openvpn+mysql+lzo配置

baiqqk

OPENVPN总结

系统环境：RedHat 9.0+Lzo2.02+Openvpn2.02+Pam_mysql-0.5
1、        为了确保所需系统文件都已经正确安装，请在安装Redhat Linux9.0时选择安装全部软件。
2、        安装Lzo2.02
A、        下载Lzo-2.02.tar.gz软件包
B、        解压缩 tar –zxvf  lzo-2.02.tar.gz
C、        进入lzo-2.02目录 cd lzo-2.02
D、        ./configure  ---- make  --- make install
3、        安装OpenVPN2.02
A、        下载openvpn-2.02.tar.gz软件包  www.openvpn..net
B、        解压缩 tar –zxvf  openvpn-2.02.tar.gz
C、        进入openvpn-2.02目录 cd  openvpn-2.02
D、        确认lzo安装位置，一般在/usr/local/include/lzo 和 /usr/local/lib下，当然也可用使用find /usr –name ‘lzo’
E、        ./configure –with-lzo-headers=/usr/local/include/lzo –with-lzo-lib=/usr/local/lib
make
make install
4、        安装pam_mysql-0.5
                A、下载pam_mysql-0.5.tar.gz软件包
        B、解压缩 tar –zxvf  pam_mysql-0.5.tar.gz
        C、进入pam_mysql-0.5目录 cd  pam_mysql-0.5
        D、利用make生成pam_mysql.so文件，并cp pam_mysql.so /lib/security
5、Mysql部分
        A、启动MYSQL  /etc/init.d/mysqld start
        B、进入mysql –u root
        C、create database vpn;
        D、GRANT ALL ON  vpn.* TO vpn@localhost IDENTIFIED BY ‘123456’;
        E、flush privileges;
        F、use vpn;
        G、create table vpnuser (name char(20) NOT NULL,password char(128) DEFAULT NULL,active int(10) NOT NULL DEFAULT 1,PRIMARY KEY (name));
        H、insert into vpnuser (name,password) values(‘test’,password(‘test’));
6、建立openvpn的pam文件
auth        sufficient        pam_mysql.so        user=vpn passwd=123456 host=localhost db=vpn \
        table=vpnuser usercolumn=name passwdcolumn=password \
        where=active=1 sqllog=0 crypt=2
account        required        pam_mysql.so        user=vpn passwd=1234546 host=localhost db=vpn \
        table=vpnuser usercolumn=name passwdcolumn=password \
        where=active=1 sqllog=0 crypt=2
7、mkdir /etc/openvpn
   Cp vpn_s /etc/openvpn
8、拷贝vpn_c到客户机config中（先清除原有文件）

第一次发贴，不足之处多多包涵，：）

baiqqk

自己顶一下，再不顶就沉下去了，呵呵

canglong

哥们，很不错啊，我现在正在Slackware下实践这个，可是不知道如何测试pam_mysql 是否成功了，我的salauthd好象不支持pam ?还有什么办法测试pam_mysql的么 ？

baiqqk

Post by canglong
哥们，很不错啊，我现在正在Slackware下实践这个，可是不知道如何测试pam_mysql 是否成功了，我的salauthd好象不支持pam ?还有什么办法测试pam_mysql的么 ？

Slackware我还没用过呢,不过你可以先据Server/client都配置好,然后从Client连一次,如出现错误马上终止Server上OPENVPN进程,然后查看  /var/log/openvpn.log和 /var/messages(不知你那个系统有没这个文件)

*************************messages***************************

Jun  7 11:00:19 dbvpn openvpn: pam_mysql: acct_mgmt called but not implemented. Dont panic though
Jun  7 11:00:39 dbvpn openvpn: pam_sm_authenticate called.
Jun  7 11:00:39 dbvpn openvpn: dbuser changed.
Jun  7 11:00:39 dbvpn openvpn: dbpasswd changed.
Jun  7 11:00:39 dbvpn openvpn: host changed.
Jun  7 11:00:39 dbvpn openvpn: database changed.
Jun  7 11:00:39 dbvpn openvpn: table changed.
Jun  7 11:00:39 dbvpn openvpn: usercolumn changed.
Jun  7 11:00:39 dbvpn openvpn: passwdcolumn changed.
Jun  7 11:00:39 dbvpn openvpn: where changed.
Jun  7 11:00:39 dbvpn openvpn: sqllog changed.
Jun  7 11:00:39 dbvpn openvpn: crypt changed.
Jun  7 11:00:39 dbvpn openvpn: db_connect  called.
Jun  7 11:00:39 dbvpn openvpn: returning 0 .
Jun  7 11:00:39 dbvpn openvpn: db_checkpasswd called.
Jun  7 11:00:39 dbvpn openvpn: pam_mysql: where clause = active=1
Jun  7 11:00:39 dbvpn openvpn: SELECT password FROM vpnuser WHERE name='ad02' AND (active=1)
Jun  7 11:00:39 dbvpn openvpn: sqlLog called.
Jun  7 11:00:39 dbvpn openvpn: returning 0 .
Jun  7 11:00:39 dbvpn openvpn: returning 0.

*************************messages***************************

以上是一次调用pam_mysql进行认证的完整过程,其中加粗的部分为认证返回值,为0是表示成功,呵呵,就知道这么点了

canglong

俺下载的是openvpn-2.0.9.tar.gz，编译是安照你的配置只是修改下：/usr/local/include/lzo为：/usr/include/lzo，
请问编译：openvpn-auth-pam.so要加什么参数么 ？对了，我见make 后，没出来
openvpn-auth-pam.so的，要自己手动进哪个plugin，进行make才能得到openvpn-auth-pam.so，什么问题呢  ？

1. 
   
2. Thu Jun  7 15:24:36 2007 us=896487 Current Parameter Settings:
   
3. Thu Jun  7 15:24:36 2007 us=897672   config = 'server.conf'
   
4. Thu Jun  7 15:24:36 2007 us=897728   mode = 1
   
5. Thu Jun  7 15:24:36 2007 us=897768   persist_config = DISABLED
   
6. Thu Jun  7 15:24:36 2007 us=897805   persist_mode = 1
   
7. Thu Jun  7 15:24:36 2007 us=897842   show_ciphers = DISABLED
   
8. Thu Jun  7 15:24:36 2007 us=897879   show_digests = DISABLED
   
9. Thu Jun  7 15:24:36 2007 us=897916   show_engines = DISABLED
   
10. Thu Jun  7 15:24:36 2007 us=897953   genkey = DISABLED
    
11. Thu Jun  7 15:24:36 2007 us=897990   key_pass_file = '[UNDEF]'
    
12. Thu Jun  7 15:24:36 2007 us=898027   show_tls_ciphers = DISABLED
    
13. Thu Jun  7 15:24:36 2007 us=898064   proto = 0
    
14. Thu Jun  7 15:24:36 2007 us=898103   local = '199.199.199.68'
    
15. Thu Jun  7 15:24:36 2007 us=898157   remote_list = NULL
    
16. Thu Jun  7 15:24:36 2007 us=898261   remote_random = DISABLED
    
17. Thu Jun  7 15:24:36 2007 us=898300   local_port = 1194
    
18. Thu Jun  7 15:24:36 2007 us=898337   remote_port = 1194
    
19. Thu Jun  7 15:24:36 2007 us=898374   remote_float = DISABLED
    
20. Thu Jun  7 15:24:36 2007 us=898412   ipchange = '[UNDEF]'
    
21. Thu Jun  7 15:24:36 2007 us=898449   bind_local = ENABLED
    
22. Thu Jun  7 15:24:36 2007 us=898487   dev = 'tap'
    
23. Thu Jun  7 15:24:36 2007 us=898524   dev_type = '[UNDEF]'
    
24. Thu Jun  7 15:24:36 2007 us=898561   dev_node = '[UNDEF]'
    
25. Thu Jun  7 15:24:36 2007 us=898598   tun_ipv6 = DISABLED
    
26. Thu Jun  7 15:24:36 2007 us=898636   ifconfig_local = '10.5.0.1'
    
27. Thu Jun  7 15:24:36 2007 us=898675   ifconfig_remote_netmask = '255.255.255.0'
    
28. Thu Jun  7 15:24:36 2007 us=898713   ifconfig_noexec = DISABLED
    
29. Thu Jun  7 15:24:36 2007 us=898750   ifconfig_nowarn = DISABLED
    
30. Thu Jun  7 15:24:36 2007 us=898787   shaper = 0
    
31. Thu Jun  7 15:24:36 2007 us=898825   tun_mtu = 1500
    
32. Thu Jun  7 15:24:36 2007 us=898862   tun_mtu_defined = ENABLED
    
33. Thu Jun  7 15:24:36 2007 us=898900   link_mtu = 1500
    
34. Thu Jun  7 15:24:36 2007 us=898937   link_mtu_defined = DISABLED
    
35. Thu Jun  7 15:24:36 2007 us=898975   tun_mtu_extra = 32
    
36. Thu Jun  7 15:24:36 2007 us=899141   tun_mtu_extra_defined = ENABLED
    
37. Thu Jun  7 15:24:36 2007 us=899178   fragment = 0
    
38. Thu Jun  7 15:24:36 2007 us=899216   mtu_discover_type = -1
    
39. Thu Jun  7 15:24:36 2007 us=899254   mtu_test = 0
    
40. Thu Jun  7 15:24:36 2007 us=899310   mlock = DISABLED
    
41. Thu Jun  7 15:24:36 2007 us=899348   keepalive_ping = 10
    
42. Thu Jun  7 15:24:36 2007 us=899385   keepalive_timeout = 120
    
43. Thu Jun  7 15:24:36 2007 us=899422   inactivity_timeout = 0
    
44. Thu Jun  7 15:24:36 2007 us=899460   ping_send_timeout = 10
    
45. Thu Jun  7 15:24:36 2007 us=899497   ping_rec_timeout = 240
    
46. Thu Jun  7 15:24:36 2007 us=899534   ping_rec_timeout_action = 2
    
47. Thu Jun  7 15:24:36 2007 us=899572   ping_timer_remote = DISABLED
    
48. Thu Jun  7 15:24:36 2007 us=899609   remap_sigusr1 = 0
    
49. Thu Jun  7 15:24:36 2007 us=899647   explicit_exit_notification = 0
    
50. Thu Jun  7 15:24:36 2007 us=899685   persist_tun = ENABLED
    
51. Thu Jun  7 15:24:36 2007 us=899722   persist_local_ip = DISABLED
    
52. Thu Jun  7 15:24:36 2007 us=899759   persist_remote_ip = DISABLED
    
53. Thu Jun  7 15:24:36 2007 us=899796   persist_key = ENABLED
    
54. Thu Jun  7 15:24:36 2007 us=899834   mssfix = 1450
    
55. Thu Jun  7 15:24:36 2007 us=899871   passtos = DISABLED
    
56. Thu Jun  7 15:24:36 2007 us=899909   resolve_retry_seconds = 1000000000
    
57. Thu Jun  7 15:24:36 2007 us=899946   connect_retry_seconds = 5
    
58. Thu Jun  7 15:24:36 2007 us=899984   username = 'nobody'
    
59. Thu Jun  7 15:24:36 2007 us=900021   groupname = 'nobody'
    
60. Thu Jun  7 15:24:36 2007 us=900059   chroot_dir = '[UNDEF]'
    
61. Thu Jun  7 15:24:36 2007 us=900096   cd_dir = '/etc/openvpn'
    
62. Thu Jun  7 15:24:36 2007 us=900134   writepid = '/var/run/openvpn/server.pid'
    
63. Thu Jun  7 15:24:36 2007 us=900171   up_script = '[UNDEF]'
    
64. Thu Jun  7 15:24:36 2007 us=900208   down_script = '[UNDEF]'
    
65. Thu Jun  7 15:24:36 2007 us=900245   down_pre = DISABLED
    
66. Thu Jun  7 15:24:36 2007 us=900282   up_restart = DISABLED
    
67. Thu Jun  7 15:24:36 2007 us=900320   up_delay = DISABLED
    
68. Thu Jun  7 15:24:36 2007 us=900017   daemon = ENABLED
    
69. Thu Jun  7 15:24:36 2007 us=900056   inetd = 0
    
70. Thu Jun  7 15:24:36 2007 us=900093   log = ENABLED
    
71. Thu Jun  7 15:24:36 2007 us=900130   suppress_timestamps = DISABLED
    
72. Thu Jun  7 15:24:36 2007 us=900368   nice = 0
    
73. Thu Jun  7 15:24:36 2007 us=900412   verbosity = 4
    
74. Thu Jun  7 15:24:36 2007 us=900449   mute = 0
    
75. Thu Jun  7 15:24:36 2007 us=900486   gremlin = 0
    
76. Thu Jun  7 15:24:36 2007 us=900524   status_file = 'openvpn-status.log'
    
77. Thu Jun  7 15:24:36 2007 us=900562   status_file_version = 1
    
78. Thu Jun  7 15:24:36 2007 us=900600   status_file_update_freq = 60
    
79. Thu Jun  7 15:24:36 2007 us=900637   occ = ENABLED
    
80. Thu Jun  7 15:24:36 2007 us=900675   rcvbuf = 65536
    
81. Thu Jun  7 15:24:36 2007 us=900712   sndbuf = 65536
    
82. Thu Jun  7 15:24:36 2007 us=900750   socks_proxy_server = '[UNDEF]'
    
83. Thu Jun  7 15:24:36 2007 us=900788   socks_proxy_port = 0
    
84. Thu Jun  7 15:24:36 2007 us=900826   socks_proxy_retry = DISABLED
    
85. Thu Jun  7 15:24:36 2007 us=900863   fast_io = DISABLED
    
86. Thu Jun  7 15:24:36 2007 us=900927   comp_lzo = ENABLED
    
87. Thu Jun  7 15:24:36 2007 us=900966   comp_lzo_adaptive = ENABLED
    
88. Thu Jun  7 15:24:36 2007 us=901003   route_script = '[UNDEF]'
    
89. Thu Jun  7 15:24:36 2007 us=901041   route_default_gateway = '[UNDEF]'
    
90. Thu Jun  7 15:24:36 2007 us=901078   route_noexec = DISABLED
    
91. Thu Jun  7 15:24:36 2007 us=901116   route_delay = 0
    
92. Thu Jun  7 15:24:36 2007 us=901153   route_delay_window = 30
    
93. Thu Jun  7 15:24:36 2007 us=901191   route_delay_defined = DISABLED
    
94. Thu Jun  7 15:24:36 2007 us=901228   management_addr = '[UNDEF]'
    
95. Thu Jun  7 15:24:36 2007 us=901266   management_port = 0
    
96. Thu Jun  7 15:24:36 2007 us=901304   management_user_pass = '[UNDEF]'
    
97. Thu Jun  7 15:24:36 2007 us=901341   management_log_history_cache = 250
    
98. Thu Jun  7 15:24:36 2007 us=901483   management_echo_buffer_size = 100
    
99. Thu Jun  7 15:24:36 2007 us=901523   management_query_passwords = DISABLED
    
100. Thu Jun  7 15:24:36 2007 us=901560   management_hold = DISABLED
     
101. Thu Jun  7 15:24:36 2007 us=901604   plugin[0] ./openvpn-auth-pam.so 'openvpn'
     
102. Thu Jun  7 15:24:36 2007 us=901643   shared_secret_file = '[UNDEF]'
     
103. Thu Jun  7 15:24:36 2007 us=901682   key_direction = 1
     
104. Thu Jun  7 15:24:36 2007 us=901720   ciphername_defined = ENABLED
     
105. Thu Jun  7 15:24:36 2007 us=901757   ciphername = 'BF-CBC'
     
106. Thu Jun  7 15:24:36 2007 us=901795   authname_defined = ENABLED
     
107. Thu Jun  7 15:24:36 2007 us=901832   authname = 'SHA1'
     
108. Thu Jun  7 15:24:36 2007 us=901870   keysize = 0
     
109. Thu Jun  7 15:24:36 2007 us=901908   engine = DISABLED
     
110. Thu Jun  7 15:24:36 2007 us=901967   replay = ENABLED
     
111. Thu Jun  7 15:24:36 2007 us=902006   mute_replay_warnings = DISABLED
     
112. Thu Jun  7 15:24:36 2007 us=902044   replay_window = 64
     
113. Thu Jun  7 15:24:36 2007 us=902081   replay_time = 15
     
114. Thu Jun  7 15:24:36 2007 us=902119   packet_id_file = '[UNDEF]'
     
115. Thu Jun  7 15:24:36 2007 us=902157   use_iv = ENABLED
     
116. Thu Jun  7 15:24:36 2007 us=902194   test_crypto = DISABLED
     
117. Thu Jun  7 15:24:36 2007 us=902232   tls_server = ENABLED
     
118. Thu Jun  7 15:24:36 2007 us=902269   tls_client = DISABLED
     
119. Thu Jun  7 15:24:36 2007 us=902307   key_method = 2
     
120. Thu Jun  7 15:24:36 2007 us=902344   ca_file = 'ca.crt'
     
121. Thu Jun  7 15:24:36 2007 us=902382   dh_file = 'dh1024.pem'
     
122. Thu Jun  7 15:24:36 2007 us=902420   cert_file = 'server.crt'
     
123. Thu Jun  7 15:24:36 2007 us=902457   priv_key_file = 'server.key'
     
124. Thu Jun  7 15:24:36 2007 us=902495   pkcs12_file = '[UNDEF]'
     
125. Thu Jun  7 15:24:36 2007 us=902533   cipher_list = '[UNDEF]'
     
126. Thu Jun  7 15:24:36 2007 us=902570   tls_verify = '[UNDEF]'
     
127. Thu Jun  7 15:24:36 2007 us=902608   tls_remote = '[UNDEF]'
     
128. Thu Jun  7 15:24:36 2007 us=902646   crl_file = '[UNDEF]'
     
129. Thu Jun  7 15:24:36 2007 us=902684   ns_cert_type = 0
     
130. Thu Jun  7 15:24:36 2007 us=902722   tls_timeout = 2
     
131. Thu Jun  7 15:24:36 2007 us=902759   renegotiate_bytes = 0
     
132. Thu Jun  7 15:24:36 2007 us=902797   renegotiate_packets = 0
     
133. Thu Jun  7 15:24:36 2007 us=902836   renegotiate_seconds = 3600
     
134. Thu Jun  7 15:24:36 2007 us=902873   handshake_window = 60
     
135. Thu Jun  7 15:24:36 2007 us=902911   transition_window = 3600
     
136. Thu Jun  7 15:24:36 2007 us=902948   single_session = DISABLED
     
137. Thu Jun  7 15:24:36 2007 us=903018   tls_exit = DISABLED
     
138. Thu Jun  7 15:24:36 2007 us=903058   tls_auth_file = 'ta.key'
     
139. Thu Jun  7 15:24:36 2007 us=903105   server_network = 10.5.0.0
     
140. Thu Jun  7 15:24:36 2007 us=903296   server_netmask = 255.255.255.0
     
141. Thu Jun  7 15:24:36 2007 us=903342   server_bridge_ip = 0.0.0.0
     
142. Thu Jun  7 15:24:36 2007 us=903381   server_bridge_netmask = 0.0.0.0
     
143. Thu Jun  7 15:24:36 2007 us=903420   server_bridge_pool_start = 0.0.0.0
     
144. Thu Jun  7 15:24:36 2007 us=903460   server_bridge_pool_end = 0.0.0.0
     
145. Thu Jun  7 15:24:36 2007 us=903498   push_list = 'route-gateway 10.5.0.1,ping 10,ping-restart 120'
     
146. Thu Jun  7 15:24:36 2007 us=903536   ifconfig_pool_defined = ENABLED
     
147. Thu Jun  7 15:24:36 2007 us=903575   ifconfig_pool_start = 10.5.0.2
     
148. Thu Jun  7 15:24:36 2007 us=903614   ifconfig_pool_end = 10.5.0.254
     
149. Thu Jun  7 15:24:36 2007 us=903654   ifconfig_pool_netmask = 255.255.255.0
     
150. Thu Jun  7 15:24:36 2007 us=903692   ifconfig_pool_persist_filename = 'ipp.txt'
     
151. Thu Jun  7 15:24:36 2007 us=903730   ifconfig_pool_persist_refresh_freq = 600
     
152. Thu Jun  7 15:24:36 2007 us=903768   ifconfig_pool_linear = DISABLED
     
153. Thu Jun  7 15:24:36 2007 us=903805   n_bcast_buf = 256
     
154. Thu Jun  7 15:24:36 2007 us=903843   tcp_queue_limit = 64
     
155. Thu Jun  7 15:24:36 2007 us=903881   real_hash_size = 256
     
156. Thu Jun  7 15:24:36 2007 us=903919   virtual_hash_size = 256
     
157. Thu Jun  7 15:24:36 2007 us=903957   client_connect_script = '[UNDEF]'
     
158. Thu Jun  7 15:24:36 2007 us=903996   learn_address_script = '[UNDEF]'
     
159. Thu Jun  7 15:24:36 2007 us=904055   client_disconnect_script = '[UNDEF]'
     
160. Thu Jun  7 15:24:36 2007 us=904094   client_config_dir = '[UNDEF]'
     
161. Thu Jun  7 15:24:36 2007 us=904132   ccd_exclusive = DISABLED
     
162. Thu Jun  7 15:24:36 2007 us=904170   tmp_dir = '[UNDEF]'
     
163. Thu Jun  7 15:24:36 2007 us=904208   push_ifconfig_defined = DISABLED
     
164. Thu Jun  7 15:24:36 2007 us=904447   push_ifconfig_local = 0.0.0.0
     
165. Thu Jun  7 15:24:36 2007 us=904499   push_ifconfig_remote_netmask = 0.0.0.0
     
166. Thu Jun  7 15:24:36 2007 us=904537   enable_c2c = ENABLED
     
167. Thu Jun  7 15:24:36 2007 us=904574   duplicate_cn = DISABLED
     
168. Thu Jun  7 15:24:36 2007 us=904612   cf_max = 0
     
169. Thu Jun  7 15:24:36 2007 us=904649   cf_per = 0
     
170. Thu Jun  7 15:24:36 2007 us=904686   max_clients = 1024
     
171. Thu Jun  7 15:24:36 2007 us=904725   max_routes_per_client = 256
     
172. Thu Jun  7 15:24:36 2007 us=904762   client_cert_not_required = ENABLED
     
173. Thu Jun  7 15:24:36 2007 us=904800   username_as_common_name = ENABLED
     
174. Thu Jun  7 15:24:36 2007 us=904838   auth_user_pass_verify_script = '[UNDEF]'
     
175. Thu Jun  7 15:24:36 2007 us=904876   auth_user_pass_verify_script_via_file = DISABLED
     
176. Thu Jun  7 15:24:36 2007 us=904913   client = DISABLED
     
177. Thu Jun  7 15:24:36 2007 us=904951   pull = DISABLED
     
178. Thu Jun  7 15:24:36 2007 us=904988   auth_user_pass_file = '[UNDEF]'
     
179. Thu Jun  7 15:24:36 2007 us=905065 OpenVPN 2.0.9 i686-pc-linux [SSL] [LZO] built on Jun  6 2007
     
180. AUTH-PAM: BACKGROUND: could not load PAM lib libpam.so: libpam.so: cannot open shared object file: No such file or directory
     
181. Thu Jun  7 15:24:36 2007 us=964413 PLUGIN_INIT: POST ./openvpn-auth-pam.so 'openvpn' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY
     
182. Thu Jun  7 15:24:36 2007 us=965305 PLUGIN_INIT: plugin initialization function failed: ./openvpn-auth-pam.so
     
183. Thu Jun  7 15:24:36 2007 us=965382 Exiting
     

复制代码

baiqqk

在redhat9中直接执行make命令，不用任何参数啊
你检查一下mysql和pam是否安装了下列包

[root@dbvpn root]# rpm -qa | grep mysql
mysql-devel-3.23.54a-11
libdbi-dbd-mysql-0.6.5-5
mysql-server-3.23.54a-11
mysql-3.23.54a-11
mod_auth_mysql-1.11-12

[root@dbvpn root]#  rpm -qa | grep pam
pam-0.75-48
pam_krb5-1.60-1
pam_smb-1.1.6-7
pam-devel-0.75-48
spamassassin-2.44-11.8.x

canglong

你好，我把贴发到了
http://bbs.chinaunix.net/viewthr ... page%3D1&page=9
那里的人气好象多点 ！！