Hello!
Every business eventually needs remote access, sometimes unexpectedly.
Practically every IT specialist faces the need to organize remote access to their networks.
Like many others, I found myself needing this with a sense of urgency. After weighing all the pros and cons, sifting through tons of information, and delving a bit into the theory, I decided to get started with the installation.
For security purposes, I chose OpenVPN with the following setup: I installed a virtual machine on a server running Windows Server 2012, and on that, I also ran Windows Server 2012, where I set up the OpenVPN server that issued and signed certificates.
For convenience, let’s call it the 'certification server'. Next, I took the server certificate, loaded it into Mikrotik, and on the Mikrotik router, I set up OpenVPN with accounts and profiles. I also used the certification server to issue the client certificate.
The implementation was, of course, challenging, and although my experience in such matters at that time was, let's say, limited, in terms of security, it was not the worst decision.
This setup worked for a while, and I was given new instructions: to migrate the certification server to Linux while maintaining connectivity with Mikrotik—clients should not be affected.
At that point, my Linux knowledge was limited to Ubuntu 16.04 LTS with a graphical interface, which I used as a terminal to connect via RDP to the Windows server. In other words, sudo apt-get -f install -y, and no further.
After researching which Linux OS would be more stable and promising for my organization, I settled on CentOS 7 Minimal.
Initially, I decided to dive a bit into the theory to understand how it works. I watched tutorial videos on the channel (Not an advertisement, they were just the first I came across). A woman with a pleasant voice introduced me to the basics of working in the chosen OS.
To start, I launched Hyper-V on my computer, installed CentOS 7 Minimal there, created an Admin user during installation, and completely closed ssh for root. After saying goodbye to the beautiful multicolored screen, I plunged into the black-and-white world of the terminal.
I think there's no point in describing the software installation process; it's better to focus on the issues that arose during it, for which I had to write a small script (it's below. You can find descriptions of each utility on the internet, but at the time I was doing this, this script didn't exist yet; everything was done for the first time, by feel and guesswork).
In the script, I tried to automate the installation of the minimally necessary utilities for the server, disable Selinux, enable the Epel repository, install OpenVPN, and so on. Below is the script itself; it's simple, but it can be used. I won't break it down, but if anyone needs it, feel free to ask.
After using the script, you will have an already configured OpenVPN server, winking with a green light.
#!/bin/bash
cd /etc/sysconfig/
sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' selinux
sudo setenforce 0
cd /home/Admin
sudo yum update -y
sudo yum install epel-release -y
sudo yum install mc -y
sudo yum install nano -y
sudo cp /usr/share/mc/syntax/sh.syntax /usr/share/mc/syntax/unknown.syntax
sudo yum install chrony -y
sudo systemctl start chronyd
sudo systemctl enable chronyd
sudo yum install net-tools -y
sudo yum install iftop -y
sudo yum install htop -y
sudo yum install lsof -y
sudo yum install dos2unix -y
sudo yum install wget -y
sudo yum install tcpdump -y
sudo yum install openvpn -y
wget https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz
sudo tar -xvzf EasyRSA-3.0.3.tgz
sudo chown -R Admin:Admin /var/log
sudo chmod 755 /var/log
mkdir /var/log/openvpn
mkdir /etc/openvpn/ccd
sudo chown -R Admin:Admin /etc/openvpn/ccd
sudo chown -R Admin:Admin /var/log/openvpn
chmod 755 /etc/openvpn/ccd
chmod 755 /var/log/openvpn
echo >/var/log/openvpn/openvpn-status.log
echo >/var/log/openvpn/openvpn.log
sudo chown -R Admin:Admin /etc/resolv.conf
chmod 755 /etc/resolv.conf
echo nameserver 8.8.8.8 >>/etc/resolv.conf
cd /etc/openvpn/
sudo /home/Admin/EasyRSA-3.0.3/easyrsa init-pki
sudo chown -R Admin:Admin /etc/openvpn
chmod 755 /etc/openvpn
echo set_var EASYRSA_DN "org" >/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_COUNTRY "RU" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_KEY_SIZE 4096 >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_PROVINCE "LIP" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_CITY "Lipetsk" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_ORG "Cool-Admin" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_EMAIL "xxx.ru" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_OU "Our_ORG" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_REQ_CN "changeme" >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_CERT_EXPIRE 3650 >>/home/Admin/EasyRSA-3.0.3/test
echo set_var EASYRSA_DH_KEY_SIZE=2048 >>/home/Admin/EasyRSA-3.0.3/test
sudo /home/Admin/EasyRSA-3.0.3/easyrsa build-ca nopass
sudo /home/Admin/EasyRSA-3.0.3/easyrsa build-server-full Serv nopass
sudo /home/Admin/EasyRSA-3.0.3/easyrsa build-client-full Client1 nopass
sudo /home/Admin/EasyRSA-3.0.3/easyrsa --vars=vars gen-dh
sudo /home/Admin/EasyRSA-3.0.3/easyrsa --vars=vars gen-crl
mkdir keys
sudo chown -R Admin:Admin /etc/openvpn/keys
chmod 755 /etc/openvpn/keys
sudo cp /etc/openvpn/pki/ca.crt /etc/openvpn/keys
sudo cp /etc/openvpn/pki/dh.pem /etc/openvpn/keys
sudo cp /etc/openvpn/pki/crl.pem /etc/openvpn/keys
sudo cp /etc/openvpn/pki/issued/Serv.crt /etc/openvpn/keys
sudo cp /etc/openvpn/pki/private/Serv.key /etc/openvpn/keys
echo port 443 >/etc/openvpn/server.conf
echo proto udp >>/etc/openvpn/server.conf
echo dev tun >>/etc/openvpn/server.conf
echo ca /etc/openvpn/keys/ca.crt >>/etc/openvpn/server.conf
echo cert /etc/openvpn/keys/Serv.crt >>/etc/openvpn/server.conf
echo key /etc/openvpn/keys/Serv.key >>/etc/openvpn/server.conf
echo dh /etc/openvpn/keys/dh.pem >>/etc/openvpn/server.conf
echo crl-verify /etc/openvpn/keys/crl.pem >>/etc/openvpn/server.conf
echo client-config-dir /etc/openvpn/ccd >>/etc/openvpn/server.conf
echo topology subnet >>/etc/openvpn/server.conf
echo server 172.21.0.0 255.255.255.0 >>/etc/openvpn/server.conf
echo route 172.21.0.0 255.255.255.0 >>/etc/openvpn/server.conf
echo push "dhcp-option DNS 8.8.8.8" >>/etc/openvpn/server.conf
echo push "dhcp-option DNS 8.8.4.4" >>/etc/openvpn/server.conf
echo keepalive 10 120 >>/etc/openvpn/server.conf
echo persist-key >>/etc/openvpn/server.conf
echo persist-tun >>/etc/openvpn/server.conf
echo status /var/log/openvpn/openvpn-status.log >>/etc/openvpn/server.conf
echo log-append /var/log/openvpn/openvpn.log >>/etc/openvpn/server.conf
echo verb 2 >>/etc/openvpn/server.conf
echo mute 20 >>/etc/openvpn/server.conf
echo daemon >>/etc/openvpn/server.conf
echo mode server >>/etc/openvpn/server.conf
echo user nobody >>/etc/openvpn/server.conf
echo group nobody >>/etc/openvpn/server.conf
sudo chown -R Admin:Admin /etc/sysctl.conf
chmod 755 /etc/sysctl.conf
echo net.ipv4.ip_forward=1 >>/etc/sysctl.conf
sudo sysctl -p /etc/sysctl.conf
sudo systemctl enable openvpn@server
sudo systemctl start openvpn@server
sudo systemctl status openvpn@serverThe installation of OpenVPN did not go entirely successfully.
Not knowing the specifics of rights policies in Linux systems, I spent a lot of time studying logs and assigning the required rights to all files.
When the OpenVPN button turned green, I was very happy, but as it turned out, that was just the beginning. Out of sheer optimism, I planned to replace the root certificates and the crl.pem file, hoping everything would work. In the end, I needed to transfer the following files from the server to Windows:
Serv.crt — Server Certificate
Serv.key — Server Key
Ca.crt — Root Certificate
Ca.key — Root Key
Crl.pem — Certificate Revocation List file
Dh.pem — Diffie-Hellman key
Index.txt — File containing information about active certificates
Serial — it also determines the validity of the certificates
I also needed the certs_by_serial folder, the vars file, and all client keys and certificates.
On Mikrotik, the certificates remained in place, so everything worked.
Problems arose when I tried to revoke a certificate; it didn't work at all — the index.txt file needed to be converted to Unix format, and I didn't do that right away. I used the dos2unix utility.
Now the certificates were being revoked, but they continued to work without any issues because Mikrotik was unaware that they had been revoked and needed to be informed somehow.
After reading the instructions and consulting with Alexander ERI (thank you very much!), I set up a simple HTTP Apache server on the certification server and published a file of revoked certificates on it. I completely restricted access to it, except for the published file from one IP.
In the Mikrotik terminal, under the /System/Certificates/CRL tab, I specified the path to the published crl.pem. It should be noted that Mikrotik accepts only HTTP and absolute addresses for the CRL tab, so it should look approximately like this:
Everything worked, at least for the 6.4.2.x RouterOS versions, but client configurations had to be created manually, which was disappointing and caused a lot of inconvenience. When a week later I needed to create configurations for about 50 clients, I decided to speed up the process and used a piece of someone else's script found on the internet.
The script works like this: after launching, we specify the 'client name', answer the question 'set password or not', and then we receive a ready configuration file 'client.ovpn', with integrated certificates and settings. To use it, we need to be in /etc/openvpn. I will comment on the lines where the path needs to be replaced with your own. It is also necessary to create a file with client settings so that the script can insert them during configuration creation.
#!/bin/bash
function newClient () {
echo ""
echo "Tell me a name for the client."
echo "Use one word only, no special characters."
until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
read -rp "Client name: " -e CLIENT
done
echo ""
echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client"
echo " 2) Use a password for the client"
until [[ "$PASS" =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 PASS
done
#cd /etc/openvpn/easy-rsa/ || return
case $PASS in
1)
sudo /home/admin/EasyRSA-3.0.3/easyrsa build-client-full "$CLIENT" nopass
;;
2)
echo "You will be asked for the client password below"
./easyrsa build-client-full "$CLIENT"
;;
esac
# Generates the custom client.ovpn
cp /etc/openvpn/client-template.txt "$home/home/admin/IT/Temp/$CLIENT.ovpn"
#Директория в которой хранится файл с настройками клиента.
#Директория, в которой сформируется файл конфигурации
{
echo "<ca>"
cat "/etc/openvpn/pki/ca.crt" #Директория хранения корневого сертификата
echo "</ca>"
echo "<cert>"
awk '/BEGIN/,/END/' "/etc/openvpn/pki/issued/$CLIENT.crt" #Директория с созданным #сертификатом клиента
echo "</cert>"
echo "<key>"
cat "/etc/openvpn/pki/private/$CLIENT.key" #Директория с созданным ключом клиента
echo "</key>"
} >> "$home/home/admin/IT/Temp/$CLIENT.ovpn" #Директория, в которой сформируется файл #конфигурации
echo ""
echo "Client $CLIENT added, the configuration file is available at $home/admin/IT/OVPN/Temp/$CLIENT.ovpn."
echo "Download the .ovpn file and import it in your OpenVPN client."
exit 0;
}
newClient
After a while, the new directive to prohibit remote access forced me to shut down this server and the working link with Mikrotik. A new OpenVPN server was created for the IT department staff, which now runs entirely on CentOS. But that's a completely different story.
I express my deep gratitude to Ivan and Pavel for their help in editing the article.
Source: habr.com
