Centos 6.8安装openvpn.三种认证方式

# mkdir /var/log/openvpn

# service openvpn start

tarting openvpn: /etc/init.d/openvpn: line 162: 328 Segmentation fault

这里可能报错，因为openvpn的启动脚本和发行版稍有差别，如果报错，编辑文件/etc/init.d/openvpn里面注释如下几行：

# Source networking configuration.

#. /etc/sysconfig/network

# Check that networking is up.

#if [ ${NETWORKING} = "no" ]

#then

# echo "Networking isdown"

# exit 0

#fi

客户端配置请参见文章http://www.jb51.cc/article/p-nvottcuw-mt.html

====================================================================================

一、使用Mysql pam数据库认证（认证方法一）

1、安装并建立数据库

先删除以前版本数据库

#rpm -qa | grep mysql

mysql-5.0.77-4.el5_6.6

mod_auth_mysql-3.0.0-3.2.el5_3

mysql-libs-5.1.73-3.el6_5.x86_64

# rpm -e mod_auth_mysql-3.0.0-3.2.el5_3

# rpm -e mysql-5.0.77-4.el5_6.6

# yum -y remove mysql-libs-5.1*

请按顺序删除旧版本的数据库。

rpm安装Mysql 5.7.4-m14版本,

#rpm -ivhMySQL-server-5.7.4_m14-1.el6.x86_64.rpm

#rpm -ivhMySQL-client-5.7.4_m14-1.el6.x86_64.rpm

#rpm -ivhMySQL-devel-5.7.4_m14-1.el6.x86_64.rpm

#rpm -ivhMySQL-shared-5.7.4_m14-1.el6.x86_64.rpm

#rpm -ivhMySQL-shared-compat-5.7.4_m14-1.el6.x86_64.rpm

#chown -R mysql:mysql /var/lib/mysql

注意，默认密码请到下面文件中查看

You will find that password in '/root/.mysql_secret'.

# service mysql start

#mysql -uroot -p

登录后,用下面命令设定密码为pk168007

mysql>set password=password('pk168007');

mysql>flush privileges;

mysql>quit

[root@openvpn01 openvpn]# service mysql restart

[root@openvpn01 openvpn]# chkconfig mysql on

[root@openvpn01 openvpn]# mysql -u root -p

运行以下SQL命令：

创建数据库

mysql> CREATE DATABASE openvpn;

切换数据库

mysql> USE openvpn;

创建用户，用户名openvpn，密码evanmis（可自行设定）

mysql>GRANT ALL ON openvpn.* TO 'openvpn'@'localhost' IDENTIFIED BY 'evanmis';

创建用户数据表

CREATE TABLE IF NOT EXISTS `user` (

`username` char(32) COLLATE utf8_unicode_ci NOT NULL,

`password` char(128) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `active` int(10) NOT NULL DEFAULT '1',198);"> `creation` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,198);"> `name` varchar(32) COLLATE utf8_unicode_ci NOT NULL,198);"> `email` char(128) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `note` text COLLATE utf8_unicode_ci,198);"> `quota_cycle` int(10) NOT NULL DEFAULT '30',198);"> `quota_bytes` bigint(20) NOT NULL DEFAULT '10737418240',198);"> `enabled` int(10) NOT NULL DEFAULT '1',198);"> PRIMARY KEY (`username`),198);"> KEY `idx_active` (`active`),198);"> KEY `idx_enabled` (`enabled`)

) DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

-- 创建日志数据表

CREATE TABLE IF NOT EXISTS `log` (

`username` varchar(32) COLLATE utf8_unicode_ci NOT NULL,198);"> `start_time` timestamp NOT NULL DEFAULT CURRENT_TIMESTAMP,198);"> `end_time` timestamp NOT NULL DEFAULT '0000-00-00 00:00:00',198);"> `trusted_ip` varchar(64) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `trusted_port` int(10) DEFAULT NULL,198);"> `protocol` varchar(16) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `remote_ip` varchar(64) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `remote_netmask` varchar(64) COLLATE utf8_unicode_ci DEFAULT NULL,198);"> `bytes_received` bigint(20) DEFAULT '0',198);"> `bytes_sent` bigint(20) DEFAULT '0',198);"> `status` int(10) NOT NULL DEFAULT '1',198);"> KEY `idx_username` (`username`),198);"> KEY `idx_start_time` (`start_time`),198);"> KEY `idx_end_time` (`end_time`)

) DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci;

2、建立客户端的VPN拨入帐号

登入MySQL数据库：

[root@openvpn01 openvpn]# mysql -uopenvpn -p

执行以下命令：

mysql>USE openvpn;

INSERT INTO user(username,password) VALUES('test',ENCRYPT('123456'));

这样就建立好了一个用户test，密码为123456的帐号。

再查看当然数据库中的用户数量。如下

mysql> select * from user;

+----------+---------------+--------+---------------------+------+-------+------+-------------+-------------+---------+

| username | password | active | creation | name | email | note | quota_cycle | quota_bytes | enabled |

| test | st3rCn.zSAbZU | 1 | 2012-05-08 08:56:24 | | NULL | NULL | 30 | 10737418240 | 1 |

| evan | bT.y7RjLv90mc | 1 | 2012-05-08 14:57:43 | | NULL | NULL | 30 | 10737418240 | 1 |

2 rows in set (0.00 sec)

3、配置OpenVPN的PAM Mysql认证

安装pam_mysql验证安装包

[root@openvpn01 openvpn]# yum install pam_krb5 pam pam-devel

[root@openvpn01 openvpn]# rpm -ivh pam_mysql-0.7-0.12.rc1.el6.x86_64.rpm

[root@openvpn01 openvpn]# rpm -qa | grep pam_mysql

pam_mysql-0.7-0.12.rc1.el6.x86_64

并确认这个文件已经存在 /lib64/security/pam_mysql.so

[root@openvpn01 ~]# rpm -qa | grep pam

pam-devel-1.1.1-22.el6.x86_64

pam_mysql-0.7-0.12.rc1.el6.x86_64

fprintd-pam-0.1-22.git04fd09cfa.el6.x86_64

pam_passwdqc-1.0.5-8.el6.x86_64

pam-1.1.1-22.el6.x86_64

pam_krb5-2.3.11-9.el6.x86_64

[root@openvpn01 ~]# touch /etc/pam.d/openvpn_mysql

[root@openvpn01 ~]# vi /etc/pam.d/openvpn_mysql

auth sufficient pam_mysql.so

user=openvpn passwd=evanmis host=localhost db=openvpn

table=user usercolumn=username passwdcolumn=password

where=active=1 sqllog=0 crypt=1

account required pam_mysql.so

where=active=1 sqllog=0 crypt=1

4、测试pam验证是否成功

[root@openvpn01 openvpn]# /etc/init.d/saslauthd restart

[root@openvpn01 openvpn]# chkconfig saslauthd on

[root@openvpn01 openvpn]# testsaslauthd -u test -p 123456 -s openvpn_mysql

如果显示

0: OK "Success."

则说明mysql认证配置成功。否则，请根据/var/log/auth.log日志查找原因。

5、复制OpenVPN PAM认证模块。

注意，2.2.2版本的认证模块文件有问题，会造成帐号密码无法得到认证，所以只能用2.0.9版的生成。

[root@openvpn01 openvpn]# wget http://openvpn.net/release/openvpn-2.0.9.tar.gz

[root@openvpn01 openvpn]# tar zxvf openvpn-2.0.9.tar.gz

[root@openvpn01 openvpn]# cd /openvpn/openvpn-2.0.9/plugin/auth-pam/

[root@openvpn01 auth-pam]# make

编译生成认证模块文件openvpn-auth-pam.so

[root@mailserver auth-pam]# cp openvpn-auth-pam.so /lib64/security/

[root@openvpn01 openvpn]# vi /etc/openvpn/server.conf

将下面一行启用。注意：Mysql 与Radius两种认证只能启用其中一种，不能2个同时使用.

plugin /lib64/security/openvpn-auth-pam.so openvpn_mysql

==========================================================================================

二、配置OpenVPN PAM Radius认证模块（认证方法二）

使用Radius认证，必须事先架设一台Radius server. 相关教程，请自行找文章。

[root@openvpn01 openvpn]# mkdir /etc/raddb/

[root@openvpn01 openvpn]#wget ftp://ftp.freeradius.org/pub/radius/pam_radius-1.4.0.tar.gz

[root@openvpn01 openvpn]# tar zxvf pam_radius-1.4.0.tar.gz

[root@openvpn01 openvpn]# cd pam_radius-1.4.0

[root@openvpn01 pam_radius-1.4.0]# vi pam_radius_auth.conf

修改部分：

# server[:port] shared_secret timeout (s)

114.112.260.90 pk888 1

#other-server other-secret 3

备注：114.112.260.90是radius服务器,pk888是shred共享密码，只需改一行即可。

[root@openvpn01 pam_radius-1.4.0]# ./configure

[root@openvpn01 pam_radius-1.4.0]# make

[root@openvpn01 pam_radius-1.4.0]# cp pam_radius_auth.so /etc/openvpn

[root@openvpn01 pam_radius-1.4.0]# cp pam_radius_auth.so /lib64/security

[root@openvpn01 pam_radius-1.4.0]# cp pam_radius_auth.conf /etc/raddb/server

配置PAM认证

[root@mailserver pam.d]# vi /etc/pam.d/openvpn_radius

account required /lib64/security/pam_radius_auth.so

auth required /lib64/security/pam_radius_auth.so

[root@mailserver software]# /etc/init.d/saslauthd restart

[root@mailserver software]# testsaslauthd -u bbb -p 456456 -s openvpn_radius

备注：帐号bbb，密码456456是radius服务器114.112.260.90中建立的。