[es] - [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

jovanmal
Jovan Malešević
Sistem administrator
BL, Republika Srpska

Član broj: 6106
Poruke: 204
*.teol.net.

Sajt: flashofobvious.blogspot.c..

+2 Profil

[REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 07:57 - pre 144 meseci}

Pozdrav ljudi,

evo primjera konfiguracionog fajla za klijente OpenVPN-a:

Kao sto vidite, ovdje se moraju navesti putanje do fajlova koji sadrze sertifikate. Da li postoji nacin da se sertifikati sadrze u ovom fajlu (npr. da se navedu kao tekst)? Na ovaj nacin bi distribucija podesavanja za korisnike bila dosta laksa i svela bi se samo na kopiranje .ovpn fajla u folder Config kod klijenta.

Hvala

..blinding flash of the obvious..

Odgovor na temu

bachi
Vladimir Vučićević
System administrator
Beograd, Srbija

Član broj: 17912
Poruke: 5318

Sajt: www.bachi.in.rs

+2827 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 08:57 - pre 144 meseci}

Ne može.... Možeš malo da skratiš config tako što ćeš koristiti pkcs format, gde ti je i rootCA i private i public key u jednom fajlu...

Kada praviš sertifikate u easy-rsa kucaš build-key-pkcs12.bat "naziv ključa" (bez navodnika naravno) i sve je isto kao za klasičan ključ, samo što ćeš morati da kucaš i export password, a to se koristi ako hoćeš iz tog fajla da izvlačiš private key, što je za korisnike nebitna stvar.

Evo kako izgleda proces:

Code:
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

c:\Program Files\OpenVPN\easy-rsa>vars

c:\Program Files\OpenVPN\easy-rsa>build-key-pkcs12.bat Proba
Loading 'screen' into random state - done
Generating a 2048 bit RSA private key
..........................................................................+++
........................+++
writing new private key to 'keys\Proba.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [SR]:
State or Province Name (full name) [BG]:
Locality Name (eg, city) [Belgrade]:
Organization Name (eg, company) [Test OpenVPN]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:Proba
Email Address [[email protected]]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from openssl.cnf
Loading 'screen' into random state - done
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'SR'
stateOrProvinceName   :PRINTABLE:'BG'
localityName          :PRINTABLE:'Belgrade'
organizationName      :PRINTABLE:'Test OpenVPN'
commonName            :PRINTABLE:'Proba'
emailAddress          :IA5STRING:'[email protected]'
Certificate is to be certified until Jun 13 07:56:51 2022 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Loading 'screen' into random state - done
Enter Export Password:
Verifying - Enter Export Password:

c:\Program Files\OpenVPN\easy-rsa>

E onda u config fajlu za openvpn umesto ona tri reda gde se definišu ca, private i public key samo stavi ova linija:

Code:
pkcs12 naziv_fajla.p12

Ako ne radi, stavi noviju verziju openvpn softvera.

Evo teme na forumu: http://openvpn.net/archive/openvpn-users/2005-09/msg00221.html

... Vladimir Vučićević aka. Bachi
~~~ www.bachi.in.rs <<<<>>>> [email protected]
>>> It's nice to be important, but it's more important to be nice...

Odgovor na temu

cyofee
Filip Ađić
Novi Sad

Član broj: 207700
Poruke: 115

Sajt: filip.adjic.net

+52 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 09:04 - pre 144 meseci}

Za početak, nije neophodno navoditi apsolutne putanje do fajlova. Dovoljno je napisati:

Code:
ca ca.crt

cert test.crt

key test.key

I radiće savršeno ako su ta tri fajla prisutni u istom folderu kao i .ovpn. Kopirati 4 fajla u /config/ nije mnogo teže nego 1.

Odgovor na temu

niceness
Novi Sad

Član broj: 93992
Poruke: 993

+22 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 10:21 - pre 144 meseci}

Nisam radio sa openvpn vec duze vremena, ali mislio sam da openvpn podrzava inline certifikate od verzije 2.1?
Jedna brza google pretraga daje npr.:
http://openvpn.net/archive/openvpn-devel/2006-06/msg00001.html
http://www.packtpub.com/articl...eatures-of-openvpn-2-1-and-2-2

Primer sa sajt:

Code:
ca [inline]
cert [inline]
key [inline]
tls-auth [inline] 1

<ca>
-----BEGIN CERTIFICATE-----
# insert base64 blob from ca.crt
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
# insert base64 blob from client1.crt
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
# insert base64 blob from client1.key
-----END PRIVATE KEY-----
</key>

<tls-auth>
-----BEGIN OpenVPN Static key V1-----
# insert ta.key
-----END OpenVPN Static key V1-----
</tls-auth>

Nikad nisam probao pa ne znam jel li stvarno radi :)

Odgovor na temu

bachi
Vladimir Vučićević
System administrator
Beograd, Srbija

Član broj: 17912
Poruke: 5318

Sajt: www.bachi.in.rs

+2827 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 12:12 - pre 144 meseci}

U pa super, nisam ni znao ima to.

... Vladimir Vučićević aka. Bachi
~~~ www.bachi.in.rs <<<<>>>> [email protected]
>>> It's nice to be important, but it's more important to be nice...

Odgovor na temu

jovanmal
Jovan Malešević
Sistem administrator
BL, Republika Srpska

Član broj: 6106
Poruke: 204
*.teol.net.

Sajt: flashofobvious.blogspot.c..

+2 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 14:03 - pre 144 meseci}

Hvala vam za javljanje.

hmmm

napravio sam izmjene onako kako je niceness napisao, medjutim sada mi prilikom konektovanja izbacuje gresku: Error: private key password verification failed. Napravio sam novi sertifikat na kojem nisam navodio challenge password, medjutim opet isto... Mozda sam nesto propustio. Evo izmijenjene konfiguracije (sertifikati i remote ip su neznatno promijenjeni, zbog sigurnosnih mjera):

Code:

client

dev tap

#dev-node MyTAP  #If you renamed your TAP interface or have more than one TAP interface then remove the # at the beginning and change "MyTAP" to its name

proto udp

remote 100.103.97.87 1194  #You will need to enter you dyndns account or static IP address here. The number following it is the port you set in the server's config

route 192.168.100.0 255.255.255.0 vpn_gateway 3  #This it the IP address scheme and subnet of your normal network your server is on.  Your router would usually be 192.168.1.1

resolv-retry infinite

nobind

persist-key

persist-tun

ca [inline]
cert [inline]
key [inline]

<ca>
-----BEGIN CERTIFICATE-----
MIIDQzCCAqygAwIBAgIJAPDdBncWon+UMA0GCSqGSIb3DQEBBQUAMHUxCzAJBgNV
BAYTAkJBMQswCQYDVQQIEwJSUzESMBAGA1UEBxMJQmFuamFMdWthMREwDwYDVQQK
EwhSYWN1bmFyaTEUMBIGA1UEAxMLUmFjdW5hcmkgQ0ExHDAaBgkqhkiG9w0BCQEW
DXRlc3RAdGVzdC5jb20wHhcNMDgxMDExMTEwNzMyWhcNMTgxMDA5MTEwNzMyWjB1
MQswCQYDVQQGEwJCQTELMAkGA1UECBMCUlMxEjAQBgNVBAcTCUJhbmphTHVrYTER
MA8GA1UEChMIUmFjdW5hcmkxFDASBgNVBAMTC1JhY3VuYXJpIENBMRwwGgYJKoZI
hvcNAQkBFg10ZXN0QHRlc3QuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKB
gQDBzyFYLvcXIgsLP9rZ0VhCSH6ayWO/pjnTkwm2VjpdFX47BsxyAbL4n3VLypCe
IsvYUIIcvsdhjvgehjiwefpPR%^+-fewtyuwel4iOPI0-45T6pppwefyuQlc2f2NkPF7j
IkPsLL43Vb6ABaYRLSQvT70HhmWq3FQzOnMtraqfeTrVVQIDAQABo4HaMIHXMB0G
A1UdDgQWBBQriNIGv5iJZdC/c2GRqu0M0rdCszCBpwYDVR0jBIGfMIGcgBQriNIG
v5iJZdC/c2GRqu0M0rdCs6F5pHcwdTELMAkGA1UEBhMCQkExCzAJBgNVBAgTAlJT
MRIwEAYDVQQHEwlCYW5qYUx1a2ExETAPBgNVBAoTCFJhY3VuYXJpMRQwEgYDVQQD
EwtSYWN1bmFyaSBDQTEcMBoGCSqGSIb3DQEJARYNdGVzdEB0ZXN0LmNvbYIJAPDd
BncWon+UMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAFcbexqK1dQp+
6jzKwPoqH9Olu6ljByN+utkSW7UBp1Tz5vbqbhZ9NCgnn/73j7FoCBksZfbHOZkD
lJNBw/2uqECyrRNESlXRFuP6QrdU2rZ1aGoHT1BrLA0+iky/PkbzuYFFIWdpgvoq
89dXYHuitDoBVx44ZUEvHK33wBRSlis=
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
MIIDmDCCAwGgAwIBAgICAOowDQYJKoZIhvcNAQEFBQAwdTELMAkGA1UEBhMCQkEx
CzAJBgNVBAgTAlJTMRIwEAYDVQQHEwlCYW5qYUx1a2ExETAPBgNVBAoTCFJhY3Vu
YXJpMRQwEgYDVQQDEwtSYWN1bmFyaSBDQTEcMBoGCSqGSIb3DQEJARYNdGVzdEB0
ZXN0LmNvbTAeFw0xMjA2MTMxNzI0NDBaFw0yMjA2MTExNzI0NDBaMIGAMQswCQYD
VQQGEwJCQTELMAkGA1UECBMCUlMxEjAQBgNVBAcTCUJhbmphTHVrYTERMA8GA1UE
ChMIGFHgjkfewhiUhuifweIOui/ghyeiswYodeUDRD+wegtyu-dsfYlFYEWH2pvdmFu
Lm1hbGVzZXZpY0ByYWN1bmFyaS1ibC5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0A
MIGJAoGBAKNDnr/3SwXdIWyS0rFFDvgc1brlc59xmoxzuVBGi7vSo9kDm58lWrHO
k1JMHa4ycJRK7j8jZ6Qu443VsssKUlte/3e+EIARXCAs24s8XC0KJeMYi+SZoZQd
CLMV5vLjXBmnSNRIhcdxuM2Sfc8vrDg0r79/XHN0+UXaSMV2f1/pAgMBAAGjggEp
MIIBJTAJBgNVHRMEAjAAMC0GCWCGSAGG+EIBDQQgFh5FYXN5LVJTQSBHZW5lcmF0
ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFGjUDLlDZHWsXGjdmvzHNg1yz2e9MIGn
BgNVHSMEgZ8wgZyAFCuI0ga/mIll0L9zYZGq7QzSt0KzoXmkdzB1MQswCQYDVQQG
EwJCQTELMAkGA1UECBMCUlMxEjAQBgNVBAcTCUJhbmphTHVrYTERMA8GA1UEChMI
UmFjdW5hcmkxFDASBgNVBAMTC1JhY3VuYXJpIENBMRwwGgYJKoZIhvcNAQkBFg10
ZXN0QHRlc3QuY29tggkA8N0Gdxaif5QwEwYDVR0lBAwwCgYIKwYBBQUHAwIwCwYD
VR0PBAQDAgeAMA0GCSqGSIb3DQEBBQUAA4GBAI4eC1w0rTFdsrQLmNq2NDxnLK50
UUPVtgIiv6qV6HDfLMEFW6RSp2b5jr4cjItTZNF98IsTFuyzKLTdNPXYqnVSMeNc
tvKLxu/ZVTZkqRZKjDJuox/Mq3TPO6wR6dVZQKAclbNgXgT0QeFMDCPtxK0IlBoW
vdedyfkv8VEjF8W/
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
MIICWwIBAAKBgQCjQ56/90sF3SFsktKxRQ74HNW65XOfcZqMc7lQRou70qPZA5uf
JVqxzpNSTB2uMnCUSu4/I2ekLuON1bLLClJbXv93vhCAEVwgLNuLPFwtCiXjGIvk
maGUHQizFeby41wZp0jUSIXHcbjNkn3PL6w4NK+/f1xzdPlF2kjFdn9f6QIDAQAB
AoGANdEdbEP0+/rXgLWpM/wCojDHFzN5eI53FmMzK84FU6VskyWIT959Ve01TMSA
aCKCT6+fdzqReGJoaiGOLTW6zZLq6UPS5/oQTIzpRKZlC/xpxZHLWvhesrImWSrg
xr0LHvbNBf3IMy/Ag7VvKNEKMP66vxbmB8akVVwItAW5tA0CQQDOD02azpY7rCzj
/SGTLA/x/UjkoHUIOT*:/*ghui345OOOOGo9ECaeDkrgthM2kpLsfjoV069JTlXY
Ma2F5lcLAkEAytUeydJqzQWDbZU4HoIyDUt8U36OGRlCvFFCjfgjrNzBLm29HlBZ
DPopgqpUuEeKg2l31guPlU+erQRPbeStWwJAIcpapIc6FaD/X4e0CMlR+BHbm/k5
gBLk/xjcocDU5gOeD19AQ8DxRDv9xWm2Lt3MYCG27rte5DuHUkObO/jwzwJACi93
k1Twrgj315nlroqFLuu6e4rgYdxF4KUH/Y8XY4fWX5l9JLeOMTuiuAALrxFQoFa8
gNAlzq6n3jJYNsGD/wJALDoLLCyShIgh+mMeYJ5xPIebsqLYfnDr0N4P6IESlD7b
vlL7obPuZdoAZsiqkUkZGZ60DtrKKQ4PXgqktDZcQA==
-----END PRIVATE KEY-----
</key>

ns-cert-type server

cipher BF-CBC        # Blowfish (default) encrytion

comp-lzo

verb 1

..blinding flash of the obvious..

Odgovor na temu

niceness
Novi Sad

Član broj: 93992
Poruke: 993

+22 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{15.06.2012. u 15:01 - pre 144 meseci}

Stvarno za ovo nema nigde dokumetacije...
Ima nesto na http://www.mail-archive.com/[email protected]/msg12349.html

Znaci pokusaj da izbacis

ca [inline]
cert [inline]
key [inline]

ostavi ostalo.

Odgovor na temu

jovanmal
Jovan Malešević
Sistem administrator
BL, Republika Srpska

Član broj: 6106
Poruke: 204
*.teol.net.

Sajt: flashofobvious.blogspot.c..

+2 Profil

Re: [REŠENO] OpenVPN - Integrisanje sertifikata u .ovpn fajl

^{18.06.2012. u 09:59 - pre 144 meseci}

Pokusao sam sa izbacivanjem tog dijela - nista. Klijent mi javlja sljedece:

Code:

Mon Jun 18 08:27:32 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Mon Jun 18 08:27:32 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Mon Jun 18 08:27:32 2012 Cannot load private key file [[INLINE]]: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error: error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib
Mon Jun 18 08:27:32 2012 Error: private key password verification failed
Mon Jun 18 08:27:32 2012 Exiting

Pokusao sam da u /etc/openvpn/server.conf dodam liniju script-security 2, ali ponovo se isto desava (restartovao sam servis openvpn poslije izmjene).

OpenVPN se inace pokrece na virtuelnom serveru Ubuntu 10.04.2 LTS i nema nikakvih problema prilikom konektovanja kada su navedene putanje do sertifikata.

..blinding flash of the obvious..

Odgovor na temu