VPN - Revision history

Ardumont: Install redirection to the docs page

2021-10-28T12:59:19Z

Install redirection to the docs page

Vsellier: /* /etc/hosts entries */

2021-07-09T10:28:22Z

/etc/hosts entries

← Older revision		Revision as of 10:28, 9 July 2021
Line 134:		Line 134:
	The counter of revoked certificate should be increased by one on for the OpenVPN CSR on the CSR list		The counter of revoked certificate should be increased by one on for the OpenVPN CSR on the CSR list

	~~== /etc/hosts entries ==~~

	~~Once the Vpn is setup on your machine, you can access Software Heritage hosts via their private IP addresses; see [[Network configuration]].~~

	~~OpenVPN now pushes the address of our DNS server (192.168.100.29, pergamon).~~

	~~You might want to add louvre.softwareheritage.org in your /etc/hosts to avoid a bootstrap problem if the "on-vpn" DNS server is in your resolv.conf.~~

	[[Category:Infrastructure]]		[[Category:Infrastructure]]
	[[Category:System administration]]		[[Category:System administration]]

Vsellier: /* Revoking a client certificate */

2021-07-09T10:23:18Z

Revoking a client certificate

← Older revision		Revision as of 10:23, 9 July 2021
Line 119:		Line 119:
	== Revoking a client certificate ==		== Revoking a client certificate ==

	On ~~louvre~~:		On the firewall (master) [https://192.168.50.1]:
			* go to the [[https://192.168.50.1/system_crlmanager.php System / Trust / Revocation]] page
			* edit the "OpenVPN certificate revocation list" CRL

	~~<pre>~~		[[File:Vpn-crl-list.png]]
	~~root@louvre:~# cd /etc/openvpn/keys~~
	~~root@louvre:/etc/openvpn/keys# ./easyrsa revoke USERNAME~~
	[ ~~say yes ]~~
	~~root@louvre~~:~~/etc/openvpn/keys# ./easyrsa gen~~-crl~~; chmod a+r pki/crl~~.~~pem~~
	~~</pre>~~

	~~OpenVPN re-reads~~ the ~~CRL at each connection (which is why we need~~ the ~~CRL to be world~~-~~readable), so once~~ the ~~cert is~~ revoked~~, there's nothing more to do. If you want to make sure~~ the ~~client is disconnected, you need to restart~~ OpenVPN ~~(which will make all clients reconnect).~~		* go to the bottom of the page

			[[File:Vpn-csr-certificate.png]]

			* select the certificate to revoke
			* Add

			The counter of revoked certificate should be increased by one on for the OpenVPN CSR on the CSR list

	== /etc/hosts entries ==		== /etc/hosts entries ==

Vsellier: /* For admins */

2021-07-09T10:12:53Z

For admins

← Older revision		Revision as of 10:12, 9 July 2021
Line 101:		Line 101:
	=== For admins ===		=== For admins ===

	On ~~louvre~~:		* On the firewall (192.168.50.1), go to the [https://192.168.50.1/system_certmanager.php System / Trust / Certificates page]
			* click on the add button on the upper right
			[[File:Vpn-main-trust-page.png]]
			* On the Method list, choose "Sign a certificate Signing Request"
			[[File:Vpn-csr-signing.png]]

	Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>		Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>

	~~Then, as root~~ on louvre:		* Enter the user name on the descriptive name
			* Select "OpenVPN Software Heritage (louvre)" as Certificate Authority
			* Enter the duration, usually 10 years
			* Paste the csr
			* Validate

	~~<pre>~~		* check the details of the csr and validate
	~~root@louvre:~# cd /etc/openvpn/keys~~
	~~root@louvre:/etc/openvpn/keys# ./easyrsa import-req ~ADMIN/USERNAME.csr USERNAME~~
	~~root@louvre:/etc/openvpn/keys# ./easyrsa sign-req client USERNAME~~
	~~</pre>~~

	~~The first command imports~~ the csr ~~into the EasyRSA PKI. The second command lets you review and sign it.~~

	~~Send the signed certificate, <tt>/etc/openvpn/keys/pki/issued/USERNAME.crt</tt>, to the user. That file only contains public key material.~~

	~~Add the DNS entry for the new host to hiera~~ and ~~do a puppet run on pergamon.~~

	== Revoking a client certificate ==		== Revoking a client certificate ==

NicolasDandrimont at 15:19, 23 June 2021

2021-06-23T15:19:27Z

← Older revision		Revision as of 15:19, 23 June 2021
Line 11:		Line 11:

	<pre>		<pre>
	remote ~~louvre~~.softwareheritage.org		remote vpn.softwareheritage.org
	ns-cert-type server		ns-cert-type server
	comp-lzo		comp-lzo

Ardumont: /* Raw OpenVPN */

2020-12-17T13:58:18Z

Raw OpenVPN

@@ Line 50: / Line 50: @@
     systemctl enable openvpn@swh.service
 Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.
 === Network Manager GUI ===

Ardumont: Clarify raw openvpn steps to enable the service

2020-12-17T13:23:48Z

Clarify raw openvpn steps to enable the service

← Older revision		Revision as of 13:23, 17 December 2020
Line 8:		Line 8:
	=== Raw OpenVPN ===		=== Raw OpenVPN ===

	Sample configuration file, e.g., /etc/openvpn/~~softwareheritage~~.conf:		Sample configuration file, e.g., /etc/openvpn/swh.conf:

	<pre>		<pre>
Line 39:		Line 39:
	</pre>		</pre>

	In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys:		In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys (matching the paths within the sample above):

	* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)		* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)
	* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)		* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)
	* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)		* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)

			Activate the openvpn server

			as root, run

			systemctl enable openvpn@swh.service

			Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.

	=== Network Manager GUI ===		=== Network Manager GUI ===

Ardumont: Internal links to clarify what's what

2020-12-17T13:18:22Z

Internal links to clarify what's what

← Older revision		Revision as of 13:18, 17 December 2020
Line 42:		Line 42:

	* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)		* '''[[softwareheritage-ca.crt]]''': ''public'' certificate for the Software Heritage certification authority (CA)
	* '''softwareheritage.crt''': ''public'', client-specific certificate (see below)		* '''[https://wiki.softwareheritage.org/index.php?title=VPN#For_admins softwareheritage.crt]''': ''public'', client-specific (certificate signed by the admin, see below)
	* '''softwareheritage.key''': ''private'', client-specific key (see below)		* '''[https://wiki.softwareheritage.org/wiki/VPN#For_users softwareheritage.key]''': ''private'', client-specific key (generated by the user, see below)

	=== Network Manager GUI ===		=== Network Manager GUI ===

NicolasDandrimont: 23 revisions imported

2020-07-17T08:44:12Z

23 revisions imported

← Older revision	Revision as of 08:44, 17 July 2020
(No difference)

NicolasDandrimont: /* Obtaining a client certificate */ Improve instructions to avoid key material transfers.

2019-12-04T17:41:51Z

Obtaining a client certificate: Improve instructions to avoid key material transfers.

← Older revision		Revision as of 17:41, 4 December 2019
Line 61:		Line 61:
	Generate a keypair (key + certificate signing request) using the following command:		Generate a keypair (key + certificate signing request) using the following command:

	~~{{{~~		<pre>
	openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"		openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"
	~~}}}~~		</pre>

			Please replace <your username> with something that uniquely identifies the certificate.

	Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).		Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).

	Provide the CSR file to a sysadmin.		Provide the CSR file to a sysadmin through a reasonably authenticated medium.

	=== For admins ===		=== For admins ===

	On louvre:		On louvre:

			Fetch the CSR file provided by the user, for instance with <tt>scp USERNAME.csr louvre:</tt>

			Then, as root on louvre:

	<pre>		<pre>
	root@louvre:~# cd /etc/openvpn/keys		root@louvre:~# cd /etc/openvpn/keys
	root@louvre:/etc/openvpn/keys# ./easyrsa ~~build~~-client~~-full~~ USERNAME ~~nopass~~		root@louvre:/etc/openvpn/keys# ./easyrsa import-req ~ADMIN/USERNAME.csr USERNAME
			root@louvre:/etc/openvpn/keys# ./easyrsa sign-req client USERNAME
	</pre>		</pre>

	At the ~~end of~~ the ~~process~~ certificate ~~and key will be in~~ /etc/openvpn/keys/pki/issued/USERNAME.crt ~~and~~ /~~etc/openvpn/keys/pki/private/USERNAME~~.key.		The first command imports the csr into the EasyRSA PKI. The second command lets you review and sign it.
	~~Send them to USERNAME (securely)~~.
			Send the signed certificate, <tt>/etc/openvpn/keys/pki/issued/USERNAME.crt</tt>, to the user. That file only contains public key material.

	Add the DNS entry for the new host to hiera and do a puppet run on pergamon.		Add the DNS entry for the new host to hiera and do a puppet run on pergamon.