Basic IPv4 config – Linux/UNIX

Pentru diferite distributii Linux/UNIX, mai jos se afla modalitatile de configurare minimala a retelei.

Date initiale:

a) interfata ce trebuie configurata: eth0

b) nu exista probleme de nivel fizic (cablu, probleme interfata defecta, etc)

c) cablul este straight (pt conexiunea cu un switch) sau cross-over (pt conexiunea cu un alt PC, router, etc)

d) in cazul configurarii statice:

- IP: 172.16.1.10

- Netmask: 255.255.255.0

- Gateway: 172.16.1.1

- DNS: 193.19.192.15, 193.19.192.16

- Hostname: server

- MAC: 00:0E:2E:90:D8:11

Configurare on-the-fly (non-persistenta)

# ifconfig eth0 hw ether 00:0E:2E:90:D8:11

# ifconfig eth0 172.16.1.10 netmask 255.255.255.0

# route del default gw

# route add default gw 172.16.1.1

1. Fedora, CentOS, Mandriva, Red Hat

/etc/sysconfig/network-scripts/ifcfg-eth0

Static config	Dynamic config (dhcp)
DEVICE=eth0 BOOTPROTO=static HWADDR=00:0E:2E:90:D8:11 IPADDR=172.16.1.10 NETMASK=255.255.255.0 NETWORK=172.16.1.0 BROADCAST=172.16.1.255 ONBOOT=yes DNS1=193.19.192.15 DNS2=193.19.192.16	DEVICE=eth0 BOOTPROTO=dhcp HWADDR=00:0E:2E:90:D8:11 ONBOOT=yes

/etc/sysconfig/network

Static config	Dynamic config (dhcp)
NETWORKING=yes GATEWAY=172.16.1.1	NETWORKING=yes

# /etc/init.d/network restart

1. Debian, Ubuntu, Kubuntu, Xubuntu, Damn Small Linux (DSL), Linux Mint

/etc/network/interfaces

Static config	Dynamic config (dhcp)
auto lo iface lo inet loopback auto eth0 iface eth0 inet static hwaddress ether 01:02:03:04:05:06 address 172.16.1.10 netmask 255.255.255.0 network 172.16.1.0 broadcast 172.16.1.255 gateway 172.16.1.1 dns-nameservers 193.19.192.15	auto lo iface lo inet loopback auto eth0 iface eth0 inet dhcp hwaddress ether 01:02:03:04:05:06

2. Gentoo

/etc/conf.d/net

Static config	Dynamic config (dhcp)
config_eth0=( "172.16.1.10/24" ) routes_eth0=( "default via 172.16.1.1" ) mac_eth0="01:02:03:04:05:06"	config_eth0=( "dhcp" ) dhcpcd_eth0="-t 10" #timeout after 10sec mac_eth0="01:02:03:04:05:06"

/etc/resolv.conf

Static config

nameserver 193.19.192.15 nameserver 193.19.192.16

3. Slackware

/etc/rc.d/rc.inet1.conf

Static config	Dynamic config (dhcp)
IPADDR[0]="172.16.1.10" NETMASK[0]="255.255.255.0" USE_DHCP[0]="no" DHCP_HOSTNAME[0]="" GATEWAY="172.16.1.1"	IPADDR[0]="" NETMASK[0]=" " USE_DHCP[0]="yes" DHCP_HOSTNAME[0]="server" GATEWAY=""

/etc/resolv.conf

Static config

nameserver 193.19.192.15 nameserver 193.19.192.16

4. OpenSUSE, SUSE Linux Enterprise

/etc/sysconfig/network/ifcfg-eth0

/etc/sysconfig/network/config

Static config	Dynamic config (dhcp)
STARTMODE=onboot BOOTPROTO=static ETHTOOL_OPTIONS='' IPADDR=172.16.1.10 MTU=1500 NAME='Broadcom NetXtreme II BCM5708 Gigabit Ethernet' NETMASK=255.255.255.0 BROADCAST=172.16.1.255 NETWORK=172.16.1.0	STARTMODE=onboot BOOTPROTO=dhcp

/etc/sysconfig/network/routes

Static config

sefault 172.16.1.1

/etc/resolv.conf

Static config

nameserver 193.19.192.15 nameserver 193.19.192.16

5. Solaris

/etc/hostname.eth0

Static config	Dynamic config (dhcp)

6. FreeBSD

/etc/rc.conf

Static config	Dynamic config (dhcp)
hostname="server" ifconfig_eth0="inet 172.16.1.1 netmask 255.255.255.0 up" defaultrouter="172.16.1.1"

7. OpenBSD

/etc/hostname.eth0

Static config	Dynamic config (dhcp)
inet 172.16.1.10 255.255.255.0 NONE

/etc/mygate

Static config	Dynamic config (dhcp)
172.16.1.1

8. NetBSD

/etc/ifconfig.eth0

Static config	Dynamic config (dhcp)
inet 172.16.1.10 netmask 255.255.255.0 media 100baseTX

1. OpenVPN Server (Ubuntu)

Scenariu 1: Remote Access VPN
Ref:
http://openvpn.net/index.php/open-source/documentation/howto.html
http://www.cosmosul.ro/software/linux-openvpn-howto.html


Cerinte:
Se doreste instalarea unui server VPN intr-o retea locala, care sa deserveasca clienti VPN remote

Date:
- Capatul de tunnel este terminat pe serverul dedicat VPN (172.16.1.10)
- Routerul de acces, ce face NAT pentru clasa 172.16.1.10, forwardeaza portul TCP/1194 catre serverul VPN si deschide in chainul FORWARD portul TCP/1194
- Serverul VPN are reguli de acces firewall pentru permiterea portului TCP/1194
- Serverul VPN aloca un ip dinamic laptop-ului din clasa 10.8.0.0/24 si impune o ruta catre clasa interna 172.16.1.10/24 prin acel IP

1. Prezentare generala
OpenVPN este o solutie SSL VPN open source ce acopera o multitudine de configuratii, incluzand accesul de la distanta, site-to-site VPN, securitate Wi-Fi, solutii profesionale pentru companii de acces la distanta. OpenVPN ofera o alternativa robusta si ieftina pentru companii fata de alte tehnologii VPN. OpenVPN NU este un proxy web si nu este destinat sa opereze prin intermediul unui browser web

2. Instalare OpenVPN 2.0

# cd /opt/src
# wget http://openvpn.net/release/openvpn-2.1.3.tar.gz
# tar –zxvf openvpn-2.1.3.tar.gz
# cd openvpn-2.1.3
# ./configure --prefix=/opt/openvpn --disable-lzo
# make
# make install

3. Configurarea infrastructurii PKI (Public Key Infrastructure)
OpenVPN necesita autentificare bidirectionala bazata pe certificate, ceea ce inseamna atat clientul trebuie sa se autentifice catre server, cat si serverul trebuie sa se autentifice catre client. In acel moment, se poate stabili o conexiune VPN (sub rezerva parametrilor VPN, care trebuie sa fie compatibili pentru ambele parti).
Atat serverul VPN, cat si clientul VPN se autentifica unul catre celalalt, verificand daca certificatul celeilalte parti este semnat de Root CA si apoi testand datele din acest certificat (de ex: Common Name, Certificate Type – Server/Client, etc). Din acest punct de vedere, OpenVPN aduce un plus de beneficii:
- Serverul VPN are doar un singur certificate si o singura cheie – nu are nevoie sa cunoasca fiecare certificat al fiecarui client VPN
- Serverul VPN va accepta conexiuni de la clienti VPN doar daca acestia prezinta certificate semnate de Root CA. Acest Root CA poate fi configurat pe o alta masina, dar pentru simplitate vom presupune ca atat Root CA cat si serverul VPN se afla pe aceeasi masina
- Daca se banuieste ca o cheie privata a unui client a fost compromisa, certificatul acelui client poate fi inclus intr-un CRL (Certificate Revocation List). Aceste CRL poate fi folosit pentru a respinge conexiuni de la clienti ce se autentifica cu un astfel de certificat, fara a mai fi nevoie de a recrea intreaga infrastructura PKI
- Serverul VPN poate impune drepturi de acces diferentiate pentru anumiti clienti VPN, prin intermediul campurilor din certificatul clientului (de ex: Common Name)

Pentru crearea acestei infrastructuri PKI, este nevoie de urmatoarele:
1. Un certificat autosemnat pentru Root CA si o cheie privata pentru semnarea certificatelor serverului VPN si a clientilor VPN
2. Un certificat separat (si o cheie) pentru serverul VPN – semnat de Root CA
3. Cate un certificat (si o cheie) pentru fiecare dintre clientii VPN – semnat de Root CA

3.1. Generarea certificatului (si cheia) pentru Root CA

# cp -r /opt/src/openvpn-2.1.3/easy-rsa /opt/openvpn
# cd /opt/openvpn/easy-rsa/2.0
# vi vars

export KEY_COUNTRY="RO"
export KEY_PROVINCE="RO"
export KEY_CITY="Bucharest"
export KEY_ORG="vocalNET SRL"
export KEY_EMAIL=postmaster@vocalnet.eu

#. ./vars
# ./clean-all
# root@mail:/opt/openvpn/easy-rsa/2.0# ./build-ca
Generating a 1024 bit RSA private key
.........................++++++
..............................++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [RO]:
State or Province Name (full name) [RO]:
Locality Name (eg, city) [Bucharest]:
Organization Name (eg, company) [vocalNET SRL]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [vocalNET SRL CA]:
Name []:
Email Address [postmaster@vocalnet.eu]:

Rezultate:
- certificat Root CA: /opt/openvpn/easy-rsa/2.0/keys/ca.crt
- cheie privata Root CA: /opt/openvpn/easy-rsa/2.0/keys/ca.key

3.2. Generarea certificatului (si cheia) pentru Serverul VPN

# cd /opt/openvpn/easy-rsa/2.0
# ./build-key-server server
./build-key-server server

Generating a 1024 bit RSA private key
..................................................................++++++
..................................++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [RO]:
State or Province Name (full name) [RO]:
Locality Name (eg, city) [Bucharest]:
Organization Name (eg, company) [vocalNET SRL]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) [server]:
Name []:
Email Address [postmaster@vocalnet.eu]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /opt/openvpn/easy-rsa/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName :PRINTABLE:'RO'
stateOrProvinceName :PRINTABLE:'RO'
localityName :PRINTABLE:'Bucharest'
organizationName :PRINTABLE:'vocalNET SRL'
commonName :PRINTABLE:'server'
emailAddress :IA5STRING:'postmaster@vocalnet.eu'
Certificate is to be certified until Sep 10 21:09:34 2020 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated