VPN: Difference between revisions
| Line 70: | Line 70: | ||
</pre> | </pre> | ||
Now have the user ssh into the dev server, generate a [[2FA]] TOTP secret key, and scan it into their [[2FA]] FLOSS app-of-choice. | Now have the user scp their CSR to their home directory on the OSE Development server. | ||
<pre> | |||
marcin@Precision-M6500:~$ scp -P 32415 $HOME/openvpn/`whoami`.csr marcin@195.201.233.113: | |||
</pre> | |||
As root, cd into the easy-rsa directory, import the OSE Developer's CSR, and sign it. | |||
<pre> | |||
[root@osedev1 ~]# cd /usr/share/easy-rsa/3 | |||
[root@osedev1 3]# ./easyrsa import-req /home/marcin/marcin.csr marcin | |||
Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 | |||
The request has been successfully imported with a short name of: marcin | |||
You may now use this name to perform signing operations on this request. | |||
[root@osedev1 3]# | |||
</pre> | |||
Finally, have the user ssh into the dev server, generate a [[2FA]] TOTP secret key, and scan it into their [[2FA]] FLOSS app-of-choice. | |||
<pre> | <pre> | ||
Revision as of 14:03, 3 December 2019
A VPN is a system that establishes a private network across a public network, such as the Internet
Use in Dev Server
OSE launched a single staging/dev server in Hetzner Cloud in 2019. For security reasons it's imperative that this server is locked-down and sitting *behind* a VPN.
Important Files & Directories
For more information about our vpn configuration, please see the following files & directories on the osedev1 server:
/usr/share/easy-rsa/3/pki//etc/openvpn/
How to connect to the VPN
Execute openvpn with sudo, passing it your client config file.
cd openvpn sudo openvpn client.conf
You will be prompted for two credentials:
Enter Auth Password:- This is your 2FA 6-digit token that changes every 30 seconds. Get it from your 2FA FLOSS TOTP app-of-choice.Enter Private Key Password:- This is the passphrase you used to symmetrically encrypt your OpenVPN client RSA certificate when you were first setup with access to the OSE VPN. Check your personal password database.
Developers: How to request access to the dev VPN
This section is intended for the OSE Developer that requires access to the developer VPN and would like to make a request for access to the OSE sysadmin.
Install Prerequisites
In order to connect to our vpn, you should install the following prerequisite software
sudo apt-get install openvpn openresolv
Now generate a RSA certificate and certificate signing request. This will prompt you for a passphrase. Choose something long, unique, and memorable (ideally generate a ~30 character random passphrase and store it to an offline password DB such as keepass).
You will have to type this passphrase every time you connect to the VPN in the future.
openssl req -new -newkey rsa:4096 -keyout `whoami`.key -out `whoami`.csr
Finally, send an email to the OSE Sysadmin requesting a meeting for you to get setup and trained with VPN access to the OSE VPN. Be sure to include an thorough explanation of why you need access to the VPN or your request may be denied.
Sysadmin: How to grant access to the dev VPN
This section is intended for the OSE sysadmin and will describe the process of granting access to the developer VPN for OSE developers.
First, make sure that the user requesting access to the dev VPN has a valid reason to need this access. Iff the request is valid, then proceed:
On the OSE Development server, create a OS-level user for the developer requesting VPN access, and add their ssh public key to their authorized_keys file
user@ose:~$ ssh osedev1 Last login: Tue Dec 3 12:40:51 2019 from 182.74.197.50 [maltfield@osedev1 ~]$ sudo su - Last login: Mon Dec 2 15:21:42 CET 2019 on pts/17 [root@osedev1 ~]# adduser marcin [root@osedev1 ~]# mkdir /home/marcin/.ssh/ [root@osedev1 ~]# echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDMiIUel3xYyxuiXAj82PzoJDwRczrEpDgUoRI4W9ceL5FqVcY38Go9q3SF2Nx0FEj+IdCUXc08lyy6ZPUbPcKvscFxWeue4aMM62ikzNxmhGBdjqgT3q3wpJgyjTXmt9AJcglcAm9mcQffSUi3RD9KDlCyc/T923eZdaLAkW/BMhjuOZqY90tjGqs/r/kxN0gf4vI24NMFL/41ct7OMKVnNNsjIpQtceX9fCOCumAx53OdtJEcp46TvzevZk2987Zn0VsONznvVCJ0kmm8B0RJxwIfmiLM73f+reo0pv+sSc2rU7SrpzLfPWLFcM7pkJQc3HtLnktl5form3flp+EkI7fr7348r8A7W+QIifjXk66ohJReDni9H/S4JSX2L1lf8LfJKSHtAqrFRWSPp22MKre5hiH0IybED6XZfz59HT0cgMK2iNcPRj/J+hEbBM0f4zZu62PUad7rr1JI4Vv078/ROaD47fykicxYhauI4R71J1YucSj/vekXf17x3xlO+u8ucSeUhdpMuIAa3Yk16bXsrwo4nIdcApC6rwfNiQDK8Ecx6+M6pV6z+dII4OMHvEYWw92wWJZfIyk7emvAoataqp3DfI0DQagPNBo2ieEZYLvNYny+X9hf6faZ6trsGnR4GfN83PEt3ZfmoEoyTVB2POiBdM8a1GNTlEasQ== marcin@Precision-M6500" >> /home/marcin/.ssh/authorized_keys [root@osedev1 ~]# chown -R marcin:marcin /home/marcin/.ssh [root@osedev1 ~]# chmod -R 0600 /home/marcin/.ssh [root@osedev1 ~]# chmod 0700 /home/marcin/.ssh [root@osedev1 ~]#
Now have the user scp their CSR to their home directory on the OSE Development server.
marcin@Precision-M6500:~$ scp -P 32415 $HOME/openvpn/`whoami`.csr marcin@195.201.233.113:
As root, cd into the easy-rsa directory, import the OSE Developer's CSR, and sign it.
[root@osedev1 ~]# cd /usr/share/easy-rsa/3 [root@osedev1 3]# ./easyrsa import-req /home/marcin/marcin.csr marcin Using SSL: openssl OpenSSL 1.0.2k-fips 26 Jan 2017 The request has been successfully imported with a short name of: marcin You may now use this name to perform signing operations on this request. [root@osedev1 3]#
Finally, have the user ssh into the dev server, generate a 2FA TOTP secret key, and scan it into their 2FA FLOSS app-of-choice.
marcin@Precision-M6500:~$ ssh -p 32415 marcin@195.201.233.113 [marcin@osedev1 ~]$ google-authenticator --time-based --disallow-reuse --issuer "vpn.opensourceecology.org" --label "`whoami`@osedev1" --emergency-codes=1 --window-size=8 --rate-limit=2 --rate-time=30
Looking Forward
Ideally, OSE would have a single rack of colocated hardware at a datacenter near FeF. As campuses pop-up, we could provision new racks at new datacenters that peer with each-other over time, if needed.
The reality is that we have a dedicated server in Falkenstein, Germany[1]; a cloud instance at a different DC in Falkenstein; a physical office in Missouri, USA that will likely have servers in the future[2]; and developers (some with their own servers) all over the world -- which begs the question: how do you architect a VPN with this hodge-podge of geographically dispersed servers & clients?
Certainly a hub-and-spoke [3] openvpn model is possible, but that introduces a single-point-of-failure.
A better option would be a decentralized mesh-style VPN solution, such as ZeroTier.