PKI, Certificates, and OpenSSL | OpenVPN 2 Cookbook

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents

OpenVPN 2 Cookbook

4.1 (12)

OpenVPN 2 Cookbook

4.1 (12)

Overview of this book

OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

Credits

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Preface

Free Chapter

Point-to-Point Networks

Point-to-Point Networks

Introduction

Shortest setup possible

OpenVPN secret keys

Multiple secret keys

Plaintext tunnel

Routing

Configuration files versus the command-line

Complete site-to-site setup

3-way routing

Client-server IP-only Networks

Client-server IP-only Networks

Introduction

Setting up the public and private keys

Simple configuration

Server-side routing

Using 'client-config-dir' files

Routing: subnets on both sides

Redirecting the default gateway

Using an 'ifconfig-pool' block

Using the status file

Management interface

Proxy-arp

Client-server Ethernet-style Networks

Client-server Ethernet-style Networks

Introduction

Simple configuration—non-bridged

Enabling client-to-client traffic

Bridging—Linux

Bridging—Windows

Checking broadcast and non-IP traffic

External DHCP server

Using the status file

Management interface

PKI, Certificates, and OpenSSL

PKI, Certificates, and OpenSSL

Introduction

Certificate generation

xCA: a GUI for managing a PKI (Part 1)

xCA : a GUI for managing a PKI (Part 2)

OpenSSL tricks: x509, pkcs12, verify output

Revoking certificates

The use of CRLs

Checking expired/revoked certificates

Intermediary CAs

Multiple CAs: stacking, using --capath

Two-factor Authentication with PKCS#11

Two-factor Authentication with PKCS#11

Introduction

Initializing a hardware token

Getting a hardware token ID

Using a hardware token

Using the management interface to list PKCS#11 certificates

Selecting a PKCS#11 certificate using the management interface

Generating a key on the hardware token

Private method for getting a PKCS#11 certificate

Pin caching example

Scripting and Plugins

Scripting and Plugins

Introduction

Using a client-side up/down script

Windows login greeter

Using client-connect/client-disconnect scripts

Using a 'learn-address' script

Using a 'tls-verify' script

Using an 'auth-user-pass-verify' script

Script order

Script security and logging

Using the 'down-root' plugin

Using the PAM authentication plugin

Troubleshooting OpenVPN: Configurations

Troubleshooting OpenVPN: Configurations

Introduction

Cipher mismatches

TUN versus TAP mismatches

Compression mismatches

Key mismatches

Troubleshooting MTU and tun-mtu issues

Troubleshooting network connectivity

Troubleshooting 'client-config-dir' issues

How to read the OpenVPN log files

Troubleshooting OpenVPN: Routing

Troubleshooting OpenVPN: Routing

Introduction

The missing return route

Missing return routes when 'iroute' is used

All clients function except the OpenVPN endpoints

Source routing

Routing and permissions on Windows

Troubleshooting client-to-client traffic routing

Understanding the 'MULTI: bad source' warnings

Failure when redirecting the default gateway

Performance Tuning

Performance Tuning

Introduction

Optimizing performance using 'ping'

Optimizing performance using 'iperf'

OpenSSL cipher speed

Compression tests

Traffic shaping

Tuning UDP-based connections

Tuning TCP-based connections

Analyzing performance using tcpdump

OS Integration

OS Integration

Introduction

Linux: using NetworkManager

Linux: using 'pull-resolv-conf'

MacOS: using Tunnelblick

Windows Vista/7: elevated privileges

Windows: using the CryptoAPI store

Windows: updating the DNS cache

Windows: running OpenVPN as a service

Windows: public versus private network adapters

Windows: routing methods

Advanced Configuration

Advanced Configuration

Introduction

Including configuration files in config files

Multiple remotes and remote-random

Details of ifconfig-pool-persist

Connecting using a SOCKS proxy

Connecting via an HTTP proxy

Connecting via an HTTP proxy with authentication

Using dyndns

IP-less setups (ifconfig-noexec)

New Features of OpenVPN 2.1 and 2.2

New Features of OpenVPN 2.1 and 2.2

Introduction

Inline certificates

Connection blocks

Port sharing with an HTTPS server

Routing features: redirect-private, allow-pull-fqdn

Handing out the public IPs

OCSP support

New for 2.2: the 'x509_user_name' parameter

Index

Index

Certificate generation

This recipe will demonstrate how to create and sign a certificate request using plain openssl commands. This is slightly different from using the easy-rsa scripts, but very instructive.

Getting ready

Set up the easy-rsa certificate environment using the first recipe from Chapter 2, Client-server IP-only Networks, by sourcing the vars file. This recipe was performed on a computer running Fedora 12 Linux but it can easily be run on Windows or MacOS.

How to do it...

Before we can use plain openssl commands to generate and sign a request, there are a few environment variables that need to be set. These variables are not set in the vars file by default.

Add the missing environment variables:

       $ cd /etc/openvpn/cookbook
       $ . ./vars
       $ export KEY_CN=dummy
       $ export KEY_OU=dummy
       $ export KEY_NAME=dummy
       $ export OPENSSL_CONF=/etc/openvpn/cookbook/openssl.cnf

Note that the openssl.cnf file is part of the easy-rsa distribution and should already...

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

OpenVPN 2 Cookbook

Search

Your notes and bookmarks