technische_naslag:sid:roer
Verschillen
Dit geeft de verschillen weer tussen de geselecteerde revisie en de huidige revisie van de pagina.
| Beide kanten vorige revisieVorige revisieVolgende revisie | Vorige revisie | ||
| technische_naslag:sid:roer [2025/06/01 20:10] – [Lynis] michelle | technische_naslag:sid:roer [2026/06/04 20:33] (huidige) – Layout verbeteringen michelle | ||
|---|---|---|---|
| Regel 1: | Regel 1: | ||
| - | ===== Introductie ===== | + | ====== Introductie |
| Al jaren draai ik thuis een servertje, vroeger was dat nogal uitgebreid met diverse netwerk-segmenten waarvoor 't ding router was en had ik mijn eigen mailserver en wat niet meer draaien. Tegenwoordig is het vooral een veredelde NAS, maar wel op een echte server die energiezuinig is met z'n SSD's en een echte distributie erop: | Al jaren draai ik thuis een servertje, vroeger was dat nogal uitgebreid met diverse netwerk-segmenten waarvoor 't ding router was en had ik mijn eigen mailserver en wat niet meer draaien. Tegenwoordig is het vooral een veredelde NAS, maar wel op een echte server die energiezuinig is met z'n SSD's en een echte distributie erop: | ||
| Regel 5: | Regel 5: | ||
| * Hardware: HP Proliant Microserver Gen10+ | * Hardware: HP Proliant Microserver Gen10+ | ||
| * Storage: 2x Western Digital Red 2TB SSD | * Storage: 2x Western Digital Red 2TB SSD | ||
| - | * OS: Debian GNU/ | + | * OS: Debian GNU/ |
| - | ===== Installatie en Configuratie ===== | + | ====== Installatie en Configuratie |
| - | ==== Webserver: Apache2 ==== | + | ===== Webserver: Apache2 |
| Met Let's Encrypt certificaat: | Met Let's Encrypt certificaat: | ||
| Regel 15: | Regel 15: | ||
| * [[https:// | * [[https:// | ||
| - | ==== OpenVPN ==== | + | ===== OpenVPN |
| + | |||
| + | ==== Installeer OpenVPN server | ||
| Hiervoor gebruik ik een handig scrippie: [[https:// | Hiervoor gebruik ik een handig scrippie: [[https:// | ||
| Regel 28: | Regel 30: | ||
| <code bash> | <code bash> | ||
| - | michelle@roer: | + | michelle@roer: |
| - | Welcome to the OpenVPN | + | [INFO] === OpenVPN Non-Interactive Install === |
| - | The git repository is available | + | [INFO] Running in non-interactive mode with the following settings: |
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] | ||
| + | [INFO] Setting up official | ||
| + | > apt-get update | ||
| + | > apt-get install -y ca-certificates curl | ||
| + | > mkdir -p / | ||
| + | > curl -fsSL https:// | ||
| + | [INFO] Updating package lists with new repository... | ||
| + | > apt-get update | ||
| + | [INFO] OpenVPN official repository configured | ||
| + | [INFO] Installing OpenVPN and dependencies... | ||
| + | > apt-get install -y openvpn iptables openssl curl ca-certificates tar dnsutils socat | ||
| + | [INFO] Data Channel Offload (DCO) is not available | ||
| + | > mkdir -p / | ||
| + | > curl -fL --retry 5 -o / | ||
| + | [INFO] Verifying Easy-RSA checksum... | ||
| + | > mkdir -p /etc/openvpn/ | ||
| + | > tar xzf / | ||
| + | > rm -f / | ||
| + | [INFO] Initializing PKI... | ||
| + | > ./easyrsa init-pki | ||
| + | [INFO] Building CA... | ||
| + | > ./easyrsa --batch --req-cn=cn_jPf4c13rKvpdCoX7 build-ca nopass | ||
| + | [INFO] Building server certificate... | ||
| + | > ./easyrsa --batch build-server-full server_JtWaiX0iDcYANtAt nopass | ||
| + | > ./easyrsa gen-crl | ||
| + | [INFO] Generating TLS key... | ||
| + | > openvpn --genkey tls-crypt-v2-server / | ||
| + | [INFO] Copying certificates... | ||
| + | > cp pki/ca.crt pki/ | ||
| + | > chmod 644 / | ||
| + | [INFO] Generating server configuration... | ||
| + | > mkdir -p / | ||
| + | > mkdir -p / | ||
| + | [INFO] Enabling IP forwarding... | ||
| + | > mkdir -p / | ||
| + | > sysctl --system | ||
| + | [INFO] Configuring OpenVPN service... | ||
| + | > cp / | ||
| + | > sed -i s|LimitNPROC|# | ||
| + | > sed -i / | ||
| + | > systemctl daemon-reload | ||
| + | > systemctl enable openvpn-server@server | ||
| + | > systemctl restart openvpn-server@server | ||
| + | [INFO] Configuring firewall rules... | ||
| + | > mkdir -p / | ||
| + | > chmod +x / | ||
| + | > chmod +x / | ||
| + | > systemctl daemon-reload | ||
| + | > systemctl enable iptables-openvpn | ||
| + | > systemctl start iptables-openvpn | ||
| + | [INFO] Creating client template... | ||
| + | [INFO] Generating first client certificate... | ||
| + | [INFO] Generating client certificate... | ||
| + | > ./easyrsa --batch build-client-full client nopass | ||
| + | [OK] Client client added and is valid for 3650 days. | ||
| + | > cp / | ||
| + | [OK] The configuration file has been written to / | ||
| + | [INFO] Download the .ovpn file and import it in your OpenVPN client. | ||
| + | [OK] If you want to add more clients, you simply need to run this script another time! | ||
| + | </ | ||
| - | I need to ask you a few questions before starting the setup. | + | ==== Open poort op Fritz!Box firewall ==== |
| - | You can leave the default options and just press enter if you are okay with them. | + | |
| - | I need to know the IPv4 address of the network interface you want OpenVPN listening to. | + | Vervolgens moet ik op mijn **Fritz!Box** wel deze **poort openen** natuurlijk! |
| - | Unless your server is behind NAT, it should be your public IPv4 address. | + | |
| - | IP address: 192.168.1.2 | + | |
| - | It seems this server is behind NAT. What is its public IPv4 address or hostname? | + | * Poortnummer: |
| - | We need it for the clients to connect to the server. | + | * Protocol: UDP |
| - | Public IPv4 address or hostname: roer.vlet.net | + | |
| - | Checking for IPv6 connectivity... | + | ==== Configureer OpenVPN server ==== |
| - | Your host appears to have IPv6 connectivity. | ||
| - | |||
| - | Do you want to enable IPv6 support (NAT)? [y/n]: n | ||
| - | |||
| - | What port do you want OpenVPN to listen to? | ||
| - | 1) Default: 1194 | ||
| - | 2) Custom | ||
| - | 3) Random [49152-65535] | ||
| - | Port choice [1-3]: 1 | ||
| - | |||
| - | What protocol do you want OpenVPN to use? | ||
| - | UDP is faster. Unless it is not available, you shouldn' | ||
| - | 1) UDP | ||
| - | 2) TCP | ||
| - | Protocol [1-2]: 1 | ||
| - | |||
| - | What DNS resolvers do you want to use with the VPN? | ||
| - | 1) Current system resolvers (from / | ||
| - | 2) Self-hosted DNS Resolver (Unbound) | ||
| - | 3) Cloudflare (Anycast: worldwide) | ||
| - | 4) Quad9 (Anycast: worldwide) | ||
| - | 5) Quad9 uncensored (Anycast: worldwide) | ||
| - | 6) FDN (France) | ||
| - | 7) DNS.WATCH (Germany) | ||
| - | 8) OpenDNS (Anycast: worldwide) | ||
| - | 9) Google (Anycast: worldwide) | ||
| - | 10) Yandex Basic (Russia) | ||
| - | 11) AdGuard DNS (Anycast: worldwide) | ||
| - | 12) NextDNS (Anycast: worldwide) | ||
| - | 13) Custom | ||
| - | DNS [1-12]: 1 | ||
| - | |||
| - | Do you want to use compression? | ||
| - | Enable compression? | ||
| - | |||
| - | Do you want to customize encryption settings? | ||
| - | Unless you know what you're doing, you should stick with the default parameters provided by the script. | ||
| - | Note that whatever you choose, all the choices presented in the script are safe (unlike OpenVPN' | ||
| - | See https:// | ||
| - | |||
| - | Customize encryption settings? [y/n]: n | ||
| - | |||
| - | Okay, that was all I needed. We are ready to setup your OpenVPN server now. | ||
| - | You will be able to generate a client at the end of the installation. | ||
| - | Press any key to continue... | ||
| - | Geraakt:1 http:// | ||
| - | Geraakt:2 http:// | ||
| - | Ophalen:3 http:// | ||
| - | 55,4 kB opgehaald in 0s (139 kB/ | ||
| - | Pakketlijsten worden ingelezen... Klaar | ||
| - | Pakketlijsten worden ingelezen... Klaar | ||
| - | Boom van vereisten wordt opgebouwd... Klaar | ||
| - | De statusinformatie wordt gelezen... Klaar | ||
| - | ca-certificates is reeds de nieuwste versie (20230311). | ||
| - | gnupg is reeds de nieuwste versie (2.2.40-1.1). | ||
| - | 0 opgewaardeerd, | ||
| - | Pakketlijsten worden ingelezen... Klaar | ||
| - | Boom van vereisten wordt opgebouwd... Klaar | ||
| - | De statusinformatie wordt gelezen... Klaar | ||
| - | openvpn is reeds de nieuwste versie (2.6.3-1+deb12u3). | ||
| - | iptables is reeds de nieuwste versie (1.8.9-2). | ||
| - | openssl is reeds de nieuwste versie (3.0.16-1~deb12u1). | ||
| - | wget is reeds de nieuwste versie (1.21.3-1+deb12u1). | ||
| - | ca-certificates is reeds de nieuwste versie (20230311). | ||
| - | curl is reeds de nieuwste versie (7.88.1-10+deb12u12). | ||
| - | 0 opgewaardeerd, | ||
| - | --2025-05-26 22: | ||
| - | Herleiden van github.com (github.com)... 140.82.121.4 | ||
| - | Verbinding maken met github.com (github.com)|140.82.121.4|: | ||
| - | HTTP-verzoek is verzonden; wachten op antwoord... 302 Found | ||
| - | Locatie: https:// | ||
| - | --2025-05-26 22: | ||
| - | Herleiden van objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.110.133, | ||
| - | Verbinding maken met objects.githubusercontent.com (objects.githubusercontent.com)|185.199.110.133|: | ||
| - | HTTP-verzoek is verzonden; wachten op antwoord... 200 OK | ||
| - | Lengte: 68984 (67K) [application/ | ||
| - | Wordt opgeslagen als: ‘/ | ||
| - | |||
| - | / | ||
| - | |||
| - | 2025-05-26 22:09:41 (9,87 MB/s) - ' | ||
| - | |||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | ' | ||
| - | |||
| - | Your newly created PKI dir is: | ||
| - | * / | ||
| - | |||
| - | * Using Easy-RSA configuration: | ||
| - | |||
| - | * The preferred location for ' | ||
| - | To silence this message move your ' | ||
| - | or declare your ' | ||
| - | |||
| - | * Using x509-types directory: / | ||
| - | |||
| - | |||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | ||
| - | |||
| - | * Using Easy-RSA configuration: | ||
| - | |||
| - | * The preferred location for ' | ||
| - | To silence this message move your ' | ||
| - | or declare your ' | ||
| - | Using configuration from / | ||
| - | ----- | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | CA creation complete and you may now import and sign cert requests. | ||
| - | Your new CA certificate file for publishing is at: | ||
| - | / | ||
| - | |||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | ||
| - | |||
| - | * Using Easy-RSA configuration: | ||
| - | |||
| - | * The preferred location for ' | ||
| - | To silence this message move your ' | ||
| - | or declare your ' | ||
| - | ----- | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Keypair and certificate request completed. Your files are: | ||
| - | req: / | ||
| - | key: / | ||
| - | Using configuration from / | ||
| - | Check that the request matches the signature | ||
| - | Signature ok | ||
| - | The Subject' | ||
| - | commonName | ||
| - | Certificate is to be certified until May 24 20:09:42 2035 GMT (3650 days) | ||
| - | |||
| - | Write out database with 1 new entries | ||
| - | Database updated | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Certificate created at: | ||
| - | * / | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Inline file created: | ||
| - | * / | ||
| - | |||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | ||
| - | |||
| - | * Using Easy-RSA configuration: | ||
| - | |||
| - | * The preferred location for ' | ||
| - | To silence this message move your ' | ||
| - | or declare your ' | ||
| - | Using configuration from / | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | An updated CRL has been created. | ||
| - | CRL file: / | ||
| - | |||
| - | 2025-05-26 22:09:42 DEPRECATED OPTION: The option --secret is deprecated. | ||
| - | 2025-05-26 22:09:42 WARNING: Using --genkey --secret filename is DEPRECATED. | ||
| - | * Applying / | ||
| - | * Applying / | ||
| - | * Applying / | ||
| - | * Applying / | ||
| - | * Applying / | ||
| - | kernel.pid_max = 4194304 | ||
| - | net.ipv4.ip_forward = 1 | ||
| - | fs.protected_fifos = 1 | ||
| - | fs.protected_hardlinks = 1 | ||
| - | fs.protected_regular = 2 | ||
| - | fs.protected_symlinks = 1 | ||
| - | |||
| - | Tell me a name for the client. | ||
| - | The name must consist of alphanumeric character. It may also include an underscore or a dash. | ||
| - | Client name: MichelleJanse | ||
| - | |||
| - | Do you want to protect the configuration file with a password? | ||
| - | (e.g. encrypt the private key with a password) | ||
| - | 1) Add a passwordless client | ||
| - | 2) Use a password for the client | ||
| - | Select an option [1-2]: 1 | ||
| - | |||
| - | * Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025) | ||
| - | |||
| - | * Using Easy-RSA configuration: | ||
| - | |||
| - | * The preferred location for ' | ||
| - | To silence this message move your ' | ||
| - | or declare your ' | ||
| - | ----- | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Keypair and certificate request completed. Your files are: | ||
| - | req: / | ||
| - | key: / | ||
| - | Using configuration from / | ||
| - | Check that the request matches the signature | ||
| - | Signature ok | ||
| - | The Subject' | ||
| - | commonName | ||
| - | Certificate is to be certified until May 24 20:09:49 2035 GMT (3650 days) | ||
| - | |||
| - | Write out database with 1 new entries | ||
| - | Database updated | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Certificate created at: | ||
| - | * / | ||
| - | |||
| - | Notice | ||
| - | ------ | ||
| - | Inline file created: | ||
| - | * / | ||
| - | Client MichelleJanse added. | ||
| - | |||
| - | The configuration file has been written to / | ||
| - | Download the .ovpn file and import it in your OpenVPN client. | ||
| - | </ | ||
| - | |||
| - | Vervolgens moet ik op mijn **Fritz!Box** wel deze **poort openen** natuurlijk! | ||
| Daarna nog wat eigen aanpassingen gedaan aan de server config: | Daarna nog wat eigen aanpassingen gedaan aan de server config: | ||
| Regel 281: | Regel 125: | ||
| push "route 192.168.1.0 255.255.255.0" | push "route 192.168.1.0 255.255.255.0" | ||
| ##push " | ##push " | ||
| + | </ | ||
| + | |||
| + | ==== Maak OpenVPN client config ==== | ||
| + | |||
| + | <code bash> | ||
| + | michelle@roer: | ||
| + | |||
| + | === New Client Setup === | ||
| + | |||
| + | [INFO] Generating client certificate... | ||
| + | > ./easyrsa --batch build-client-full MichelleJanse nopass | ||
| + | [OK] Client MichelleJanse added and is valid for 3650 days. | ||
| + | > cp / | ||
| + | |||
| + | [OK] The configuration file has been written to / | ||
| + | [INFO] Download the .ovpn file and import it in your OpenVPN client. | ||
| </ | </ | ||
| En klaar is Kees. Oh nee: **klaar is de oudste dochter van Kees!!** | En klaar is Kees. Oh nee: **klaar is de oudste dochter van Kees!!** | ||
| - | ===== Hardening ===== | + | ====== Hardening |
| Nadat de functionaliteit erin zit mag er ook nog wel aan de veiligheid gedaan worden. Want Debian GNU/Linux is out-of-the-box wel aardig in elkaar gestoken maar het kan nog altijd beter! | Nadat de functionaliteit erin zit mag er ook nog wel aan de veiligheid gedaan worden. Want Debian GNU/Linux is out-of-the-box wel aardig in elkaar gestoken maar het kan nog altijd beter! | ||
| - | ==== Lynis ==== | + | ===== Lynis ===== |
| Een tooltje om de hardening van het systeem te scannen en met adviezen te komen. Geen daemon maar een check van mijn systeem: kan er qua veiligheid nog wat verbeterd worden? De versie in Debian GNU/Linux loopt achter dus een aparte repo toegevoegd, zoals beschreven op [[https:// | Een tooltje om de hardening van het systeem te scannen en met adviezen te komen. Geen daemon maar een check van mijn systeem: kan er qua veiligheid nog wat verbeterd worden? De versie in Debian GNU/Linux loopt achter dus een aparte repo toegevoegd, zoals beschreven op [[https:// | ||
| Regel 307: | Regel 167: | ||
| Een malware scanner had ik nog niet, dus..... | Een malware scanner had ik nog niet, dus..... | ||
| - | === Extra packages === | + | ==== Extra packages |
| <code bash> | <code bash> | ||
| Regel 313: | Regel 173: | ||
| </ | </ | ||
| - | === Permissies === | + | ==== Permissies |
| <code bash> | <code bash> | ||
| Regel 321: | Regel 181: | ||
| en in <code bash>/ | en in <code bash>/ | ||
| - | === Blacklist rare modules === | + | ==== Blacklist rare modules |
| <code bash> | <code bash> | ||
| Regel 331: | Regel 191: | ||
| </ | </ | ||
| - | === Purge restanten van packages === | + | ==== Purge restanten van packages |
| Er slingeren soms nog configuratie-bestanden en andere cruft rond van packages die allang niet meer op het systeem staan. Die herken je in de output van `dpkg -l` doordat ze beginnen met rc. Mik deze weg: | Er slingeren soms nog configuratie-bestanden en andere cruft rond van packages die allang niet meer op het systeem staan. Die herken je in de output van `dpkg -l` doordat ze beginnen met rc. Mik deze weg: | ||
| Regel 338: | Regel 198: | ||
| michelle@roer: | michelle@roer: | ||
| libpython3.10-minimal: | libpython3.10-minimal: | ||
| - | ==== AppArmor ==== | + | </ |
| + | |||
| + | ===== AppArmor | ||
| ** ToDo ** | ** ToDo ** | ||
technische_naslag/sid/roer.1748808647.txt.gz · Laatst gewijzigd: 2025/06/01 20:10 door michelle