Forum Debian Users Gang

Sun Jul 17 10:17:18 2011 OpenVPN 2.1_rc19 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jul 16 2009
Sun Jul 17 10:17:27 2011 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Sun Jul 17 10:17:27 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Jul 17 10:17:34 2011 LZO compression initialized
Sun Jul 17 10:17:34 2011 Attempting to establish TCP connection with xx.xx.xx.xx:7500
Sun Jul 17 10:17:34 2011 TCP connection established with xx.xx.xx.xx:7500
Sun Jul 17 10:17:34 2011 TCPv4_CLIENT link local: [undef]
Sun Jul 17 10:17:34 2011 TCPv4_CLIENT link remote: xx.xx.xx.xx:7500
Sun Jul 17 10:17:34 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sun Jul 17 10:17:34 2011 TLS Error: TLS object -> incoming plaintext read error
Sun Jul 17 10:17:34 2011 TLS Error: TLS handshake failed
Sun Jul 17 10:17:34 2011 Fatal TLS error (check_tls_errors_co), restarting
Sun Jul 17 10:17:34 2011 SIGUSR1[soft,tls-error] received, process restarting

Sun Jul 17 10:33:56 2011 OpenVPN 2.1_rc11 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] built on Sep 18 2008
Sun Jul 17 10:33:56 2011 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Sun Jul 17 10:33:56 2011 WARNING: the current --script-security setting may allow passwords to be passed to scripts via environmental variables
Sun Jul 17 10:33:56 2011 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-auth-pam.so '[/usr/lib/openvpn/openvpn-auth-pam.so] [common-auth]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Sun Jul 17 10:33:57 2011 Diffie-Hellman initialized with 1024 bit key
Sun Jul 17 10:33:57 2011 WARNING: file '/etc/ssl/private/newkey.pem' is group or others accessible
Sun Jul 17 10:33:57 2011 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Sun Jul 17 10:33:57 2011 TLS-Auth MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sun Jul 17 10:33:57 2011 ROUTE default_gateway=xxx.xxx.xxx.xxx
Sun Jul 17 10:33:57 2011 TUN/TAP device tun0 opened
Sun Jul 17 10:33:57 2011 TUN/TAP TX queue length set to 100
Sun Jul 17 10:33:57 2011 /sbin/ifconfig tun0 10.3.0.1 pointopoint 10.3.0.2 mtu 1500
Sun Jul 17 10:33:57 2011 /sbin/route add -net 10.3.0.0 netmask 255.255.255.0 gw 10.3.0.2
Sun Jul 17 10:33:57 2011 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 17 10:33:57 2011 GID set to nogroup
Sun Jul 17 10:33:57 2011 UID set to nobody
Sun Jul 17 10:33:57 2011 Listening for incoming TCP connection on 78.8.35.102:7500
Sun Jul 17 10:33:57 2011 Socket Buffers: R=[87380->131072] S=[16384->131072]
Sun Jul 17 10:33:57 2011 TCPv4_SERVER link local (bound): xxx.xxx.xxx.xxx:7500
Sun Jul 17 10:33:57 2011 TCPv4_SERVER link remote: [undef]
Sun Jul 17 10:33:57 2011 MULTI: multi_init called, r=256 v=256
Sun Jul 17 10:33:57 2011 IFCONFIG POOL: base=10.3.0.4 size=62
Sun Jul 17 10:33:57 2011 IFCONFIG POOL LIST
Sun Jul 17 10:33:57 2011 MULTI: TCP INIT maxclients=4 maxevents=8
Sun Jul 17 10:33:57 2011 Initialization Sequence Completed

Tworzenie własnego centrum certyfikacji PKI

./CA.pl -newca
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase: podaję hasło1
Verifying - Enter PEM pass phrase: hasło1
Country Name (2 letter code) [AU]:PL
State or Province Name (full name) [Some-State]:Dolnoslaskie
Locality Name (eg, city) []:Kamienna
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ISP
Organizational Unit Name (eg, section) []:ISP
Common Name (eg, YOUR name) []:ISP ROOT CA
Email Address []: admin@moja.domena

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: nie podaje hasła
An optional company name []:nie podaje hasła
Tworzenie certyfikatu serwera np. apacha, openvpn, exim.
Wywołujemy komendę:
./CA.pl -newreq-nodes

writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase: podaje hasło1
Verifying - Enter PEM pass phrase: podaje hasło1

Country Name (2 letter code) [AU]:PL
State or Province Name (full name) [Some-State]:Dolnoślaskie
Locality Name (eg, city) []:Kamienna
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ISP
Organizational Unit Name (eg, section) []:ISP
Common Name (eg, YOUR name) []:ISP ROOT CA
Email Address []:admin@moja.domena

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: nie podaje hasła
An optional company name []:nie podaje hasła


Podpisywanie  wyżej wygenerowanego certyfikatu serwera

wywołujemy komendę
./CA.pl -sign

[b]Po tym przekopiowałem certyfikaty z /usr/lib/ssl/misc do 
cert /etc/ssl/certs/newcert.pem   
key /etc/ssl/private/newkey.pem 
i w /usr/lib/ssl/misc je wykasowałem i zacząłem robic certy dla usera[/b]
3. Generowanie imiennego certyfikatu clienta np. dla openvpn, mail




Wywołujemy komendę:
./CA.pl -newreq



debian:/usr/lib/ssl/misc# ./CA.pl -newreq
Generating a 1024 bit RSA private key
...........++++++
...........................++++++
writing new private key to 'newkey.pem'
Enter PEM pass phrase: podaje hasło1
Verifying - Enter PEM pass phrase: podaje hasło1
-----

Country Name (2 letter code) [AU]:PL
State or Province Name (full name) [Some-State]:Dolnoslaskie
Locality Name (eg, city) []:Kamienna
Organization Name (eg, company) [Internet Widgits Pty Ltd]:ISP
Organizational Unit Name (eg, section) []:ISP
Common Name (eg, YOUR name) []:Jakub  --- taka sama nazwa jak w pliku userlist.txt
Email Address []: Jakub@moja.domena

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []: nie podaje hasła
An optional company name []: nie podaje hasła
Request is in newreq.pem, private key is in newkey.pem

Podpisujemy certyfikat clienta:

debian:/usr/lib/ssl/misc# ./CA.pl -sign