1. LPIC Level3 303 Security

Size: px

Start display at page:

Download "1. LPIC Level3 303 Security"

なおとみもと
6 years ago
Views:

1 LPIC Security tmiyahar@begi.net

2 1. LPIC Level3 303 Security

3 1. 2. I. OpenSSL II. OpenVPN 3

4 303 (v1.0) OpenSSL GPG ACL netfilter/iptables SELinux OpenVPN BIND/DNS Apache/HTTP/HTTPS FTP OpenSSH NFSv syslog

5 5

6 6

7 OpenSSL

8 HTTPS 3 SSL HTTP HTTPS

9 /

11 CA CA( ) eb CA CA

12 SSL 12

13 HTTPS Apache ssl CA CA

14 HTTPS CSR Certificate Signing Request 3. CA 4. Apache ssl.conf ssl.conf httpd.conf httpd.conf

15 1. OpenSSL 2. # opensslmd5 * > rand.dat 3. # opensslgenrsa -rand rand.dat -des > key.pem 2 Apache

16 CSR CSR Certificate Signing Request CA CSR CSR 1.# opensslreq new -key key.pem -outcsr.pem CSR csr.pem

17 CA CSR CA 2 HTTPS CA CA 1.CA 2./etc/pki/tls/misc/CA 3.# /etc/pki/tls/misc/ca -newca 4.CA

18 1. CSR newreq.pem /root/ca/ 2. CA CA #/etc/pki/tls/misc/ca -sign 3. /root/ca/ newcert.pem

19 ssl.conf SSLCertificateFile SSLCertificateKeyFile

20 Apache 1. yum # yum installhttpdmod_ssl httpd: Apache mod_ssl: SSL distcache

21 1. # opensslmd5 * > rand.dat 2. # opensslgenrsa -rand rand.dat-des > key.pem 2

22 CSR 1. CSR # opensslreq new key key.pem outcsr.pem Country Name (2letter code) [GB]:JP State or Province Name (fullname) [Berkshire]:Tokyo Locality Name (eg,city) [Newbury]:Chiyodaku Organization Name (eg, company) [My Company Ltd]:JPI-Japan Organizational UnitNa me (eg, section) []( ) Com mon Name (eg, your name or yourserver'shostname) []: Please enterthefollowing 'extra'attributes to be sentwith yourcertificaterequest A challenge password []:( ) An optional company name []:( ) 22

23 openssl.cnf 1. /etc/pki/tls/openssl.cnf # cd /etc/pki/tls/ # cp openssl.cnf openssl.cnf.bak 2. dir../../ca. basicconstraints CA:FALSE CA:true

24 CA 1. /etc/pki/tls/misc/ca # cd /etc/pki/tls/misc # cp CA CA.bak 2. CATOP../../ca.

25 CA 1. /root/ca # mkdir/root/ca 2. /root/ca # cd /root/ca 3. #/etc/pki/tls/misc/ca -newca CA

26 CA CA Country Name (2letter code) [GB]:JP State or Province Name (fullname) [Berkshire]:Tokyo Locality Name (eg,city) [Newbury]:Chiyodaku Organization Name (eg, company) [My Company Ltd]:LPI-Japan Organizational UnitNa me (eg, section) []:( ) Com mon Name (eg, your name or yourserver'shostname) []:ca.lpi.or.jp Please enterthefollowing 'extra'attributes to be sentwith yourcertificaterequest A challenge password []:( ) An optional company name []:( ) Using configuration from /etc/pki/tls/openssl.cnf Enter pass phrase for./private/./cakey.pem:(ca ) Check that therequest matchesthe signature Signature ok 26

27 1. CSR /root/ca newreq.pem # cp../csr.pem newreq.pem 2. # /etc/pki/tls/misc/ca -sign CA newcert.pem 27

28 1. 2. key.pem /etc/httpd/conf/ssl.key/server.key newcert.pem /etc/httpd/conf/ssl.crt/server.crt

29 Apache 1. ssl.conf # vi/etc/httpd/conf.d/ssl.conf 2. DocumentRoot "/var/www/html" 3. SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

30 1. Apache # servicehttpd restart 2. Web CA /root/ca/cacert.pem 3. / DNS /etc/hosts 4. SSL 30

31 OpenVPN

32 OpenVPN SSL VPN GPL OS Linux Windows BSD OS Solaris 32

33 OpenVPN VPN LAN VPN VPN OpenVPN OpenVPN 33

34 OpenVPN Windows OpenVPN OpenVPN NIC 1 NIC NAT 34

35 tun/tap NIC tun/tap tun L3 tap L2 tap eth br tap tap eth eth OpenVPN OpenVPN 35

36 OpenVPN 36

37 VMware Workstation NAT OS Windows XP Professional NIC /24 OS CentOS 5.3 NAT eth /8 NAT

38 Windows XP NAT VPN VPN OpenVPN OpenVPN 38

39 CA NTP OpenVPN openvpn OpenVPN 39

40 OpenVPN CA DH TLS OpenVPN 40

41 bridge-utils RPMforge openvpn # yum installopenvpn lzo2 41

42 easy-rsa make /etc/openvpn/easy-rsa # cd /usr/share/doc/openvpn-*/easy-rsa/2.0/ # make installdestdir=/etc/openvpn/easyrsa # cd /etc/openvpn/easy-rsa/ 42

43 CA /etc/openvpn/easy-rsa/vars exportkey_co U N TRY="JP" exportke Y_PRO VIN CE="Tokyo" exportk E Y_CITY="Chiyodaku" exportkey_or G="LPI-Japan" exportkey_e M AIL=info@lpi.or.jp CA # source vars #./clean-all #./build-ca CA # cp keys/ca.crt /etc/openvpn/ 43

44 #./build-key-server server [y/n] y 2 # cp keys/server.crt /etc/openvpn/ # cp keys/server.key /etc/openvpn/ # chmod 600 /etc/openvpn/server.key 44

45 DH DH #./build-dh DH # cp keys/dh1024.pem /etc/openvpn/ 45

46 openssl.cnf #[ pkcs11_section ] #engine_id = pkcs11 #dynamic_path = /usr/lib/engines/engine_pkcs11.so #MODULE_PATH = $ENV::PKCS11_MODULE_PATH #PIN = $ENV::PKCS11_PIN #init = 0 #./build-key dummy #./revoke-full dummy CRL # cp keys/crl.pem /etc/openvpn/ 46

47 SSL/TLS HMAC --tls-auth openvpn --genkey # openvpn --genkey --secret /etc/openvpn/ta.key 47

48 # cp /usr/share/doc/openvpn-2.0.9/samplescripts/bridge-st* /etc/openvpn/ chmod +x /etc/openvpn/bridge-st* bridge-start eth_ip=" " eth_netmask=" " eth_broadcast=" " 48

49 OpenVPN cp /usr/share/doc/openvpn-2.0.9/sampleconfig-files/server.conf /etc/openvpn/ TCP tap /etc/openvpn 49

50 OpenVPN # udp tcp proto tcp ;proto udp #dev tap0 dev tap0 ;dev tun # (1 ) #/etc/openvpn/ccd client-config-dir ccd # client-to-client duplicate-cn # tls-auth ta.key 0 ; 0 # /etc/openvpn/ ca ca.crt cert server.crt # nobody key server.key user nobody group nobody #DH dh dh1024.pem # # status /var/log/openvpn-status.log ;server log /var/log/openvpn.log log-append /var/log/openvpn.log # server-bridge #CRL crl-verify crl.pem 50

51 OpenVPN # cd /etc/openvpn #./bridge-start # brctl show eth0 tap0 br0 # ifconfig OpenVPN # service openvpn start 51

52 OpenVPN OpenVPN 52

53 OpenVPN OpenVPN GUI for Windows Tunnelblick Mac OS X OpenVPN 53

54 CA # cd /etc/openvpn/easy-rsa # source vars (client1 ) #./build-key-pass client1 2 [y/n] y 2 keys client1.crt client1.key 54

55 "C: Program Files OpenVPN config" CA ca.crt ta.key client1.crt client1.key 55

56 pull tls-client dev tap proto tcp-client remote 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt certclient1.crt key client1.key ns-cert-type server tls-authta.key 1 comp-lzo verb 3 ca CA cert key tls-auth

57 proto UDP TCP ns-cert-type server nscerttype=server build-key-server 57

58 VPN Windows Connect View Log PING 58

1. NIC IP 2. VMware Server NAT 3. OS OS CentOS 5.3 NAT NAT /8 eth /8 4. NAT

LPIC 3 303 Security tmiyahar@begi.net 1. NIC IP 2. VMware Server NAT 3. OS OS CentOS 5.3 NAT NAT 10.0.0.0/8 eth0 10.0.0.10/8 4. NAT 22 1194 2 1. OS 2. OS 3. OS Web 4. OS SSH PuTTY OS WinSCP 3 OpenSSL HTTPS