DokuWiki van Michelle

Deze pagina is alleen-lezen. Je kan de broncode bekijken maar niet veranderen. Neem contact op met de beheerder als je denkt dat dit niet klopt.
===== Introductie =====

Al jaren draai ik thuis een servertje, vroeger was dat nogal uitgebreid met diverse netwerk-segmenten waarvoor 't ding router was en had ik mijn eigen mailserver en wat niet meer draaien. Tegenwoordig is het vooral een veredelde NAS, maar wel op een echte server die energiezuinig is met z'n SSD's en een echte distributie erop:

  * Hardware: HP Proliant Microserver Gen10+
  * Storage: 2x Western Digital Red 2TB SSD
  * OS: Debian GNU/Linux 12 ("bookworm")

===== Installatie en Configuratie =====

==== Webserver: Apache2 ====

Met Let's Encrypt certificaat:

  * [[https://www.server-world.info/en/note?os=Debian_12&p=ssl&f=2|ServerWorld.info Let's Encrypt HowTo]]

==== OpenVPN ====

Hiervoor gebruik ik een handig scrippie: [[https://github.com/angristan/openvpn-install]]
Download het geval en maak het executable:

<code bash>
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh
</code>

Voer het uit en gebruik het meest de defaults:

<code bash>
michelle@roer:~/bin$ sudo ./openvpn-install.sh 
Welcome to the OpenVPN installer!
The git repository is available at: https://github.com/angristan/openvpn-install

I need to ask you a few questions before starting the setup.
You can leave the default options and just press enter if you are okay with them.

I need to know the IPv4 address of the network interface you want OpenVPN listening to.
Unless your server is behind NAT, it should be your public IPv4 address.
IP address: 192.168.1.2

It seems this server is behind NAT. What is its public IPv4 address or hostname?
We need it for the clients to connect to the server.
Public IPv4 address or hostname: roer.vlet.net

Checking for IPv6 connectivity...

Your host appears to have IPv6 connectivity.

Do you want to enable IPv6 support (NAT)? [y/n]: n

What port do you want OpenVPN to listen to?
   1) Default: 1194
   2) Custom
   3) Random [49152-65535]
Port choice [1-3]: 1

What protocol do you want OpenVPN to use?
UDP is faster. Unless it is not available, you shouldn't use TCP.
   1) UDP
   2) TCP
Protocol [1-2]: 1

What DNS resolvers do you want to use with the VPN?
   1) Current system resolvers (from /etc/resolv.conf)
   2) Self-hosted DNS Resolver (Unbound)
   3) Cloudflare (Anycast: worldwide)
   4) Quad9 (Anycast: worldwide)
   5) Quad9 uncensored (Anycast: worldwide)
   6) FDN (France)
   7) DNS.WATCH (Germany)
   8) OpenDNS (Anycast: worldwide)
   9) Google (Anycast: worldwide)
   10) Yandex Basic (Russia)
   11) AdGuard DNS (Anycast: worldwide)
   12) NextDNS (Anycast: worldwide)
   13) Custom
DNS [1-12]: 1

Do you want to use compression? It is not recommended since the VORACLE attack makes use of it.
Enable compression? [y/n]: n

Do you want to customize encryption settings?
Unless you know what you're doing, you should stick with the default parameters provided by the script.
Note that whatever you choose, all the choices presented in the script are safe (unlike OpenVPN's defaults).
See https://github.com/angristan/openvpn-install#security-and-encryption to learn more.

Customize encryption settings? [y/n]: n

Okay, that was all I needed. We are ready to setup your OpenVPN server now.
You will be able to generate a client at the end of the installation.
Press any key to continue...
Geraakt:1 http://security.debian.org/debian-security bookworm-security InRelease
Geraakt:2 http://ftp.nl.debian.org/debian bookworm InRelease
Ophalen:3 http://ftp.nl.debian.org/debian bookworm-updates InRelease [55,4 kB]
55,4 kB opgehaald in 0s (139 kB/s)  
Pakketlijsten worden ingelezen... Klaar
Pakketlijsten worden ingelezen... Klaar
Boom van vereisten wordt opgebouwd... Klaar
De statusinformatie wordt gelezen... Klaar 
ca-certificates is reeds de nieuwste versie (20230311).
gnupg is reeds de nieuwste versie (2.2.40-1.1).
0 opgewaardeerd, 0 nieuw geïnstalleerd, 0 te verwijderen en 0 niet opgewaardeerd.
Pakketlijsten worden ingelezen... Klaar
Boom van vereisten wordt opgebouwd... Klaar
De statusinformatie wordt gelezen... Klaar 
openvpn is reeds de nieuwste versie (2.6.3-1+deb12u3).
iptables is reeds de nieuwste versie (1.8.9-2).
openssl is reeds de nieuwste versie (3.0.16-1~deb12u1).
wget is reeds de nieuwste versie (1.21.3-1+deb12u1).
ca-certificates is reeds de nieuwste versie (20230311).
curl is reeds de nieuwste versie (7.88.1-10+deb12u12).
0 opgewaardeerd, 0 nieuw geïnstalleerd, 0 te verwijderen en 0 niet opgewaardeerd.
--2025-05-26 22:09:40--  https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.2/EasyRSA-3.1.2.tgz
Herleiden van github.com (github.com)... 140.82.121.4
Verbinding maken met github.com (github.com)|140.82.121.4|:443... verbonden.
HTTP-verzoek is verzonden; wachten op antwoord... 302 Found
Locatie: https://objects.githubusercontent.com/github-production-release-asset-2e65be/4519663/c2688102-7cd5-4fcc-b272-083d48dc4b4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250526%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250526T200941Z&X-Amz-Expires=300&X-Amz-Signature=2485ac5c7a4789394eb9bd7092f8622c6a59beb13bd29efc075083ec0373cd05&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.1.2.tgz&response-content-type=application%2Foctet-stream [volgen...]
--2025-05-26 22:09:41--  https://objects.githubusercontent.com/github-production-release-asset-2e65be/4519663/c2688102-7cd5-4fcc-b272-083d48dc4b4d?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20250526%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250526T200941Z&X-Amz-Expires=300&X-Amz-Signature=2485ac5c7a4789394eb9bd7092f8622c6a59beb13bd29efc075083ec0373cd05&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3DEasyRSA-3.1.2.tgz&response-content-type=application%2Foctet-stream
Herleiden van objects.githubusercontent.com (objects.githubusercontent.com)... 185.199.110.133, 185.199.109.133, 185.199.111.133, ...
Verbinding maken met objects.githubusercontent.com (objects.githubusercontent.com)|185.199.110.133|:443... verbonden.
HTTP-verzoek is verzonden; wachten op antwoord... 200 OK
Lengte: 68984 (67K) [application/octet-stream]
Wordt opgeslagen als: ‘/root/easy-rsa.tgz’

/root/easy-rsa.tgz                                         100%[========================================================================================================================================>]  67,37K  --.-KB/s    in 0,007s  

2025-05-26 22:09:41 (9,87 MB/s) - '‘/root/easy-rsa.tgz’' opgeslagen [68984/68984]


Notice
------
'init-pki' complete; you may now create a CA or requests.

Your newly created PKI dir is:
* /etc/openvpn/easy-rsa/pki

* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>

* Using x509-types directory: /etc/openvpn/easy-rsa/x509-types


* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)

* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>
Using configuration from /etc/openvpn/easy-rsa/pki/7ba6cb44/temp.c2cc7acf
-----

Notice
------
CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/easy-rsa/pki/ca.crt

* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)

* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>
-----

Notice
------
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/server_iNB2fzeo5oCSxH4c.req
key: /etc/openvpn/easy-rsa/pki/private/server_iNB2fzeo5oCSxH4c.key
Using configuration from /etc/openvpn/easy-rsa/pki/0fd6f457/temp.608d26c2
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'server_iNB2fzeo5oCSxH4c'
Certificate is to be certified until May 24 20:09:42 2035 GMT (3650 days)

Write out database with 1 new entries
Database updated

Notice
------
Certificate created at:
* /etc/openvpn/easy-rsa/pki/issued/server_iNB2fzeo5oCSxH4c.crt

Notice
------
Inline file created:
* /etc/openvpn/easy-rsa/pki/inline/server_iNB2fzeo5oCSxH4c.inline

* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)

* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>
Using configuration from /etc/openvpn/easy-rsa/pki/1c28e610/temp.e551f6fb

Notice
------
An updated CRL has been created.
CRL file: /etc/openvpn/easy-rsa/pki/crl.pem

2025-05-26 22:09:42 DEPRECATED OPTION: The option --secret is deprecated.
2025-05-26 22:09:42 WARNING: Using --genkey --secret filename is DEPRECATED.  Use --genkey secret filename instead.
* Applying /usr/lib/sysctl.d/50-pid-max.conf ...
* Applying /etc/sysctl.d/99-openvpn.conf ...
* Applying /usr/lib/sysctl.d/99-protect-links.conf ...
* Applying /etc/sysctl.d/99-sysctl.conf ...
* Applying /etc/sysctl.conf ...
kernel.pid_max = 4194304
net.ipv4.ip_forward = 1
fs.protected_fifos = 1
fs.protected_hardlinks = 1
fs.protected_regular = 2
fs.protected_symlinks = 1

Tell me a name for the client.
The name must consist of alphanumeric character. It may also include an underscore or a dash.
Client name: MichelleJanse

Do you want to protect the configuration file with a password?
(e.g. encrypt the private key with a password)
   1) Add a passwordless client
   2) Use a password for the client
Select an option [1-2]: 1

* Using SSL: openssl OpenSSL 3.0.16 11 Feb 2025 (Library: OpenSSL 3.0.16 11 Feb 2025)

* Using Easy-RSA configuration: /etc/openvpn/easy-rsa/vars

* The preferred location for 'vars' is within the PKI folder.
  To silence this message move your 'vars' file to your PKI
  or declare your 'vars' file with option: --vars=<FILE>
-----

Notice
------
Keypair and certificate request completed. Your files are:
req: /etc/openvpn/easy-rsa/pki/reqs/MichelleJanse.req
key: /etc/openvpn/easy-rsa/pki/private/MichelleJanse.key
Using configuration from /etc/openvpn/easy-rsa/pki/10e4606a/temp.942d459c
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'MichelleJanse'
Certificate is to be certified until May 24 20:09:49 2035 GMT (3650 days)

Write out database with 1 new entries
Database updated

Notice
------
Certificate created at:
* /etc/openvpn/easy-rsa/pki/issued/MichelleJanse.crt

Notice
------
Inline file created:
* /etc/openvpn/easy-rsa/pki/inline/MichelleJanse.inline
Client MichelleJanse added.

The configuration file has been written to /home/michelle/MichelleJanse.ovpn.
Download the .ovpn file and import it in your OpenVPN client.
</code>

Vervolgens moet ik op mijn **Fritz!Box** wel deze **poort openen** natuurlijk!
Daarna nog wat eigen aanpassingen gedaan aan de server config:

<code bash>
michelle@roer:~$ sudo egrep '^server|^push|^\#\#' /etc/openvpn/server.conf
##server 10.8.0.0 255.255.255.0
server 192.168.3.0 255.255.255.0
push "dhcp-option DNS 192.168.1.1"
push "route 192.168.1.0 255.255.255.0"
##push "redirect-gateway def1 bypass-dhcp"
</code>

En klaar is Kees. Oh nee: **klaar is de oudste dochter van Kees!!**

===== Hardening =====

Nadat de functionaliteit erin zit mag er ook nog wel aan de veiligheid gedaan worden. Want Debian GNU/Linux is out-of-the-box wel aardig in elkaar gestoken maar het kan nog altijd beter!

==== Lynis ====

Een tooltje om de hardening van het systeem te scannen en met adviezen te komen. Geen daemon maar een check van mijn systeem: kan er qua veiligheid nog wat verbeterd worden? De versie in Debian GNU/Linux loopt achter dus een aparte repo toegevoegd, zoals beschreven op [[https://packages.cisofy.com/community/]]

<code bash>
root@roer:~# curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cisofy-software-public.gpg
root@roer:~# echo "deb [arch=amd64,arm64 signed-by=/etc/apt/trusted.gpg.d/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list
deb [arch=amd64,arm64 signed-by=/etc/apt/trusted.gpg.d/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main
</code>

Daarna een scan draaien:

<code bash>
root@roer:~# sudo lynis audit system
</code>

Een malware scanner had ik nog niet, dus.....

=== Extra packages ===

<code bash>
root@roer:~# sudo apt install rkhunter apt-show-versions debsums
</code>

=== Permissies ===

<code bash>
sudo chmod o-rwx /home/*
</code>

en in <code bash>/etc/login.defs</code> de UMASK op 027 gezet.

=== Blacklist rare modules ===

<code bash>
michelle@lummel:~$ sudo cat /etc/modprobe.d/lynis-blacklist.conf
install dccp /bin/true
install sctp /bin/true
install rds /bin/true
install tipc /bin/true
</code>

=== Purge restanten van packages ===

Er slingeren soms nog configuratie-bestanden en andere cruft rond van packages die allang niet meer op het systeem staan. Die herken je in de output van `dpkg -l` doordat ze beginnen met rc. Mik deze weg:

<code bash>
michelle@roer:~$ dpkg -l | grep ^rc | awk '{ print $2 }' | xargs echo " "
  libpython3.10-minimal:amd64 linux-image-6.0.0-5-amd64 linux-image-6.0.0-6-amd64 linux-image-6.1.0-1-amd64 linux-image-6.1.0-10-amd64 linux-image-6.1.0-11-amd64 linux-image-6.1.0-12-amd64 linux-image-6.1.0-13-amd64 linux-image-6.1.0-14-amd64 linux-image-6.1.0-15-amd64 linux-image-6.1.0-16-amd64 linux-image-6.1.0-17-amd64 linux-image-6.1.0-18-amd64 linux-image-6.1.0-2-amd64 linux-image-6.1.0-20-amd64 linux-image-6.1.0-21-amd64 linux-image-6.1.0-22-amd64 linux-image-6.1.0-23-amd64 linux-image-6.1.0-25-amd64 linux-image-6.1.0-26-amd64 linux-image-6.1.0-27-amd64 linux-image-6.1.0-28-amd64 linux-image-6.1.0-29-amd64 linux-image-6.1.0-3-amd64 linux-image-6.1.0-30-amd64 linux-image-6.1.0-31-amd64 linux-image-6.1.0-32-amd64 linux-image-6.1.0-33-amd64 linux-image-6.1.0-34-amd64 linux-image-6.1.0-5-amd64 linux-image-6.1.0-6-amd64 linux-image-6.1.0-7-amd64 linux-image-6.1.0-9-amd64 python3.10-minimal
  </code>
==== AppArmor ====

** ToDo **