Integration/OpenVPN.iRedMail.with.OpenLDAP/CentOS - Revision history

ZhangHuangbin: /* Configure LDAP auth */

ZhangHuangbin — Tue, 07 Jun 2011 03:04:21 GMT

Configure LDAP auth

← Older revision		Revision as of 03:04, 7 June 2011
Line 125:		Line 125:
	BaseDN "o=domains,dc=example,dc=com"		BaseDN "o=domains,dc=example,dc=com"
	# User Search Filter		# User Search Filter
-	SearchFilter "(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"	+	SearchFilter "(&(mail=%u)(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
	# Require Group Membership		# Require Group Membership
	RequireGroup false		RequireGroup false

Shake.chen at 03:48, 21 April 2010

Shake.chen — Wed, 21 Apr 2010 03:48:47 GMT

← Older revision		Revision as of 03:48, 21 April 2010
Line 1:		Line 1:
		+	This tutorial is come from Howtoforge http://www.howtoforge.com/using-iredmail-and-openvpn-for-virtual-email-hosting-and-vpn-services-centos-5.4
		+
	==Install OpenVPN==		==Install OpenVPN==

Shake.chen: /* Configuring OpenVPN */

Shake.chen — Sun, 18 Apr 2010 07:29:28 GMT

Configuring OpenVPN

← Older revision		Revision as of 07:29, 18 April 2010
Line 139:		Line 139:
	* Open /etc/openvpn/server.conf and set correct values:		* Open /etc/openvpn/server.conf and set correct values:
	{{cfg\|/etc/openvpn/server.conf\|<pre>		{{cfg\|/etc/openvpn/server.conf\|<pre>
		+
		+	[...]
	push "redirect-gateway def1"		push "redirect-gateway def1"
		+	[...]
	push "dhcp-option DNS 10.8.0.1"		push "dhcp-option DNS 10.8.0.1"
		+
		+	[...] #add two line at the botton
	plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf		plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf
	client-cert-not-required		client-cert-not-required

Shake.chen: /* Installing OpenVPN GUI On Windows XP / Vista */

Shake.chen — Sun, 18 Apr 2010 07:26:48 GMT

Installing OpenVPN GUI On Windows XP / Vista

← Older revision		Revision as of 07:26, 18 April 2010
Line 251:		Line 251:

	Now you can use the account www@example.com connect the vpn.		Now you can use the account www@example.com connect the vpn.
		+
		+	==Troubleshooting==
		+
		+	===Eable ldap log===
		+
		+	* Open /etc/ldap/slapd.conf and set correct values:
		+	{{cfg\|/etc/ldap/slapd.conf\|<pre>
		+	loglevel 256 # <-- change form 0 to 256
		+
		+	</pre>}}
		+
		+	===Eable Openvpn log===
		+
		+	Issue the following command to create log files and setting the right permission:
		+
		+	{{cmd\|<pre>
		+	touch /var/log/openvpn.log
		+	touch /var/log/openvpn-status.log
		+	chown nobody.nobody /var/log/openvpn.log
		+	chown nobody.nobody /var/log/openvpn-status.log
		+	</pre>}}
		+
		+	* Open /etc/openvpn/server.conf and set correct values:
		+	{{cfg\|/etc/openvpn/server.conf\|<pre>
		+	[...]
		+	user nobody
		+	group nobody
		+
		+	[...]
		+	status /var/log/openvpn-status.log
		+	log /var/log/openvpn.log
		+
		+	</pre>}}
		+
		+	===Monitor the log===
		+
		+	Restart the OpenLDAP and OpenVPN service and monitor the log
		+
		+	<pre>
		+	# tail -0f /var/log/openldap.log
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 fd=14 ACCEPT from IP=127.0.0.1:35456 (IP=0.0.0.0:389)
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=0 RESULT tag=97 err=0 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=1 SRCH base="o=domains,dc=example,dc=com"
		+	scope=2 deref=0 filter="(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 fd=18 ACCEPT from IP=127.0.0.1:35457 (IP=0.0.0.0:389)
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=0 RESULT tag=97 err=0 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=1 BIND anonymous mech=implicit ssf=0
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=1 BIND dn="mail=www@example.com,
		+	ou=Users,domainName=example.com,o=domains,dc=example,dc=com" method=128
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=1 BIND dn="mail=www@example.com,
		+	ou=Users,domainName=example.com,o=domains,dc=example,dc=com" mech=SIMPLE ssf=0
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=1 RESULT tag=97 err=0 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 op=2 UNBIND
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 op=2 UNBIND
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=1 fd=18 closed
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 fd=18 ACCEPT from IP=127.0.0.1:35458 (IP=0.0.0.0:389)
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=0 BIND dn="cn=vmail,dc=example,dc=com" method=128
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=0 BIND dn="cn=vmail,dc=example,dc=com" mech=SIMPLE ssf=0
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=0 fd=14 closed
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=0 RESULT tag=97 err=0 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=1 SRCH base="o=domains,dc=example,dc=com"
		+	scope=2 deref=0 filter="(&(objectClass=mailUser)(accountStatus=active)(enabledService=vpn))"
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 op=2 UNBIND
		+	Apr 4 22:45:17 centos54 slapd[6622]: conn=2 fd=18 closed
		+
		+	# tail -0f /var/log/openvpn.log
		+	Sun Apr 4 22:47:01 2010 MULTI: multi_create_instance called
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Re-using SSL/TLS context
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 LZO compression initialized
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Local Options hash (VER=V4): '530fdded'
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Expected Remote Options hash (VER=V4): '41690919'
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 TLS: Initial packet from 192.168.1.147:51240, sid=01b29dca a4554de8
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 PLUGIN_CALL:
		+	POST /usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 TLS: Username/Password authentication succeeded for username 'www@example.com'
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 [] Peer Connection Initiated with 192.168.1.147:51240
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 PLUGIN_CALL:
		+	POST /usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so/PLUGIN_CLIENT_CONNECT status=0
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 MULTI: Learn: 10.8.0.14 -> 192.168.1.147:51240
		+	Sun Apr 4 22:47:01 2010 192.168.1.147:51240 MULTI: primary virtual IP for 192.168.1.147:51240: 10.8.0.14
		+	Sun Apr 4 22:47:02 2010 192.168.1.147:51240 PUSH: Received control message: 'PUSH_REQUEST'
		+	Sun Apr 4 22:47:02 2010 192.168.1.147:51240 SENT CONTROL [UNDEF]:
		+	'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.8.0.1,route 10.8.0.1,
		+	topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13' (status=1)
		+	Sun Apr 4 22:47:13 2010 192.168.1.147:51240 Authenticate/Decrypt
		+	packet error: bad packet ID (may be a replay): [ #1 ] -- see the man page entry for
		+	--no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
		+
		+	</pre>

Shake.chen: /* Client setting */

Shake.chen — Sun, 18 Apr 2010 07:19:31 GMT

Client setting

← Older revision		Revision as of 07:19, 18 April 2010
Line 225:		Line 225:
	# Add the vpn server		# Add the vpn server
	remote mail.example.com 1194		remote mail.example.com 1194
		+
		+	[...]
	#Comment out the below two line		#Comment out the below two line
	#cert client.crt		#cert client.crt
Line 234:		Line 236:

	</pre>}}		</pre>}}
		+
		+	Copy the client.ovpn and ca.crt file to your client system. Also can use mutt sent the files to mailbox. you can login email account and download the fies.
		+
		+	{{cmd\|<pre>
		+	yum -y install mutt zip
		+	cd /etc/openvpn/easy-rsa/2.0/keys
		+	zip config.zip client.ovpn ca.crt
		+	mutt -s "OpenVPN client config files" -a /etc/openvpn/easy-rsa/2.0/keys/config.zip www@example.com < /usr/share/doc/openvpn-2.1.1/README
		+	</pre>}}
		+
		+	===Installing OpenVPN GUI On Windows XP / Vista===
		+
		+	Download the client software here:http://www.openvpn.se/development.html . The tested version is OpenVPN 2.1_beta7 & OpenVPN GUI 1.0.3 , works on Vista. After install, put the client.ovpn and ca.crt file to C:\Program Files\OpenVPN\config.
		+
		+	Now you can use the account www@example.com connect the vpn.

Shake.chen: /* Restart relate service */

Shake.chen — Sun, 18 Apr 2010 07:16:55 GMT

Restart relate service

← Older revision		Revision as of 07:16, 18 April 2010
Line 212:		Line 212:
	/etc/init.d/openvpn restart		/etc/init.d/openvpn restart
	/etc/init.d/iptables restart		/etc/init.d/iptables restart
		+	</pre>}}
		+
		+	==Client setting==
		+
		+	{{cmd \| <pre>
		+	cp /usr/share/doc/openvpn-2.1.1/sample-config-files/client.conf /etc/openvpn/easy-rsa/2.0/keys/client.ovpn
		+	cd /etc/openvpn/easy-rsa/2.0/keys
		+	</pre>}}
		+
		+	* Open /etc/openvpn/easy-rsa/2.0/keys/client.ovpn and set correct values:
		+	{{cfg\|/etc/openvpn/easy-rsa/2.0/keys/client.ovpn\|<pre>
		+	# Add the vpn server
		+	remote mail.example.com 1194
		+	#Comment out the below two line
		+	#cert client.crt
		+	#key client.key
		+
		+	[...]
		+	#Add thes line at the botton
		+	auth-user-pass
		+
	</pre>}}		</pre>}}

Shake.chen: /* Enable VPN service for mail user */

Shake.chen — Sun, 18 Apr 2010 07:13:08 GMT

Enable VPN service for mail user

← Older revision		Revision as of 07:13, 18 April 2010
Line 150:		Line 150:
	Use phpLDAPadmin or other tools to add LDAP values for exist mail user.		Use phpLDAPadmin or other tools to add LDAP values for exist mail user.

-	Login in the phpLDAPadmin	+	*Login in the phpLDAPadmin
		+	*Find the exit mail user www@example.com
		+	*Enable VPN service for the user www@example.com.
		+
		+	==Enable IP forward and config iptables==
		+
		+	* Open /etc/sysctl.conf and set correct values:
		+	{{cfg\|/etc/sysctl.conf\|<pre>
		+	net.ipv4.ip_forward = 1
		+
		+	</pre>}}
		+
		+	Issue the following commands to configure iptables to properly forward traffic through the VPN:
		+
		+	{{cmd \| <pre>
		+	echo 1 > /proc/sys/net/ipv4/ip_forward
		+	</pre>}}
		+
		+	* Open /etc/sysconfig/iptables and add the below. Let the iptables open 1194 ports.:
		+	{{cfg\|/etc/sysconfig/iptables\|<pre>
		+	#openvpn
		+	-A INPUT -p udp -m multiport --dport 1194 -j ACCEPT
		+
		+	</pre>}}
		+
		+	Issue the following command to set this variable for the current session:
		+
		+	{{cmd \| <pre>
		+
		+	iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
		+	iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
		+	iptables -A FORWARD -j REJECT
		+	iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
		+
		+	</pre>}}
		+
		+	Before continuing, insert these iptables rules into your system's /etc/rc.local file to ensure that theses iptables rules will be recreated following your next reboot cycle:
		+
		+
		+	* Open /etc/rc.local and let look like:
		+	{{cfg\|/etc/rc.local\|<pre>
		+	#!/bin/sh
		+	#
		+	# [...]
		+	#
		+
		+	iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
		+	iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
		+	iptables -A FORWARD -j REJECT
		+	iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
		+
		+	touch /var/lock/subsys/local
		+	</pre>}}
		+
		+	==Restart relate service==
		+
		+	we need restart all relate service, let the cofig work.
		+
		+	{{cmd \| <pre>
		+	/etc/init.d/ldap restart
		+	/etc/init.d/openvpn restart
		+	/etc/init.d/iptables restart
		+	</pre>}}

Shake.chen: /* Configure LDAP auth */

Shake.chen — Sun, 18 Apr 2010 07:00:26 GMT

Configure LDAP auth

← Older revision		Revision as of 07:00, 18 April 2010
Line 128:		Line 128:
	</Authorization>		</Authorization>
	</pre>}}		</pre>}}
		+
		+	==Configuring OpenVPN==
		+
		+	We'll now need to configure our server file. There is an example file in /usr/share/doc/openvpn-2.1.1/examples/sample-config-files. Issue the following sequence of commands to retrieve the example configuration files and move them to the required directories:
		+
		+	{{cmd \| <pre>
		+	cp /usr/share/doc/openvpn-2.1.1/sample-config-files/server.conf /etc/openvpn/
		+	</pre>}}
		+
		+	* Open /etc/openvpn/server.conf and set correct values:
		+	{{cfg\|/etc/openvpn/server.conf\|<pre>
		+	push "redirect-gateway def1"
		+	push "dhcp-option DNS 10.8.0.1"
		+	plugin /usr/lib/openvpn/plugin/lib/openvpn-auth-ldap.so /etc/openvpn/auth/ldap.conf
		+	client-cert-not-required
		+
		+	</pre>}}
		+
		+	==Enable VPN service for mail user==
		+
		+	Use phpLDAPadmin or other tools to add LDAP values for exist mail user.
		+
		+	Login in the phpLDAPadmin

Shake.chen: /* Configure LDAP auth */

Shake.chen — Sun, 18 Apr 2010 06:55:46 GMT

Configure LDAP auth

← Older revision		Revision as of 06:55, 18 April 2010
Line 127:		Line 127:
	RequireGroup false		RequireGroup false
	</Authorization>		</Authorization>
-		+	</pre>}}
-	</pre>}	+

Shake.chen: /* Configure LDAP auth */

Shake.chen — Sun, 18 Apr 2010 06:54:27 GMT

Configure LDAP auth

← Older revision		Revision as of 06:54, 18 April 2010
Line 106:		Line 106:
	* Open /etc/openvpn/auth/ldap.conf and set correct values:		* Open /etc/openvpn/auth/ldap.conf and set correct values:
	{{cfg\|/etc/openvpn/auth/ldap.conf\|<pre>		{{cfg\|/etc/openvpn/auth/ldap.conf\|<pre>
		+
	<LDAP>		<LDAP>
	# LDAP server URL		# LDAP server URL