technische_naslag:sid:roer
Verschillen
Dit geeft de verschillen weer tussen de geselecteerde revisie en de huidige revisie van de pagina.
| Beide kanten vorige revisieVorige revisieVolgende revisie | Vorige revisie | ||
| technische_naslag:sid:roer [2025/05/26 20:47] – michelle | technische_naslag:sid:roer [2026/06/04 20:33] (huidige) – Layout verbeteringen michelle | ||
|---|---|---|---|
| Regel 1: | Regel 1: | ||
| - | ===== Introductie ===== | + | ====== Introductie |
| Al jaren draai ik thuis een servertje, vroeger was dat nogal uitgebreid met diverse netwerk-segmenten waarvoor 't ding router was en had ik mijn eigen mailserver en wat niet meer draaien. Tegenwoordig is het vooral een veredelde NAS, maar wel op een echte server die energiezuinig is met z'n SSD's en een echte distributie erop: | Al jaren draai ik thuis een servertje, vroeger was dat nogal uitgebreid met diverse netwerk-segmenten waarvoor 't ding router was en had ik mijn eigen mailserver en wat niet meer draaien. Tegenwoordig is het vooral een veredelde NAS, maar wel op een echte server die energiezuinig is met z'n SSD's en een echte distributie erop: | ||
| Regel 5: | Regel 5: | ||
| * Hardware: HP Proliant Microserver Gen10+ | * Hardware: HP Proliant Microserver Gen10+ | ||
| * Storage: 2x Western Digital Red 2TB SSD | * Storage: 2x Western Digital Red 2TB SSD | ||
| - | * OS: Debian GNU/ | + | * OS: Debian GNU/ |
| - | ===== Installatie en Configuratie ===== | + | ====== Installatie en Configuratie |
| - | ==== Webserver: Apache2 ==== | + | ===== Webserver: Apache2 |
| Met Let's Encrypt certificaat: | Met Let's Encrypt certificaat: | ||
| Regel 15: | Regel 15: | ||
| * [[https:// | * [[https:// | ||
| - | ==== OpenVPN ==== | + | ===== OpenVPN |
| + | |||
| + | ==== Installeer OpenVPN server | ||
| Hiervoor gebruik ik een handig scrippie: [[https:// | Hiervoor gebruik ik een handig scrippie: [[https:// | ||
| Regel 28: | Regel 30: | ||
| <code bash> | <code bash> | ||
| - | michelle@roer: | + | michelle@roer: |
| - | Welcome to the OpenVPN | + | [INFO] === OpenVPN Non-Interactive Install === |
| - | The git repository is available | + | [INFO] Running in non-interactive mode with the following settings: |
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] Setting up official | ||
| + | > apt-get update | ||
| + | > apt-get install -y ca-certificates curl | ||
| + | > mkdir -p / | ||
| + | > curl -fsSL https:// | ||
| + | [INFO] Updating package lists with new repository... | ||
| + | > apt-get update | ||
| + | [INFO] OpenVPN official repository configured | ||
| + | [INFO] Installing OpenVPN and dependencies... | ||
| + | > apt-get install -y openvpn iptables openssl curl ca-certificates tar dnsutils socat | ||
| + | [INFO] Data Channel Offload (DCO) is not available | ||
| + | > mkdir -p / | ||
| + | > curl -fL --retry 5 -o / | ||
| + | [INFO] Verifying Easy-RSA checksum... | ||
| + | > mkdir -p /etc/openvpn/ | ||
| + | > tar xzf / | ||
| + | > rm -f / | ||
| + | [INFO] Initializing PKI... | ||
| + | > ./easyrsa init-pki | ||
| + | [INFO] Building CA... | ||
| + | > ./easyrsa --batch --req-cn=cn_jPf4c13rKvpdCoX7 build-ca nopass | ||
| + | [INFO] Building server certificate... | ||
| + | > ./easyrsa --batch build-server-full server_JtWaiX0iDcYANtAt nopass | ||
| + | > ./easyrsa gen-crl | ||
| + | [INFO] Generating TLS key... | ||
| + | > openvpn --genkey tls-crypt-v2-server / | ||
| + | [INFO] Copying certificates... | ||
| + | > cp pki/ca.crt pki/ | ||
| + | > chmod 644 / | ||
| + | [INFO] Generating server configuration... | ||
| + | > mkdir -p / | ||
| + | > mkdir -p / | ||
| + | [INFO] Enabling IP forwarding... | ||
| + | > mkdir -p / | ||
| + | > sysctl --system | ||
| + | [INFO] Configuring OpenVPN service... | ||
| + | > cp / | ||
| + | > sed -i s|LimitNPROC|# | ||
| + | > sed -i / | ||
| + | > systemctl daemon-reload | ||
| + | > systemctl enable openvpn-server@server | ||
| + | > systemctl restart openvpn-server@server | ||
| + | [INFO] Configuring firewall rules... | ||
| + | > mkdir -p / | ||
| + | > chmod +x / | ||
| + | > chmod +x / | ||
| + | > systemctl daemon-reload | ||
| + | > systemctl enable iptables-openvpn | ||
| + | > systemctl start iptables-openvpn | ||
| + | [INFO] Creating client template... | ||
| + | [INFO] Generating first client certificate... | ||
| + | [INFO] Generating client certificate... | ||
| + | > ./easyrsa --batch build-client-full client nopass | ||
| + | [OK] Client client added and is valid for 3650 days. | ||
| + | > cp / | ||
| + | [OK] The configuration file has been written to / | ||
| + | [INFO] Download the .ovpn file and import it in your OpenVPN client. | ||
| + | [OK] If you want to add more clients, you simply need to run this script another time! | ||
| + | </ | ||
| - | I need to ask you a few questions before starting the setup. | + | ==== Open poort op Fritz!Box firewall ==== |
| - | You can leave the default options and just press enter if you are okay with them. | + | |
| - | I need to know the IPv4 address of the network interface you want OpenVPN listening to. | + | Vervolgens moet ik op mijn **Fritz!Box** wel deze **poort openen** natuurlijk! |
| - | Unless your server is behind NAT, it should be your public IPv4 address. | + | |
| - | IP address: 192.168.1.2 | + | |
| - | It seems this server is behind NAT. What is its public IPv4 address or hostname? | + | * Poortnummer: |
| - | We need it for the clients to connect to the server. | + | * Protocol: UDP |
| - | Public IPv4 address or hostname: roer.vlet.net | + | |
| - | Checking for IPv6 connectivity... | + | ==== Configureer OpenVPN server ==== |
| - | Your host appears to have IPv6 connectivity. | + | Daarna nog wat eigen aanpassingen gedaan aan de server config: |
| - | Do you want to enable IPv6 support (NAT)? [y/n]: n | + | <code bash> |
| + | michelle@roer:~$ sudo egrep ' | ||
| + | ##server 10.8.0.0 255.255.255.0 | ||
| + | server 192.168.3.0 255.255.255.0 | ||
| + | push " | ||
| + | push "route 192.168.1.0 255.255.255.0" | ||
| + | ##push " | ||
| + | </ | ||
| - | What port do you want OpenVPN | + | ==== Maak OpenVPN |
| - | 1) Default: 1194 | + | |
| - | 2) Custom | + | |
| - | 3) Random [49152-65535] | + | |
| - | Port choice [1-3]: 1 | + | |
| - | What protocol do you want OpenVPN to use? | + | <code bash> |
| - | UDP is faster. Unless it is not available, you shouldn' | + | michelle@roer: |
| - | 1) UDP | + | |
| - | 2) TCP | + | |
| - | Protocol [1-2]: 1 | + | |
| - | What DNS resolvers do you want to use with the VPN? | + | === New Client Setup === |
| - | 1) Current system resolvers (from / | + | |
| - | 2) Self-hosted DNS Resolver (Unbound) | + | |
| - | 3) Cloudflare (Anycast: worldwide) | + | |
| - | 4) Quad9 (Anycast: worldwide) | + | |
| - | 5) Quad9 uncensored (Anycast: worldwide) | + | |
| - | 6) FDN (France) | + | |
| - | 7) DNS.WATCH (Germany) | + | |
| - | 8) OpenDNS (Anycast: worldwide) | + | |
| - | 9) Google (Anycast: worldwide) | + | |
| - | 10) Yandex Basic (Russia) | + | |
| - | 11) AdGuard DNS (Anycast: worldwide) | + | |
| - | 12) NextDNS (Anycast: worldwide) | + | |
| - | 13) Custom | + | |
| - | DNS [1-12]: 1 | + | |
| - | Do you want to use compression? | + | [INFO] Generating client certificate... |
| - | Enable compression? | + | > ./easyrsa --batch build-client-full MichelleJanse nopass |
| + | [OK] Client MichelleJanse added and is valid for 3650 days. | ||
| + | > cp / | ||
| - | Do you want to customize encryption settings? | + | [OK] The configuration file has been written |
| - | Unless you know what you're doing, you should stick with the default parameters provided by the script. | + | [INFO] Download |
| - | Note that whatever you choose, all the choices presented | + | </code> |
| - | See https:// | + | |
| - | Customize encryption settings? [y/n]: n | + | En klaar is Kees. Oh nee: **klaar is de oudste dochter van Kees!!** |
| - | Okay, that was all I needed. We are ready to setup your OpenVPN server now. | + | ====== |
| - | You will be able to generate a client at the end of the installation. | + | |
| - | Press any key to continue... | + | |
| - | Geraakt:1 http:// | + | |
| - | Geraakt:2 http:// | + | |
| - | Ophalen:3 http:// | + | |
| - | 55,4 kB opgehaald in 0s (139 kB/s) | + | |
| - | Pakketlijsten worden ingelezen... Klaar | + | |
| - | Pakketlijsten worden ingelezen... Klaar | + | |
| - | Boom van vereisten wordt opgebouwd... Klaar | + | |
| - | De statusinformatie wordt gelezen... Klaar | + | |
| - | ca-certificates is reeds de nieuwste versie (20230311). | + | |
| - | gnupg is reeds de nieuwste versie (2.2.40-1.1). | + | |
| - | 0 opgewaardeerd, | + | |
| - | Pakketlijsten worden ingelezen... Klaar | + | |
| - | Boom van vereisten wordt opgebouwd... Klaar | + | |
| - | De statusinformatie wordt gelezen... Klaar | + | |
| - | openvpn is reeds de nieuwste versie (2.6.3-1+deb12u3). | + | |
| - | iptables is reeds de nieuwste versie (1.8.9-2). | + | |
| - | openssl is reeds de nieuwste versie (3.0.16-1~deb12u1). | + | |
| - | wget is reeds de nieuwste versie (1.21.3-1+deb12u1). | + | |
| - | ca-certificates is reeds de nieuwste versie (20230311). | + | |
| - | curl is reeds de nieuwste versie (7.88.1-10+deb12u12). | + | |
| - | 0 opgewaardeerd, | + | |
| - | --2025-05-26 22: | + | |
| - | Herleiden van github.com (github.com)... 140.82.121.4 | + | |
| - | Verbinding maken met github.com (github.com)|140.82.121.4|: | + | |
| - | HTTP-verzoek is verzonden; wachten op antwoord... 302 Found | + | |
| - | Locatie: https:// | + | |
| - | --2025-05-26 22: | + | |
| - | Herleiden van objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.110.133, | + | |
| - | Verbinding maken met objects.githubusercontent.com (objects.githubusercontent.com)|185.199.110.133|: | + | |
| - | HTTP-verzoek is verzonden; wachten op antwoord... 200 OK | + | |
| - | Lengte: 68984 (67K) [application/ | + | |
| - | Wordt opgeslagen als: ‘/ | + | |
| - | /root/easy-rsa.tgz | + | Nadat de functionaliteit erin zit mag er ook nog wel aan de veiligheid gedaan worden. Want Debian GNU/Linux is out-of-the-box wel aardig |
| - | 2025-05-26 22:09:41 (9,87 MB/s) - ' | + | ===== Lynis ===== |
| + | Een tooltje om de hardening van het systeem te scannen en met adviezen te komen. Geen daemon maar een check van mijn systeem: kan er qua veiligheid nog wat verbeterd worden? De versie in Debian GNU/Linux loopt achter dus een aparte repo toegevoegd, zoals beschreven op [[https:// | ||
| - | Notice | + | <code bash> |
| - | ------ | + | root@roer: |
| - | 'init-pki' complete; you may now create a CA or requests. | + | root@roer: |
| + | deb [arch=amd64, | ||
| + | </ | ||
| - | Your newly created PKI dir is: | + | Daarna een scan draaien: |
| - | * / | + | |
| - | * Using Easy-RSA configuration: /etc/ | + | <code bash> |
| + | root@roer:~# sudo lynis audit system | ||
| + | </code> | ||
| - | * The preferred location for ' | + | Een malware scanner had ik nog niet, dus..... |
| - | To silence this message move your ' | + | |
| - | or declare your ' | + | |
| - | * Using x509-types directory: / | + | ==== Extra packages ==== |
| + | <code bash> | ||
| + | root@roer: | ||
| + | </ | ||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | + | ==== Permissies ==== |
| - | * Using Easy-RSA configuration: | + | <code bash> |
| + | sudo chmod o-rwx /home/* | ||
| + | </code> | ||
| - | * The preferred location for ' | + | en in <code bash>/etc/login.defs< |
| - | To silence this message move your ' | + | |
| - | or declare your ' | + | |
| - | Using configuration from /etc/openvpn/easy-rsa/ | + | |
| - | ----- | + | |
| - | Notice | + | ==== Blacklist rare modules ==== |
| - | ------ | + | |
| - | CA creation complete and you may now import and sign cert requests. | + | |
| - | Your new CA certificate file for publishing is at: | + | |
| - | / | + | |
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | + | <code bash> |
| + | michelle@lummel:~$ sudo cat / | ||
| + | install dccp /bin/true | ||
| + | install sctp /bin/true | ||
| + | install rds /bin/true | ||
| + | install tipc /bin/true | ||
| + | </ | ||
| - | * Using Easy-RSA configuration: | + | ==== Purge restanten van packages ==== |
| - | * The preferred location for ' | + | Er slingeren soms nog configuratie-bestanden en andere cruft rond van packages die allang niet meer op het systeem staan. Die herken je in de output van `dpkg -l` doordat ze beginnen met rc. Mik deze weg: |
| - | To silence this message move your ' | + | |
| - | or declare your ' | + | |
| - | ----- | + | |
| - | Notice | + | <code bash> |
| - | ------ | + | michelle@roer: |
| - | Keypair and certificate request completed. Your files are: | + | libpython3.10-minimal: |
| - | req: / | + | |
| - | key: / | + | |
| - | Using configuration from / | + | |
| - | Check that the request matches the signature | + | |
| - | Signature ok | + | |
| - | The Subject' | + | |
| - | commonName | + | |
| - | Certificate is to be certified until May 24 20:09:42 2035 GMT (3650 days) | + | |
| - | + | ||
| - | Write out database with 1 new entries | + | |
| - | Database updated | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | Certificate created at: | + | |
| - | * / | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | Inline file created: | + | |
| - | * / | + | |
| - | + | ||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | + | |
| - | + | ||
| - | * Using Easy-RSA configuration: | + | |
| - | + | ||
| - | * The preferred location for ' | + | |
| - | To silence this message move your ' | + | |
| - | or declare your ' | + | |
| - | Using configuration from / | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | An updated CRL has been created. | + | |
| - | CRL file: / | + | |
| - | + | ||
| - | 2025-05-26 22:09:42 DEPRECATED OPTION: The option | + | |
| - | 2025-05-26 22:09:42 WARNING: Using --genkey | + | |
| - | * Applying / | + | |
| - | * Applying / | + | |
| - | * Applying / | + | |
| - | * Applying / | + | |
| - | * Applying / | + | |
| - | kernel.pid_max = 4194304 | + | |
| - | net.ipv4.ip_forward = 1 | + | |
| - | fs.protected_fifos = 1 | + | |
| - | fs.protected_hardlinks = 1 | + | |
| - | fs.protected_regular = 2 | + | |
| - | fs.protected_symlinks = 1 | + | |
| - | + | ||
| - | Tell me a name for the client. | + | |
| - | The name must consist of alphanumeric character. It may also include an underscore or a dash. | + | |
| - | Client name: MichelleJanse | + | |
| - | + | ||
| - | Do you want to protect the configuration file with a password? | + | |
| - | (e.g. encrypt the private key with a password) | + | |
| - | 1) Add a passwordless client | + | |
| - | 2) Use a password for the client | + | |
| - | Select an option [1-2]: 1 | + | |
| - | + | ||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | + | |
| - | + | ||
| - | * Using Easy-RSA configuration: | + | |
| - | + | ||
| - | * The preferred location for ' | + | |
| - | To silence this message move your ' | + | |
| - | or declare your ' | + | |
| - | ----- | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | Keypair and certificate request completed. Your files are: | + | |
| - | req: / | + | |
| - | key: / | + | |
| - | Using configuration from / | + | |
| - | Check that the request matches the signature | + | |
| - | Signature ok | + | |
| - | The Subject' | + | |
| - | commonName | + | |
| - | Certificate is to be certified until May 24 20:09:49 2035 GMT (3650 days) | + | |
| - | + | ||
| - | Write out database with 1 new entries | + | |
| - | Database updated | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | Certificate created at: | + | |
| - | * / | + | |
| - | + | ||
| - | Notice | + | |
| - | ------ | + | |
| - | Inline file created: | + | |
| - | * / | + | |
| - | Client MichelleJanse added. | + | |
| - | + | ||
| - | The configuration file has been written to / | + | |
| - | Download the .ovpn file and import it in your OpenVPN client. | + | |
| </ | </ | ||
| - | Vervolgens moet ik op mijn **Fritz!Box** wel deze **poort openen** natuurlijk! | + | ===== AppArmor ===== |
| - | Daarna nog wat eigen aanpassingen gedaan aan de server config: | + | |
| - | <code bash> | + | ** ToDo ** |
| - | michelle@roer: | + | |
| - | ##server 10.8.0.0 255.255.255.0 | + | |
| - | server 192.168.3.0 255.255.255.0 | + | |
| - | ##push " | + | |
| - | push "route 192.168.1.0 255.255.255.0" | + | |
| - | push " | + | |
| - | </ | + | |
| - | + | ||
| - | En klaar is Kees. Oh nee: **klaar is de oudste dochter van Kees!!** | + | |
technische_naslag/sid/roer.1748292455.txt.gz · Laatst gewijzigd: 2025/05/26 20:47 door michelle