安装ocserv服务

修改selinux文件
[root@~]# sed -i 's/SELINUX=enfrocing/SELINUX=disabled/g' /etc/selinux/config
[root@ ~]# cat /etc/selinux/config
SELINUX=disabled
SELINUXTYPE=targeted

安装ocserv服务
[root@~]#yum install epel-release
[root@~]#yum install -y ocserv

构建一个CA认证中心
[root@ *** ~]# mkdir CA && cd CA

[root@ CA]# certtool --generate-privkey --outfile ca-key.pem
[root@ CA]# vim ca.tmpl

cn = "www.abc.com"
organization = "Abc"
serial = 1
expiration_days = 3600
ca
signing_key
cert_signing_key
crl_signing_key
[root@ CA]# certtool --generate-self-signed --load-privkey ca-key.pem --template ca.tmpl --outfile ca-cert.pem
[root@ CA]# certtool --generate-privkey --outfile server-key.pem
[root@ CA]# vim server.tmpl
cn = "www.abc.com"
organization = "Abc"
serial = 2
expiration_days = 3600
signing_key
encryption_key
tls_www_server
[root@ CA]# certtool --generate-certificate --load-privkey server-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template server.tmpl --outfile server-cert.pem
配置ocserv
[root@ CA]# mkdir /etc/ssl/private
[root@ CA]# cp server-cert.pem /etc/ssl/certs/
[root@ CA]# cp server-key.pem /etc/ssl/private/
[root@ CA]# vim /etc/ocserv/ocserv.conf

auth = "plain[/etc/ocserv/ocpasswd]"
tcp-port = 9443
udp-port = 9443
run-as-user = ocserv
run-as-group = ocserv
socket-file = ocserv.sock
chroot-dir = /var/lib/ocserv
isolate-workers = false
max-clients = 16
max-same-clients = 2
keepalive = 32400
dpd = 90
mobile-dpd = 1800
switch-to-tcp-timeout = 25
try-mtu-discovery = false
server-cert = /etc/ssl/certs/server-cert.pem
server-key = /etc/ssl/private/server-key.pem
ca-cert = /etc/pki/ocserv/cacerts/ca.crt
cert-user-oid = 0.9.2342.19200300.100.1.1
tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"
auth-timeout = 240
min-reauth-time = 300
max-ban-score = 50
ban-reset-time = 300
cookie-timeout = 300
deny-roaming = false
rekey-time = 172800
rekey-method = ssl
use-occtl = true
pid-file = /var/run/ocserv.pid
device = s
predictable-ips = true
default-domain = example.com
ipv4-network = 192.168.111.0
ipv4-netmask = 255.255.255.0
dns = 218.85.157.99
dns = 114.114.114.114
ping-leases = false
cisco-client-compat = true
dtls-legacy = true
user-profile = profile.xml
创建用户
[root@ CA]# ocpasswd -c /etc/ocserv/ocpasswd yexl
设置路由转发
[root@ CA]# echo "net.ipv4.ip_forward = 1" > /etc/sysctl.conf
[root@ CA]# sysctl -p
设置ＮＡＴ及防火墙
filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [143:12724]
-A FORWARD -s 192.168.111.0/24 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 9443 -j ACCEPT
-A INPUT -p udp -m state --state NEW -m udp --dport 9443 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
nat
:PREROUTING ACCEPT [4:463]
:POSTROUTING ACCEPT [1:76]
:OUTPUT ACCEPT [1:76]
-A POSTROUTING -s 192.168.111.0/24 -o eth0 -j MASQUERADE
COMMIT

转载于:https://blog.51cto.com/980696/2144012