1. NIC IP 2. VMware Server NAT 3. OS OS CentOS 5.3 NAT NAT /8 eth /8 4. NAT

Size: px

Start display at page:

Download "1. NIC IP 2. VMware Server NAT 3. OS OS CentOS 5.3 NAT NAT /8 eth /8 4. NAT"

ともみりゅうとう
7 years ago
Views:

1 LPIC Security tmiyahar@begi.net

2 1. NIC IP 2. VMware Server NAT 3. OS OS CentOS 5.3 NAT NAT /8 eth /8 4. NAT

3 1. OS 2. OS 3. OS Web 4. OS SSH PuTTY OS WinSCP 3

4 OpenSSL

5 HTTPS 3 SSL HTTP HTTPS

6 /

8 CA CA( ) eb CA CA

9 HTTPS Apache ssl CA CA

10 HTTPS CSR Certificate Signing Request 3. CA 4. Apache ssl.conf ssl.conf httpd.conf httpd.conf

11 OpenVPN

12 OpenVPN SSL VPN GPL OS Linux Windows BSD OS Solaris 12

13 OpenVPN VPN LAN VPN OpenVPN OpenVPN 13

14 OpenVPN Windows OpenVPN OpenVPN NIC 1 NIC NAT 14

15 tun/tap NIC tun/tap tun L3 tap L2 tap eth br tap tap eth eth OpenVPN OpenVPN 15

16 CA NTP OpenVPN openvpn OpenVPN 16

17 OpenVPN CA DH TLS OpenVPN 17

18 1. bridge-utils 2. RPMforge 3. openvpn # yum installopenvpn lzo2 18

19 easy-rsa 1. make /etc/openvpn/easy-rsa # cd/usr/share/doc/openvpn-*/easy-rsa/2.0/ # make installdestdir=/etc/openvpn/easyrsa 2. # cd/etc/openvpn/easy-rsa/ 19

20 CA 1. /etc/openvpn/easy-rsa/vars exportkey_co U N TRY="JP" exportke Y_PRO VIN CE="Tokyo" exportk E Y_CITY="Chiyodaku" exportkey_or G="LPI-Japan" exportkey_e M AIL=info@lpi.or.jp 2. CA # source vars #./clean-all #./build-ca 3. CA # cp keys/ca.crt /etc/openvpn/ 20

21 1. #./build-key-server server [y/n] y 2 2. # cp keys/server.crt /etc/openvpn/ # cp keys/server.key /etc/openvpn/ # chmod 600 /etc/openvpn/server.key 21

22 DH 1. DH #./build-dh 2. DH # cp keys/dh1024.pem /etc/openvpn/ 22

23 1. openssl.cnf #[ pkcs11_section ] #engine_id = pkcs11 #dynamic_path = /usr/lib/engines/engine_pkcs11.so #MODULE_PATH = $ENV::PKCS11_MODULE_PATH #PIN = $ENV::PKCS11_PIN #init = 0 2. #./build-key dummy #./revoke-full dummy 3. CRL # cp keys/crl.pem /etc/openvpn/ 23

24 SSL/TLS HMAC --tls-auth 1.openvpn --genkey # openvpn --genkey --secret /etc/openvpn/ta.key 24

25 1. # cp /usr/share/doc/openvpn-2.0.9/samplescripts/bridge-st* /etc/openvpn/ chmod +x /etc/openvpn/bridge-st* 2. bridge-start eth_ip=" " eth_netmask=" " eth_broadcast=" " 25

26 OpenVPN 1. cp /usr/share/doc/openvpn-2.0.9/sampleconfig-files/server.conf /etc/openvpn/ 2. (server.conf) TCP tap /etc/openvpn 26

27 OpenVPN /etc/openvpn/server.conf # udp tcp proto tcp ;proto udp #dev tap0 dev tap0 ;dev tun # (1 ) #/etc/openvpn/ccd client-config-dir ccd # client-to-client duplicate-cn # tls-auth ta.key 0 ; 0 # /etc/openvpn/ ca ca.crt cert server.crt # nobody key server.key user nobody group nobody #DH dh dh1024.pem # # status /var/log/openvpn-status.log ;server log /var/log/openvpn.log log-append /var/log/openvpn.log # server-bridge #CRL crl-verify crl.pem 27

28 OpenVPN 1. # cd /etc/openvpn #./bridge-start 2. # brctlshow eth0 tap0 br0 # ifconfig 3. OpenVPN # service openvpn start 28

29 OpenVPN 1. OpenVPN

30 OpenVPN OpenVPN GUI for Windows Tunnelblick Mac OS X OpenVPN 30

31 1. CA # cd /etc/openvpn/easy-rsa # source vars 2. (client1 ) #./build-key-pass client1 2 [y/n] y 2 keys client1.crt client1.key 31

32 1. "C: Program Files OpenVPN config" CA ca.crt ta.key client1.crt client1.key 32

33 pull tls-client dev tap proto tcp-client remote 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt certclient1.crt key client1.key ns-cert-type server tls-authta.key 1 comp-lzo verb 3 ca CA cert key tls-auth 1 1 OS NIC IP 33

34 proto UDP TCP ns-cert-type server nscerttype=server build-key-server 34

35 VPN 1. Windows Connect 2. View Log 3. PING 35

1. LPIC Level3 303 Security

LPIC 3 303 Security tmiyahar@begi.net 1. LPIC Level3 303 Security 2. 1 1 3. 4. 5. 303 2 1. 2. I. OpenSSL II. OpenVPN 3 303 (v1.0) 320 320.1 OpenSSL 4 320.2 GPG 4 320.3 3 321 324.2 5 321.1 2 324.3 3 321.2