瑞豪开源官方博客 /

cd /usr/local/lxlabs/kloxo/httpdocs/lang/
wget dl.rashost.com/kloxo-cn.tar.gz
tar zxf kloxo-cn.tar.gz
chown -R lxlabs: cn

error_reporting  =  E_ALL | E_NOTICE
display_errors = On
log_errors = On
error_log = /var/log/httpd/php.log

CentOS 5 下 OpenVPN 和 Windows 下 OpenVPN GUI 安装笔记

Posted by zuzhihui in vps技术 on 2009/05/08 with 1 Comment

此笔记,基于 “程序员小辉”的安装笔记修改 ——————————————————————————————————————–

一. OpenVPN 安装环境

Server 端的环境

1. CentOS, kernel版本: 2.6.18, IP 为 221.233.59.16(ADSL拨号)
2. kernel 需要支持 tun 设备, 需要加载 iptables 模块.
3. 安装的 OpenVPN 的版本: 2.1.rc15.(目前最新版 可在http://openvpn.net 上下载).

Client 端的环境:

1. Windows XP SP2
2. openvpn-2.1_rc15-install.exe(此版本集成了 OpenVPN GUI 客户端)

二. OpenVPN 服务端安装过程

1. 用putty登录到CentOS
2. 下载LZO和OpenVPN 2.1.rc15

wget http://www.oberhumer.com/opensource/lzo/download/lzo-2.03.tar.gz
wget http://openvpn.net/release/openvpn-2.1_rc15.tar.gz

yum install -y openssl-devel

1. 安装LZO和OpenVPN

tar zxvf lzo-2.03.tar.gz
cd lzo-2.03
./configure
make
make install
cd ..
tar zxvf openvpn-2.1_rc15.tar.gz
cd openvpn-2.1_rc15
./configure
make
make install
cd ..
cp /root/openvpn-2.1_rc15/easy-rsa/ -r /etc/openvpn

1. 生成证书

初始化PKI

cd /etc/openvpn/2.0/#可以设置下OpenVPN参数(也可以修改vars文件来配置)
export D=`pwd`
export KEY_CONFIG=$D/openssl.cnf
export KEY_DIR=$D/keys
export KEY_SIZE=1024
export KEY_COUNTRY=CN
export KEY_PROVINCE=GD
export KEY_CITY=SZ
export KEY_ORG="dvdmaster"
export KEY_EMAIL="support@cooldvd.com"
#也可以不用设置直接执行下面的命令
. vars

创建证书颁发机构(CA)

./clean-all
./build-ca

Generating a 1024 bit RSA private key
................      
........      
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server
Email Address [support@cooldvd.com]:

建立server key

./build-key-server server

Generating a 1024 bit RSA private key
......      
....................      
writing new private key to 'server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:server
Email Address [support@cooldvd.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /etc/openvpn/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           ::'CN'
stateOrProvinceName   ::'GD'
localityName          ::'SZ'
organizationName      ::'dvdmaster'
organizationalUnitName::'dvdmaster'
commonName            ::'server'
emailAddress          ::'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:15:31 2016 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

生成客户端 key

./build-key client1
Generating a 1024 bit RSA private key
.....      
......      
writing new private key to 'client1.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [CN]:
State or Province Name (full name) [GD]:
Locality Name (eg, city) [SZ]:
Organization Name (eg, company) [dvdmaster]:
Organizational Unit Name (eg, section) []:dvdmaster
Common Name (eg, your name or your server's hostname) []:client1 #重要: 每个不同的client 生成的证书, 名字必须不同.
Email Address [support@cooldvd.com]:

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:abcd1234
An optional company name []:dvdmaster
Using configuration from /etc/openvpn/2.0/openssl.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           ::'CN'
stateOrProvinceName   ::'GD'
localityName          ::'SZ'
organizationName      ::'dvdmaster'
organizationalUnitName::'dvdmaster'
commonName            ::'client1'
emailAddress          ::'support@cooldvd.com'
Certificate is to be certified until Mar 19 08:22:00 2016 GMT (3650 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

以此类推建立其他客户端 key

./build-key client2
./build-key client3

注意在进入 Common Name (eg, your name or your server’s hostname) []: 的输入时, 每个证书输入的名字必须不同.

• 生成Diffie Hellman参数

./build-dh

• 将 keys 下的所有文件打包下载到本地(可以通过winscp,http,ftp等等……)

tar zcvf yskeys.tar.gz keys/

• 创建服务端配置文件

mkdir /etc/openvpn/2.0/conf
cp /root/openvpn-2.1_rc15/sample-config-files/server.conf /etc/openvpn/2.0/conf/server.conf

服务端配置文件(server.conf)样例

port 1194

proto udp

dev tun

ca /etc/openvpn/2.0/keys/ca.crt
cert /etc/openvpn/2.0/keys/ovpnser.crt
key /etc/openvpn/2.0/keys/ovpnser.key  # This file should be kept secret

dh /etc/openvpn/2.0/keys/dh1024.pem

server 10.8.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

push "redirect-gateway def1 bypass-dhcp"

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 202.103.44.150" #客户端获得的DNS地址
push "dhcp-option DNS 202.103.24.68" #客户端获得的DNS地址

client-to-client

keepalive 10 120

comp-lzo

user nobody
group nobody

persist-key
persist-tun

status openvpn-status.log

verb 3

• 启动OpenVPN

/usr/local/sbin/openvpn --config /etc/openvpn/2.0/conf/server.conf &

三. OpenVPN GUI For Windows 客户端安装过程

1. 下载 openvpn-2.1_rc15-install.exe(此版本集成 OpenVPN  GUI)

官方下载地址:http://openvpn.net/release/openvpn-2.1_rc15-install.exe

• 依屏幕指示安装OpenVPN GUI
• 配置 openvpn gui

将上面第6步打包的yskeys.tar.gz中的下列证书文件解压到 你的OpenVPN GUI安装路径\OpenVPN\config文件夹下

ca.crt
ca.key
client1.crt
client1.csr
client1.key

• 修改client.ovpn

把你的OpenVPN GUI安装路径\OpenVPN\sample-config下的client.ovpn文件复制到你的OpenVPN GUI安装路径\OpenVPN\config文件夹下,用记事本打开client.ovpn

#找到remote my-server-1 1194,把my-server-1改成你的ip地址
remote 221.233.59.16 1194

• 双击 client.ovpn 即可启动 openvpn, 或者通过 OpenVPN GUI 的控制启动 VPN.

三. OpenVPN 访问外网的设置

1. 开启CentOS 5 的路由转发功能

echo 1 > /proc/sys/net/ipv4/ip_forward
#为了使CentOS重启后仍然开启路由转发功能我们需要再执行下列命令
sysctl -w net.ipv4.ip_forward=1

1. 添加iptables转发规则

#因为我那天CentOS是ADSL拨号上网,所以把出口设置成ppp0,请根据实际情况设置
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o ppp0 -j MASQUERADE

1. 必须保证server.conf配置中,有下面三个配置

push "dhcp-option DNS 10.8.0.1"
push "dhcp-option DNS 202.103.44.150" #客户端获得的DNS地址
push "dhcp-option DNS 202.103.24.68" #客户端获得的DNS地址

当 client 连接成功后, 在 cmd 下执行 ipconfig /all, 应该有这类似这样的输出:

Ethernet adapter 本地连接 2:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : TAP-Win32 Adapter V9
        Physical Address. . . . . . . . . : 00-FF-F2-1A-44-BD
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . : 10.8.0.6
        Subnet Mask . . . . . . . . . . . : 255.255.255.252
        Default Gateway . . . . . . . . . : 10.8.0.5
        DHCP Server . . . . . . . . . . . : 10.8.0.5
        DNS Servers . . . . . . . . . . . : 10.8.0.1
                                            202.103.44.150
                                            202.103.24.68
        Lease Obtained. . . . . . . . . . : 2009年5月8日 23:55:06
        Lease Expires . . . . . . . . . . : 2010年5月8日 23:55:06

四. 设置 OpenVPN 服务器 reboot后自动启动 openvpn

执行

vi /etc/rc.local

然后在最后面加入此行:

/usr/local/sbin/openvpn --config /etc/openvpn/2.0/conf/server.conf &

五.OpenVPN 测试

连接成功之后,去ip138.com上看看外网ip是多少,如果是CentOS系统的外网ip那说明测试成功了~

apt-get install make gcc apache2-prefork-dev

make
make install

ExtendedStatus On
　< IfModule mod_limitipconn.c >
　　    < Location / > # 所有虚拟主机的/目录
　　　　　　MaxConnPerIP 3         # 每IP只允许3个并发连接
　　    < /Location >
　　< /IfModule >

wget http://nchc.dl.sourceforge.net/sourceforge/awstats/awstats-6.9.tar.gz

tar zxvf awstats-6.9.tar.gz

mv awstats-6.9/  /usr/local/

cd /usr/local/awstats-6.9/tools/

perl awstats_configure.pl

-----> Running OS detected: Linux, BSD or Unix

Warning: AWStats standard directory on Linux OS is '/usr/local/awstats'.

If you want to use standard directory, you should first move all content

of AWStats distribution from current directory:

/usr/local/awstats-6.9

to standard directory:

/usr/local/awstats

And then, run configure.pl from this location.

Do you want to continue setup from this NON standard directory [yN] ?

y

-----> Check for web server install

Enter full config file path of your Web server.

Example: /etc/httpd/httpd.conf

Example: /usr/local/apache2/conf/httpd.conf

Example: c:\Program files\apache group\apache\conf\httpd.conf

Config file path ('none' to skip web server setup):

>none

-----> Need to create a new config file ?

Do you want me to build a new AWStats config/profile

file (required if first install) [y/N] ?

y

-----> Define config file name to create
What is the name of your web site or profile analysis ?
Example: www.mysite.com
Example: demo
Your web site, virtual server or profile name:
>test.com

-----> Define config file path
In which directory do you plan to store your config file(s) ?
Default: /etc/awstats
Directory path to store config file(s) (Enter for default):
>Enter(安默认的，配置文件保存在/etc/awstats)

mkdir /var/lib/awstats/
/usr/local/awstats-6.9/wwwroot/cgi-bin/awstats.pl -config=test.com -update

        ScriptAlias /cgi-bin/ /usr/local/awstats-6.9/wwwroot/cgi-bin/

                AllowOverride None
                Options  ExecCGI -MultiViews  SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all

 wget http://www.cpan.org/modules/by-module/FCGI/FCGI-0.67.tar.gz
tar -zxvf FCGI-0.67.tar.gz
cd FCGI-0.67
perl Makefile.PL
make && make install

 wget http://search.cpan.org/CPAN/authors/id/G/GB/GBJK/FCGI-ProcManager-0.18.tar.gz
tar -xzxf FCGI-ProcManager-0.18.tar.gz
cd FCGI-ProcManager-0.18
perl Makefile.PL
make
make install

vi fcgi_perl

#!/usr/bin/perl -w
use FCGI;
use Socket;
use FCGI::ProcManager;
sub shutdown { FCGI::CloseSocket($socket); exit; }
sub restart { FCGI::CloseSocket($socket); &main; }
use sigtrap 'handler', \&shutdown, 'normal-signals';
use sigtrap 'handler', \&restart, 'HUP';
require 'syscall.ph';
use POSIX qw(setsid);

#&daemonize; we don't daemonize when running under runsv
#this keeps the program alive or something after exec'ing perl scripts
END() { }
BEGIN() { }
{
no warnings;
*CORE::GLOBAL::exit = sub { die "fakeexit\nrc=" . shift() . "\n"; };
};
eval q{exit};
if ($@) {
exit unless $@ =~ /^fakeexit/;
}
&main;

sub daemonize() {
chdir '/' or die "Can't chdir to /: $!";
defined( my $pid = fork ) or die "Can't fork: $!";
exit if $pid;
setsid() or die "Can't start a new session: $!";
umask 0;
}

sub main {
#如果使用 IP sockets
#$socket = FCGI::OpenSocket( "127.0.0.1:8999", 10 );
#如果使用 UNIX sockets
#$socket = FCGI::OpenSocket( "/var/run/perl_cgi-dispatch.sock", 10 );

#foreach $item (keys %ENV) { delete $ENV{$item}; }
#设置fastcgi进程数，默认四个
my $n_processes = $ENV{FCGI_NPROCESSES} || 4;
$proc_manager = FCGI::ProcManager->new( {n_processes => $n_processes} );
#使用unix socket
$socket = FCGI::OpenSocket( "$ENV{FCGI_SOCKET_PATH}", 10 );
#设置Socket权限
chmod 0777, $ENV{FCGI_SOCKET_PATH};

; #use UNIX sockets - user running this script must have w access to the 'nginx' folder!!
$request =
FCGI::Request( \*STDIN, \*STDOUT, \*STDERR, \%req_params, $socket,
&FCGI::FAIL_ACCEPT_ON_INTR );
$proc_manager->pm_manage();
if ($request) { request_loop() }
FCGI::CloseSocket($socket);
}

sub request_loop {
while ( $request->Accept() >= 0 ) {
$proc_manager->pm_pre_dispatch();

#processing any STDIN input from WebServer (for CGI-POST actions)
$stdin_passthrough = '';
{ no warnings; $req_len = 0   $req_params{'CONTENT_LENGTH'}; };
if ( ( $req_params{'REQUEST_METHOD'} eq 'POST' ) && ( $req_len != 0 ) )
{
my $bytes_read = 0;
while ( $bytes_read  0 ) {
close(CHILD_RD);
close(CHILD_ERR);
print PARENT_WR $stdin_passthrough;
close(PARENT_WR);
$rin = $rout = $ein = $eout = '';
vec( $rin, fileno(CHILD_O), 1 ) = 1;
vec( $rin, fileno(PARENT_ERR), 1 ) = 1;
$ein = $rin;
$nfound = 0;

while ( $nfound =
select( $rout = $rin, undef, $ein = $eout, 10 ) )
{
die "$!" unless $nfound != -1;
$r1 = vec( $rout, fileno(PARENT_ERR), 1 ) == 1;
$r2 = vec( $rout, fileno(CHILD_O), 1 ) == 1;
$e1 = vec( $eout, fileno(PARENT_ERR), 1 ) == 1;
$e2 = vec( $eout, fileno(CHILD_O), 1 ) == 1;

if ($r1) {
while ( $bytes = read( PARENT_ERR, $errbytes, 4096 ) ) {
print STDERR $errbytes;
}

if ($!) {
$err = $!;
die $!;
vec( $rin, fileno(PARENT_ERR), 1 ) = 0
unless ( $err == EINTR or $err == EAGAIN );
}
}
if ($r2) {
while ( $bytes = read( CHILD_O, $s, 4096 ) ) {
print $s;
}
if ( !defined($bytes) ) {
$err = $!;
die $!;
vec( $rin, fileno(CHILD_O), 1 ) = 0
unless ( $err == EINTR or $err == EAGAIN );
}
}
last if ( $e1 || $e2 );
}
close CHILD_RD;
close PARENT_ERR;
waitpid( $pid, 0 );
} else {
foreach $key ( keys %req_params ) {
$ENV{$key} = $req_params{$key};
}

# cd to the script's local directory
if ( $req_params{SCRIPT_FILENAME} =~ /^(.*)\/[^\/] $/ ) {
chdir $1;
}
close(PARENT_WR);

#close(PARENT_ERR);
close(STDIN);
close(STDERR);

#fcntl(CHILD_RD, F_DUPFD, 0);
syscall( &SYS_dup2, fileno(CHILD_RD), 0 );
syscall( &SYS_dup2, fileno(CHILD_ERR), 2 );

#open(STDIN, "<&CHILD_RD");
exec( $req_params{SCRIPT_FILENAME} );
die("exec failed");
}
} else {
print("Content-type: text/plain\r\n\r\n");
print
"Error: No such CGI app - $req_params{SCRIPT_FILENAME} may not exist or is not executable by this process.\n";
}
}
}

vi startfcgiperl

#!/bin/bash
export FCGI_SOCKET_PATH="/tmp/perl_fcgi.socket"
export FCGI_NPROCESSES=4
/etc/init.d/fcgi_perl > /dev/null 2>&1 &

vi /usr/local/nginx/conf/nginx.conf

		location ~ .*\.pl$
                        {
                                fastcgi_index awstats.pl;
                                include perl.conf;
                        }

                location /awstats {
                        alias /usr/local/awstats-6.9/wwwroot/cgi-bin/;
                }

vi /usr/local/nginx/conf/perl.conf

fastcgi_pass unix:/tmp/perl_fcgi.socket;
#fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
#fastcgi_param SCRIPT_FILENAME /var/www/awstats-6.8/wwwroot/cgi-bin$fastcgi_script_name;
fastcgi_param SCRIPT_FILENAME /usr/local/awstats-6.9/wwwroot/cgi-bin/awstats.pl;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
fastcgi_read_timeout 60;

cp /etc/awstats/awstats.test.com.conf /etc/awstats/awstats.test2.com.conf
修改/etc/awstats/awstats.test2.com.conf
#你要分析的日志文件位置
LogFile="/web/logs/access.log"
#日志的类型1:apache 2:IIS
LogFormat=1
#要分析日志所属的域名
SiteDomain="test2.com"
#是否允许在统计页面直接更新数据1:允许 0:不允许
AllowToUpdateStatsFromBrowser=1

yum -y install gcc automake make

yum -y install pam-devel openldap-devel cyrus-sasl-devel openssl-devel

wget http://jaist.dl.sourceforge.net/sourceforge/ss5/ss5-3.6.1-1.tar.gz
tar zxvf ss5-3.6.1-1.tar.gz
cd ss5-3.6.1
./configure
make
make install

#启动ss5服务
/etc/init.d/ss5 start

#       SHost           SPort           Authentication
#
auth    0.0.0.0/0               -              -

为

#       SHost           SPort           Authentication
#
auth    0.0.0.0/0               -              u

test test

/etc/init.d/ss5 restart