openssh搭建说明

宸..

已于 2023-04-24 09:20:54 修改

阅读量273

点赞数

文章标签：云计算 docker linux openvino

于 2023-04-23 10:35:51 首次发布

本文链接：https://blog.csdn.net/weixin_45422660/article/details/130315885

版权

某项目因开发测试环境本地联调需要，在10.80.178.160这台ECS搭建了openssh用于本地连接开发测试环境的dubbo

一、工具包下载

##这里直接使用yum安装openvpn
[root@openvpn ~]# yum install -y openvpn
Loaded plugins: fastestmirror
Determining fastest mirrors
...
##安装easy-rsa
[root@openvpn tools]# wget https://github.com/OpenVPN/easy-rsa/archive/master.zip
[root@openvpn tools]# unzip master.zip
[root@openvpn tools]# ls
easy-rsa-master  master.zip
[root@openvpn tools]# mv easy-rsa-master easy-rsa
[root@openvpn tools]# cp -R easy-rsa /etc/openvpn
[root@openvpn tools]# cd /etc/openvpn/easy-rsa/easyrsa3
##准备生成证书，对vars文件做出以下修改，都是自定义，没有特殊要求
[root@openvpn easyrsa3]# mv vars.example vars
[root@openvpn easyrsa3]# vim vars
[root@openvpn easyrsa3]# cat vars | grep -Ev "^#|^$" | grep set_var
set_var EASYRSA_REQ_COUNTRY    "CN"
set_var EASYRSA_REQ_PROVINCE    "ZheJiang"
set_var EASYRSA_REQ_CITY    "HangZhou"
set_var EASYRSA_REQ_ORG    "alibaba"
set_var EASYRSA_REQ_EMAIL    "jackma@alibaba.com"
set_var EASYRSA_REQ_OU        "pinming"

二、easyrsa证书配置

[root@openvpn easyrsa3]# pwd
/etc/openvpn/easy-rsa/easyrsa3
##初始化pki文件
[root@openvpn easyrsa3]# ./easyrsa init-pki
##创建服务端CA证书，输入两遍CA密码，common name可回车不填，使用默认

[root@openvpn easyrsa3]# ./easyrsa build-ca
###创建服务端证书，common name可回车不填
[root@openvpn easyrsa3]# ./easyrsa gen-req server nopass
##签约服务端证书，输入之前正确的CA密码
[root@openvpn easyrsa3]# ./easyrsa sign server server
##创建数据穿越密钥
[root@openvpn easyrsa3]# ./easyrsa gen-dh

三、openvn服务端配置

[root@openvpn easyrsa3]# pwd
/etc/openvpn/easy-rsa/easyrsa3
[root@openvpn easyrsa3]# cd /etc/openvpn/easy-rsa/easyrsa3/pki/
###将服务端要用到的证书、密钥都放到指定目录下
[root@openvpn pki]# cp ca.crt /etc/openvpn/server/

[root@openvpn pki]# cp private/server.key /etc/openvpn/server/
[root@openvpn pki]# cp issued/server.crt /etc/openvpn/server/
[root@openvpn pki]# cp dh.pem /etc/openvpn/server/
###创建密码脚本
[root@openvpn pki]# cd /etc/openvpn
[root@openvpn openvpn]# vim checkpsw.sh
###内容如下，现在直接从公网wget不了了，需要复制以下内容
#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.
PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/etc/openvpn/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`
###########################################################
if [ ! -r "${PASSFILE}" ]; then
  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
  exit 1
fi
CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
if [ "${CORRECT_PASSWORD}" = "" ]; then
  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
  exit 1
fi
if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
  exit 0
fi
echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

 ##创建密码文件，这里账号密码为明文，必须修改权限
[root@openvpn openvpn]# vim psw-file

###明文账号密码
 wanghaibo XXXXXX
 ...
####修改服务端配置文件
[root@openvpn openvpn]# vim server.conf
###定义服务端端口
port 55555
proto tcp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/server/server.crt
key /etc/openvpn/server/server.key
dh /etc/openvpn/server/dh.pem
###定义连上VPN之后可以获取的网段IP，搞个特殊的
server 10.250.248.0 255.255.252.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
max-clients 500
status  openvpn-status.log
verb 3
###定义客户端连接VPN之后，本地会增加的路由，有以下路由连上服务端之后才能通VPN服务端的内网
push "route 10.250.248.0 255.255.252.0"
push "route 10.70.0.0 255.255.0.0"
push "route 172.30.0.0 255.255.0.0"
log /var/log/openvpn.log
script-security 3
###有以下几行才能用账号密码连接
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
client-cert-not-required
username-as-common-name

[root@openvpn openvpn]# chmod +x /etc/openvpn/checkpsw.sh
[root@openvpn openvpn]# chmod 400 /etc/openvpn/psw-file
[root@openvpn openvpn]# chown nobody.nobody /etc/openvpn/psw-file
###将服务端设置成开机自启
[root@openvpn ~]# systemctl start openvpn@server
[root@openvpn ~]# systemctl enable openvpn@server
Created symlink from /etc/systemd/system/multi-user.target.wants/openvpn@server.service to /usr/lib/systemd/system/openvpn@.service.
[root@openvpn ~]# systemctl status openvpn@server
● openvpn@server.service - OpenVPN Robust And Highly Flexible Tunneling Application On server
   Loaded: loaded (/usr/lib/systemd/system/openvpn@.service; enabled; vendor preset: disabled)
   Active: active (running) since Sun 2022-11-13 19:59:26 CST; 11s ago
 Main PID: 12240 (openvpn)
   Status: "Initialization Sequence Completed"
   CGroup: /system.slice/system-openvpn.slice/openvpn@server.service
           └─12240 /usr/sbin/openvpn --cd /etc/openvpn/ --config server.conf

Nov 13 19:59:26 openvpn systemd[1]: Starting OpenVPN Robust And Highly Flexible Tunneling Application On server...
Nov 13 19:59:26 openvpn systemd[1]: Started OpenVPN Robust And Highly Flexible Tunneling Application On server.

四、服务端防火墙配置


##把防火墙的nat转发策略开起来
[root@openvpn openvpn]# echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/99-sysctl.conf
[root@openvpn openvpn]# sysctl -p
net.ipv4.ip_forward = 1
##停用firewalld，使用iptables管理
[root@openvpn openvpn]# systemctl stop firewalld
[root@openvpn openvpn]# systemctl disable firewalld
[root@openvpn openvpn]# yum install iptables-services -y

[root@openvpn openvpn]# systemctl enable iptables
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@openvpn openvpn]# systemctl start iptables
###把这两条策略删掉
[root@openvpn openvpn]# vim /etc/sysconfig/iptables
...
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
...
[root@openvpn openvpn]# systemctl restart iptables
####放行openvpn的55555端口，最终这个端口需通过SLB映射到公网
[root@openvpn openvpn]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 55555 -j ACCEPT
####对来自客户端的流量转发到本机端口，用于服务端局域网通信，这里IP网段不能写错了
[root@openvpn openvpn]# iptables -t nat -A POSTROUTING -s 10.250.248.0/22 -o eth0 -j MASQUERADE
####一定记得要保存，而且保存这一步要后面做，避免前面修改了配置文件，这里save又覆盖掉了
[root@openvpn openvpn]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

五、用户管理

###openvpn在服务器上使用明文管理用户名密码，如后续需要增加用户名密码，可以明文增加，格式如下
[root@zhgd-jenkins openvpn]# cat /etc/openvpn/psw-file 
###品茗-运维人员
wanghaibo XXXXXX
wuhaozhen XXXXXX
###研究院-自有项目组
liyunyao XXXXXX

六、客户端连接

###客户端需要先自行下载openvpn，使用配置文件如下
client
dev tun
proto tcp
remote 47.112.148.31 55555 
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
MIIDNTCCAh2gAwIBAgIJAO5S0EU8b/iXMA0GCSqGSIb3DQEBCwUAMBYxFDASBgNV
BAMMC0Vhc3ktUlNBIENBMB4XDTIzMDEwOTA3MzQxMFoXDTMzMDEwNjA3MzQxMFow
FjEUMBIGA1UEAwwLRWFzeS1SU0EgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQCwa43pJBEv72xQBI4WeThnR24/xSA13l5VjmuAb2+5vpH1s6QVOM8z
SIOyT/mC+0byVEUXrUeR41MAEtI28zO+18O8ljXVWQRAenmBQlWwm1CXbD20PNMr
RFTLmH6fvrkiWgszECFMYDXySC9uezFUiLDrH5m71UuoRr7swLA/0nn2IJaRXI98
/juwKfGCng3mYyBdzifiKOjkEfPpfYqTEl+fSxTi8l5G9DwcN0l4bNmHO7ERiC5I
5pVFfLIXFI5uQuw5Uz9autJupa5mbB3EIYXNi/+VFRm7BdBExPBbTk+cEzpTNhrF
nqvBMEWIM3ivdtTVcf/2LIU8xfw3Wk1fAgMBAAGjgYUwgYIwHQYDVR0OBBYEFPR6
K/r9p7JjHr7VjnLz81GF/kR5MEYGA1UdIwQ/MD2AFPR6K/r9p7JjHr7VjnLz81GF
/kR5oRqkGDAWMRQwEgYDVQQDDAtFYXN5LVJTQSBDQYIJAO5S0EU8b/iXMAwGA1Ud
EwQFMAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQAV8N/wqLud
nrw0B7u0WMetXL78xFOkhuPFwXowDNBHNB3SEa7TqW1wrREunj7v9A/i7eZnnfbi
O03yu5U8BpUBcQZ9Z1KY5oGYXSGWYNfg7JHZyzbywkRkmpTj+Ovsirp5vLvGA1JX
NeedPG/qtkPjNp+bogttXiFNsGreQMt6cY5Ie0lV1KN41X7aD7fKkEwX1E0nsqlz
5Ck50R1t9TMUven9pLuDzvpXgkFpZkpSDmgu3DTTKl3anvDxnqXk2hflwJV8pn5a
yeFwWqKDPtSBzDQgzg4woTU1LPL0i9hoFYbuJn0Ulirsi8m8Jepoumz2t6KXSbhp
oZUZp5Yr8V1s
-----END CERTIFICATE-----
</ca>

七、dubbo反向调用配置

连接openvpn后，如果本地起的应用dubbo接口，有被注册在zookeeper上的其它应用调用需求，则需要按照以下方法完成配置。

VN启动后，鼠标悬停客户端图标查看连接获取的IP，如图例如获取到的客户端IP为10.250.248.6