墨 痕

yum install -y openssl openssl-devel lzo lzo-devel pam pam-devel automake pkgconfig
yum -y install openvpn

cd /etc/openvpn
wget -c -O easy-rsa.zip https://github.com/OpenVPN/easy-rsa/archive/master.zip
unzip easy-rsa.zip
mv easy-rsa-master easy-rsa

cd /etc/openvpn/easy-rsa/easyrsa3/
cp vars.example vars
  export set_var EASYRSA_REQ_COUNTRY "CN"
  export set_var EASYRSA_REQ_PROVINCE    "GuangDong"
  export set_var EASYRSA_REQ_CITY    "XXXXX"
  export set_var EASYRSA_REQ_ORG "Company"
  set_var EASYRSA_REQ_EMAIL   "XXXXX@gmail.com"
  export set_var EASYRSA_REQ_OU      "YunWeiBu"
  #easy-rsa3已经不支持nsCertType设置，若需要则设置EASYRSA_NS_SUPPORT
  export set_var EASYRSA_NS_SUPPORT     "yes"
./easyrsa init-pki		#初始化PKI
./easyrsa build-ca		#创建CA，输入PEM密码(签发证书使用)，其余一律回车
./easyrsa gen-req server nopass	#创建服务端证书。 设置一下common name后其余一律回车
./easyrsa sign server server		#签发服务端证书。输入yes，输入创建CA的PEM密码
./easyrsa gen-dh 		#创建Diffie-Hellman，增强OpenVPN安全性，确保key穿越不安全网络的命令

mkdir -p /home/openvpn_client && cd /home/openvpn_client
cp -a /etc/openvpn/easy-rsa/easyrsa3/ /home/openvpn_client/easyrsa3_client && cd /home/openvpn_client/easyrsa3_client/
mv pki/ "/tmp/pki_`date "+%F_%H:%M:%S"`"
./easyrsa init-pki			#初始化PKI
./easyrsa gen-req mogl		#为用户生成证书，输入密码，此后改key则使用该密码，其余默认回车

cd /etc/openvpn/easy-rsa/easyrsa3/
./easyrsa import-req /home/openvpn_client/easyrsa3_client/pki/reqs/mogl.req mogl		#导入用户的req
./easyrsa sign client mogl			#用户签约，输入yes，输入服务端PEM密码

[root@openvpn easyrsa3]# cd /etc/openvpn/easy-rsa/easyrsa3
[root@openvpn easyrsa3]# tree pki
pki
├── ca.crt
├── certs_by_serial
│   ├── 01.pem
│   └── 02.pem
├── dh.pem
├── index.txt
├── index.txt.attr
├── index.txt.attr.old
├── index.txt.old
├── issued
│   ├── mogl.crt
│   └── server.crt
├── private
│   ├── ca.key
│   └── server.key
├── reqs
│   ├── mogl.req
│   └── server.req
├── serial
└── serial.old
4 directories, 16 files

#User/Pass认证方式
auth-user-pass-verify /etc/openvpn/checkpsw.sh via-env
client-cert-not-required
username-as-common-name

#!/bin/sh
###########################################################
# checkpsw.sh (C) 2004 Mathias Sundman <mathias@openvpn.se>
#
# This script will authenticate OpenVPN users against
# a plain text file. The passfile should simply contain
# one row per user with the username first followed by
# one or more space(s) or tab(s) and then the password.

PASSFILE="/etc/openvpn/psw-file"
LOG_FILE="/var/log/openvpn-password.log"
TIME_STAMP=`date "+%Y-%m-%d %T"`

###########################################################

if [ ! -r "${PASSFILE}" ]; then
  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
  exit 1
fi

CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`

if [ "${CORRECT_PASSWORD}" = "" ]; then
  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
  exit 1
fi

if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
  exit 0
fi

echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
exit 1

client
auth-user-pass
dev tun
proto udp
remote 服务器主机IP 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
;cert mogl.crt
;key mogl.key
#ns-cert-type server	#假若客户端报错'VERIFY nsCertType ERROR: require nsCertType=SERVER'，则将此行注释
comp-lzo
verb 3

auth-user-pass pwd.txt
#在config目录下新建文件pwd.txt明文保存用户名/密码
username
password

# 安装Google验证码工具
# sudo apt-get install oathtool

# 动态修改pwd.txt，拨号脚本
. /etc/profile
set -ue
BASE_DIR="$(dirname $(readlink -f $0))"
cd $BASE_DIR

TOKEN="xxxxxxxxxxxxxxxxxxx"

GOOGLE_AUTH_NUM="`oathtool --totp -b $TOKEN`"
PASSWORD_FILE="pwd.txt"

# OpenVPN密码为`固定密码(xxxxxxxxx) +  Google动态验证码`
sed -ri "s/(xxxxxxxxx)(.*)/\1$GOOGLE_AUTH_NUM/" $PASSWORD_FILE
sleep 1
sudo openvpn --daemon --cd /etc/openvpn --config /etc/openvpn/client.ovpn && sleep 5 && route -n