博客

修改selinux文件


[root@


~]# sed -i ‘s/SELINUX=enfrocing/SELINUX=disabled/g’ /etc/selinux/config

[root@


~]# cat /etc/selinux/config

SELINUX=disabled

SELINUXTYPE=targeted

安装ocserv服务


[root@


~]#yum install epel-release

[root@


~]#yum install -y ocserv

构建一个CA认证中心


[root@ *** ~]# mkdir CA && cd CA

[root@


CA]# certtool –generate-privkey –outfile ca-key.pem

[root@


CA]# vim ca.tmpl

cn = “www.abc.com”

organization = “Abc”

serial = 1

expiration_days = 3600

ca

signing_key

cert_signing_key

crl_signing_key

[root@


CA]# certtool –generate-self-signed –load-privkey ca-key.pem –template ca.tmpl –outfile ca-cert.pem

[root@


CA]# certtool –generate-privkey –outfile server-key.pem

[root@


CA]# vim server.tmpl

cn = “www.abc.com”

organization = “Abc”

serial = 2

expiration_days = 3600

signing_key

encryption_key

tls_www_server

[root@


CA]# certtool –generate-certificate –load-privkey server-key.pem –load-ca-certificate ca-cert.pem –load-ca-privkey ca-key.pem –template server.tmpl –outfile server-cert.pem


配置ocserv


[root@


CA]# mkdir /etc/ssl/private

[root@


CA]# cp server-cert.pem /etc/ssl/certs/

[root@


CA]# cp server-key.pem /etc/ssl/private/

[root@


CA]# vim /etc/ocserv/ocserv.conf

auth = “plain[/etc/ocserv/ocpasswd]”

tcp-port = 9443

udp-port = 9443

run-as-user = ocserv

run-as-group = ocserv

socket-file = ocserv.sock

chroot-dir = /var/lib/ocserv

isolate-workers = false

max-clients = 16

max-same-clients = 2

keepalive = 32400

dpd = 90

mobile-dpd = 1800

switch-to-tcp-timeout = 25

try-mtu-discovery = false

server-cert = /etc/ssl/certs/server-cert.pem

server-key = /etc/ssl/private/server-key.pem

ca-cert = /etc/pki/ocserv/cacerts/ca.crt

cert-user-oid = 0.9.2342.19200300.100.1.1

tls-priorities = “NORMAL:%SERVER_PRECEDENCE:%COMPAT:-VERS-SSL3.0”

auth-timeout = 240

min-reauth-time = 300

max-ban-score = 50

ban-reset-time = 300

cookie-timeout = 300

deny-roaming = false

rekey-time = 172800

rekey-method = ssl

use-occtl = true

pid-file = /var/run/ocserv.pid

device =


s

predictable-ips = true

default-domain = example.com

ipv4-network = 192.168.111.0

ipv4-netmask = 255.255.255.0

dns = 218.85.157.99

dns = 114.114.114.114

ping-leases = false

cisco-client-compat = true

dtls-legacy = true

user-profile = profile.xml


创建用户


[root@


CA]# ocpasswd -c /etc/ocserv/ocpasswd yexl


设置路由转发


[root@


CA]# echo “net.ipv4.ip_forward = 1” > /etc/sysctl.conf

[root@


CA]# sysctl -p


设置ＮＡＴ及防火墙



filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [143:12724]

-A FORWARD -s 192.168.111.0/24 -j ACCEPT

-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT

-A INPUT -p tcp -m state –state NEW -m tcp –dport 9443 -j ACCEPT

-A INPUT -p udp -m state –state NEW -m udp –dport 9443 -j ACCEPT

-A INPUT -j REJECT –reject-with icmp-host-prohibited

COMMIT


nat

:PREROUTING ACCEPT [4:463]

:POSTROUTING ACCEPT [1:76]

:OUTPUT ACCEPT [1:76]

-A POSTROUTING -s 192.168.111.0/24 -o eth0 -j MASQUERADE

COMMIT