In below post I established VPN by Softether.
In this post I switched to use certicate based authentication which are sure to be more secure than password.
There are lots of articles which introduces how to use GUI tool on Windows.
I don’t have Windows PC so I setup by command line on Linux.
Server authentication
This chapter shows how to configure client to authenticate server.
Server side
Let’s create certificate and key pair.
Softether has covenient commands MakeCert and MakeCert2048.
– The difference is just the key length, MakeCert is 1024bit, MakeCert2048 is 2048bit.
Each field can be empty.
Period will be automatically 10 years if empty.
sudo /opt/vpnserver/vpncmd (snip) 1. Management of VPN Server or VPN Bridge 2. Management of VPN Client 3. Use of VPN Tools (certificate creation and Network Traffic Speed Test Tool) Select 1, 2 or 3: 1 (Enter) (snip) Hostname of IP Address of Destination: localhost:5555 (Enter) (snip) Specify Virtual Hub Name: (Enter) (snip) VPN Server>MakeCert2048 MakeCert2048 command - Create New X.509 Certificate and Private Key (2048 bit) Name of Certificate to Create (CN): (Enter) Organization of Certificate to Create (O): (Enter) Organization Unit of Certificate to Create (OU): (Enter) Country of Certificate to Create (C): (Enter) State of Certificate to Create (ST): (Enter) Locale of Certificate to Create (L): (Enter) Serial Number of Certificate to Create (Hexadecimal): (Enter) Expiration Date of Certificate to Create (Days): (Enter) File Name to Save Certificate to Create: /opt/vpnserver/server.cert File Name to Save Private Key to Create: /opt/vpnserver/server.priv The command completed successfully.
Next is to configure these certificate and key to be used for authentication.
VPN Server>Hub virtual_hub (snip) VPN Server/virtual_hub>ServerCertSet ServerCertSet command - Set SSL Certificate and Private Key of VPN Server Read X.509 certificate from file name: /opt/vpnserver/server.cert Read private key from file name: /opt/vpnserver/server.priv The command completed successfully.
Now certificate and key is stored in configuration file of VPN Server so you can delete.
If you want to restore you can do by ServerCertGet command.
Client side
Next let’s configure to authenticate server by certificate.
Please copy certificate file and do these commands.
sudo /opt/vpnclient/vpncmd (snip) 1. Management of VPN Server or VPN Bridge 2. Management of VPN Client 3. Use of VPN Tools (certificate creation and Network Traffic Speed Test Tool) Select 1, 2 or 3: 2 (Enter) (snip) Hostname of IP Address of Destination: (Enter) (snip) VPN Client>AccountServerCertEnable virtual_connection AccountServerCertEnable command - Enable VPN Connection Setting Server Certificate Verification Option The command completed successfully. VPN Client>AccountServerCertSet virtual_connection AccountServerCertSet command - Set Server Individual Certificate for VPN Connection Setting Read X.509 certificate from file name: ./server.cert The command completed successfully.
Disconnect and connect to see configuration is properly done.
Yes, it’s good!
VPN Client>AccountDisconnect virtual_connection AccountDisconnect command - Disconnect VPN Connection Setting During Connection The command completed successfully. VPN Client>AccountConnect virtual_connection AccountConnect command - Start Connection to VPN Server using VPN Connection Setting The command completed successfully. VPN Client>AccountStatusGet virtual_connection AccountStatusGet command - Get Current VPN Connection Setting Status Item |Value ------------------------------------------+------------------------------------------------------------------------ VPN Connection Setting Name |virtual_connection Session Status |Connection Completed (Session Established) (snip) VPN Client>AccountGet virtual_connection AccountGet command - Get Setting of VPN Connection Setting Item |Value -----------------------------------------------------+--------------------------------------------------------------------------------------------------------------- (snip) Verify Server Certificate |Enable Registered Server Individual Certificate |, SERIAL="00" (Digest: MD5="12345678901234567890123456789012", SHA1="1234567890123456789012345678901234567890") (snip)
Client authentication
We can do client authentication as well.
Server side
Please create client certificate and key by MakeCert or MakeCert2048.
Server needs to configure to use certificate for authentication of client.
VPN Server>Hub virtual_hub (snip) VPN Server/virtual_hub>UserSignedSet UserSignedSet command - Set Signed Certificate Authentication for User Auth Type User Name: yasu Limit of Common Name (CN) Value: Limit of Serial Number Value: The command completed successfully. VPN Server/virtual_hub>UserCertSet UserCertSet command - Set Individual Certificate Authentication for User Auth Type and Set Certificate User Name: yasu Read X.509 certificate from file name: /opt/vpnserver/yasu.cert The command completed successfully.
Client side
Client side as well.
sudo /opt/vpnclient/vpncmd (snip) 1. Management of VPN Server or VPN Bridge 2. Management of VPN Client 3. Use of VPN Tools (certificate creation and Network Traffic Speed Test Tool) Select 1, 2 or 3: 2 (Enter) (snip) Hostname of IP Address of Destination: (Enter) (snip) VPN Client>AccountCertSet virtual_connection AccountCertSet command - Set User Authentication Type of VPN Connection Setting to Client Certificate Authentication Read X.509 certificate from file name: /opt/vpnserver/yasu.cert Read private key from file name: /opt/vpnclient/yasu.priv The command completed successfully.
Disconnect and connect again.
Yes, client authentication worked as well.
VPN Client>AccountDisconnect virtual_connection AccountDisconnect command - Disconnect VPN Connection Setting During Connection The command completed successfully. VPN Client>AccountConnect virtual_connection AccountConnect command - Start Connection to VPN Server using VPN Connection Setting The command completed successfully. VPN Client>AccountStatusGet virtual_connection AccountStatusGet command - Get Current VPN Connection Setting Status Item |Value ------------------------------------------+-------------------------------------------------------- VPN Connection Setting Name |virtual_connection Session Status |Connection Completed (Session Established) (snip) VPN Client>AccountGet virtual_connection AccountGet command - Get Setting of VPN Connection Setting Item |Value -----------------------------------------------------+--------------------------------------------------------------------------------------------------------------- VPN Connection Setting Name |virtual_connection (snip) Authentication Type |Client Certificate Authentication User Name |yasu Client Certificate for Authentication Use |, SERIAL="00" (Digest: MD5="12345678901234567890123456789012", SHA1="1234567890123456789012345678901234567890") (snip)
Now certificate based authentication was done for both server and client!
Conclusion
How was it?
This isn’t complicated as you are expecting!
Comments