Two-factor Authentication with PKCS#11 | OpenVPN 2 Cookbook

Sign In Start Free Trial

Book Overview & Buying
Table Of Contents
Feedback & Rating

OpenVPN 2 Cookbook

4.1 (12)

OpenVPN 2 Cookbook

4.1 (12)

Overview of this book

OpenVPN 2 Cookbook

OpenVPN 2 Cookbook

Credits

Credits

About the Author

About the Author

About the Reviewers

About the Reviewers

www.PacktPub.com

www.PacktPub.com

Preface

Preface

Free Chapter

Point-to-Point Networks

Point-to-Point Networks

Introduction

Shortest setup possible

OpenVPN secret keys

Multiple secret keys

Plaintext tunnel

Routing

Configuration files versus the command-line

Complete site-to-site setup

3-way routing

Client-server IP-only Networks

Client-server IP-only Networks

Introduction

Setting up the public and private keys

Simple configuration

Server-side routing

Using 'client-config-dir' files

Routing: subnets on both sides

Redirecting the default gateway

Using an 'ifconfig-pool' block

Using the status file

Management interface

Proxy-arp

Client-server Ethernet-style Networks

Client-server Ethernet-style Networks

Introduction

Simple configuration—non-bridged

Enabling client-to-client traffic

Bridging—Linux

Bridging—Windows

Checking broadcast and non-IP traffic

External DHCP server

Using the status file

Management interface

PKI, Certificates, and OpenSSL

PKI, Certificates, and OpenSSL

Introduction

Certificate generation

xCA: a GUI for managing a PKI (Part 1)

xCA : a GUI for managing a PKI (Part 2)

OpenSSL tricks: x509, pkcs12, verify output

Revoking certificates

The use of CRLs

Checking expired/revoked certificates

Intermediary CAs

Multiple CAs: stacking, using --capath

Two-factor Authentication with PKCS#11

Two-factor Authentication with PKCS#11

Introduction

Initializing a hardware token

Getting a hardware token ID

Using a hardware token

Using the management interface to list PKCS#11 certificates

Selecting a PKCS#11 certificate using the management interface

Generating a key on the hardware token

Private method for getting a PKCS#11 certificate

Pin caching example

Scripting and Plugins

Scripting and Plugins

Introduction

Using a client-side up/down script

Windows login greeter

Using client-connect/client-disconnect scripts

Using a 'learn-address' script

Using a 'tls-verify' script

Using an 'auth-user-pass-verify' script

Script order

Script security and logging

Using the 'down-root' plugin

Using the PAM authentication plugin

Troubleshooting OpenVPN: Configurations

Troubleshooting OpenVPN: Configurations

Introduction

Cipher mismatches

TUN versus TAP mismatches

Compression mismatches

Key mismatches

Troubleshooting MTU and tun-mtu issues

Troubleshooting network connectivity

Troubleshooting 'client-config-dir' issues

How to read the OpenVPN log files

Troubleshooting OpenVPN: Routing

Troubleshooting OpenVPN: Routing

Introduction

The missing return route

Missing return routes when 'iroute' is used

All clients function except the OpenVPN endpoints

Source routing

Routing and permissions on Windows

Troubleshooting client-to-client traffic routing

Understanding the 'MULTI: bad source' warnings

Failure when redirecting the default gateway

Performance Tuning

Performance Tuning

Introduction

Optimizing performance using 'ping'

Optimizing performance using 'iperf'

OpenSSL cipher speed

Compression tests

Traffic shaping

Tuning UDP-based connections

Tuning TCP-based connections

Analyzing performance using tcpdump

OS Integration

OS Integration

Introduction

Linux: using NetworkManager

Linux: using 'pull-resolv-conf'

MacOS: using Tunnelblick

Windows Vista/7: elevated privileges

Windows: using the CryptoAPI store

Windows: updating the DNS cache

Windows: running OpenVPN as a service

Windows: public versus private network adapters

Windows: routing methods

Advanced Configuration

Advanced Configuration

Introduction

Including configuration files in config files

Multiple remotes and remote-random

Details of ifconfig-pool-persist

Connecting using a SOCKS proxy

Connecting via an HTTP proxy

Connecting via an HTTP proxy with authentication

Using dyndns

IP-less setups (ifconfig-noexec)

New Features of OpenVPN 2.1 and 2.2

New Features of OpenVPN 2.1 and 2.2

Introduction

Inline certificates

Connection blocks

Port sharing with an HTTPS server

Routing features: redirect-private, allow-pull-fqdn

Handing out the public IPs

OCSP support

New for 2.2: the 'x509_user_name' parameter

Index

Index

Customer Reviews

4.1 (12)

5 star

41.7%

4 star

33.3%

3 star

16.7%

2 star

8.3%

1 star

0%

Using a hardware token

This recipe will demonstrate how to use a hardware token as a replacement for an X509 certificate and the corresponding private key.

Getting ready

We use the following network layout:

Keep the hardware token from the first recipe at hand. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Fedora 12 Linux and OpenVPN 2.1.1. Keep the server configuration file basic-udp-server.conf from the Chapter 2 recipe Server-side routing at hand.

How to do it...

Start the server using the configuration file basic-udp-server.conf:
```
[root@server]# openvpn --config basic-udp-server.conf
```

Next, create the client configuration file:

client
proto udp
remote openvpnserver.example.com

port 1194

dev tun
nobind

ca       /etc/openvpn/cookbook/ca.crt
tls-auth /etc/openvpn/cookbook/ta.key 1

ns-cert-type server

pkcs11-providers /usr/lib64/libeTPkcs11.so
pkcs11-id 'Aladdin\x20Ltd\x2E/eToken/001a01a9/Cookbook/20100703'

The last directive pkcs11...

Visually different images

CONTINUE READING

83

Tech Concepts

36

Programming languages

73

Tech Tools

Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.

Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.

50+ new titles added per month and exclusive early access to books as they are being written.

OpenVPN 2 Cookbook

Search

Your notes and bookmarks