Centos 6.5 Open××× 2.3.4搭建
参考http://mjjwu.blog.51cto.com/600072/1311008配置
配置环境：
server：Centos6.5 Open××× 2.3.4
client：Windows7-64 Open×××GUI 2.3.4
服务器端配置：
1、安装基础库
[root@demo open***]# for i in $(rpm -q gcc gcc-c++ openssl openssl-devel lzo lzo-devel pam pam-devel) do yum –y install $i; done |
安装lzo压缩算法
不安装的话configure的时候就会提示configure: error: lzo enabled but missing
[root@demo open***]# wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.06.tar.gz [root@demo open***]# tar zxvf lzo-2.06.tar.gz [root@demo open***]# cd lzo-2.06 [root@demo open***]# ./configure [root@demo open***]# make && make install |
2、安装Open×××2.3.4
[root@demo open***]# wget -c http://swupdate.open***.org/community/releases/open***-2.3.4.tar.gz [root@demo open***]# tar zxvf open***-2.3.4.tar.gz [root@demo open***]# cd open***-2.3.4 [root@demo open***]# ./configure --prefix=/opt/open*** [root@demo open***]# make && make install |
3、配置Open×××
在github上拉一个resy-rsa2.0下来、地址:https://github.com/Open×××/easy-rsa
下载好之后解压到目录/opt/open***
再把easy-rsa搞到（cp复制过去）这个文件夹中，然后进入这个文件夹：
[root@demo open***]# cp -arp easy-rsa /opt/open***/ |
看看这个文件夹里面的东西
[root@demo open***]# chmod u+x /opt/open***/easy-rsa/easy-rsa/2.0/* [root@demo open***]# ll /opt/open***/easy-rsa/easy-rsa/2.0/ total 112 -rwxr-xr-x. 1 root root 119 Jul 5 10:49 build-ca -rwxr-xr-x. 1 root root 352 Jul 5 10:49 build-dh -rwxr-xr-x. 1 root root 188 Jul 5 10:49 build-inter -rwxr-xr-x. 1 root root 163 Jul 5 10:49 build-key -rwxr-xr-x. 1 root root 157 Jul 5 10:49 build-key-pass -rwxr-xr-x. 1 root root 249 Jul 5 10:49 build-key-pkcs12 -rwxr-xr-x. 1 root root 268 Jul 5 10:49 build-key-server -rwxr-xr-x. 1 root root 213 Jul 5 10:49 build-req -rwxr-xr-x. 1 root root 158 Jul 5 10:49 build-req-pass -rwxr-xr-x. 1 root root 449 Jul 5 10:49 clean-all -rwxr-xr-x. 1 root root 1471 Jul 5 10:49 inherit-inter -rwxr-xr-x. 1 root root 302 Jul 5 10:49 list-crl -rwxr-xr-x. 1 root root 7791 Jul 5 10:49 openssl-0.9.6.cnf -rwxr-xr-x. 1 root root 8348 Jul 5 10:49 openssl-0.9.8.cnf -rwxr-xr-x. 1 root root 8245 Jul 5 10:49 openssl-1.0.0.cnf -rwxr-xr-x. 1 root root 12984 Jul 5 10:49 pkitool -rwxr-xr-x. 1 root root 928 Jul 5 10:49 revoke-full -rwxr-xr-x. 1 root root 178 Jul 5 10:49 sign-req -rwxr-xr-x. 1 root root 2077 Jul 5 10:49 vars -rwxr-xr-x. 1 root root 740 Jul 5 10:49 whichopensslcnf |
4、生成CA证书
修改vars文件
[root@demo open***]# cd /opt/open***/easy-rsa/easy-rsa/2.0/ [root@demo 2.0]# vim vars ................ export KEY_COUNTRY=""CN" export KEY_PROVINCE=""BJ" export KEY_CITY=""BeiJing" export KEY_ORG=""xxxx" export KEY_EMAIL=""Woo@xx.com" export KEY_OU=""MyOpen***" ................. |
这一部分按照自己的情况来填啦,修改完成后保存退出。
然后：
[root@demo 2.0]# source ./vars NOTE: If you run ./clean-all, I will be doing a rm -rf on /opt/open***/easy-rsa/easy-rsa/2.0/keys |
之后执行./clean-all
[root@demo open***]# ./clean-all |
这是为了针对已经有了keys/而想用改写的vars重新生成证书的情况而执行的
第一次安的话不执行也好
当然在这一步之前如果执行./clean-all 和 ./build-ca两条命令的话将会出现以下提示：
[root@demo open***]# ./clean-all Please source the vars script first (i.e. "source ./vars") Make sure you have edited it to reflect your configuration. |
[root@demo open***]# ./build-ca Please edit the vars script to reflect your configuration, then source it with "source ./vars". Next, to start with a fresh PKI configuration and to delete any previous certificates and keys, run "./clean-all". Finally, you can run this tool (pkitool) to build certificates/keys. |
大意就是说修改好vars之后执行source./vars然后才能执行这些
5、初始化keys
然后执行./build-ca生成证书：
[root@demo 2.0]# ./build-ca Generating a 2048 bit RSA private key ....+++ .............................................................+++ writing new private key to 'ca.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [LN]: Locality Name (eg, city) [ChengDu]: Organization Name (eg, company) [xxxx]: Organizational Unit Name (eg, section) [MyOpen***]: Common Name (eg, your name or your server's hostname) [xxxx CA]: Name [EasyRSA]: Email Address [Woo@xx.com]: |
这样一直回车就好（这些是、vars里设置的东西） 或者输入些想输入的什么的， 即可结束keys的初始化。
看下keys/中都有些什么文件：
[root@demo 2.0]# ll keys/ total 12 -rw-r--r--. 1 root root 1655 Oct 19 00:37 ca.crt -rw-------. 1 root root 1704 Oct 19 00:37 ca.key -rw-r--r--. 1 root root 0 Oct 19 00:36 index.txt -rw-r--r--. 1 root root 3 Oct 19 00:36 serial |
6、生成DH文件
下面是生成DH文件，执行./build-dh：
[root@demo 2.0]# ./build-dh Generating DH parameters, 2048 bit long safe prime, generator 2 This is going to take a long time ...........+.............................................................................................................+..........................................................................................................++*++* [root@demo 2.0]# ll keys/ total 16 -rw-r--r--. 1 root root 1655 Oct 19 00:37 ca.crt -rw-------. 1 root root 1704 Oct 19 00:37 ca.key -rw-r--r--. 1 root root 424 Oct 19 00:42 dh2048.pem -rw-r--r--. 1 root root 0 Oct 19 00:36 index.txt -rw-r--r--. 1 root root 3 Oct 19 00:36 serial |
7、生成服务器证书
执行./build-key-server [证书名]为服务器生成证书：
[root@demo 2.0]# ./build-key-server Open×××_Server Generating a 2048 bit RSA private key ..+++ ..+++ writing new private key to 'Open×××_Server.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [LN]: Locality Name (eg, city) [ChengDu]: Organization Name (eg, company) [xxxx]: Organizational Unit Name (eg, section) [MyOpen***]: Common Name (eg, your name or your server's hostname) [Open×××_Server]: Name [EasyRSA]: Email Address [Woo@xx.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /opt/open***/easy-rsa/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'LN' localityName :PRINTABLE:'ChengDu' organizationName :PRINTABLE:'xxxx' organizationalUnitName:PRINTABLE:'MyOpen***' commonName :T61STRING:'Open×××_Server' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'Woo@xx.com' Certificate is to be certified until Oct 16 16:43:29 2023 GMT (3650 days) Sign the certificate? [y/n]:y （注意：这里输入y） 1 out of 1 certificate requests certified, commit? [y/n]y （注意：这里输入y） Write out database with 1 new entries Data Base Updated |
这样服务器证书搞定了 可以看到keys/文件夹中东西又多了..
[root@demo 2.0]# ll keys/ total 52 -rw-r--r--. 1 root root 5373 Oct 19 00:43 01.pem -rw-r--r--. 1 root root 1655 Oct 19 00:37 ca.crt -rw-------. 1 root root 1704 Oct 19 00:37 ca.key -rw-r--r--. 1 root root 424 Oct 19 00:42 dh2048.pem -rw-r--r--. 1 root root 125 Oct 19 00:43 index.txt -rw-r--r--. 1 root root 21 Oct 19 00:43 index.txt.attr -rw-r--r--. 1 root root 0 Oct 19 00:36 index.txt.old -rw-r--r--. 1 root root 5373 Oct 19 00:43 Open×××_Server.crt -rw-r--r--. 1 root root 1066 Oct 19 00:43 Open×××_Server.csr -rw-------. 1 root root 1704 Oct 19 00:43 Open×××_Server.key -rw-r--r--. 1 root root 3 Oct 19 00:43 serial -rw-r--r--. 1 root root 3 Oct 19 00:36 serial.old |
8、生成客户端证书(mysql验证可不用)
接下来为我自己申请了一份客户端证书（这些到时要copy到客户端上以便能和服务器进行认证）：
[root@demo 2.0]# ./build-key client1 Generating a 2048 bit RSA private key ...+++ ....................................................................+++ writing new private key to 'client1.key' ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [CN]: State or Province Name (full name) [LN]: Locality Name (eg, city) [ChengDu]: Organization Name (eg, company) [xxxx]: Organizational Unit Name (eg, section) [MyOpen***]: Common Name (eg, your name or your server's hostname) [client1]: #重要: 每个不同的 client 生成的证书, 名字必须不同 Name [EasyRSA]: Email Address [Woo@xx.com]: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /opt/open***/easy-rsa/easy-rsa/2.0/openssl-1.0.0.cnf Check that the request matches the signature Signature ok The Subject's Distinguished Name is as follows countryName :PRINTABLE:'CN' stateOrProvinceName :PRINTABLE:'LN' localityName :PRINTABLE:'ChengDu' organizationName :PRINTABLE:'xxxx' organizationalUnitName:PRINTABLE:'MyOpen***' commonName :PRINTABLE:'client1' name :PRINTABLE:'EasyRSA' emailAddress :IA5STRING:'Woo@xx.com' Certificate is to be certified until Oct 16 16:45:15 2023 GMT (3650 days) Sign the certificate? [y/n]:y （注意：这里输入y） 1 out of 1 certificate requests certified, commit? [y/n]y （注意：这里输入y） Write out database with 1 new entries Data Base Updated |
依次类推生成其他客户端证书/key代码:
./build-key client2
./build-key client3
然后我们将CA证书和客户端证书打包下载，好在客户端上作为验证使用
[root@demo 2.0]# cd keys/ [root@demo keys]# tar -zcvf client1.tar.gz client1.* ca.* client1.crt client1.csr client1.key ca.crt ca.key |
9、服务器端配置文件修改
将server.conf文件复制到/opt/conf/open***中
[root@demo open***]# cp -arp /soft/open***-2.3.4/sample/sample-config-files/server.conf /opt /open***/conf [root@demo open***]# vim /opt/open***/conf/server.conf .... # Which local IP address should Open××× # listen on? (optional) ;local a.b.c.d
# Which TCP/UDP port should Open××× listen on? # If you want to run multiple Open××× instances # on the same machine, use a different port # number for each one. You will need to # open up this port on your firewall. port 1194
# TCP or UDP server? ;proto tcp proto tcp .... ca /opt/open***/easy-rsa/easy-rsa/2.0/keys/ca.crt cert /opt/open***/easy-rsa/easy-rsa/2.0/keys/Open×××_Serve.crt key /opt/open***/easy-rsa/easy-rsa/2.0/keys/Open×××_Serve.key # This file should be kept secret # Diffie hellman parameters. # Generate your own with: # openssl dhparam -out dh1024.pem 1024 # Substitute 2048 for 1024 if you are using # 2048 bit keys. dh /opt/open***/easy-rsa/easy-rsa/2.0/keys/dh2048.pem .... .... server 10.8.0.0 255.255.255.0 #这里配置的是***为客户端分配地址的网段，用私有地址就好，这里没必要改 .... .... ;push "route 192.168.20.0 255.255.255.0" #这条是将路由信息推送到客户端 .... .... ;push “redirect-gateway def1 bypass-dhcp" #改成这个样纸： push "redirect-gateway def1" .... .... ;client-to-client #这句话取消注释可以让用户借助open***转发互相访问 #效率会高一点 .... .... ;duplicate-cn #若是client所使用的CA的CommonName有重复连接×××，不打开该选项的话只会允#许一名用户连接××× .... .... comp-lzo #数据压缩算法，服务器端 用户端要一致 .... .... user nobody group nobody #用于运行open***的用户 .... .... ;log open***.log ;log-append open***.log 这两句定义open***日志文件位置以及追加日志方式写入，我将它修改成这个样纸了0.0： log /opt/open***/log/open***.log log-append log/open***.log .... .... status log/open***-status.log |
# #号和;号开头的都是注释
# 设置监听IP，默认是监听所有IP ;local a.b.c.d local 192.168.228.155
# 设置监听端口，必须要对应的在防火墙里面打开 port 1194
# 设置用TCP还是UDP协议？ ;proto tcp proto udp
# 设置创建tun的路由IP通道，还是创建tap的以太网通道 # 路由IP容易控制，所以推荐使用它；但如果如IPX等必须 # 使用第二层才能通过的通讯，则可以用tap方式，tap也 # 就是以太网桥接 ;dev tap dev tun
# Windows需要给网卡一个名称，这里设置，linux不需要 ;dev-node MyTap
# 这里是重点，必须指定SSL/TLS root certificate (ca), # certificate(cert), and private key (key) # ca文件是服务端和客户端都必须使用的，但不需要ca.key # 服务端和客户端指定各自的.crt和.key # 请注意路径,可以使用以配置文件开始为根的相对路径, # 也可以使用绝对路径 # 请小心存放.key密钥文件 ca ./easy-rsa/keys/ca.crt cert ./easy-rsa/keys/server.crt key ./easy-rsa/keys/server.key # This file should be kept secret
# 指定Diffie hellman parameters. dh ./easy-rsa/keys/dh1024.pem
# 配置×××使用的网段，Open×××会自动提供基于该网段的DHCP # 服务，但不能和任何一方的局域网段重复，保证唯一 server 10.8.0.0 255.255.255.0
# 维持一个客户端和virtual IP的对应表，以方便客户端重新 # 连接可以获得同样的IP ifconfig-pool-persist ipp.txt
# 配置为以太网桥模式,但需要使用系统的桥接功能 # 这里不需要使用 ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
# 为客户端创建对应的路由,以另其通达公司网内部服务器 # 但记住，公司网内部服务器也需要有可用路由返回到客户端 ;push "route 192.168.20.0 255.255.255.0" push "route 192.168.56.0 255.255.255.0"
# 为特定的客户端指定IP或指定路由,该路由通常是客户端后面的 # 内网网段,而不是服务端连接的网段 # ccd是/etc/open***下的目录，其中建有希望限制的客户端Common # Name为文件名的文件,并通过下面的命令写入固定IP地址 # 例如Common Name为client1,则在/opt/open***/ccd/client1写有： # ifconfig-push 10.9.0.1 10.9.0.2 ;client-config-dir ccd ;route 192.168.40.128 255.255.255.248
# 为可以对不同的客户端设置防火墙等权限 # 可以让其自动运行对应脚本,可参考man ;learn-address ./script
# 若客户端希望所有的流量都通过×××传输,则可以使用该语句 # 其会自动改变客户端的网关为×××服务器,推荐关闭 # 一旦设置，请小心服务端的DHCP设置问题 ;push "redirect-gateway"
# 用Open×××的DHCP功能为客户端提供指定的DNS、WINS等 ;push "dhcp-option DNS 10.8.0.1" ;push "dhcp-option WINS 10.8.0.1"
# 默认客户端之间是不能直接通讯的，除非把下面的语句注释掉 client-to-client
# 如果您希望有相同Common Name的客户端都可以登陆 # 也可以注释下面的语句,推荐每个客户端都使用不用的Common Name # 常用于测试 ;duplicate-cn
# 设置服务端检测的间隔和超时时间 keepalive 10 120
# 下面是一些对安全性增强的措施,后续说明吧 # For extra security beyond that provided # by SSL/TLS, create an "HMAC firewall" # to help block DoS attacks and UDP port flooding. # # Generate with: # open*** --genkey --secret ta.key # # The server and each client must have # a copy of this key. # The second parameter should be 0 # on the server and 1 on the clients. ;tls-auth ta.key 0 # This file is secret
# Select a cryptographic cipher. # This config item must be copied to # the client config file as well. ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES
# 使用lzo压缩的通讯,服务端和客户端都必须配置 comp-lzo
# 设置最大用户数 ;max-clients 100
# 让Open×××以nobody用户和组来运行（安全） ;user nobody ;group nobody
# The persist options will try to avoid # accessing certain resources on restart # that may no longer be accessible because # of the privilege downgrade. persist-key persist-tun
# 输出短日志,每分钟刷新一次,以显示当前的客户端 status /var/log/open***/open***-status.log
# 缺省日志会记录在系统日志中，但也可以导向到其他地方 # 建议调试的使用先不要设置,调试完成后再定义 ;log /var/log/open***/open***.log ;log-append /var/log/open***/open***.log
# 设置日志的级别 # # 0 is silent, except for fatal errors # 4 is reasonable for general usage # 5 and 6 can help to debug connection problems # 9 is extremely verbose verb 3
# Silence repeating messages. At most 20 # sequential messages of the same message # category will be output to the log. ;mute 20
# 打开管理界面,可以定义监控的IP和端口 management localhost 7505 |
10、防火墙设置
sysctl -w net.ipv4.ip_forward=1 net.ipv4.ip_forward=1 |
-A FORWARD -j ACCEPT 或者删除 #-A FORWARD -j REJECT --reject-with icmp-host-prohibited |
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE 另一种模板 iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j SNAT --to-source a.b.c.d |
11、设置 Open××× 服务器reboot后自动启动 open***
执行命令:
代码:
vi /etc/rc.local
然后在最后面加入此行:
代码:
/opt/sbin/open*** --daemon --config /opt/open***/conf/server.conf > /dev/null 2>&1 &
由于我是将open***安装在/usr/local/文件夹中，所以做个软连接链接到sbin中以便以后方便使用，不过到了sbin普通用户可是不能启动或停止的哦
[root@demo open***]# ls -n /usr/local/open***/sbin/open*** /sbin/open*** [root@demo open***]# open*** --daemon --config /opt/open***/conf/server.conf |
这里不加--daemon的话，会在shell前台执行。
客户端配置过程
客户端采用Open×××-GUI，版本要和服务器版本相对应.
在http://open***.se/development.html这里是可以下载的 不过这里没有2.3.0的版本。
没办法啊 挂着代理跑去官网下了一记：open***.net
下载好 安装好 然后进行下面的配置：
1、将刚才从服务器下载的证书解压到config文件夹中
2、在sample-config中复制client.o***到config文件夹，做如下修改：
;proto tcp proto udp 改成 proto tcp ;proto udp
remote my-server-1 1194 my-server-1填写你的open***服务器的地址 ns-cert-type server 打开这个选项
ca ca.crt cert client.crt key client.key 刚好刚才将证书都扔到了config文件夹下，也就在一起了，改个名字就行了： ca ca.crt cert client1.crt key client1.key |
然后就改完了 准备开始***之旅了哈0.0
由于我在windows下配置的客户端 有些针对linux的修改就跳过了的…
现在尝试连接一下，应该是可以连通的哦~~~
到目前为止，×××是假设好了，但是要网络转NAT还得继续。
让服务器那边进行数据包转发
Open×××访问公网设置
在server.conf中打开下面的配置：
push "dhcp-option DNS10.8.0.1"
push "dhcp-option DNS8.8.8.8"
push "dhcp-option DNS8.8.4.4"
这样就好~
这回就都完成了 启动open***服务器（要是刚刚开着的话退掉重开哦 killall open***）：
[root@demo ~]# open*** --daemon--config opt/open***/conf/server.conf
Open***+mysql验证方式
目的：客户端还是连接到公司局域网中，但为了用户管理方便，认证数据从mysql 数
据库中提取。
Open×××Server 基本设定：连接方式采用路由，认证方式采用mysql认证，虚拟设备使用tun
1．首先检查pam-devel包是否安装
rpm–qa | grep pam
2．检查Mysql是否安装
确认mysql-devel包已经安装，否则从系统盘安装改软件包
rpm –qa | grep msql ##5.6还需要mysql-share要不pam_mysql编译不过
mysql-5.0.45-7.el5
mysql-devel-5.0.45-7.el5
mysql-server-5.0.45-7.el5
3．安装pam_mysql
[root@localhost~]#wget http://prdownloads.sourceforge.net/pam-mysql/pam_mysql-0.7RC1.tar.gz
[root@localhost ~]# gzip -cd pam_mysql-0.7RC1.tar.gz | tar xvf – [root@localhost ~]# cd pam_mysql-0.7RC1 [root@localhost pam_mysql-0.7RC1]# ./configure --with-openssl [root@localhost pam_mysql-0.7RC1]# make [root@localhost pam_mysql-0.7RC1]# cp .libs/pam_mysql.so /lib64/security/ |
4．配置mysql 数据库和pam
4.1 配置数据库
以管理员身份登录数据库：
mysql>;create database ***;
mysql>;GRANT ALL ON ***.* TO ***@localhost IDENTIFIED BY '***123';
mysql>;flush privileges;
mysql>;use ***;
创建数据库： CREATE TABLE ***user ( id int(11) unsigned NOT NULL AUTO_INCREMENT, name CHAR (20) NOT NULL, password CHAR (128) NOT NULL, active INT (10) NOT NULL DEFAULT 1 comment '值为1 可以用***', PRIMARY KEY (id) ); 插入测试数据： #增加用户 用户名：elm 密码：elm
mysql>insert into ***user (name,password) values('elm',md5('elm')); b）对应mysqlpass加密方式 mysql>insert into ***user (name,password) values('elm',password('elm')); |
4.2 配置pam_mysql模块
创建/etc/pam.d/open***文件，添加文件内容如下：
auth sufficient pam_mysql.so user=*** passwd=***123 host=localhost db=*** \ table=***user usercolumn=name passwdcolumn=password \ where=active=1 sqllog=0 crypt=3 verbose=1 account required pam_mysql.so user=*** passwd=***123 host=localhost db=*** \ table=***user usercolumn=name passwdcolumn=password \ where=active=1 sqllog=0 crypt=3 verbose=1 |
注意：（1）crypt=3这个参数的设置，表示数据库密码是使用MD5加密。
这里如果你设置crypt=2，使用mysql的password的函数来加密。
0 (or"plain" ) = 明文 No encryption. Passwordsstored in plaintext. HIGHLY DISCOURAGED.
1 (or "Y") = Usecrypt(3) function.
2 (or"mysql") = Use MySQLPASSWORD() function. It is possible that the encryption function used byPAM-MySQL is different from that of the MySQL server, as PAM-MySQL uses thefunction defined in MySQL's C-client API instead of using PASSWORD() SQL function in the query.
3 (or "md5") = Useplain hex MD5.
4 (or "sha1") = Useplain hex SHA1.
（2） verbose=1 详细日志
4.3测试pam_mysql是否工作正常，
先检查saslauthd是否安装：
[root@localhostpam_mysql-0.7RC1]# rpm -qa | grep sasl
cyrus-sasl-plain-2.1.22-4
cyrus-sasl-devel-2.1.22-4
cyrus-sasl-2.1.22-4
cyrus-sasl-lib-2.1.22-4
有cyrus-sasl-2.1.22-4应该就可以了
[root@*** ~]# saslauthd -a pam
[root@*** ~]# testsaslauthd -u elm -p elm -sopen***
0:OK "Success."
恭喜，pam_mysql工作正常了，下面可以开始配置Open×××服务器了。
相关日志有所体现：
/var/log/syslog
/var/log/auth.log
4.4 配置 open*** 服务器及客户端有关认证的内容：
1.在server.conf最下面添加如下内容
#说明使用的插件，open***为插件的参数，使用pam的servicesname plugin /opt/open***/lib/open***/plugins/open***-auth-pam.so open*** #不请求客户的CA证书，使用User/Pass验证 client-cert-not-required #使用客户提供的UserName作为Common Name username-as-common-name |
Or： 进入 open*** 源代码目,在 plugin/auth-pam 下将 open*** 认证模块编译出来: # cd /usr/local/src/open***/open***-2.0.9/plugin/auth-pam # make 32位系统: # cp -f open***-auth-pam.so /lib/security/. 64位系统: # cp -f open***-auth-pam.so /lib64/security/. 在open***服务器端的配置文件中加入认证模块： # vi /opt/open***/etc/open***.conf 在最后一行加入: plugin /lib64/security/open***-auth-pam.so open*** #32位系统做相关的改动。 |
注：open*** 2.0以上验证会出问题，需要编译低版本的模块：
wget http://down1.chinaunix.net/distfiles/open***-2.0.7.tar.gz
tar-zxvfopen***-2.0.7.tar.gz
cdopen***-2.0.7/
./configure
cdplugin/auth-pam/
make
cpopen***-auth-pam.so/opt/open***/lib/open***/plugins/
2. 配置客户端配置文件
注释掉 ;cert client1.crt ;key client1.key 增加： #询问用户名和密码 auth-user-pass |
Open***+ldap验证（没有实际验证待测试）
2. 修改配置文件：auth-ldap.conf
<LDAP> # LDAP server URL URL ldap://192.168.1.208 # Bind DN (If your LDAP server doesn't support anonymous binds) BindDN cn=admin,dc=gxw,dc=com # Bind Password Password secret # Network timeout (in seconds) Timeout 15 # Enable Start TLS TLSEnable no # Follow LDAP Referrals (anonymously) FollowReferrals no # TLS CA Certificate File #TLSCACertFile /usr/local/etc/ssl/ca.pem # TLS CA Certificate Directory #TLSCACertDir /etc/ssl/certs # Client Certificate and key # If TLS client authentication is required #TLSCertFile /usr/local/etc/ssl/client-cert.pem #TLSKeyFile /usr/local/etc/ssl/client-key.pem # Cipher Suite # The defaults are usually fine here # TLSCipherSuite ALL:!ADH:@STRENGTH </LDAP> <Authorization> # Base DN BaseDN "dc=gxw,dc=com" # User Search Filter SearchFilter "(uid=%u)" # Require Group Membership RequireGroup false # Add non-group members to a PF table (disabled) #PFTable ips_***_users <Group> BaseDN "ou=tech,dc=gxw,dc=com" SearchFilter "(|(cn=developers)(cn=artists))" MemberAttribute uniqueMember # Add group members to a PF table (disabled) #PFTable ips_***_eng </Group> </Authorization> |
3. 修改open***配置文件
open*** 的配置文件类似 mysql
plugin /usr/local/lib/open***-auth-ldap.so /etc/open***/auth/ldap.conf
client-cert-not-required
username-as-common-name
转载于:https://blog.51cto.com/xiaowei8/1610824
796
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
