Linux Systems Security. VPN NETS1028 Fall 2016

Transcription

1 Linux Systems Security VPN NETS1028 Fall 2016

2 Virtual Private Network Provides a method of extending access to one or more internal hosts or networks, using a public network Enables the use of firewalled internal services (e.g. DNS, web, file sharing, authentication) without having to configure the firewall to provide access to each service Enables the use of LAN protocols securely with remote clients using encryption to prevent eavesdropping and detect tampering

3 VPN Implementations Various protocols for VPNs have been defined IPsec IETF RFC 6434, complex, fractured, steep learning curve SSL/TLS (e.g. OpenVPN, SoftEther VPN), simplified universal offshoot of IPSEC DTLS (e.g. Cisco AnyConnect VPN, OpenConnect VPN), also SSL/TLS based MPPE/PPTP (e.g. Windows feature), Microsoft product, old, vulnerable, replaced by L2TP SSH (e.g. OpenSSH tunnels), alternative to OpenVPN/OpenConnect VPN

4 OpenVPN VPN implementation with commercial and community versions, community version is under GPL Certificate and key based, uses SSL/TLS with a pre-shared private key for connection establishment and SSL for subsequent communications PAM can be added to OpenVPN configurations to support multi-factor authentication (e.g. shared secret key plus login/password) Client software available for all popular platforms Server version available for many platforms, also available as a commercial VM VHD and in commercial cloud-aware configurations from openvpn.net

5 OpenVPN Package Ubuntu and Debian repositories have openvpn community edition packages, but are behind the release schedule (not good in the security world) Add the openvpn repositories to your machine to install current software from the openvpn.net site, install easy-rsa if you want to use it to set up certificates for openvpn use curl apt-key add - echo "deb <osrelease> main" > /etc/apt/sources.list.d/swupdate.openvpn.net.list apt update ; apt install openvpn easy-rsa Packages set up init scripts to establish vpn services at boot based on conf files

6 OpenVPN Certificate Authority Certificates are used to authenticate the openvpn server and client to each other Genuine certificates and a real CA can be used as long as the client and server both use the same CA, but additional authentication factors (e.g. tlsauth, login/password) will be required A private CA can be generated and used by the server to sign certificates, servers and clients signed by that CA can trust each other, this is the preferred method easy-rsa is a package of scripts designed to simplify the management of this limited function CA see for an alternate way to set up a certificate authority for internal use

7 Generating CA Files After installing openvpn and easy-rsa, set up your private CA (make-cadir /etc/openvpn/easy-rsa) Set up an easy-rsa config file (/etc/openvpn/easy-rsa/vars) Set EASY_RSA, KEY_SIZE, KEY_EXPIRE, KEY_{ORG S STUFF} if you want the CA customized for your organization, change where generated files go by changing KEY_DIR if you want Use easy-rsa scripts (. vars ;./clean-all ;./build-ca) to produce the CA certificate files (ca.crt, ca.key) for the server, only do this once!

8 Generating Certificate/Key Files for the OpenVPN Server Use the easy-rsa script (cd /etc/openvpn/easy-rsa ;./build-key-server servername) to build the certificate files (servername.crt, servername.key) for the openvpn server, signed with your new private CA Use the easy-rsa script (./build-dh) to produce Diffie-Hellman parameters (dh2048.pem) for TLS-AUTH to use when clients connect Use openvpn --genkey --secret ta.key to create a TLS auth key file for use as the shared secret key when establishing connections Copy the openvpn server's files (ca.crt, ca.key, servername.crt, servername.key, dh2048.pem, ta.key) to the /etc/openvpn directory or wherever you want to configure openvpn to find them

9 OpenVPN Server Configuration Generate and install ca, cert, key, ta.key, and dh files using easy-rsa as shown on the previous slide Enable ip forwarding (/etc/sysctl.conf) if you plan to route internal networks to vpn clients (for testing: sysctl -w net.ipv4.ip_forward=1) - this is for a tap or bridge vpn server Be sure to forward your UDP port as necessary through firewalls, and allow it through your iptables firewall if you are using one

10 OpenVPN Server Configuration Copy the /usr/share/doc/openvpn/examples/sample-configfiles/server.conf file to /etc/openvpn and modify it Choose a local address for the server to listen on or leave it at the default of all addresses The default port of 1194 can be changed if desired, UDP is the preferred protocol for performance reasons Set up tunnel or tap device as desired, with matching server or serverbridge Point ca, cert, key, tls-auth (uncomment as well), and dh at your generated files from easy-rsa Add any push options for routing or dhcp as required

11 OpenVPN Server Configuration Test your configuration using openvpn --script-security 2 --config server.conf Once the test is successful, run the server automatically using service openvpn restart The default service startup for openvpn will read and start any vpns for which there is a file ending in.conf in /etc/openvpn

12 OpenVPN Client Configuration Each client requires a certificate signed by your private CA, the tls-auth shared key file, and the CA certificate from your private CA You can generate a client certificate and key on the server trivially by using the easy-rsa scripts (./build-key clientname) Install openvpn on the client host Securely transfer the necessary files (ca.crt, ta.key, clientname.crt, clientname.key) to the client, or generate a csr on the client, sign it on the server, then transfer the ca and tls-auth key and client certificate to the client

13 OpenVPN Client Configuration Copy the /usr/share/doc/openvpn/examples/sample-configfiles/client.conf file to /etc/openvpn and modify it to match your server configuration (proto, remote, user, group, ca, cert, key, tls-auth) Test your client by running openvpn --config client.conf If client is not Linux, create client.conf as client.ovpn by adding <ca><key><cert><tls-auth> and key-direction 1 sections to the basic conf file and use that on the client Once the test is successful, run the client automatically using service openvpn restart

14 Adding a Login/Password to OpenVPN Authentication Add plugin /usr/lib/openvpn/openvpn-plugin-authpam.so login to the server.conf file The server can also use client-cert-not-required and remove tls-auth if desired, although these actions reduce your protection against fraudulent authentication The client.conf must use auth-user-pass in order to request a login from the user

15 Other VPN Solutions OpenConnect SSH VPN SSH_VPN Hamachi