The setup is client-server, with per-client certificates.
OpenVPN client configuration
Sample configuration file, e.g., /etc/openvpn/swh.conf:
remote louvre.softwareheritage.org ns-cert-type server comp-lzo nobind dev tun proto udp port 1194 log /var/log/openvpn.log up-restart persist-key persist-tun client ca /etc/openvpn/keys/softwareheritage-ca.crt cert /etc/openvpn/keys/softwareheritage.crt key /etc/openvpn/keys/softwareheritage.key user nobody group nogroup # If you are using resolvconf, add this: # Make sure you add louvre to /etc/hosts to avoid issues in using the vpn-provided DNS server. script-security 2 up /etc/openvpn/update-resolv-conf down /etc/openvpn/update-resolv-conf # If you want the connection to persist when your network fails, add this: ping-restart 10
In addition to the above configuration file, you will need to install the following 3 files under /etc/openvpn/keys (matching the paths within the sample above):
- softwareheritage-ca.crt: public certificate for the Software Heritage certification authority (CA)
- softwareheritage.crt: public, client-specific (certificate signed by the admin, see below)
- softwareheritage.key: private, client-specific key (generated by the user, see below)
Activate the openvpn server
as root, run
systemctl enable firstname.lastname@example.org systemctl start email@example.com systemctl status firstname.lastname@example.org
Note: Internally, the `swh` must match the /etc/openvpn/swh.conf filename.
Excerpt of a successful start:
root@machine:~# systemctl status email@example.com firstname.lastname@example.org - OpenVPN connection to swh Loaded: loaded (/lib/systemd/system/openvpn@.service; indirect; vendor preset: enabled) Active: active (running) since Thu 2020-12-17 19:03:29 IST; 22min ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Main PID: 12302 (openvpn) Status: "Initialization Sequence Completed" Tasks: 1 (limit: 4915) CGroup: /email@example.com └─12302 /usr/sbin/openvpn --daemon ovpn-swh --status /run/openvpn/swh.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/swh.conf --writepid /run/openvpn/swh.pid
Dec 17 19:03:29 machine systemd: Starting OpenVPN connection to swh... Dec 17 19:03:29 machine systemd: Started OpenVPN connection to swh.
Network Manager GUI
You need network-manager-openvpn and network-manager-openvpn-gnome for the configuration gui.
Obtaining a client certificate
Generate a keypair (key + certificate signing request) using the following command:
openssl req -new -newkey rsa:2048 -nodes -keyout openvpn.key -out openvpn.csr -subj "/CN=<your username>"
Please replace <your username> with something that uniquely identifies the certificate.
Make sure openvpn.key is stored in a safe place (it's your private key, which will allow anyone to connect to the VPN).
Provide the CSR file to a sysadmin through a reasonably authenticated medium.
Fetch the CSR file provided by the user, for instance with scp USERNAME.csr louvre:
Then, as root on louvre:
root@louvre:~# cd /etc/openvpn/keys root@louvre:/etc/openvpn/keys# ./easyrsa import-req ~ADMIN/USERNAME.csr USERNAME root@louvre:/etc/openvpn/keys# ./easyrsa sign-req client USERNAME
The first command imports the csr into the EasyRSA PKI. The second command lets you review and sign it.
Send the signed certificate, /etc/openvpn/keys/pki/issued/USERNAME.crt, to the user. That file only contains public key material.
Add the DNS entry for the new host to hiera and do a puppet run on pergamon.
Revoking a client certificate
root@louvre:~# cd /etc/openvpn/keys root@louvre:/etc/openvpn/keys# ./easyrsa revoke USERNAME [ say yes ] root@louvre:/etc/openvpn/keys# ./easyrsa gen-crl; chmod a+r pki/crl.pem
OpenVPN re-reads the CRL at each connection (which is why we need the CRL to be world-readable), so once the cert is revoked, there's nothing more to do. If you want to make sure the client is disconnected, you need to restart OpenVPN (which will make all clients reconnect).
Once the Vpn is setup on your machine, you can access Software Heritage hosts via their private IP addresses; see Network configuration.
OpenVPN now pushes the address of our DNS server (192.168.100.29, pergamon).
You might want to add louvre.softwareheritage.org in your /etc/hosts to avoid a bootstrap problem if the "on-vpn" DNS server is in your resolv.conf.