Ssltunnel:server

From aldeid
Jump to navigation Jump to search

Installation du serveur

Pré-requis

  1. Installation d'OpenSSL :
    1. A partir des packages : # apt-get install openssl
    2. A partir des sources : Voir ici
  2. Installation des packages nécessaires :
# apt-get install libssl-dev ppp autoconf automake gcc g++ make

Installation à partir des sources

# cd /usr/local/src/
# wget http://www.hsc.fr/ressources/outils/ssltunnel/download/ssltunnel-1.16.tar.gz
# tar xzvf ssltunnel-1.16.tar.gz
# cd ssltunnel-1.16
# ./configure --disable-client
# make
# make install

Si l'installation s'est bien déroulée, vous devriez voir les fichiers suivants :

  • /usr/local/libexec/pppserver
  • /usr/local/etc/ssltunnel/tunnel.conf.default
  • /usr/local/sbin/pppwho

Pour automatiser le démarrage de ssltunnel : 

# cd /usr/local/src/ssltunnel-1.16/server/
# cp pppserver.sh /etc/init.d/
# cd /etc/init.d/
# chmod +x pppserver.sh
# update-rc.d pppserver.sh defaults 98

Copie du fichier "users" : 

# cp /usr/local/src/ssltunnel-1.16/server/users /usr/local/etc/ssltunnel/
Info.png
Note
Ce fichier est un exemple, à adapter. Ce point est décrit dans la section Paramétrage/Serveur.


Génération des certificats

Sur le serveur, la génération des certificats s'effectue par les commandes qui suivent.
La documentation officielle se situe ici : http://sourceforge.net/docman/display_doc.php?docid=21843&group_id=89578.

Génération d'un certificat racine avec passphrase

Info.png
Note
Si vous avez installé openssl à partir des sources, l'outil CA.pl sera certainement dans le répertoire /usr/local/openssl/misc/. Sinon (installation à partir des packages), il doit se trouver dans /usr/lib/ssl/misc/.
# cd /usr/local/etc/ssltunnel/
# /usr/local/openssl/misc/CA.pl -newca
CA certificate filename (or enter to create)
<<ENTER>>
Making CA certificate ...
Generating a 1024 bit RSA private key
....++++++
.......++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:<<PASSPHRASE>>
Verifying - Enter PEM pass phrase:<<PASSPHRASE>>
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:FR
State or Province Name (full name) [Some-State]:France
Locality Name (eg, city) []:Paris
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Aldeid
Organizational Unit Name (eg, section) []:Main
Common Name (eg, YOUR name) []:www.aldeid.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<<ENTER PASSWORD>>
An optional company name []:<<ENTER>>
Using configuration from /usr/local/openssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
Serial Number:
   e4:bb:ea:fa:84:ba:82:ea
Validity
   Not Before: Jan 24 10:14:37 2009 GMT
   Not After : Jan 24 10:14:37 2012 GMT
Subject:
   countryName               = FR
   stateOrProvinceName       = France
   organizationName          = Aldeid
   organizationalUnitName    = Main
   commonName                = www.aldeid.com
   emailAddress              = [email protected]
X509v3 extensions:
   X509v3 Subject Key Identifier: 
       CC:84:B0:99:87:73:6F:EB:80:6F:34:60:39:9C:A9:34:5F:CF:AA:0E
   X509v3 Authority Key Identifier: 
       keyid:CC:84:B0:99:87:73:6F:EB:80:6F:34:60:39:9C:A9:34:5F:CF:AA:0E
       DirName:/C=FR/ST=France/O=Aldeid/OU=Main/CN=www.aldeid.com/[email protected]
       serial:E4:BB:EA:FA:84:BA:82:EA

   X509v3 Basic Constraints: 
       CA:TRUE
Certificate is to be certified until Jan 24 10:14:37 2012 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated

Copie du certificat dans le système de fichier ssltunnel

# cd /usr/local/etc/ssltunnel/
# cp demoCA/cacert.pem /usr/local/etc/ssltunnel/trusted.pem

Création d'un certificat serveur

Info.png
Note
Si vous avez installé openssl à partir des sources, openssl sera certainement dans le répertoire /usr/local/bin/. Sinon (installation à partir des packages), il doit se trouver dans /usr/bin/.
# /usr/local/bin/openssl req -new -nodes -keyout server.key -out server.csr -days 365
Generating a 1024 bit RSA private key
..++++++
.......++++++
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:FR
State or Province Name (full name) [Some-State]:France
Locality Name (eg, city) []:Paris
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Aldeid
Organizational Unit Name (eg, section) []:Main
Common Name (eg, YOUR name) []:www.aldeid.com
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<<<ENTER>>>
An optional company name []:<<<ENTER>>>

Signature du certificat serveur avec le CA_root

#/usr/local/bin/openssl ca -policy policy_anything -out server.crt -infiles server.csr

Using configuration from /usr/local/openssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:<<PASSPHRASE>>
Check that the request matches the signature
Signature ok
Certificate Details:
      Serial Number:
          cc:00:19:37:ce:f8:4b:85
      Validity
          Not Before: Jan 24 10:41:55 2009 GMT
          Not After : Jan 24 10:41:55 2010 GMT
      Subject:
          countryName               = FR
          stateOrProvinceName       = France
          localityName              = Paris
          organizationName          = Aldeid
          organizationalUnitName    = Main
          commonName                = www.aldeid.com
          emailAddress              = [email protected]
      X509v3 extensions:
          X509v3 Basic Constraints: 
              CA:FALSE
          Netscape Comment: 
              OpenSSL Generated Certificate
          X509v3 Subject Key Identifier: 
              5F:98:96:05:1D:A5:1A:68:75:DA:0D:CC:E1:B7:E8:AA:2A:CA:F5:54
          X509v3 Authority Key Identifier: 
              keyid:A7:17:11:84:2E:9A:3B:FF:58:54:F2:FC:D7:D5:8A:9B:C1:77:D8:5F

Certificate is to be certified until Jan 24 10:41:55 2010 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Application des droits sur la clé serveur

# chmod 600 server.key

Création d'un certificat client

# /usr/local/bin/openssl req -new -nodes -keyout client.key -out client.csr -days 365
Generating a 1024 bit RSA private key
................++++++
...............++++++
writing new private key to 'client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:FR
State or Province Name (full name) [Some-State]:France
Locality Name (eg, city) []:Paris
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Aldeid
Organizational Unit Name (eg, section) []:Main
Common Name (eg, YOUR name) []:Sebastien Damaye
Email Address []:[email protected]

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:<<PASSWORD>>
An optional company name []:<<ENTER>>

Signature du certificat client

# /usr/local/bin/openssl ca -policy policy_anything -out client.crt -infiles client.csr
Using configuration from /usr/local/openssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:<<PASSWORD>>
Check that the request matches the signature
Signature ok
Certificate Details:
     Serial Number:
         cc:00:19:37:ce:f8:4b:86
     Validity
         Not Before: Jan 24 10:49:41 2009 GMT
         Not After : Jan 24 10:49:41 2010 GMT
     Subject:
         countryName               = FR
         stateOrProvinceName       = France
         localityName              = Paris
         organizationName          = Aldeid
         organizationalUnitName    = Main
         commonName                = Sebastien Damaye
         emailAddress              = [email protected]
     X509v3 extensions:
         X509v3 Basic Constraints: 
             CA:FALSE
         Netscape Comment: 
             OpenSSL Generated Certificate
         X509v3 Subject Key Identifier: 
             45:78:CC:01:F2:CC:9F:CF:4B:3D:65:45:94:7C:BE:02:63:F4:90:A6
         X509v3 Authority Key Identifier: 
             keyid:A7:17:11:84:2E:9A:3B:FF:58:54:F2:FC:D7:D5:8A:9B:C1:77:D8:5F

Certificate is to be certified until Jan 24 10:49:41 2010 GMT (365 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

Vérification de l'arborescence

.
|-- client.crt
|-- client.csr
|-- client.key
|-- server.crt
|-- server.csr
|-- server.key
|-- trusted.pem
|-- tunnel.conf
|-- tunnel.conf.default
`-- users

Transfert des fichiers vers le client

Transférer les fichiers suivants vers le client :

  • trusted.pem
  • client.crt
  • client.key

Puis appliquez les droits appropriés (sur le client) : 

# chmod 600 client.key

Paramétrage du serveur

Fichier tunnel.conf

Ouvrir et modifier le fichier tunnel.conf : 

keyfile         /usr/local/etc/ssltunnel/server.key
certfile        /usr/local/etc/ssltunnel/server.crt
cacertfile      /usr/local/etc/ssltunnel/trusted.pem
userfile        /usr/local/etc/ssltunnel/users
wmtp            /var/log/ssltunnel.wtmp
pidfile         /var/run/pppserver.pid
timeout         20
maxusers        10
port            443
listenaddr      192.168.1.1
lockdir         /var/lock/ssltunnel

+------------+------------------------------------------------------------+
| Paramètre  | Description                                                |
+------------+------------------------------------------------------------+
| keyfile    | Emplacement de la clé du serveur                           |
| certfile   | Emplacement du certificat serveur                          |
| cacertfile | Emplacement du certificat autorité de confiance (CA_root)  |
| userfile   | Emplacement du fichier "users"                             |
| wtmp       | Emplacement du fichier de log (servant à pppwho)           |
| pidfile    | Emplacement du fichier de pid (identificatgion du process) |
| timeout    | Durée du ssl_accept et lecture de la bannière              |
| maxusers   | Nombre maximum d'utilisateurs connectés simultanément      |
| port       | Port d'écoute du démon (laisser 443)                       |
| listenaddr | Adresse d'écoute (mettre votre adresse publique)           |
| lockdir    | Emplacement du fichier de lock                             |
+------------+------------------------------------------------------------+

Fichier users

Editer et adapter le fichier "users" : 

 # vim /usr/local/etc/ssltunnel/users

Puis y reporter les lignes suivantes : 

user    /C=FR/ST=France/L=Paris/O=Aldeid/OU=Main/CN=Sebastien Damaye/[email protected]
command /usr/sbin/pppd
args    192.168.1.1:192.168.1.100 nodefaultroute nodetach debug
args    lcp-echo-failure 10 lcp-echo-interval 10 proxyarp deflate 8
pty     1
uid     1000
gid     58
Info.png
Note
Attention, le fichier doit se terminer par une ligne vide.
Info.png
Note
Si uid et gid sont absents, le serveur sera démarré en tant que root.
+-------------+--------------------------------------------------------------+
| Paramètre   | Description                                                  |
+-------------+--------------------------------------------------------------+
| user        | Récupérer le "subject" renvoyé par la commande suivante:     |
|             |   # /usr/local/bin/openssl x509 -subject < client.crt        |
| fingerprint | Récupérer le "fingerprint" renvoyé par la commande suivante: |
|  (optionnel)|   # /usr/local/bin/openssl x509 -fingerprint < client.crt    |
| command     | Emplacement de pppd                                          |
| args        | Avant les ":" Adr. IP locale, après les ":" adresse IP du    |
|             |   client                                                     |
| pty         | Création d'un pty (laisser 1 pour pppd)                      |
| uid         | User id utilisé pour lancer pppd                             |
|  (optionnel)|                                                              |
| gid         | Group id utilisé pour lancer pppd                            |
|  (optionnel)|                                                              |
+-------------+--------------------------------------------------------------+

Fichier /etc/ppp/options

Editez le fichier /etc/ppp/options : 

# vim /etc/ppp/options
  • Repérez la ligne "auth" et remplacez-la par "noauth" :
# Require the peer to authenticate itself before allowing network
# packets to be sent or received.
# Please do not disable this setting. It is expected to be standard in
# future releases of pppd. Use the call option (see manpage) to disable
# authentication for specific peers.
#auth
noauth
  • Repérez les lignes suivantes et décommentez proxyarp
# Add an entry to this system's ARP [Address Resolution Protocol]
# table with the IP address of the peer and the Ethernet address of this
# system.
proxyarp






Description
 Sommaire
Partie client
Retrieved from "https://www.aldeid.com/w/index.php?title=Ssltunnel:server&oldid=11517"