Witam,
próbuję skonfigurować vpna na tomato, tak by każdy użytkownik prócz klucza musiał również podać swój login oraz hasło. Niestety utknąłem. Dodam jeszcze, że udało mi się stworzyć działającą konfigurację w oparciu o same klucze i certyfikaty. Nie mogę jednak dołożyć loginów i haseł.
Korzystam z versji: Tomato Firmware v1.25vpn3.4.4a8380cb.
Cześć konfiguracji serwera zrobiłem z pomocą gui, ale to nie ma raczej żadnego znaczenia.
Konfiguracja serwera przedstawia się następująco:
# Automatically generated configuration
daemon
server 10.8.0.0 255.255.255.0
proto udp
port 1199
dev tun21
comp-lzo yes
keepalive 15 60
verb 3
tls-auth static.key
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status
# Custom Configuration
script-security 3
auth-user-pass-verify /jffs/openvpn/auth.sh via-file
Konfiguracja klienta:
client
dev tun
proto udp
#testwo sam sie lacze do siebie
remote 192.168.90.1 1199
nobind
persist-key
persist-tun
mute-replay-warnings
auth-user-pass
ca ca.crt
cert login.crt
key login.key
ns-cert-type server
tls-auth ta.key
cipher BF-CBC
comp-lzo
verb 3
mute 20
Skrypt którym chciałem autoryzować użytkowników wygląda tak:
#!/bin/sh
# Wczytujemy plik z nazwami uzytkownikow i zaszyfrowanymi haslami
# plik ma postac: login1:password1\n
# login2:password2
USERS=`cat users_file`
vpn_verify() {
#skrypt musi przyjac 2 argumenty
if [ $# != 2 ] then
echo "No username or password: $*" >> /tmp/var/log/messages
exit 1
fi
## it can also be done with grep or sed
for i in $USERS; do
#szukamy nazwy uzytkownika w linii z pliku
#jesli jest wartość tego porownania wieksza od zera
if [ `expr match "$i" $1` -gt 0 ] then
HASH=`echo -n $1$2 | md5sum | sed s'/\ -//'`
j=0
while [ $j != 10 ] do
HASH=`echo -n $HASH$HASH | md5sum | sed s'/\ -//'`
j=`expr $j + 1`
done
if [ `expr match "$i" $1:$HASH` -gt 0 ] then
echo "Authentication OK: $1" >> /tmp/var/log/messages
exit 0
else
echo "Authentication failure" >> /tmp/var/log/messages
exit 1
fi
fi
done
}
vpn_verify $1 $2
echo "No user with this password found" >> /tmp/var/log/messages
exit 1
Oczywiście dodając wpisy do users_file należy najpierw stworzyć w analogiczny sposób odpowiednie hashe.
Przy próbie połączenia po stronie klienta mam takie logi:
Thu Dec 3 17:21:51 2009 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Mar 9 2009
Enter Auth Username:login
Enter Auth Password:
Thu Dec 3 17:22:12 2009 /usr/bin/openssl-vulnkey -q -b 1024 -m
Thu Dec 3 17:22:12 2009 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Thu Dec 3 17:22:12 2009 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 3 17:22:12 2009 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 3 17:22:12 2009 LZO compression initialized
Thu Dec 3 17:22:12 2009 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Dec 3 17:22:12 2009 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Dec 3 17:22:12 2009 Local Options hash (VER=V4): '02af3434'
Thu Dec 3 17:22:12 2009 Expected Remote Options hash (VER=V4): '3f08d474'
Thu Dec 3 17:22:12 2009 Socket Buffers: R=[112640->131072] S=[112640->131072]
Thu Dec 3 17:22:12 2009 UDPv4 link local: [undef]
Thu Dec 3 17:22:12 2009 UDPv4 link remote: 192.168.90.1:1199
Thu Dec 3 17:22:12 2009 TLS: Initial packet from 192.168.90.1:1199, sid=84f0e12c 9772d5dc
Thu Dec 3 17:22:12 2009 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Dec 3 17:22:13 2009 VERIFY OK: depth=1, /C=PL/
Thu Dec 3 17:22:13 2009 VERIFY OK: nsCertType=SERVER
Thu Dec 3 17:22:13 2009 VERIFY OK: depth=0, /C=PL/
Thu Dec 3 17:22:14 2009 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec 3 17:22:14 2009 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 3 17:22:14 2009 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Dec 3 17:22:14 2009 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Dec 3 17:22:14 2009 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
Thu Dec 3 17:22:14 2009 [onyx] Peer Connection Initiated with 192.168.90.1:1199
Thu Dec 3 17:22:15 2009 SENT CONTROL [onyx]: 'PUSH_REQUEST' (status=1)
Thu Dec 3 17:22:15 2009 AUTH: Received AUTH_FAILED control message
Thu Dec 3 17:22:15 2009 TCP/UDP: Closing socket
Thu Dec 3 17:22:15 2009 SIGTERM[soft,auth-failure] received, process exiting
Na serwerze natomiast mam:
Dec 3 17:20:13 onyx user.info kernel: device tun21 entered promiscuous mode
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: OpenVPN 2.1_rc19 mipsel-unknown-linux-gnu [SSL] [LZO2] built on Aug 12 2009
Dec 3 17:20:13 onyx daemon.warn openvpn[23372]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: Diffie-Hellman initialized with 1024 bit key
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: Control Channel Authentication: using 'static.key' as a OpenVPN static key file
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: TLS-Auth MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: TUN/TAP device tun21 opened
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: TUN/TAP TX queue length set to 100
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: /sbin/ifconfig tun21 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Dec 3 17:20:13 onyx daemon.notice openvpn[23372]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: Socket Buffers: R=[32767->65534] S=[32767->65534]
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: UDPv4 link local (bound): [undef]:1199
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: UDPv4 link remote: [undef]
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: MULTI: multi_init called, r=256 v=256
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: IFCONFIG POOL: base=10.8.0.4 size=62
Dec 3 17:20:13 onyx daemon.notice openvpn[23378]: Initialization Sequence Completed
Dec 3 17:20:18 onyx daemon.err openvpn[23378]: event_wait : Interrupted system call (code=4)
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: MULTI: multi_create_instance called
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 Re-using SSL/TLS context
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 LZO compression initialized
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Dec 3 17:22:09 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 TLS: Initial packet from 192.168.90.30:39977, sid=1970f751 c1a841ec
Dec 3 17:22:10 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 VERIFY OK: depth=1, /C=PL
Dec 3 17:22:10 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 VERIFY OK: depth=0, /C=PL
No username or password: openvpn_up_58ece879c80d751f9b76592f55281454.tmp
Dec 3 17:22:11 onyx daemon.err openvpn[23378]: 192.168.90.30:39977 TLS Auth Error: Auth Username/Password verification failed for peer
Dec 3 17:22:11 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
Dec 3 17:22:11 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 [login] Peer Connection Initiated with 192.168.90.30:39977
Dec 3 17:22:12 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 PUSH: Received control message: 'PUSH_REQUEST'
Dec 3 17:22:12 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 Delayed exit in 5 seconds
Dec 3 17:22:12 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 SENT CONTROL [login]: 'AUTH_FAILED' (status=1)
Dec 3 17:22:14 onyx daemon.err openvpn[23378]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Dec 3 17:22:16 onyx daemon.err openvpn[23378]: read UDPv4 [ECONNREFUSED]: Connection refused (code=146)
Dec 3 17:22:17 onyx daemon.notice openvpn[23378]: 192.168.90.30:39977 SIGTERM[soft,delayed-exit] received, client-instance exiting
Jak odpalam skrypt 'auth.sh' z konsoli to wykonuje się poprawnie.
Co robię źle?
Edytowany przez fabix dnia 04-12-2009 09:02
|
' target='_blank'>Link
