Hardware & Software

vineri, 10 iunie 2011

Openvpn network with tun

SERVER SIDE

Before you start you need to generate ca.crt, server.crt, server.key, dh1024.pem and clients keys and certificates

#Begin server.conf
local x.x.x.x (server ip address)
port 1194
proto tcp
dev tun

ca /usr/local/etc/keys/ca.crt
cert /usr/local/etc/keys/server.crt
key /usr/local/etc/keys/server.key # This file should be kept secret
dh /usr/local/etc/keys/dh1024.pem
# Don't put this in the keys directory unless user nobody can read it
#crl-verify /usr/local/etc/keys/crl.pem

#Make sure this is your tunnel address pool
server 10.10.101.0 255.255.255.0
ifconfig-pool-persist ipp.txt
#This is the route to push to the client, add more if necessary
push "route 192.168.101.0 255.255.255.0"
push "route 192.168.102.0 255.255.255.0"
push "route 192.168.103.0 255.255.255.0"
push "route 192.168.104.0 255.255.255.0"
push "route 192.168.105.0 255.255.255.0"
push "route 192.168.106.0 255.255.255.0"
push "route 192.168.107.0 255.255.255.0"
push "route 192.168.108.0 255.255.255.0"
push "route 192.168.109.0 255.255.255.0"
push "route 192.168.110.0 255.255.255.0"
push "route 192.168.111.0 255.255.255.0"
push "route 192.168.112.0 255.255.255.0"

#push "dhcp-option DNS 10.0.0.2"
keepalive 10 120
cipher BF-CBC #Blowfish encryption
comp-lzo
user nobody
group nobody
persist-key
persist-tun
client-to-client
status openvpn-status.log
verb 6
mute 20
client-config-dir /usr/local/etc/openvpn/ccd
route 192.168.102.0 255.255.255.0
route 192.168.103.0 255.255.255.0
route 192.168.104.0 255.255.255.0
route 192.168.105.0 255.255.255.0
route 192.168.106.0 255.255.255.0
route 192.168.107.0 255.255.255.0
route 192.168.108.0 255.255.255.0
route 192.168.109.0 255.255.255.0
route 192.168.110.0 255.255.255.0
route 192.168.111.0 255.255.255.0
route 192.168.112.0 255.255.255.0

============================================================
cat ipp.txt

1.example.com,10.10.101.8
2.example.com,10.10.101.12
3.example.com,10.10.101.16
4.example.com,10.10.101.20
5.example.com,10.10.101.24
6.example.com,10.10.101.28
7.example.com,10.10.101.32
8.example.com,10.10.101.36
9.example.com,10.10.101.40
10.example.com,10.10.101.44
11.example.com,10.10.101.48

========================================================
# cd /usr/local/etc/openvpn/ccd
# ls

1.example.com
2.example.com
3.example.com
4.example.com
5.example.com
6.example.com
7.example.com
8.example.com
9.example.com
10.example.com
11.example.com

# cat 1.example.com
iroute 192.168.102.0 255.255.255.0
#
# cat 2.example.com
iroute 192.168.103.0 255.255.255.0
#
.......

===============================================================
===============================================================
CLIENT SIDE

client
dev tun
proto tcp
remote x.x.x.x 1194 (Server address)
resolv-retry infinite
nobind
persist-key
persist-tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
comp-lzo

FreeBSD Qmail Install

cd /usr/ports/mail/qmail
make config
make install

#TcpServer

cd /usr/ports/sysutils/ucspi-tcp
make install clean

#Daemontools
cd /usr/ports/sysutils/daemontools
make install clean
echo 'svscan_enable="YES"' >> /etc/rc.conf

#vpopmail
cd /usr/ports/mail/vpopmail
make install clean -DWITH_DOMAIN_QUOTAS -DWITH_SPAMASSASSIN SPAM_THRESHOLD=10

#courierimap
cd /usr/ports/mail/courier-imap
make config
make install clean

#qmailadmin

cd /usr/ports/mail/qmailadmin
make all install clean CGIBINDIR=www/cgi-bin-dist WEBDATADIR=www/data-dist

#qmail-scanner
cd /usr/ports/mail/qmail-scanner
make install

#$clamav
cd /usr/ports/security/clamav
make install

#vqadmin
cd /usr/ports/mail/vqadmin/
make install

miercuri, 1 iunie 2011

To Recreate Qmail's Queue

To Recreate Qmail's Queue

1. Log in to your server using SSH.
2. Type su -.
3. Enter the password for the root user on your server.
4. At the command prompt, stop Qmail by typing /etc/init.d/qmail stop.
cd /var/qmail/queue
rm -rf info intd local mess remote todo

mkdir mess

for i in `seq 0 22`; do
mkdir -p mess/$i
done

cp -r mess info
cp -r mess intd
cp -r mess local
cp -r mess remote
cp -r mess todo

chmod -R 750 mess todo
chown -R qmailq:qmail mess todo

chmod -R 700 info intd local remote
chown -R qmailq:qmail intd
chown -R qmails:qmail info local remote

5. Then, type the following:
6. Start Qmail by typing /etc/init.d/qmail start.

luni, 28 martie 2011

Extract mail addreses from files or downloaded site

======================================
grep -Eiorh '([[:alnum:]_.]+@[[:alnum:]_]+?\.[[:alpha:].]{2,6})' ./ > emails.txt
======================================

This makes grep find all email addresses and write them to file emails.txt in the current dir.
-E makes grep use extended regular expressions
-i does a case-insensitive match
-o makes grep return only the matching part of the line and not the whole line
-r makes grep look files recursively
-h stops grep from outputting the filename where the match was found

with the r parameter and the source file as ./ grep will go through all the files in the current directory and sub directories. The weird looking string in the line is the regular expression which looks for emails.

vineri, 31 decembrie 2010

FreeBSD Vlans

script version
=======================================
ifconfig vlan1874 create
ifconfig vlan1875 create

ifconfig vlan1874 vlan 1874 vlandev re0
ifconfig vlan1875 vlan 1875 vlandev re0

ifconfig vlan1874 inet x.x.x.x netmask 255.255.255.252
ifconfig vlan1875 inet y.y.y.y netmask 255.255.255.128

ifconfig re0 up
=======================================

rc.conf version
#######################################

cloned_interfaces="vlan1874 vlan1875"
ifconfig_vlan1874="inet x.x.x.x netmask 255.255.255.252 vlan 1874 vlandev re0"
ifconfig_vlan1875="inet y.y.y.y netmask 255.255.255.128 vlan 1875 vlandev re0"

ifconfig_re0="up"
#######################################

Cisco version
---------------------------------------
conf t

interface FastEthernet0/20
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1874,1875
switchport mode trunk
no shutdown

---------------------------------------

miercuri, 26 august 2009

OpenVPN under FreeBSD

Getting OpenVPN to play nice with FreeBSD was not as easy as I normally
get from a FreeBSD port

This is due to both my learning on the fly and lack of good
BSD related documentation

Here's my notes on how I accomplished it

I hope it helps you

Feel free to use/share/mod

Sorry it's not yet all that perty

I used/did

FreeBSD 6.2/7.0

portsnap

cd /usr/ports/security/openvpn

make install clean

I like to copy the scripts to
/etc/openvpn

cd /usr/local/share/doc/openvpn/easy-rsa

mkdir /etc/openvpn

cp -R * /etc/openvpn

cd /etc/openvpn

Edit vars to your environment (http://openvpn.net/howto.html)

Now run the scripts. They are
bash scripts !!

sh

. ./vars

sh ./clean-all

sh ./build-ca

sh ./build-key-server server

sh ./build-key-pass client

sh ./build-dh (takes a while, grab a drink/chill)

Copy/Edit the config. I like to
keep the openvpn.conf in the normal configuration location. Edit
/usr/local/etc/rc.d/openvpn to adjust the default location

mkdir /usr/local/etc/openvpn

cp /usr/local/share/doc/openvpn/sample-config-files/server.conf
/usr/local/etc/openvpn/openvpn.conf

Edit
/usr/local/etc/openvpn/openvpn.conf to add the correct path to these
files

ca.crt

server.crt

server.key

dh1024.pem

Like

ca /etc/openvpn/2.0/keys/ca.crt

cert /etc/openvpn/2.0/keys/server.crt

key /etc/openvpn/2.0/keys/server.key

dh /etc/openvpn/2.0/keys/dh1024.pem

Add this to /etc/rc.conf

openvpn_enable="YES"

gateway_enable="YES"

openvpn_if="tun" for Tunneling

or

openvpn_if="tap" for Bridging

Make sure IP Forwarding is enabled

Check it with

sysctl -a |grep net.inet.ip.f

It should look like this

inet.inet.ip.forwarding: 1

If your /etc/rc.conf has gateway_enable="YES",
it will be set on reboot

You can have this /etc/rc.conf setting read without a reboot by doing
this

/etc/rc/d/routing restart

You can also set IP Forwarding manaully with sysctl

sysctl inet.inet.ip.forwarding=1

Edit
/usr/local/etc/openvpn/openvpn.conf enough
to get tunelling going

Leave it at that if you want

For me it was a pain to configure routing on the server side

I found it necessary to
add permanent routes back as static routes on my gateway did not seem
to help

This probably will be less painful if your gateway is your OpenVPN
server.

It wasnt for my install

I did eventually choose bridging but here's my route notes for history

FreeBSD

Temporary

route add -net 10.8.0.0/24 192.168.10.1

Permanent

/etc/rc.conf

static_routes="openvpn"

openvpn="-net 10.8.0.0/24 192.168.10.1"

Windows

Temporary

route ADD 10.8.0.0 MASK 255.255.255.0 192.168.10.1

Permanent

route -p ADD 10.8.0.0 MASK 255.255.255.0 192.168.10.1

Because of the routing pain, I then
tried Bridge

OpenVPN's scripts do not automatically create the bridge device

I could not find a solution

Based on some reading, I made a startup script to build the bridge at
startup

So far so good, It's probably a bad hack, maybe someone will help me
out here

/usr/local/etc/rc.d/create-bridge.sh

ifconfig bridge0 create

ifconfig bridge0 addm fxp0 addm tap0 up

ifconfig bridge0 inet 192.168.10.12 netmask 255.255.255.0

The script

1. Creates the bridge device

2. Adds a hardware NIC and TAP0 device, brings it up

3. Assigns a static IP

You'll have to edit the interface name and bridged IP to taste

For a bridge, you have to modify the
openvpn.conf

Change from tun to tap

dev tap

;dev tun

Modify server-bridge for the bridge IP
and pushed out IP range

server-bridge 192.168.10.12 255.255.255.0 192.168.10.100
192.168.110.109

Your dmesg will fill up with stuff
like this

arp: 192.168.10.2 is on fxp0 but got reply from 00:0a:5e:4d:37:ee on
bridge0

I turned off logging of this with sysctl
net.link.ether.inet.log_arp_wrong_iface=0

Add net.link.ether.inet.log_arp_wrong_iface=0

to /etc/sysctl.conf for a permanent change to this setting

Optional improved security

Use tls-auth

openvpn --genkey --secret ta.key

Copy ta.key to server and client

In the server configuration, add:

tls-auth ta.key 0

In the client configuration, add:

tls-auth ta.key 1

Larger RSA keys like 2048

Edit vars to include

export KEY_SIZE=2048

Revoke a certificate if someone gets
the boot (aka fired), hopefully not me

. ./vars

./revoke-full client2

This Creates crl.pem

Edit server config to point to this file

crl-verify crl.pem

Watch permissions

I needed to copy the crl.pem to /usr/local/sbin as the openvpn daemon
running as nobody could not see it in the location is was created

Adding authentication seemed an easy
improvement method for security

Add to client config

auth-user-pass

Add to server config

plugin /usr/local/lib/openvpn-auth-pam.so login

For lab use I did this

# Uncomment this directive if multiple clients

# might connect with the same certificate/key

# files or common names. This is recommended

# only for testing purposes. For production use,

# each client should have its own certificate/key

# pair.

#

# IF YOU HAVE NOT GENERATED INDIVIDUAL

# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,

# EACH HAVING ITS OWN UNIQUE "COMMON NAME",

# UNCOMMENT THIS LINE OUT.

;duplicate-cn

--duplicate-cn

Cipher strength hmmm

3 choices

;cipher BF-CBC        # Blowfish
(default)

;cipher AES-128-CBC   # AES

;cipher DES-EDE3-CBC # Triple-DES

Here's a cool command to test
throughput relative to cipher

openssl speed bf-cbc des-ede3 aes-128-cbc

The 'numbers' are in 1000s of bytes per second processed.

type
16 bytes     64 bytes    256
bytes   1024 bytes   8192 bytes

des ede3
11884.66k    11914.43k

11951.81k    11965.71k    11963.80k

blowfish cbc     52814.10k
53821.89k    54053.87k
54415.30k    53871.86k

aes-128 cbc      40888.23k
38975.23k    39728.08k
40106.78k    39669.99k

Want to delete a person in order to
create a new key or changes
password?

Delete their .crt .key and .csr

Then remove their entry from the OpenVPN keys directory in the file
index.txt

I was getting - Initialization
Sequence Completed With Errors

ip-win32 netsh - was the fix for me

Here's a rip from some docs

Make sure that the DHCP Client Service is started.

If the above fix doesn't work, then it's possible that the TAP-Win32
adapter is being firewalled. In general, it's safe to disable the
firewall on the TAP-Win32 adapter because OpenVPN makes sure that only
an authenticated machine on the other end of the connection can
communicate through it. Having said that, there have been reports that
certain third party firewalls will block the TAP-Win32 adapter after an
XP SP2 upgrade.

You can also try changing the ip-win32 setting to a non-DHCP method.
For example:

ip-win32 netsh

ip-win32 ipapi

ip-win32 manual

Signing the Certificate. I chose
the allow the users to create
their own key. They then sent me a csr which I signed ...

Transfer the csr to the server in /etc/openvpn/2.0/keys

From /etc/openvpn/2.0

sh

. ./vars

sh ./pkitool --sign dsuzuki

This creates a certificate *.crt in /etc/openvpn/2.0/keys

Sent this back to the client

Fast Forwarding

I dont know why I wrote this
down originally

It looks cool so I left it

net.inet.ip.fastforwarding=1

Here's notes from the FreeBSD Kernel Interfaces Manual for inet(4)

(ip.fastforwarding)

Boolean: enable/disable the use of fast IP forwarding code.

Defaults to off

When fast IP forwarding is enabled, IP packets are forwarded directly
to the appropriate network interface with direct processing to
completion, which

greatly improves the throughput.

All packets for local IP addresses, non-unicast, or with IP optionsare
handled by the normal IP input processing path.

All features of the normal (slow) IP forwarding path are supported
including firewall (through pfil(9) hooks) checking, except ipsec(4)
tunnel brokering.

The IP fastforwarding path does not generate ICMP redirect or source
quench messages.

Have fun