linux ocserv 客户端,安装ocserv服务

修改selinux文件

[root@~]# sed -i 's/SELINUX=enfrocing/SELINUX=disabled/g' /etc/selinux/config

[root@~]# cat /etc/selinux/config

SELINUX=disabled

SELINUXTYPE=targeted

安装ocserv服务

[root@~]#yum install epel-release

[root@~]#yum install -y ocserv

构建一个CA认证中心

[root@ *** ~]# mkdir CA && cd CA

[root@ CA]# certtool --generate-privkey --outfile ca-key.pem

[root@ CA]# vim ca.tmpl

cn = "www.abc.com"

organization = "Abc"

serial = 1

expiration_days = 3600

ca

signing_key

cert_signing_key

crl_signing_key

[root@CA]# certtool --generate-self-signed --load-privkey ca-key.pem --template ca.tmpl --outfile ca-cert.pem

[root@ CA]# certtool --generate-privkey --outfile server-key.pem

[root@ CA]# vim server.tmpl

cn = "www.abc.com"

organization = "Abc"

serial = 2

expiration_days = 3600

signing_key

encryption_key

tls_www_server

[root@ CA]# certtool --generate-certificate --load-privkey server-key.pem --load-ca-certificate ca-cert.pem --load-ca-privkey ca-key.pem --template server.tmpl --outfile server-cert.pem

配置ocserv

[root@CA]# mkdir /etc/ssl/private

[root@ CA]# cp server-cert.pem /etc/ssl/certs/

[root@CA]# cp server-key.pem /etc/ssl/private/

[root@ CA]# vim /etc/ocserv/ocserv.conf

auth = "plain[/etc/ocserv/ocpasswd]"

tcp-port = 9443

udp-port = 9443

run-as-user = ocserv

run-as-group = ocserv

socket-file = ocserv.sock

chroot-dir = /var/lib/ocserv

isolate-workers = false

max-clients = 16

max-same-clients = 2

keepalive = 32400

dpd = 90

mobile-dpd = 1800

switch-to-tcp-timeout = 25

try-mtu-discovery = false

server-cert = /etc/ssl/certs/server-cert.pem

server-key = /etc/ssl/private/server-key.pem

ca-cert = /etc/pki/ocserv/cacerts/ca.crt

cert-user-oid = 0.9.2342.19200300.100.1.1

tls-priorities = "NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0"

auth-timeout = 240

min-reauth-time = 300

max-ban-score = 50

ban-reset-time = 300

cookie-timeout = 300

deny-roaming = false

rekey-time = 172800

rekey-method = ssl

use-occtl = true

pid-file = /var/run/ocserv.pid

device = s

predictable-ips = true

default-domain = example.com

ipv4-network = 192.168.111.0

ipv4-netmask = 255.255.255.0

dns = 218.85.157.99

dns = 114.114.114.114

ping-leases = false

cisco-client-compat = true

dtls-legacy = true

user-profile = profile.xml

创建用户

[root@ CA]# ocpasswd -c /etc/ocserv/ocpasswd yexl

设置路由转发

[root@CA]# echo "net.ipv4.ip_forward = 1" > /etc/sysctl.conf

[root@ CA]# sysctl -p

设置ＮＡＴ及防火墙

filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [143:12724]

-A FORWARD -s 192.168.111.0/24 -j ACCEPT

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 9443 -j ACCEPT

-A INPUT -p udp -m state --state NEW -m udp --dport 9443 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

COMMITnat

:PREROUTING ACCEPT [4:463]

:POSTROUTING ACCEPT [1:76]

:OUTPUT ACCEPT [1:76]

-A POSTROUTING -s 192.168.111.0/24 -o eth0 -j MASQUERADE

COMMIT