Deploying OpenVPN with AD domain authentication
Deploying OpenVPN with AD domain authentication OpenVPN + PAM + SSSD + Active Directory https://computingforgeeks.com/install-and-configure-openvpn-server-on-rhel-centos-8/ https://www.redhat.com/en/blog/consistent-security-crypto-policies-red-hat-enterprise-linux-8 https://medium.com/jerrynotes/linux-authentication-windows-ad-without-join-domain-7963c3fd44c5 # Install OpenVPN yum install openvpn -y yum -y install openssl openssl-devel -y yum -y install lzo lzo-devel -y yum install -y libgcrypt libgpg-error libgcrypt-devel # Install OpenVPN auth plugin yum install openvpn-auth-ldap -y # Install easy-rsa # Since openvpn 2.3 removed easy-rsa from the package, install it separately. yum install easy-rsa cp -rf /usr/share/easy-rsa/2.0 /etc/opevpn/ # Generate OpenVPN keys and certificates # Edit `/opt/openvpn/etc/easy-rsa/2.0/vars` parameters export KEY_COUNTRY="CN" # Country export KEY_PROVINCE="ZJ" # Province export KEY_CITY="NingBo" # City export KEY_ORG="TEST-VPN" # Organization exportKEY_EMAIL="81367070@qq.com" # Email export KEY_OU="baidu" # Unit source vars ./clean-all ./build-ca ./build-dh ./build-key-server server ./build-key client1 # Edit the OpenVPN server config: `/etc/openvpn/server.conf` port 1194 proto udp dev tun ca keys/ca.crt cert keys/server.crt key keys/server.key # This file should be kept secret dh keys/dh2048.pem server 10.8.0.0 255.255.255.0 // client IP pool push "route 192.168.1.0 255.255.255.0" // push route to clients push "redirect-gateway" // change client gateway to route VPN traffic ifconfig-pool-persist ipp.txt keepalive 10 120 comp-lzo persist-key persist-tun status openvpn-status.log verb 3 plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-ldap.so "/etc/openvpn/auth/ldap.conf" client-cert-not-required username-as-common-name log /var/log/openvpn.log # Edit openvpn-ldap-auth config: `/etc/openvpn/auth/ldap.conf` # /etc/openvpn/auth/ldap.conf <LDAP> # LDAP server URL # Change to the AD server IP URL ldap://172.16.76.238:389 # Bind DN (If your LDAP server doesn't support anonymous binds) # BindDN uid=Manager,ou=People,dc=example,dc=com # Change to the domain admin DN; you can query it with ldapsearch # Replace the IP in -h with the server IP, -D with the admin DN, -b with the base DN, and * for all # ldapsearch -LLL -x -h 172.16.76.238 -D "administrator@xx.com" -W -b "dc=xx,dc=com" "*" BindDN "cn=administrator,cn=Users,dc=xx,dc=com" # Bind Password # Password SecretPassword # Domain admin password Password passwd # Network timeout (in seconds) Timeout 15 # Enable Start TLS TLSEnable no # Follow LDAP Referrals (anonymously) FollowReferrals no # TLS CA Certificate File # TLSCACertFile /usr/local/etc/ssl/ca.pem # TLS CA Certificate Directory # TLSCACertDir /etc/ssl/certs # Client Certificate and key # If TLS client authentication is required # TLSCertFile /usr/local/etc/ssl/client-cert.pem # TLSKeyFile /usr/local/etc/ssl/client-key.pem # Cipher Suite # The defaults are usually fine here # TLSCipherSuite ALL:!ADH:@STRENGTH </LDAP> <Authorization> # Base DN # Base DN for auth search BaseDN "dc=boqii-inc,dc=com" # User Search Filter # SearchFilter "(&(uid=%u)(accountStatus=active))" # sAMAccountName=%u uses the sAMAccountName value as the username, # and "memberof=CN=myvpn,DC=xx,DC=com" points to the VPN user group to authenticate, # so any user can use VPN once they are in this group. SearchFilter "(&(sAMAccountName=%u)(memberof=CN=myvpn,DC=boqii-inc,DC=com))" # Require Group Membership RequireGroup false # Add non-group members to a PF table (disabled) # PFTable ips_vpn_users <Group> # BaseDN "ou=Groups,dc=example,dc=com" # SearchFilter "(|(cn=developers)(cn=artists))" # MemberAttribute uniqueMember # Add group members to a PF table (disabled) # PFTable ips_vpn_eng BaseDN "ou=vpn,dc=boqii-inc,dc=com" SearchFilter "(cn=openvpn)" MemberAttribute "member" </Group> </Authorization> Copy the ca.crt certificate under /etc/openvpn/key for client use.
