAkqgAwIBAgIRAJIFEQynHbI+uyST6YqCCdcwDQYJKoZIhvcNAQELBQAw 218 EjEQMA4GA1UEAwwHYm9ycmFtZTAeFw0yMTExMTkyMjU4NTlaFw0yNDAyMjIyMjU4 219 NTlaMBIxEDAOBgNVBAMMB2JvcnJhbWUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw 220 ggEKAoIBAQDKePacVhI1vkgFwpHFLe9FfnNbopgscMA2w2aAsPvXOA2ATwvTLFxX 221 ccqtfx3A4BrWD+LmOU6WXU413uofi15Wq2RCNb1q5exHnFHeHol15UOjpHvarZYA 222 mYuAJ47HnSu3QXwuLeNuvE5xmuJLisP2hBh2bggIxm8aGapbjJdyPi4ri6WRwFSc 223 IcxQLmOethzDRbVUemGXbwhKUQLhYtmcx0Y0KXiuzqECZgh7S6M2+vSEzDYTHT+f 224 Xa+N/0QGvPYQm2cZjcHUp5hsgPCAk4/T4A76kaAowJSB/rHFsyPXzjHpiwBqBZL8 225 05OLJhSo1w9iXdaUCCpfZRgEBaJ+KVvFAgMBAAGjgbIwga8wCQYDVR0TBAIwADAd 226 BgNVHQ4EFgQU4Ga5CoBVXjj49ORIBQMBkcjfMaswTQYDVR0jBEYwRIAUr9U0vYAD 227 mRhjmIgl0FGGrmCX0fihFqQUMBIxEDAOBgNVBAMMB2JvcnJhbWWCFFLM56li49/c 228 6q7/+884ysVxjstuMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAsGA1UdDwQEAwIFoDAS 229 BgNVHREECzAJggdib3JyYW1lMA0GCSqGSIb3DQEBCwUAA4IBAQAgUDTRCnwh1Lqs 230 gjTCv5VWFePxJLahSkiK+OsSi6dYaqB3oGdmGg+wsOAE71k4VBBGizUYw5K4ecvB 231 C5bxuYGKjgABB030sc97NTYdeMJCKAYOn8koG8enodMkwAfR1D2ljvL6/IfnxlQM 232 u0gUjVrPfNeRHU+hv46pP0XymLGLzHXcsUePHspPUSH0xeO9/+EPseIpNcUX7156 233 PdCIr0dLnjO9IBVWqAlkgyvsZ/ZL/XzKgAfvjPjR4mRKSA2iiPHfnBQ7g6c/Kpm0 234 QnYXI4kkB6040Hpblbti3KSEah2VMtfsIQ9iwAP+AMfbPNqeSS5ho1SUhidIBDXG 235 2clyb1Io 236 -----END CERTIFICATE----- 237 </code></pre> 238 <li>pki/private/oldscizor.key (para el cliente oldscizor)</li> 239 <pre><code>-----BEGIN PRIVATE KEY----- 240 MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC4jweH+SP7WRcl 241 /0CLgn/NVoWmokRmgqFa+pURpt9KzZvXXSPRE2AhTO5YuX//NPd17QFJTMpvowC4 242 AqwBTvVkFI9LpUNVNvIoVmMGy2rleUdwiZra2k2Q/Nyk6rbWSbYKelNwl4BzR671 243 217f5tuoXsPsDk4Qd7f3GP4peFBRFXy4tbHXIaKpOIHnvzFBlOPJ5g+w3fdH5f3c 244 6mMEvPqBgpBRcBfntZKWLw0IyMbetVA7Tvp6XhpOjvR7P/64lcmTJiu9/h10CBcO 245 TX1cvh3P9K9NOrBUl1UuMXwjuKCWoGVebZo3evD2OFRNv7XYcjpSQCDpq2l9YvRH 246 WCbPdfhZAgMBAAECggEBAJZsBQBfIGOQ9lwC0fGjGFUc6uuon8VJPQfw6qSrdJz8 247 PcNnZ3TVrOkXUcBA2MEBw5t64yyCCRC6MzDHBLhASaMbWruV4+5FTVNxLV7xVpvX 248 oFFp5ivv935vicpkf0biZxvdHbrL0GalC0XZWVd2SpvNOTRhaGDloqwj06urIxMh 249 4ohf5jPr38ly2yaoAygHEXa4xRc0JUed4n+wgdCAaUU//+9LwSaDl2xa3GX/6B4Y 250 NLpzYVGysgqR+CP7T4OFLMdwYuRFWSWkfwTAZL8840W9OMPOZ1j1P+q8CNnHZAVT 251 86LvEI6K8aD/UOwUnujMkUZoIUY5Pq77bBdTrcol1oECgYEA8/dHWXi/VVJpLhd1 252 g2QEbj5p5xbYOzpRv84j0qcLXMwtHajLpeCZtjawTmIsUwoJuigJxCLpRUm9Y9Iq 253 qqzmfTb5Jghadg8SuiWDb0ih8XPZtnt3Ayo3NKWqeDri3Rw8MK9gWpRL3SQCoHbK 254 D4RZR5tW+1HeqDat9gVtaGUMqWkCgYEAwamTbZO7EYGHUJXw8GvFZEmZYpkHeNUS 255 o4LEgWYCDC5I7ba11zRQf7nyFNBfeFcznf/K3wEsjOl2SRKezubK1xwFQE+gVxQ5 256 FbkGDUtY45lxuygpLfFOcVjktEaKO3HNmLnyaEa7Jta0n0SG25oKDVoruSXReehY 257 Aqr+DE/GiXECgYEA3zZuB4ScurnuFgfMsux9yUg9qPuT14ziYvV+fSvtD3iYBrz7 258 psc6nCapZO4Z09gpUjNzzAqNF6ICMCSIeSQ8tm/nwU5/RelAnyPXf6ga00nF9lo8 259 Z57mZ7rzn5FxJBDDWV/8bqOkTa624I4PDedvsD6GdOdRKuLsg14v3gYmcZECgYB3 260 La9PkMlfhZHLUuraWcg45l4hYkFJ5/43Z8McSrVZ36X7vCP9kvEzGTBUBMOr4CYg 261 xoiHYkaTVRz47R+T/k23wUOuBxKKZCSZLKr/xW2nawelgJqO7mAyutzL4FkzKd63 262 bT8zUsvbo+e118sSG6KyAtrDbvWRix2WTrpWw0VP0QKBgGTiq7IoHrR6FURR3DLR 263 xAhMnXgOzLtENgCWxcRoapsaM1BaAQBnjCys06MoG1BX3qQAzIy+BTYMAUHhYoRn 264 /lZdhJGS6OGfzdyGTyHzHzfTr2Jknisksww3LOYkYdpfco+BlWF9CV0ST1jj9v00 265 AlVH0P5K3lFKD9q5/8oIcWDm 266 -----END PRIVATE KEY----- 267 </code></pre> 268 <li>pki/issued/oldscizor.crt (para el cliente oldscizor)</li> 269 <pre><code>Certificate: 270 Data: 271 Version: 3 (0x2) 272 Serial Number: 273 e4:e7:35:27:0e:39:9b:a0:0a:38:c0:3e:89:a9:a2:44 274 Signature Algorithm: sha256WithRSAEncryption 275 Issuer: CN=borrame 276 Validity 277 Not Before: Nov 19 22:59:14 2021 GMT 278 Not After : Feb 22 22:59:14 2024 GMT 279 Subject: CN=oldscizor 280 Subject Public Key Info: 281 Public Key Algorithm: rsaEncryption 282 RSA Public-Key: (2048 bit) 283 Modulus: 284 00:b8:8f:07:87:f9:23:fb:59:17:25:ff:40:8b:82: 285 7f:cd:56:85:a6:a2:44:66:82:a1:5a:fa:95:11:a6: 286 df:4a:cd:9b:d7:5d:23:d1:13:60:21:4c:ee:58:b9: 287 7f:ff:34:f7:75:ed:01:49:4c:ca:6f:a3:00:b8:02: 288 ac:01:4e:f5:64:14:8f:4b:a5:43:55:36:f2:28:56: 289 63:06:cb:6a:e5:79:47:70:89:9a:da:da:4d:90:fc: 290 dc:a4:ea:b6:d6:49:b6:0a:7a:53:70:97:80:73:47: 291 ae:f5:db:5e:df:e6:db:a8:5e:c3:ec:0e:4e:10:77: 292 b7:f7:18:fe:29:78:50:51:15:7c:b8:b5:b1:d7:21: 293 a2:a9:38:81:e7:bf:31:41:94:e3:c9:e6:0f:b0:dd: 294 f7:47:e5:fd:dc:ea:63:04:bc:fa:81:82:90:51:70: 295 17:e7:b5:92:96:2f:0d:08:c8:c6:de:b5:50:3b:4e: 296 fa:7a:5e:1a:4e:8e:f4:7b:3f:fe:b8:95:c9:93:26: 297 2b:bd:fe:1d:74:08:17:0e:4d:7d:5c:be:1d:cf:f4: 298 af:4d:3a:b0:54:97:55:2e:31:7c:23:b8:a0:96:a0: 299 65:5e:6d:9a:37:7a:f0:f6:38:54:4d:bf:b5:d8:72: 300 3a:52:40:20:e9:ab:69:7d:62:f4:47:58:26:cf:75: 301 f8:59 302 Exponent: 65537 (0x10001) 303 X509v3 extensions: 304 X509v3 Basic Constraints: 305 CA:FALSE 306 X509v3 Subject Key Identifier: 307 ED:06:85:8E:70:F2:2E:F4:46:68:AE:5D:A8:97:8D:63:84:DB:1E:3D 308 X509v3 Authority Key Identifier: 309 keyid:AF:D5:34:BD:80:03:99:18:63:98:88:25:D0:51:86:AE:60:97:D1:F8 310 DirName:/CN=borrame 311 serial:52:CC:E7:A9:62:E3:DF:DC:EA:AE:FF:FB:CF:38:CA:C5:71:8E:CB:6E 312 313 X509v3 Extended Key Usage: 314 TLS Web Client Authentication 315 X509v3 Key Usage: 316 Digital Signature 317 Signature Algorithm: sha256WithRSAEncryption 318 af:30:c2:94:52:f0:01:0f:3b:e9:93:47:b0:bf:9e:9a:d5:e0: 319 07:21:af:b8:3f:1e:80:b1:37:bf:89:f6:d3:9d:07:da:27:9b: 320 ce:3c:e6:54:14:a2:7b:8f:4c:43:67:b3:1c:12:a9:4e:5f:e3: 321 6f:f6:a6:48:94:9a:f6:a4:75:d6:31:0e:2b:ab:18:7c:54:c1: 322 ae:82:09:d6:1f:2d:2d:c3:3a:1d:5b:7a:92:b7:13:16:40:da: 323 69:3a:47:52:b0:cb:f5:53:71:ba:53:a6:3e:77:33:04:d7:ae: 324 d7:8a:09:56:23:6b:2c:2c:29:a6:eb:b9:54:79:10:40:4b:d4: 325 db:71:ed:fd:5d:cc:9f:bc:fd:9a:dc:58:ed:de:c2:62:9d:bc: 326 fc:3e:13:7e:9b:f5:8c:02:cf:aa:30:e4:86:68:7b:f0:0a:83: 327 18:03:af:50:c2:ed:8c:c0:63:cf:48:38:e1:c5:10:a2:06:40: 328 09:d9:63:31:b8:0f:c4:b6:2d:8f:0b:ee:b8:29:a5:e5:30:2e: 329 48:63:f6:20:27:38:3c:22:e3:52:7b:bf:29:50:82:3e:b1:b6: 330 80:bd:3b:f0:a3:ba:1b:4f:22:40:07:e0:4c:89:13:68:32:b0: 331 d0:a8:32:6b:3a:f5:1d:10:8d:26:34:10:c7:5d:ec:1a:5a:6d: 332 c3:e8:0e:db 333 -----BEGIN CERTIFICATE----- 334 MIIDUDCCAjigAwIBAgIRAOTnNScOOZugCjjAPompokQwDQYJKoZIhvcNAQELBQAw 335 EjEQMA4GA1UEAwwHYm9ycmFtZTAeFw0yMTExMTkyMjU5MTRaFw0yNDAyMjIyMjU5 336 MTRaMBQxEjAQBgNVBAMMCW9sZHNjaXpvcjCCASIwDQYJKoZIhvcNAQEBBQADggEP 337 ADCCAQoCggEBALiPB4f5I/tZFyX/QIuCf81WhaaiRGaCoVr6lRGm30rNm9ddI9ET 338 YCFM7li5f/8093XtAUlMym+jALgCrAFO9WQUj0ulQ1U28ihWYwbLauV5R3CJmtra 339 TZD83KTqttZJtgp6U3CXgHNHrvXbXt/m26hew+wOThB3t/cY/il4UFEVfLi1sdch 340 oqk4gee/MUGU48nmD7Dd90fl/dzqYwS8+oGCkFFwF+e1kpYvDQjIxt61UDtO+npe 341 Gk6O9Hs//riVyZMmK73+HXQIFw5NfVy+Hc/0r006sFSXVS4xfCO4oJagZV5tmjd6 342 8PY4VE2/tdhyOlJAIOmraX1i9EdYJs91+FkCAwEAAaOBnjCBmzAJBgNVHRMEAjAA 343 MB0GA1UdDgQWBBTtBoWOcPIu9EZorl2ol41jhNsePTBNBgNVHSMERjBEgBSv1TS9 344 gAOZGGOYiCXQUYauYJfR+KEWpBQwEjEQMA4GA1UEAwwHYm9ycmFtZYIUUsznqWLj 345 39zqrv/7zzjKxXGOy24wEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYDVR0PBAQDAgeA 346 MA0GCSqGSIb3DQEBCwUAA4IBAQCvMMKUUvABDzvpk0ewv56a1eAHIa+4Px6AsTe/ 347 ifbTnQfaJ5vOPOZUFKJ7j0xDZ7McEqlOX+Nv9qZIlJr2pHXWMQ4rqxh8VMGuggnW 348 Hy0twzodW3qStxMWQNppOkdSsMv1U3G6U6Y+dzME167XiglWI2ssLCmm67lUeRBA 349 S9Tbce39XcyfvP2a3Fjt3sJinbz8PhN+m/WMAs+qMOSGaHvwCoMYA69Qwu2MwGPP 350 SDjhxRCiBkAJ2WMxuA/Eti2PC+64KaXlMC5IY/YgJzg8IuNSe78pUII+sbaAvTvw 351 o7obTyJAB+BMiRNoMrDQqDJrOvUdEI0mNBDHXewaWm3D6A7b 352 -----END CERTIFICATE----- 353 </code></pre> 354 <li>ta.key (para el servidor arrakis y sus clientes)</li> 355 <pre><code>-----BEGIN OpenVPN Static key V1----- 356 c7a3b92eea6eaf2392b8610c05e9fe87 357 4b69bdaa948b136098d953681e3bc71b 358 c33a32c2936952af6ad02faf64148da9 359 40f4bbfb5d8e97c0404702c618af2668 360 8e7adf84d37343ce5ab6d13e4e5a7dd3 361 5351c90db4c04dd6794088625cbb7238 362 8fb03663b5cffc00626d7acc00a44f3b 363 157edd5f98c3e7b04f8815a98801d34e 364 e38c2fb39608d8658d528a65879326f0 365 8c501f46b8cfa3e6520e5e116263fad9 366 1e28fe1c4f949d8117b190f800e70614 367 7d5cfc6c8312e566971f83115087497d 368 f23803399d963ad9653e56845a610d4c 369 886fba216f71ae6d87fc3b07c2bd288f 370 4eb81dff04ffd2dede81993cb29bd470 371 3e0a42728ae814f08694d4be46bdbd74 372 -----END OpenVPN Static key V1----- 373 </code></pre> 374 </ul> 375 <p>Enviando claves al servidor (en este caso es la misma máquina):</p> 376 <pre><code>cp pki/dh.pem /etc/openvpn/server/ 377 cp pki/ca.crt /etc/openvpn/server/ 378 cp pki/private/arrakis.key /etc/openvpn/server/ 379 cp pki/issued/arrakis.crt /etc/openvpn/server/ 380 cp ta.key /etc/openvpn/server/</code></pre> 381 <p>Enviando claves al cliente oldscizor (mediante SCP):</p> 382 <pre><code>scp pki/private/oldscizor.key oldscizor.es:/tmp 383 scp pki/issued/oldscizor.crt oldscizor.es:/tmp 384 scp pki/ca.crt oldscizor.es:/tmp 385 scp ta.key oldscizor.es:/tmp</code></pre> 386 <p>Entonces, en el cliente oldscizor, los movemos a su localización final:</p> 387 <pre><code>sudo mv /tmp/oldscizor.key /etc/openvpn 388 sudo mv /tmp/oldscizor.crt /etc/openvpn 389 sudo mv /tmp/ca.crt /etc/openvpn 390 sudo mv /tmp/ta.key /etc/openvpn</code></pre> 391 <h1>Configuración de servidor arrakis</h1> 392 <pre><code>port 1194 393 proto udp 394 dev tun 395 ca /etc/openvpn/server/ca.crt 396 cert /etc/openvpn/server/arrakis.crt 397 key /etc/openvpn/server/arrakis.key 398 dh /etc/openvpn/server/dh.pem 399 server 10.10.0.0 255.255.255.0 400 ifconfig-pool-persist ipp.code 401 keepalive 10 120 402 tls-auth ta.key 0 403 cipher AES-256-CBC 404 persist-key 405 persist-tun 406 status openvpn-status.log 407 log /var/log/openvpn 408 verb 3 409 explicit-exit-notify 1</code></pre> 410 <h1>Configuración de cliente oldscizor</h1> 411 <pre><code>client 412 dev tun 413 proto udp 414 remote arrakis 1194 415 resolv-retry infinite 416 nobind 417 persist-key 418 persist-tun 419 ca /etc/openvpn/ca.crt 420 cert /etc/openvpn/oldscizor.crt 421 key /etc/openvpn/oldscizor.key 422 remote-cert-tls server 423 tls-auth /etc/openvpn/ta.key 1 424 cipher AES-256-CBC 425 verb 3</code></pre> 426 <h1>Asignación de una dirección IP fija al cliente oldscizor</h1> 427 <pre><code>echo "client-config-dir ccd" >> /etc/openvpn/server/arrakis.conf 428 mkdir /etc/openvpn/server/ccd 429 echo "ifconfig-push 10.10.0.100 255.255.255.0" >> /etc/openvpn/server/ccd/oldscizor</code></pre> 430 <h1>Permiso de comunicación 'client to client'</h1> 431 <pre><code>echo "client-to-client" >> /etc/openvpn/server/arrakis.conf</code></pre> 432 <h1>Generación de nuevo cliente maquina</h1> 433 <p>En el servidor arrakis:</p> 434 <pre><code>./easyrsa gen-req maquina nopass 435 ./easyrsa sign-req client maquina 436 cp pki/private/maquina.key /tmp 437 cp pki/issued/maquina.crt /tmp 438 cp pki/ca.crt /tmp 439 cp ta.key /tmp 440 echo "ifconfig-push 10.10.0.101 255.255.255.0" >> /etc/openvpn/server/ccd/maquina</code></pre> 441 <p>En el nuevo cliente:</p> 442 <pre><code>scp arrakis:/tmp/maquina.key /etc/openvpn 443 scp arrakis:/tmp/maquina.crt /etc/openvpn 444 scp arrakis:/tmp/ca.crt /etc/openvpn 445 scp arrakis:/tmp/ta.key /etc/openvpn 446 echo "client 447 dev tun 448 proto udp 449 remote arrakis 1194 450 resolv-retry infinite 451 nobind 452 persist-key 453 persist-tun 454 ca /etc/openvpn/ca.crt 455 cert /etc/openvpn/maquina.crt 456 key /etc/openvpn/maquina.key 457 remote-cert-tls server 458 tls-auth /etc/openvpn/ta.key 1 459 cipher AES-256-CBC 460 verb 3 461 auth-nocache" > /etc/openvpn/maquina.conf 462 chmod 700 /etc/openvpn/*</code></pre> 463 </body> 464 </html>