Good
Every enterprise, sooner or later, all of a sudden, needs remote access.
Practically every IT specialist is faced with the need to organize remote access to their networks at the enterprise.
I, like many, this need covered with the stamp "yesterday." After analyzing all the pros and cons, as well as shoveling tons of information and digging a bit in theory, I decided to proceed with the installation.
For security reasons, I chose OpenVPN in the following implementation: a virtual machine was installed on a server running Windows Server 2012, it also had Windows Server 2012, and on it, in turn, an OpenVPN server that issued and signed certificates.
For convenience, we will call it a “certification server”. Further, he took the server certificate, pushed it into Mikrotik, and on the router Mikrotik raised OpenVPN with accounts, profiles. I also used a certification server to issue a client certificate.
The implementation, of course, is awful, and although at that time my experience in such things was, say, not enough, in matters of security, this was not a bad decision.
This bundle worked for a while and I was given a new introductory: transfer the certification server to Linux, while maintaining the connection with Mikrotik - the clients should not suffer.
My knowledge of Linux at that time ended on Ubuntu 16.04LTS with a graphical interface, which was used as a terminal for connecting via RDP to a Windows server. That is, sudo apt-get -f install -y, and not a centimeter more.
Having studied the question which OS from the Linux family is more stable and promising for my organization, I settled on CentOS 7 Minimal.
To begin with, I decided to delve a little into the theory, to understand how it generally works and works. I watched the video tutorials on the channel
www.youtube.com/channel/UCKdRgZWgy42YxoFcTJ30LTA (Generally not an advertisement, they just got me first). The girl with a pleasant voice introduced me to the basics of working in the selected OS.
To start, I launched Hyper-V on my computer, installed CentOS 7 Minimal there, during the installation I created the Admin user and completely closed ssh for root. Saying goodbye to a beautiful multi-colored screen, plunged into the black and white world of the terminal.
I think it makes no sense to describe the software installation process, it’s better to focus on the problems that arose during the process and for which I had to write a small script (it is under a cat. The description of each of the utilities can be found on the Internet, but at that moment when I’m all did it, this script was not there yet, everything was done for the first time, to the touch and at random).
In the script, I tried to automate the installation of the minimum necessary utilities for the server, disable Selinux, connect the Epel repository, install OpenVPN, etc. Below is the script itself, it is simple, but it can be used. I will not disassemble it, but if someone needs it, write a reply.
After using the script, an already configured OpenVPN server will appear, winking with a green eye.
Installing OpenVPN was not entirely successful.
Not knowing about the features of the rights policy on Linux systems, I spent a lot of time studying logs and assigning all the required rights to all files.
When the OpenVPN button turned green, I was very happy, but as it turned out, this was only the beginning. For the sake of simplicity, I expected to replace the root certificates and the crl.pem file, hoping that everything worked. As a result, I needed to transfer the following files from the server to Windows:
Serv.crt - Server Certificate
Serv.key - Server Key
Ca.crt - Root Certificate
Ca.key - Root Key
Crl.pem - Certificate Revocation File
Dh.pem - Diffie-Hellman key
Index.txt - File with information about current certificates
Serial - it is also responsible for the relevance of certificates
It also required the certs_by_serial folder, the vars file, and all client keys and certificates.
At Mikrotik, the certificates remained in place, so it worked.
Problems appeared when I tried to revoke the certificate, it didn’t work from the word at all - the index.txt file needed to be converted to unix format, but I didn’t do it right away. Used the dos2unix utility.
Now the certificates were revoked, but continued to work without any problems, because Mikrotik did not know that they were revoked and he needed to somehow inform about it.
After reading the instructions, as well as consulting with Alexander ERI (thank you very much!), I picked up a simple Apache http server on the certification server and published a file of revoked certificates on it. Completely closed access to it, except for the published file from one ip.
In the Mikrotik terminal, in the / System / Certificates / CRL tab, indicated the path to the published crl.pem. Here it should be clarified that Mikrotik accepts only http and an absolute address for the CRL tab, i.e. It should look something like this:
127.0.0.1/crl/1.crlEverything worked, at least for versions 6.4.2.x of RouterOS, but I had to create client configurations by hand, and this was unfortunate for me and caused a lot of inconvenience. When in a week I needed to create configurations for about 50 clients, I decided to speed up this process and for this I used a piece of someone else's script found on the Internet.
The script works like this: after launch, specify “client name”, answer the question “set a password or not”, after that we pick up the ready-made configuration file “client.ovpn”, with certificates and settings integrated into it. To use it, you must have / etc / openvpn. I will sign komenty lines in which the path must be replaced with your own. It is also necessary to create a file with client settings so that the script substitutes them in the process of creating the configuration.
After some time, a new introductory ban on remote access forced to kill both this server and the working bundle with Mikrotik. A new OpenVPN server was created for the IT department, which now works completely on CentOS. But this is a completely different story.
I express my deep gratitude to Ivan and Pavel for their help in editing the article.