Software Heritage Wiki - User contributions [en]

VPN

2021-07-09T10:28:22Z

Vsellier: /* /etc/hosts entries */

The [[Software Heritage]] server and the VMs running on it are severely firewalled.
To get onto their network unrestricted, a VPN based on [https://openvpn.net/ OpenVPN] is available.

The setup is client-server, with per-client certificates.

== OpenVPN client configuration ==

=== Raw OpenVPN ===

Sample configuration file, e.g., /etc/openvpn/swh.conf:

<pre>
remote vpn.softwareheritage.org
ns-cert-type server
comp-lzo
nobind
dev tun
proto udp
port 1194
log /var/log/openvpn.log
up-restart
persist-key
persist-tun
client
ca /etc/openvpn/keys/softwareheritage-ca.crt
cert /etc/openvpn/keys/softwareheritage.crt
key /etc/openvpn/keys/softwareheritage.key
user nobody
group nogroup

# If you are using resolvconf, add this:
# Make sure you add louvre to /etc/hosts to avoid issues in using the vpn-provided DNS server.
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

# If you want the connection to persist when your network fails, add this:
ping-restart 10
</pre>

In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys (matching the paths within the sample above):

* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)
* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)
* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)

Activate the openvpn server

as root, run

systemctl enable openvpn@swh.service
systemctl start openvpn@swh.service
systemctl status openvpn@swh.service

Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.

Excerpt of a successful start:

root@machine:~# systemctl status openvpn@swh.service
openvpn@swh.service - OpenVPN connection to swh
Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled)
Active: active (running) since Thu 2020-12-17 19:03:29 IST; 22min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 12302 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 4915)
CGroup: /system.slice/system-openvpn.slice/openvpn@swh.service
└─12302 /usr/sbin/openvpn --daemon ovpn-swh --status /run/openvpn/swh.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/swh.conf --writepid /run/openvpn/swh.pid

Dec 17 19:03:29 machine systemd[1]: Starting OpenVPN connection to swh...
Dec 17 19:03:29 machine systemd[1]: Started OpenVPN connection to swh.

=== Network Manager GUI ===

You need network-manager-openvpn and network-manager-openvpn-gnome for the configuration gui.

[[File:nm_openvpn_base.png]]
[[File:nm_openvpn_routes.png]]
[[File:nm_openvpn_advanced_general.png]]
[[File:nm_openvpn_advanced_security.png]]
[[File:nm_openvpn_advanced_tls_auth.png]]

== Obtaining a client certificate ==

=== For users ===

Generate a keypair (key + certificate signing request) using the following command:

<pre>
openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"
</pre>

Please replace <your username> with something that uniquely identifies the certificate.

Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).

Provide the CSR file to a sysadmin through a reasonably authenticated medium.

=== For admins ===

* On the firewall (192.168.50.1), go to the [https://192.168.50.1/system_certmanager.php System / Trust / Certificates page]
* click on the add button on the upper right
[[File:Vpn-main-trust-page.png]]
* On the Method list, choose "Sign a certificate Signing Request"
[[File:Vpn-csr-signing.png]]

Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>

* Enter the user name on the descriptive name
* Select "OpenVPN Software Heritage (louvre)" as Certificate Authority
* Enter the duration, usually 10 years
* Paste the csr
* Validate

* check the details of the csr and validate

== Revoking a client certificate ==

On the firewall (master) [https://192.168.50.1]:
* go to the [[https://192.168.50.1/system_crlmanager.php System / Trust / Revocation]] page
* edit the "OpenVPN certificate revocation list" CRL

[[File:Vpn-crl-list.png]]

* go to the bottom of the page

[[File:Vpn-csr-certificate.png]]

* select the certificate to revoke
* Add

The counter of revoked certificate should be increased by one on for the OpenVPN CSR on the CSR list

[[Category:Infrastructure]]
[[Category:System administration]]

VPN

2021-07-09T10:23:18Z

Vsellier: /* Revoking a client certificate */

The [[Software Heritage]] server and the VMs running on it are severely firewalled.
To get onto their network unrestricted, a VPN based on [https://openvpn.net/ OpenVPN] is available.

The setup is client-server, with per-client certificates.

== OpenVPN client configuration ==

=== Raw OpenVPN ===

Sample configuration file, e.g., /etc/openvpn/swh.conf:

<pre>
remote vpn.softwareheritage.org
ns-cert-type server
comp-lzo
nobind
dev tun
proto udp
port 1194
log /var/log/openvpn.log
up-restart
persist-key
persist-tun
client
ca /etc/openvpn/keys/softwareheritage-ca.crt
cert /etc/openvpn/keys/softwareheritage.crt
key /etc/openvpn/keys/softwareheritage.key
user nobody
group nogroup

# If you are using resolvconf, add this:
# Make sure you add louvre to /etc/hosts to avoid issues in using the vpn-provided DNS server.
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

# If you want the connection to persist when your network fails, add this:
ping-restart 10
</pre>

In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys (matching the paths within the sample above):

* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)
* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)
* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)

Activate the openvpn server

as root, run

systemctl enable openvpn@swh.service
systemctl start openvpn@swh.service
systemctl status openvpn@swh.service

Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.

Excerpt of a successful start:

root@machine:~# systemctl status openvpn@swh.service
openvpn@swh.service - OpenVPN connection to swh
Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled)
Active: active (running) since Thu 2020-12-17 19:03:29 IST; 22min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 12302 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 4915)
CGroup: /system.slice/system-openvpn.slice/openvpn@swh.service
└─12302 /usr/sbin/openvpn --daemon ovpn-swh --status /run/openvpn/swh.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/swh.conf --writepid /run/openvpn/swh.pid

Dec 17 19:03:29 machine systemd[1]: Starting OpenVPN connection to swh...
Dec 17 19:03:29 machine systemd[1]: Started OpenVPN connection to swh.

=== Network Manager GUI ===

You need network-manager-openvpn and network-manager-openvpn-gnome for the configuration gui.

[[File:nm_openvpn_base.png]]
[[File:nm_openvpn_routes.png]]
[[File:nm_openvpn_advanced_general.png]]
[[File:nm_openvpn_advanced_security.png]]
[[File:nm_openvpn_advanced_tls_auth.png]]

== Obtaining a client certificate ==

=== For users ===

Generate a keypair (key + certificate signing request) using the following command:

<pre>
openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"
</pre>

Please replace <your username> with something that uniquely identifies the certificate.

Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).

Provide the CSR file to a sysadmin through a reasonably authenticated medium.

=== For admins ===

* On the firewall (192.168.50.1), go to the [https://192.168.50.1/system_certmanager.php System / Trust / Certificates page]
* click on the add button on the upper right
[[File:Vpn-main-trust-page.png]]
* On the Method list, choose "Sign a certificate Signing Request"
[[File:Vpn-csr-signing.png]]

Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>

* Enter the user name on the descriptive name
* Select "OpenVPN Software Heritage (louvre)" as Certificate Authority
* Enter the duration, usually 10 years
* Paste the csr
* Validate

* check the details of the csr and validate

== Revoking a client certificate ==

On the firewall (master) [https://192.168.50.1]:
* go to the [[https://192.168.50.1/system_crlmanager.php System / Trust / Revocation]] page
* edit the "OpenVPN certificate revocation list" CRL

[[File:Vpn-crl-list.png]]

* go to the bottom of the page

[[File:Vpn-csr-certificate.png]]

* select the certificate to revoke
* Add

The counter of revoked certificate should be increased by one on for the OpenVPN CSR on the CSR list

== /etc/hosts entries ==

Once the Vpn is setup on your machine, you can access Software Heritage hosts via their private IP addresses; see [[Network configuration]].

OpenVPN now pushes the address of our DNS server (192.168.100.29, pergamon).

You might want to add louvre.softwareheritage.org in your /etc/hosts to avoid a bootstrap problem if the "on-vpn" DNS server is in your resolv.conf.

[[Category:Infrastructure]]
[[Category:System administration]]

File:Vpn-csr-certificate.png

2021-07-09T10:21:01Z

Vsellier:

File:Vpn-crl-list.png

2021-07-09T10:19:04Z

Vsellier:

VPN

2021-07-09T10:12:53Z

Vsellier: /* For admins */

The [[Software Heritage]] server and the VMs running on it are severely firewalled.
To get onto their network unrestricted, a VPN based on [https://openvpn.net/ OpenVPN] is available.

The setup is client-server, with per-client certificates.

== OpenVPN client configuration ==

=== Raw OpenVPN ===

Sample configuration file, e.g., /etc/openvpn/swh.conf:

<pre>
remote vpn.softwareheritage.org
ns-cert-type server
comp-lzo
nobind
dev tun
proto udp
port 1194
log /var/log/openvpn.log
up-restart
persist-key
persist-tun
client
ca /etc/openvpn/keys/softwareheritage-ca.crt
cert /etc/openvpn/keys/softwareheritage.crt
key /etc/openvpn/keys/softwareheritage.key
user nobody
group nogroup

# If you are using resolvconf, add this:
# Make sure you add louvre to /etc/hosts to avoid issues in using the vpn-provided DNS server.
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf

# If you want the connection to persist when your network fails, add this:
ping-restart 10
</pre>

In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys (matching the paths within the sample above):

* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)
* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)
* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)

Activate the openvpn server

as root, run

systemctl enable openvpn@swh.service
systemctl start openvpn@swh.service
systemctl status openvpn@swh.service

Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.

Excerpt of a successful start:

root@machine:~# systemctl status openvpn@swh.service
openvpn@swh.service - OpenVPN connection to swh
Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled)
Active: active (running) since Thu 2020-12-17 19:03:29 IST; 22min ago
Docs: man:openvpn(8)
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage
https://community.openvpn.net/openvpn/wiki/HOWTO
Main PID: 12302 (openvpn)
Status: "Initialization Sequence Completed"
Tasks: 1 (limit: 4915)
CGroup: /system.slice/system-openvpn.slice/openvpn@swh.service
└─12302 /usr/sbin/openvpn --daemon ovpn-swh --status /run/openvpn/swh.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/swh.conf --writepid /run/openvpn/swh.pid

Dec 17 19:03:29 machine systemd[1]: Starting OpenVPN connection to swh...
Dec 17 19:03:29 machine systemd[1]: Started OpenVPN connection to swh.

=== Network Manager GUI ===

You need network-manager-openvpn and network-manager-openvpn-gnome for the configuration gui.

[[File:nm_openvpn_base.png]]
[[File:nm_openvpn_routes.png]]
[[File:nm_openvpn_advanced_general.png]]
[[File:nm_openvpn_advanced_security.png]]
[[File:nm_openvpn_advanced_tls_auth.png]]

== Obtaining a client certificate ==

=== For users ===

Generate a keypair (key + certificate signing request) using the following command:

<pre>
openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"
</pre>

Please replace <your username> with something that uniquely identifies the certificate.

Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).

Provide the CSR file to a sysadmin through a reasonably authenticated medium.

=== For admins ===

* On the firewall (192.168.50.1), go to the [https://192.168.50.1/system_certmanager.php System / Trust / Certificates page]
* click on the add button on the upper right
[[File:Vpn-main-trust-page.png]]
* On the Method list, choose "Sign a certificate Signing Request"
[[File:Vpn-csr-signing.png]]

Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>

* Enter the user name on the descriptive name
* Select "OpenVPN Software Heritage (louvre)" as Certificate Authority
* Enter the duration, usually 10 years
* Paste the csr
* Validate

* check the details of the csr and validate

== Revoking a client certificate ==

On louvre:

<pre>
root@louvre:~# cd /etc/openvpn/keys
root@louvre:/etc/openvpn/keys# ./easyrsa revoke USERNAME
[ say yes ]
root@louvre:/etc/openvpn/keys# ./easyrsa gen-crl; chmod a+r pki/crl.pem
</pre>

OpenVPN re-reads the CRL at each connection (which is why we need the CRL to be world-readable), so once the cert is revoked, there's nothing more to do. If you want to make sure the client is disconnected, you need to restart OpenVPN (which will make all clients reconnect).

== /etc/hosts entries ==

Once the Vpn is setup on your machine, you can access Software Heritage hosts via their private IP addresses; see [[Network configuration]].

OpenVPN now pushes the address of our DNS server (192.168.100.29, pergamon).

You might want to add louvre.softwareheritage.org in your /etc/hosts to avoid a bootstrap problem if the "on-vpn" DNS server is in your resolv.conf.

[[Category:Infrastructure]]
[[Category:System administration]]

File:Vpn-main trust-page.png

2021-07-09T10:02:28Z

Vsellier: Vsellier moved page File:Vpn-main trust-page.png to File:Vpn-main-trust-page.png

#REDIRECT [[File:Vpn-main-trust-page.png]]

File:Vpn-main-trust-page.png

2021-07-09T10:02:28Z

Vsellier: Vsellier moved page File:Vpn-main trust-page.png to File:Vpn-main-trust-page.png

File:Vpn-main-trust-page.png

2021-07-09T10:01:29Z

Vsellier:

File:Vpn-csr-signing.png

2021-07-09T10:01:02Z

Vsellier: