1、系統版本

CentOS release 5.10 (Final) 64bits

2、軟體版本

openvpn-2.3.6-1.el5
lzo-2.02-2.el5.1
lzo-devel-2.02-2.el5.1
easy-rsa-2.2.2-1.el5
pam-0.99.6.2-12.el5
pam-devel-0.99.6.2-12.el5

1、開啟ip轉發功能

echo "net.ipv4.ip_forward = 1">> /etc/sysctl.conf
sysctl -p

2、安裝依賴及所需軟體包

yum install -y openvpn easy-rsa cyrus-saslcyrus-sasl-plain cyrus-sasl-devel cyrus-sasl-lib cyrus-sasl-gssapi pampam-devel
/etc/init.d/saslauthd restart

3、修改變數及生成證書

cd /usr/share/easy-rsa/2.0
vi vars                           #編輯vars檔案,生成環境變數, vars裡的引數根據自己需要改變
export KEY_COUNTRY="CN"           #定義你所在的國家，2個字元
export KEY_PROVINCE="ShangHai"    #你所在的省份
export KEY_CITY="ShangHai"        #你所在的城市
export KEY_ORG="xxx"              #你所在的組織
export KEY_EMAIL="[email protected]
 
"     #你的郵件地址，可以修改
source ./vars
 ./clean-all
 ./build-ca
 ./build-dh
 ./build-key-server server
 ./build-key client
 #tar -zcvf client.tar.gz keys/{ca.crt,client.crt,client.key} #windows客戶端使用需下載到本地
mkdir /etc/openvpn/{keys,logs,plugin/auth-pam} -p
cp /usr/share/easy-rsa/2.0/keys/{ca.crt,server.crt,server.key,dh2048.pem} /etc/openvpn/keys/
cat > /etc/openvpn/server.conf << EOF
 port 443
 proto tcp
 dev tun
 ca keys/ca.crt
 cert keys/server.crt
 key keys/server.key
 dh keys/dh2048.pem
 server 10.100.0.0 255.255.255.0
 ifconfig-pool-persist ipp.txt
 #新增主機路由
 push "route 10.200.0.0 255.255.0.0"
 push "route 10.220.0.0 255.255.0.0"
 keepalive 10 120
 comp-lzo
 user nobody
 group nobody
 persist-key
 persist-tun
 status logs/openvpn-status.log
 log logs/openvpn.log
 log-append logs/openvpn.log
 verb 3
 plugin /etc/openvpn/plugin/openvpn-auth-pam.so openvpn
 client-cert-not-required
 username-as-common-name
 EOF 

4、使用低版本的認證外掛

wget http://pkgs.fedoraproject.org/repo/pkgs/openvpn/openvpn-2.0.7.tar.gz/93528233f1f6d02fc18e2c00f82e0aca/openvpn-2.0.7.tar.gz
 tar xf openvpn-2.0.7.tar.gz
 cd openvpn-2.0.7/plugin/auth-pam
 make
 cp openvpn-auth-pam.so /etc/openvpn/plugin/
 #（這一步可能無法成功，假如無法成功可從其他機器拷貝一份過去，我在附件中放了該檔案）
 wget http://nchc.dl.sourceforge.net/project/pam-mysql/pam-mysql/0.7RC1/pam_mysql-0.7RC1.tar.gz
 tar xf pam_mysql-0.7RC1.tar.gz && cd pam_mysql-0.7RC1
 ./configure
 make
 makeinstall
 ln -s /lib/security/pam_mysql.so /lib64/security/
#如果編譯中報錯需要MySQL的庫檔案：
yum install -y pam-devel mysql mysql-devel
 cat > /etc/pam.d/openvpn << EOF
 auth sufficient /lib/security/pam_mysql.so user=xxx passwd=xxxxx host=xxxxxx db=vpn table=openvpnuser usercolumn=name passwdcolumn=password crypt=2
 account required /lib/security/pam_mysql.so user=xxx passwd=xxxxx host=xxxxxx db=vpn table=openvpnuser usercolumn=name passwdcolumn=password crypt=2
 EOF

5、MySQL配置

mysql -hjconnhrdmgt82.mysql.rds.aliyuncs.com -uzabbix_1 -p -D operations
 create database vpn;
 #grant all on vpn.* to [email protected]'%' identified by 'xxxxxx';
 create table openvpnuser ( name char(20) NOT NULL, password char(128)default NULL, active int(10) NOT NULL DEFAULT 1, primary key (name) );
 insert into openvpnuser (name,password)values('vpnuser',password('vpnpassword'));
 #flush privileges;

6、啟動openvpn

 /etc/init.d/openvpn restart

testsaslauthd -u vpnuser -p vpnpassword -s openvpn
0:OK "Success."

1、客戶端配置檔案

cat > someone.ovpn << EOF
 client
 dev tun
 proto tcp
 remote 公網IP 443
 resolv-retry infinite
 nobind
 persist-key
 persist-tun
 ca ca.crt
 #cert client.crt
 #key client.key
 #上面兩個是配置客戶端使用祕鑰登入的證書
 remote-cert-tls server
 comp-lzo
 verb 3
 auth-user-pass #此引數後可接檔名，例如：auth.txt,檔案中記錄賬號和密碼需換行
 EOF

2、下載服務端證書
下載ca.crt和someone.ovpn檔案到本地

*nat
:PREROUTING ACCEPT [222:10664]
:POSTROUTING ACCEPT [37944:2486906]
:OUTPUT ACCEPT [37944:2486906]
-A POSTROUTING -s 10.100.0.0/255.255.255.0 -o eth0 -j MASQUERADE
COMMIT
 #以上是iptables的配置檔案中需要加入的一條配置，可以配置下面的命令然後儲存iptables資訊到配置檔案中
 #iptables -t nat -A POSTROUTING -s10.100.0.0/255.255.255.0 -o eth0 -j MASQUERADE
 #iptables-save >/etc/sysconfig/iptables
 將openvpn新增到開機啟動項中
 chkconfig --add openvpn
 chkconfig openvpn on

Mar 10 17:05:15 jstwpz76bqary8 openvpn[27972]: PAM unableto dlopen(/lib/security/pam_mysql.so)
Mar 10 17:05:15 jstwpz76bqary8 openvpn[27972]: PAM [error:/lib/security/pam_mysql.so: undefined symbol: pam_set_data]

/var/log/secure中若出現如上錯誤，請嘗試使用低版本的openvpn編譯出來的openvpn-auth-pam.so動態連結庫檔案。

本文轉載自：http://www.linuxprobe.com/centos-openvpn-mysql-auth
免費提供最新Linux技術教程書籍，為開源技術愛好者努力做得更多更好：http://www.linuxprobe.com/