SSL VPNs and OpenVPN – Part IV

Use Netsparker


4. Brief How-to …. Creating Multiple clients to Single site tunnels.

Example of using PKI to create a client-to-site VPN:

For a road warrior or roaming/multiple user scenario, static keys based VPNs don’t scale well. You will need to implement a PKI if you have Hub and Spoke architecture of VPN.

From the OpenVPN.net website:

Static Key advantages

  • Simple Setup
  • No X509 PKI (Public Key Infrastructure) to maintain

Static Key disadvantages

  • Limited scalability — one client, one server
  • Lack of perfect forward secrecy — key compromise results in total disclosure of previous sessions
  • Secret key must exist in plaintext form on each VPN peer
  • Secret key must be exchanged using a pre-existing secure channel

The following describes implementing PKI from OpenVPN.net’s OpenVPN 2.x How-to. For far more description and settings, please consult this howto.

If you want to use OpenVPN in a multiple client’s setup, then it’s recommended that you setup PKI first. A PKI will have;

– A certificate (Public key) and a private key for the server and each client

– A certificate authority (CA) certificate and key for signing server and client certificates.

Both server and client will authenticate the other by first verifying that the presented certificate was signed by the master certificate authority (CA), and then by testing information in the now-authenticated certificate header, such as the certificate common name or certificate type (client or server).

Generating the master Certificate Authority (CA) certificate and key:

For PKI management, we will use a set of scripts bundled with OpenVPN.

If you are using Linux, BSD, or a unix-like OS, open a shell and cd to the easy-rsa subdirectory of the OpenVPN distribution. If you installed OpenVPN from an RPM file, the easy-rsa directory can usually be found in /usr/share/doc/packages/openvpn or /usr/share/doc/openvpn-2.0 (it’s best to copy this directory to another location such as /etc/openvpn, before any edits, so that future OpenVPN package upgrades won’t overwrite your modifications). If you installed from a .tar.gz file, the easy-rsa directory will be in the top level directory of the expanded source tree.

If you are using Windows, open up a Command Prompt window and cd to \Program Files\OpenVPN\easy-rsa. Run the following batch file to copy configuration files into place (this will overwrite any preexisting vars.bat and openssl.cnf files):

init-config

Now edit the vars file (called vars.bat on Windows) and set the KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL parameters. Don’t leave any of these parameters blank.

Next, initialize the PKI. On Linux/BSD/Unix:

. ./vars

./clean-all

./build-ca

On Windows:

vars

clean-all

build-ca

The final command (build-ca) will build the certificate authority (CA) certificate and key by invoking the interactive openssl command:

ai:easy-rsa # ./build-ca

Generating a 1024 bit RSA private key

............++++++

...........++++++

writing new private key to 'ca.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [KG]:

State or Province Name (full name) [NA]:

Locality Name (eg, city) [BISHKEK]:

Organization Name (eg, company) [OpenVPN-TEST]:

Organizational Unit Name (eg, section) []:

Common Name (eg, your name or your server's hostname) []:OpenVPN-CA

Email Address [me@myhost.mydomain]:

Note that in the above sequence, most queried parameters were defaulted to the values set in the vars or vars.bat files. The only parameter which must be explicitly entered is the Common Name. In the example above, I used “OpenVPN-CA”.

Generate certificate & key for server

Next, we will generate a certificate and private key for the server. On Linux/BSD/Unix:

./build-key-server server

On Windows:

build-key-server server

As in the previous step, most parameters can be defaulted. When the Common Name is queried, enter “server”. Two other queries require positive responses, “Sign the certificate? [y/n]” and “1 out of 1 certificate requests certified, commit? [y/n]”.

Generate certificates & keys for 3 clients

Generating client certificates is very similar to the previous step. On Linux/BSD/Unix:

./build-key client1

./build-key client2

./build-key client3

On Windows:

build-key client1

build-key client2

build-key client3

If you would like to password-protect your client keys, substitute the build-key-pass script.

Remember that for each client, make sure to type the appropriate Common Name when prompted, i.e. "client1", "client2", or "client3". Always use a unique common name for each client.

Generate Diffie Hellman parameters

Diffie Hellman parameters must be generated for the OpenVPN server. On Linux/BSD/Unix:

./build-dh

On Windows:

build-dh

Output:

ai:easy-rsa # ./build-dh

Generating DH parameters, 1024 bit long safe prime, generator 2

This is going to take a long time

.................+...........................................

...................+.............+.................+.........

......................................

The final step in the key generation process is to copy all files to the machines which need them, taking care to copy secret files over a secure channel.

You can also generate the certificates and keys in their respective machines to bypass copying them over some secure channel.

Although your default installation will have sample client and server ovpn files, you can also find an excellent sample Client and Server configuration files here.

The sample files are pretty easy to understand and are common for Linux and Windows except for the part where config files look for "key" and "crt" files. On Windows, you will have to use double backslashes to quote a path. For example; "C:\\Program Files\\OpenVPN\\config\\foo.key" .

After configuring the files according to your network, you can put those "ovpn" files in the config directory of your installed path and start OpenVPN using these files.

That's it! Following these steps correctly will most probably have your VPN tunnel up and running. This translates into a VPN that's easy to implement, easy to maintain and dirt cheap. The choice doesn't get any easier than this.

4. OpenVPN in a Nutshell

OpenVPN is a free, open source GPL'ed software. Implementing it across your tunnel requirements not only is cheaper, but also easy to implement and maintain. It takes away the complexity of IPSec, and it introduces the security of SSL in VPN domain.

If you do face any problems; the OpenVPN.net mailing list and Mathias Sundman's website http://openvpn.de should get you all the help you require.

All the best SSL VPN'ing!!

Some excellent articles:

1. Meet OpenVPN By Hans-Cees Speel

2. Introduction to OpenVPN By David Bogen

3. OpenVPN GUI for Windows By Mathias Sundman

4. OpenVPN 2.0 TAP mini-HOWTO By cchee on forums.gentoo.org

5. To setup a VPN using OpenVPN on UIC.edu

Previously:

1. SSL VPNs and Using OpenVPN : What is an SSL VPN
2 .SSL VPNs and OpenVPN - Part II : Why OpenVPN?
3. SSL VPNs and OpenVPN - Part III : Brief How-to - OpenVPN and Site-to-Site Tunnels.

Posted in: Linux Hacking, Networking Hacking, Security Software

, , , , , ,


Latest Posts:


StaCoAn - Mobile App Static Analysis Tool StaCoAn – Mobile App Static Analysis Tool
StaCoAn is a cross-platform tool which aids developers, bug bounty hunters and ethical hackers performing mobile app static analysis on the code of the application for both native Android and iOS applications.
snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.


Comments are closed.