Workplace Plus. How to configure VPN on Ubuntu. Document version: 1.0 Document revision date:

Transcription

1 Workplace Plus How to configure VPN on Ubuntu Document version: 1.0 Document revision date: AO KASPERSKY LAB. ALL RIGHTS RESERVED. THIS DOCUMENT REPRESENTS PROPRIETARY RESEARCH ON THE PART OF KASPERSKY LAB. THIS INFORMATION IS PROVIDED UNDER A STRICT NON-DISCLOSURE AGREEMENT. DISTRIBUTION AND DUPLICATION ARE STRICTLY FORBIDDEN.

2 Table of contents 1. Install packages required for SafeNet Authentication Client Install SafeNet Authentication Client Set up the working environment Configure Firefox Configure VPN connection via PPTP Install and configure the Evolution mail client... 8 Page 2 of 9

3 1. Install packages required for SafeNet Authentication Client Most modern distributives already contain drivers for USB devices. To check it, insert the token into the USB port and run the dmesg command. You should get the following output (the Product and Manufacturer attributes may be missing): $ dmesg [ ] usb 1-2: new full-speed USB device number 3 using ohci_hcd [ ] usb 1-2: New USB device found, idvendor=0529, idproduct=0600 [ ] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ ] usb 1-2: Product: Token [ ] usb 1-2: Manufacturer: Aladdin Knowledge Systems Ltd. If the etoken is not found, then install the drivers. The following packages are required for SafeNet Authentication Client 9.1 to work: Package set for smart cards (opensc, libpcsclite1, pcsc-tools) The QT library To install the packages, use the following command: # apt-get install opensc libpcsclite1 pcsc-tools pcscd libqt4qt3support Page 3 of 9

4 2. Install SafeNet Authentication Client Depending on the OS architecture (32 or 64 bit), the following versions of SafeNet are available: SafenetAuthenticationClient-<X>.<n>-0_i386.deb for 32 bit systems SafenetAuthenticationClient-<X>.<n>-0_amd64.deb for 64 bit systems SAC-32-CompatibilityPack-<X>.<n>-0_amd64.deb for 32 bit applications installed on 64 bit systems where <X> package version (latest 9.1), <n> build (latest 17). To install the package, run the following command: # dpkg -i./safenetauthenticationclient-*.deb Now you can read the etoken with the SafeNet driver: $ pkcs11-tool --module /usr/lib/libetpkcs11.so -L Available slots: Slot 0 (0x0): AKS ifdh token label: User Name token manuf: SafeNet Inc. token model: etoken token flags: rng, login required, PIN initialized, token initialized, other flags=0x200 serial num : Page 4 of 9

5 3. Set up the working environment 3.1. Configure Firefox To configure the Firefox browser, follow these steps: Download the certificates from In Firefox, open Certificate Manager: in the browser menu, click Edit Preferences and go the Advanced Certificates tab. a. Click View Certificates. On the Authorities tab, import all downloaded certificates. Make sure that they are added to the list and click OK. b. Click Security Devices. If the list does not contain etoken, then click Load and specify the following parameters: Device name Path to the pkcs11 module: /usr/lib/libetpkcs11.so. Page 5 of 9

6 The corresponding record will appear with the slot list. The list should contain your personal etoken slot (as in the pkcs11-tool L command output see section 2, Install SafeNet Authentication Client). Click OK. On the page, click Enter the System and specify your PIN for the etoken. Page 6 of 9

7 3.2. Configure VPN connection via PPTP To configure VPN connection via PPTP, follow these steps: Install the library required for working with PKCS#11 via OpenSSL: # apt-get install libengine-pkcs11-openssl Get the IDs of the certificate and key. Specify your PIN and save the IDs (you will need them in step 6 of the instruction): $ pkcs11-tool --module /usr/lib/libetpkcs11.so -l O Using slot 0 with a present token (0x0) Logging in to "User Name". Please enter User PIN: Private Key Object; RSA label: etcapi private key ID: Usage: decrypt, sign, unwrap Certificate Object, type = X.509 cert label: (etcapi) User Name's ID ID: Install the packages for working with VPN and PPTP: o For Ubuntu of version and later, run the following command: # apt-get install ppp pptp-linux o For older Ubuntu versions, download the required package from and install it using the dpkg command: # dpkg -i ppp_*.deb Create the /etc/ppp/openssl.cnf file with the following contents: openssl_conf = openssl_def [ openssl_def ] engines = engine_section [ engine_section ] pkcs11 = pkcs11_section [ pkcs11_section ] engine_id = pkcs11 dynamic_path = /usr/lib/x86_64-linux-gnu/openssl /engines/pkcs11.so MODULE_PATH = /usr/lib/libetpkcs11.so init = 0 In the /etc/ppp/optitons.pptp file, comment out the refuse-eap line to allow the EAP-TLS authentication. Create the /etc/ppp/peers/klvpn file with the following connection parameters: o UserName: your domain login o ca: path to the converted root certificate in the PEM format o cert and key: IDs of the certificate and key (from step 2) with the pkcs11 prefix: pty "pptp vpn.kaspersky.com --nolaunchpppd" name KL\\UserName remotename vpn.kaspersky.com requiremppe-128 file Page 7 of 9

8 /etc/ppp/options.pptp ipparam klvpn need-peer-eap updetach usepeerdns password PassWord defaultroute replacedefaultroute ca /path/to/kasperskylabshqca.pem cert pkcs11: key pkcs11: Download the ppp package distributive. Compile and install the pppgetpass utility: # apt-get install dpkg-dev $ apt-get source ppp $ cd ppp-2.4.5/contrib/pppgetpass $ make -f Makefile.linux pppgetpass.vt # cp pppgetpass.vt /usr/local/bin/ In the connection parameters file, instead of the password line, add the following lines: plugin passprompt.so promptprog /usr/local/bin/pppgetpass.vt The pppgetpass.vt plugin opens a local console where PIN should be specified. You can only use this console if you have physical access to the workstation. If you are trying to establish the VPN connection via SSH or VNC, you will not be able to specify the password. In this case, you can use the parameter in the connection file. Now you can establish the VPN connection: o To establish the connection: # pon klvpn o To break the connection: # poff klvpn o To turn on the debug output for the connection establishing: # pon klvpn debug dump logfd Install and configure the Evolution mail client To install and configure the Evolution mail client, follow these steps: Install the Evolution mail client to work with the corporate Exchange server: # apt-get install evolution evolution-ews Establish the VPN connection and start the Evolution mail client. In the Identity window, specify the following account parameters: o Full name: your user name o Address: your In the Receiving window, specify the following parameters: o Server Type: Exchange Web Services o Username: kl\<your_login> o Host URL: Page 8 of 9

9 o OAB URL: The mail client is ready for work: Page 9 of 9