- •Credits
- •About the Author
- •About the Reviewers
- •www.PacktPub.com
- •Table of Contents
- •Preface
- •Introduction
- •Shortest setup possible
- •OpenVPN secret keys
- •Multiple secret keys
- •Plaintext tunnel
- •Routing
- •Configuration files versus the command-line
- •Complete site-to-site setup
- •3-way routing
- •Introduction
- •Setting up the public and private keys
- •Simple configuration
- •Server-side routing
- •Routing: subnets on both sides
- •Redirecting the default gateway
- •Using an 'ifconfig-pool' block
- •Using the status file
- •Management interface
- •Proxy-arp
- •Introduction
- •Simple configuration—non-bridged
- •Enabling client-to-client traffic
- •Bridging—Linux
- •Bridging—Windows
- •Checking broadcast and non-IP traffic
- •External DHCP server
- •Using the status file
- •Management interface
- •Introduction
- •Certificate generation
- •xCA: a GUI for managing a PKI (Part 1)
- •xCA: a GUI for managing a PKI (Part 2)
- •OpenSSL tricks: x509, pkcs12, verify output
- •Revoking certificates
- •The use of CRLs
- •Checking expired/revoked certificates
- •Intermediary CAs
- •Multiple CAs: stacking, using --capath
- •Introduction
- •Initializing a hardware token
- •Getting a hardware token ID
- •Using a hardware token
- •Selecting a PKCS#11 certificate using the management interface
- •Generating a key on the hardware token
- •Private method for getting a PKCS#11 certificate
- •Pin caching example
- •Introduction
- •Using a client-side up/down script
- •Windows login greeter
- •Using client-connect/client-disconnect scripts
- •Using a 'learn-address' script
- •Using a 'tls-verify' script
- •Using an 'auth-user-pass-verify' script
- •Script order
- •Script security and logging
- •Using the 'down-root' plugin
- •Using the PAM authentication plugin
- •Introduction
- •Cipher mismatches
- •TUN versus TAP mismatches
- •Compression mismatches
- •Key mismatches
- •Troubleshooting MTU and tun-mtu issues
- •Troubleshooting network connectivity
- •How to read the OpenVPN log files
- •Introduction
- •The missing return route
- •Missing return routes when 'iroute' is used
- •Source routing
- •Routing and permissions on Windows
- •Troubleshooting client-to-client traffic routing
- •Understanding the 'MULTI: bad source' warnings
- •Failure when redirecting the default gateway
- •Introduction
- •Optimizing performance using 'ping'
- •OpenSSL cipher speed
- •Compression tests
- •Traffic shaping
- •Tuning UDP-based connections
- •Tuning TCP-based connections
- •Analyzing performance using tcpdump
- •Introduction
- •Linux: using NetworkManager
- •MacOS: using Tunnelblick
- •Windows Vista/7: elevated privileges
- •Windows: using the CryptoAPI store
- •Windows: updating the DNS cache
- •Windows: running OpenVPN as a service
- •Windows: public versus private network adapters
- •Windows: routing methods
- •Introduction
- •Including configuration files in config files
- •Details of ifconfig-pool-persist
- •Connecting using a SOCKS proxy
- •Connecting via an HTTP proxy
- •Connecting via an HTTP proxy with authentication
- •Using dyndns
- •IP-less setups (ifconfig-noexec)
- •Introduction
- •Inline certificates
- •Connection blocks
- •Port sharing with an HTTPS server
- •Routing features: redirect-private, allow-pull-fqdn
- •OCSP support
- •New for 2.2: the 'x509_user_name' parameter
- •Index
Scripting and Plugins
Windows login greeter
This recipe is a continuation of the previous recipe. It will demonstrate how to push a message from the OpenVPN server to the client during the connection phase. This message can be used as a legal warning or as a disclaimer message. In order to do this, we use the setenv-safe directive, which is available in OpenVPN 2.1 and higher. This directive can be pushed out to clients, in contrast with the more commonly-used setenv directive.
Getting ready
Install OpenVPN 2.1 or higher on two computers. Make sure the computers are connected over a network. Set up the client and server certificates using the first recipe from Chapter 2, Client-server IP-only Networks. For this recipe, the server computer was running Fedora 12 Linux and OpenVPN 2.1.1. The client was running Windows XP SP3 and OpenVPN 2.1.1. Keep the server configuration file, example6-1-server.conf, from the previous recipe at hand.
How to do it...
1.Append a line to the server configuration file example6-1-server.conf:
push "setenv-safe MSG 'This is a message from the OpenVPN server'"
Note that this is a single line. Save it as example6-2-server.conf.
2.Start the server:
[root@server]# openvpn --config example6-2-server.conf
3.Next, create the client configuration file:
client proto udp
remote openvpnserver.example.com port 1194
dev tun nobind
ca |
"c:/program files/openvpn/config/ca.crt" |
cert |
"c:/program files/openvpn/config/client2.crt" |
key |
"c:/program files/openvpn/config/client2.key" |
tls-auth "c:/program files/openvpn/config/ta.key" 1
script-security 2 system
up "c:\\openvpn\\cookbook\\example6-2.vbs"
Save it as example6-2.ovpn.
158
Chapter 6
4.Next, create the Visual Basic Script, example6-2.vbs:
Set oShell = CreateObject( "WScript.Shell" ) msg=oShell.ExpandEnvironmentStrings("%OPENVPN_MSG%") MsgBox msg, , "Welcome"
Save it in c:\openvpn\cookbook, or more importantly in a location with no spaces in the directory name. Start the OpenVPN client. During the connection phase, a message box will pop up:
How it works...
The following server directive pushes the statement setenv-safe MSG … to the connecting client:
push "setenv-safe MSG 'This is a message from the OpenVPN server'"
The client carries out the directive as if the following was specified:
setenv-safe MSG 'This is a message from the OpenVPN server'
The setenv-safe directive prepends OPENVPN_ to all the environment variables prior to setting them to avoid conflicts with the existing system variables.
159
Scripting and Plugins
The following directive is required so that we can execute the Visual Basic script directly:
script-security 2 system
If we had specified it without the system, the OpenVPN client would not have been able to execute the VBS file, as it is not a real executable program.
The Visual Basic script picks up the new environment variable and displays a message box with the text.
There's more...
There are a few things to keep in mind when developing scripts for the Windows platform.
Spaces in filenames
An oddity of running scripts is related to the use of spaces in filenames: it is not easy to place a script in a directory with a space in it, nor should the script itself have a space in the filename. OpenVPN gets confused which part of the command is the actual script and which part comprises the command-line parameters to the script. Therefore, it is best to avoid spaces in the full pathnames for scripts altogether. With OpenVPN 2.1, we could also
have used:
cd "c:\\program files\\openvpn\\scripts" up "example6-2.vbs"
Another option is to always use the OpenVPN GUI application. This application switches to the directory C:\Program Files\OpenVPN\config prior to launching the OpenVPN. So,
a script can also be referenced using:
up "..\\scripts\\example6-2.vbs"
Yet another option is to specify the path to the Windows scripting executable directly. You can then pass the name of the actual script as the first argument, which can then be stored in a directory containing spaces:
up "%windir%\\system32\\wscript.exe
\"c:\\program files\\openvpn\\scripts\\example6-2.vbs\""
Note that this statement is a single line.
setenv or setenv-safe
Normally, the following directive is used to set an environment variable that will be available to any script that OpenVPN calls:
setenv env-var value
160
Chapter 6
However, the setenv directive cannot be pushed to a client from the server side. The setenv-safe directive, which was introduced in OpenVPN 2.1, can be pushed.
Security considerations
This recipe can be used to show a disclaimer or legal text when a user sets up a VPN connection. However, it is trivial for a user to circumvent this by modifying the client configuration file. If more stringent security is required, an application should be developed that can interact with the OpenVPN server itself.
Using client-connect/client-disconnect scripts
This recipe will demonstrate how to set up a client-connect script that gets executed on the server side when a new client connects. Similarly, a client-disconnect script can be specified that is executed when a client disconnects from the server. Client-connect and client-disconnect scripts can be used for several purposes:
Extra authentication
Opening and closing firewall ports
Assigning specific IP address to special clients
Writing out connection-specific configuration lines for a client
In this recipe, we will use a client-connect script to push a custom message to an OpenVPN client, based on the time of the day when the client connects.
Getting ready
Install OpenVPN 2.1 or higher on two computers. Make sure the computers are connected over a network. Set up the client and server certificates using the first recipe from Chapter 2. For this recipe, the server computer was running CentOS 5 Linux and OpenVPN 2.1.1. The client was running Windows XP SP3 and OpenVPN 2.1.1. Keep the server configuration file example6-1-server.conf from the first recipe of this chapter at hand.
How to do it...
1.Append the following lines to the example6-1-server.conf server configuration file:
script-security 2
client-connect /etc/openvpn/cookbook/example6-3-connect.sh
Save it as example6-3-server.conf.
161
Scripting and Plugins
2.Next , create the connect script:
#!/bin/bash
hour=`/bin/date +"%H"` if [ $hour -lt 6 ] then
msg1="You're up at a weird hour" elif [ $hour -le 12 ]
then
msg1="Good morning" elif [ $hour -lt 18 ] then
msg1="Good afternoon"
else
msg1="Good evening"
fi
OPENVPN_MSG1="$msg1 $common_name" OPENVPN_MSG2=`/bin/date +"Local time at the VPN server is %H:%M:%S"`
# now write out the extra configuration lines to $1 echo "push \"setenv-safe MSG1 '$OPENVPN_MSG1'\"" > $1 echo "push \"setenv-safe MSG2 '$OPENVPN_MSG2'\"" >> $1
Save this file as example6-3-connect.sh.
3.Make sure the script is executable:
[root@server]# chmod 755 example6-3-connect.sh
4.Start the server:
[root@server]# openvpn --config example6-3-server.conf
5.The client configuration file is very similar to the one from the previous recipe:
client proto udp
remote openvpnserver.example.com port 1194
dev tun nobind
ca |
"c:/program |
files/openvpn/config/ca.crt" |
cert |
"c:/program |
files/openvpn/config/client2.crt" |
162
Chapter 6
key |
"c:/program |
files/openvpn/config/client2.key" |
tls-auth "c:/program |
files/openvpn/config/ta.key" 1 |
script-security 2 system
up "c:\\openvpn\\cookbook\\example6-3.vbs"
Save it as example6-3.ovpn.
6.Create the VB Script file:
Set oShell = CreateObject( "WScript.Shell" ) msg1=oShell.ExpandEnvironmentStrings("%OPENVPN_MSG1%") msg2=oShell.ExpandEnvironmentStrings("%OPENVPN_MSG2%") MsgBox msg1 + vbcrlf + msg2, , "Welcome"
Save it as c:\openvpn\cookbook\example6-3.vbs.
7.Start the OpenVPN client:
During the connection phase a message box will pop up:
163
Scripting and Plugins
How it works...
When a client connects, the OpenVPN server executes the client-connect script with several environment variables set that are related to the client connecting. The script writes out two lines to the connect-specific configuration file, which is passed as the first and only parameter to the client-connect script. This configuration file is then processed by the OpenVPN server as if it's a normal configuration file. The two lines that we use are:
push "setenv-safe MSG1 '$OPENVPN_MSG1'" push "setenv-safe MSG2 '$OPENVPN_MSG2'"
This means that two environment variables are pushed out to the client. These environment variables are picked up by the OpenVPN client and are displayed in a dialog box using a Windows VBS script.
There's more...
In this section, we focus on client-disconnect and the many environment variables that are available to all OpenVPN scripts.
'client-disconnect' scripts
A client-disconnect script can be specified using:
client-disconnect /etc/openvpn/cookbook/disconnect.sh
This script is executed when the client disconnects from the server. Be aware that when a client first disconnects and a explicit-exit-notify is not specified on the client side, then the OpenVPN server will first try to reconnect several times to the client. If a client does not respond after several attempts then the client-disconnect script will be executed.
Depending on the server configuration, this might be several minutes after the client has actually disconnected.
Environment variables
There is a multitude of environment variables available inside a client-connect and clientdisconnect script. It is very instructive to write a client-connect script that does a little more than:
#!/bin.bash env >> /tmp/log
Also, similar to the up and down script, is the environment variable script_type that contains the type of script as configured in the server configuration file. This gives the server administrator the option to write a single script for both client-connect and
client-disconnect.
164