====== OpenVPN avec TLS ======
===== Les certificats =====
Puisque nous savons utiliser ''TinyCA'', autant nous en servir. Nous allons créer avec notre CA un certificat pour ''aaron'' (serveur) et un autre pour ''cyclope'' (client) et allons les placer, ainsi que leur clé privée, sur leurs destinations respectives.
Nous ne détaillons pas la création de ces certificats, reportez-vous à la page [[:270crypt:030_application]] du chapitre [[:270crypt:start]].
Nous disposons donc de :
* ''bts.eme-cacert.pem'' le certificat de notre CA ;
* ''cyclope.maison.mrs-key.pem'' la clé privée de ''cyclope'' ;
* ''cyclope.maison.mrs.pem'' le certificat de ''cyclope'' ;
* ''aaron.bts.eme-key.pem'' la clé privée de ''aaron'' ;
* ''aaron.bts.eme.pem'' le certificat de ''aaron''.
Nous posons, par un moyen sécurisé, bts.eme-cacert.pem, cyclope.maison.mrs-key.pem et cyclope.maison.mrs.pem par exemple dans le répertoire de ''root'' de ''cyclope''.
Nous posons, par un moyen sécurisé, bts.eme-cacert.pem, aaron.bts.eme-key.pem et aaron.bts.eme.pem par exemple dans le répertoire de ''root'' de ''aaron''.
===== Paramètre « Diffie Hellman » =====
Enfin, nous créons sur ''aaron'' (le serveur), un paramètre « Diffie Hellman » au moyen d'''OpenSSL'', qui servira à générer les clés de session. En effet, la cryptographie « asymétrique », très gourmande en ressources, n'est utilisée que dans la phase d'authentification et d'établissement du tunnel. Par la suite, les données sont chiffrées de manière symétrique avec une clé partagée, communiquée par le serveur au client (à travers un chiffrement asymétrique, bien entendu).
aaron:~# openssl dhparam -out dh1024.pem 1024
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
..................................
Et quelques (parfois très longues) minutes plus tard, nous avons le fichier :
aaron:~# cat dh1024.pem
-----BEGIN DH PARAMETERS-----
MIGHAoGBANcTIW0XcvuNDSgK+KiS0rmo14zHNxnMK3IHjvWCqjJL8F0+nwFKvLql
FBggAoL1Si+4iuVJoZU3T4H/tsGlsayvWF1l4PNVuaenER2bhIDeFNGx1A/WbYmK
1JNOVpyfwC/i1fv1L/8bpzrjGsgl4GIy8sKzJt+PXRcV61fcJIM7AgEC
-----END DH PARAMETERS-----
Celui là, on ne pourra pas dire qu'il a été écrit à la légère.
===== Le tunnel final =====
La ligne de commande va commencer à être longue...
==== Sur aaron ====
C'est le serveur.
aaron:~# openvpn --port 8147 --dev tun1 --ifconfig 192.168.25.1 192.168.25.2 --comp-lzo --verb 5 --tls-server --dh dh1024.pem --ca bts.eme-cacert.pem --cert aaron.bts.eme.pem --key aaron.bts.eme-key.pem --reneg-sec 21600
Ce qui nous dit :
Sat Nov 15 18:49:41 2008 us=923686 Current Parameter Settings:
Sat Nov 15 18:49:41 2008 us=924704 config = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=924953 mode = 0
Sat Nov 15 18:49:41 2008 us=925180 persist_config = DISABLED
Sat Nov 15 18:49:41 2008 us=925410 persist_mode = 1
Sat Nov 15 18:49:41 2008 us=925635 show_ciphers = DISABLED
Sat Nov 15 18:49:41 2008 us=925862 show_digests = DISABLED
Sat Nov 15 18:49:41 2008 us=926087 show_engines = DISABLED
Sat Nov 15 18:49:41 2008 us=926314 genkey = DISABLED
Sat Nov 15 18:49:41 2008 us=926542 key_pass_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=926771 show_tls_ciphers = DISABLED
Sat Nov 15 18:49:41 2008 us=927001 proto = 0
Sat Nov 15 18:49:41 2008 us=927226 local = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=927452 remote_list = NULL
Sat Nov 15 18:49:41 2008 us=927679 remote_random = DISABLED
Sat Nov 15 18:49:41 2008 us=927909 local_port = 8147
Sat Nov 15 18:49:41 2008 us=928155 remote_port = 8147
Sat Nov 15 18:49:41 2008 us=928381 remote_float = DISABLED
Sat Nov 15 18:49:41 2008 us=928688 ipchange = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=928925 bind_local = ENABLED
Sat Nov 15 18:49:41 2008 us=929153 dev = 'tun1'
Sat Nov 15 18:49:41 2008 us=929381 dev_type = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=929608 dev_node = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=929832 tun_ipv6 = DISABLED
Sat Nov 15 18:49:41 2008 us=930059 ifconfig_local = '192.168.25.1'
Sat Nov 15 18:49:41 2008 us=930303 ifconfig_remote_netmask = '192.168.25.2'
Sat Nov 15 18:49:41 2008 us=930536 ifconfig_noexec = DISABLED
Sat Nov 15 18:49:41 2008 us=930765 ifconfig_nowarn = DISABLED
Sat Nov 15 18:49:41 2008 us=930995 shaper = 0
Sat Nov 15 18:49:41 2008 us=931222 tun_mtu = 1500
Sat Nov 15 18:49:41 2008 us=931452 tun_mtu_defined = ENABLED
Sat Nov 15 18:49:41 2008 us=931683 link_mtu = 1500
Sat Nov 15 18:49:41 2008 us=931909 link_mtu_defined = DISABLED
Sat Nov 15 18:49:41 2008 us=932140 tun_mtu_extra = 0
Sat Nov 15 18:49:41 2008 us=932365 tun_mtu_extra_defined = DISABLED
Sat Nov 15 18:49:41 2008 us=932635 fragment = 0
Sat Nov 15 18:49:41 2008 us=932866 mtu_discover_type = -1
Sat Nov 15 18:49:41 2008 us=933092 mtu_test = 0
Sat Nov 15 18:49:41 2008 us=933317 mlock = DISABLED
Sat Nov 15 18:49:41 2008 us=933545 keepalive_ping = 0
Sat Nov 15 18:49:41 2008 us=933772 keepalive_timeout = 0
Sat Nov 15 18:49:41 2008 us=933999 inactivity_timeout = 0
Sat Nov 15 18:49:41 2008 us=934227 ping_send_timeout = 0
Sat Nov 15 18:49:41 2008 us=934452 ping_rec_timeout = 0
Sat Nov 15 18:49:41 2008 us=934679 ping_rec_timeout_action = 0
Sat Nov 15 18:49:41 2008 us=934921 ping_timer_remote = DISABLED
Sat Nov 15 18:49:41 2008 us=935153 remap_sigusr1 = 0
Sat Nov 15 18:49:41 2008 us=935381 explicit_exit_notification = 0
Sat Nov 15 18:49:41 2008 us=935609 persist_tun = DISABLED
Sat Nov 15 18:49:41 2008 us=935837 persist_local_ip = DISABLED
Sat Nov 15 18:49:41 2008 us=936065 persist_remote_ip = DISABLED
Sat Nov 15 18:49:41 2008 us=936294 persist_key = DISABLED
Sat Nov 15 18:49:41 2008 us=936521 mssfix = 1450
Sat Nov 15 18:49:41 2008 us=936787 passtos = DISABLED
Sat Nov 15 18:49:41 2008 us=937016 resolve_retry_seconds = 1000000000
Sat Nov 15 18:49:41 2008 us=937245 connect_retry_seconds = 5
Sat Nov 15 18:49:41 2008 us=937473 username = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=937700 groupname = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=937926 chroot_dir = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=938157 cd_dir = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=938385 writepid = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=938612 up_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=938839 down_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=939065 down_pre = DISABLED
Sat Nov 15 18:49:41 2008 us=939291 up_restart = DISABLED
Sat Nov 15 18:49:41 2008 us=939518 up_delay = DISABLED
Sat Nov 15 18:49:41 2008 us=939743 daemon = DISABLED
Sat Nov 15 18:49:41 2008 us=939970 inetd = 0
Sat Nov 15 18:49:41 2008 us=940195 log = DISABLED
Sat Nov 15 18:49:41 2008 us=940422 suppress_timestamps = DISABLED
Sat Nov 15 18:49:41 2008 us=940692 nice = 0
Sat Nov 15 18:49:41 2008 us=940919 verbosity = 5
Sat Nov 15 18:49:41 2008 us=941146 mute = 0
Sat Nov 15 18:49:41 2008 us=941372 gremlin = 0
Sat Nov 15 18:49:41 2008 us=941611 status_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=941840 status_file_version = 1
Sat Nov 15 18:49:41 2008 us=942066 status_file_update_freq = 60
Sat Nov 15 18:49:41 2008 us=942292 occ = ENABLED
Sat Nov 15 18:49:41 2008 us=942520 rcvbuf = 65536
Sat Nov 15 18:49:41 2008 us=942747 sndbuf = 65536
Sat Nov 15 18:49:41 2008 us=942975 socks_proxy_server = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=943205 socks_proxy_port = 0
Sat Nov 15 18:49:41 2008 us=943431 socks_proxy_retry = DISABLED
Sat Nov 15 18:49:41 2008 us=943660 fast_io = DISABLED
Sat Nov 15 18:49:41 2008 us=943887 comp_lzo = ENABLED
Sat Nov 15 18:49:41 2008 us=944114 comp_lzo_adaptive = ENABLED
Sat Nov 15 18:49:41 2008 us=944345 route_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=944614 route_default_gateway = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=944852 route_noexec = DISABLED
Sat Nov 15 18:49:41 2008 us=945081 route_delay = 0
Sat Nov 15 18:49:41 2008 us=945309 route_delay_window = 30
Sat Nov 15 18:49:41 2008 us=945534 route_delay_defined = DISABLED
Sat Nov 15 18:49:41 2008 us=945764 management_addr = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=945995 management_port = 0
Sat Nov 15 18:49:41 2008 us=946221 management_user_pass = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=946452 management_log_history_cache = 250
Sat Nov 15 18:49:41 2008 us=946683 management_echo_buffer_size = 100
Sat Nov 15 18:49:41 2008 us=946911 management_query_passwords = DISABLED
Sat Nov 15 18:49:41 2008 us=947139 management_hold = DISABLED
Sat Nov 15 18:49:41 2008 us=947369 shared_secret_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=947599 key_direction = 0
Sat Nov 15 18:49:41 2008 us=947842 ciphername_defined = ENABLED
Sat Nov 15 18:49:41 2008 us=948074 ciphername = 'BF-CBC'
Sat Nov 15 18:49:41 2008 us=948302 authname_defined = ENABLED
Sat Nov 15 18:49:41 2008 us=948809 authname = 'SHA1'
Sat Nov 15 18:49:41 2008 us=949054 keysize = 0
Sat Nov 15 18:49:41 2008 us=949281 engine = DISABLED
Sat Nov 15 18:49:41 2008 us=949509 replay = ENABLED
Sat Nov 15 18:49:41 2008 us=949738 mute_replay_warnings = DISABLED
Sat Nov 15 18:49:41 2008 us=949970 replay_window = 64
Sat Nov 15 18:49:41 2008 us=950198 replay_time = 15
Sat Nov 15 18:49:41 2008 us=950424 packet_id_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=950654 use_iv = ENABLED
Sat Nov 15 18:49:41 2008 us=950882 test_crypto = DISABLED
Sat Nov 15 18:49:41 2008 us=951109 tls_server = ENABLED
Sat Nov 15 18:49:41 2008 us=951336 tls_client = DISABLED
Sat Nov 15 18:49:41 2008 us=951569 key_method = 2
Sat Nov 15 18:49:41 2008 us=951797 ca_file = 'bts.eme-cacert.pem'
Sat Nov 15 18:49:41 2008 us=952028 dh_file = 'dh1024.pem'
Sat Nov 15 18:49:41 2008 us=952256 cert_file = 'aaron.bts.eme.pem'
Sat Nov 15 18:49:41 2008 us=952485 priv_key_file = 'aaron.bts.eme-key.pem'
Sat Nov 15 18:49:41 2008 us=952760 pkcs12_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=952987 cipher_list = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=953214 tls_verify = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=953442 tls_remote = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=953669 crl_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=953898 ns_cert_type = 0
Sat Nov 15 18:49:41 2008 us=954127 tls_timeout = 2
Sat Nov 15 18:49:41 2008 us=954356 renegotiate_bytes = 0
Sat Nov 15 18:49:41 2008 us=954584 renegotiate_packets = 0
Sat Nov 15 18:49:41 2008 us=954826 renegotiate_seconds = 21600
Sat Nov 15 18:49:41 2008 us=955057 handshake_window = 60
Sat Nov 15 18:49:41 2008 us=955285 transition_window = 3600
Sat Nov 15 18:49:41 2008 us=955513 single_session = DISABLED
Sat Nov 15 18:49:41 2008 us=955743 tls_exit = DISABLED
Sat Nov 15 18:49:41 2008 us=955971 tls_auth_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=956283 server_network = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=956530 server_netmask = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=956810 server_bridge_ip = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=957049 server_bridge_netmask = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=957288 server_bridge_pool_start = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=957527 server_bridge_pool_end = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=957758 ifconfig_pool_defined = DISABLED
Sat Nov 15 18:49:41 2008 us=957997 ifconfig_pool_start = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=958249 ifconfig_pool_end = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=958487 ifconfig_pool_netmask = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=958717 ifconfig_pool_persist_filename = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=958952 ifconfig_pool_persist_refresh_freq = 600
Sat Nov 15 18:49:41 2008 us=959185 ifconfig_pool_linear = DISABLED
Sat Nov 15 18:49:41 2008 us=959417 n_bcast_buf = 256
Sat Nov 15 18:49:41 2008 us=959647 tcp_queue_limit = 64
Sat Nov 15 18:49:41 2008 us=959875 real_hash_size = 256
Sat Nov 15 18:49:41 2008 us=960104 virtual_hash_size = 256
Sat Nov 15 18:49:41 2008 us=960332 client_connect_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=960565 learn_address_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=960836 client_disconnect_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=961068 client_config_dir = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=961302 ccd_exclusive = DISABLED
Sat Nov 15 18:49:41 2008 us=961532 tmp_dir = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=961760 push_ifconfig_defined = DISABLED
Sat Nov 15 18:49:41 2008 us=962000 push_ifconfig_local = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=962238 push_ifconfig_remote_netmask = 0.0.0.0
Sat Nov 15 18:49:41 2008 us=962467 enable_c2c = DISABLED
Sat Nov 15 18:49:41 2008 us=962694 duplicate_cn = DISABLED
Sat Nov 15 18:49:41 2008 us=962921 cf_max = 0
Sat Nov 15 18:49:41 2008 us=963150 cf_per = 0
Sat Nov 15 18:49:41 2008 us=963379 max_clients = 1024
Sat Nov 15 18:49:41 2008 us=963609 max_routes_per_client = 256
Sat Nov 15 18:49:41 2008 us=963839 client_cert_not_required = DISABLED
Sat Nov 15 18:49:41 2008 us=964069 username_as_common_name = DISABLED
Sat Nov 15 18:49:41 2008 us=964300 auth_user_pass_verify_script = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=964545 auth_user_pass_verify_script_via_file = DISABLED
Sat Nov 15 18:49:41 2008 us=964847 client = DISABLED
Sat Nov 15 18:49:41 2008 us=965048 pull = DISABLED
Sat Nov 15 18:49:41 2008 us=965250 auth_user_pass_file = '[UNDEF]'
Sat Nov 15 18:49:41 2008 us=965456 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 20 2007
Sat Nov 15 18:49:42 2008 us=15536 Diffie-Hellman initialized with 1024 bit key
Sat Nov 15 18:49:42 2008 us=21069 LZO compression initialized
Sat Nov 15 18:49:42 2008 us=21975 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Nov 15 18:49:42 2008 us=72086 TUN/TAP device tun1 opened
Sat Nov 15 18:49:42 2008 us=72501 TUN/TAP TX queue length set to 100
Sat Nov 15 18:49:42 2008 us=72890 ifconfig tun1 192.168.25.1 pointopoint 192.168.25.2 mtu 1500
Sat Nov 15 18:49:42 2008 us=87489 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Nov 15 18:49:42 2008 us=88034 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,ifconfig 192.168.25.2 192.168.25.1,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Nov 15 18:49:42 2008 us=88289 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,ifconfig 192.168.25.1 192.168.25.2,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Nov 15 18:49:42 2008 us=88685 Local Options hash (VER=V4): '40c5ad26'
Sat Nov 15 18:49:42 2008 us=88966 Expected Remote Options hash (VER=V4): 'b7094d11'
Sat Nov 15 18:49:42 2008 us=89285 Socket Buffers: R=[110592->131072] S=[110592->131072]
Sat Nov 15 18:49:42 2008 us=89823 UDPv4 link local (bound): [undef]:8147
Sat Nov 15 18:49:42 2008 us=90054 UDPv4 link remote: [undef]
==== Sur cyclope ====
C'est le client
cyclope:~# openvpn --remote 82.127.57.95 --port 8147 --dev tun1 --ifconfig 192.168.25.2 192.168.25.1 --comp-lzo --verb 5 --tls-client --ca bts.eme-cacert.pem --cert cyclope.maison.mrs.pem --key cyclope.maison.mrs-key.pem
Sat Nov 15 18:55:03 2008 us=70505 Current Parameter Settings:
Sat Nov 15 18:55:03 2008 us=72038 config = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=72781 mode = 0
Sat Nov 15 18:55:03 2008 us=73464 persist_config = DISABLED
Sat Nov 15 18:55:03 2008 us=74166 persist_mode = 1
Sat Nov 15 18:55:03 2008 us=74853 show_ciphers = DISABLED
Sat Nov 15 18:55:03 2008 us=75617 show_digests = DISABLED
Sat Nov 15 18:55:03 2008 us=76425 show_engines = DISABLED
Sat Nov 15 18:55:03 2008 us=77118 genkey = DISABLED
Sat Nov 15 18:55:03 2008 us=77810 key_pass_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=78515 show_tls_ciphers = DISABLED
Sat Nov 15 18:55:03 2008 us=79374 proto = 0
Sat Nov 15 18:55:03 2008 us=80071 local = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=80886 remote_list[0] = {'82.127.57.95', 8147}
Sat Nov 15 18:55:03 2008 us=81641 remote_random = DISABLED
Sat Nov 15 18:55:03 2008 us=82336 local_port = 8147
Sat Nov 15 18:55:03 2008 us=83033 remote_port = 8147
Sat Nov 15 18:55:03 2008 us=84055 remote_float = DISABLED
Sat Nov 15 18:55:03 2008 us=84570 ipchange = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=84953 bind_local = ENABLED
Sat Nov 15 18:55:03 2008 us=85293 dev = 'tun1'
Sat Nov 15 18:55:03 2008 us=86334 dev_type = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=86994 dev_node = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=87748 tun_ipv6 = DISABLED
Sat Nov 15 18:55:03 2008 us=88442 ifconfig_local = '192.168.25.2'
Sat Nov 15 18:55:03 2008 us=89163 ifconfig_remote_netmask = '192.168.25.1'
Sat Nov 15 18:55:03 2008 us=89688 ifconfig_noexec = DISABLED
Sat Nov 15 18:55:03 2008 us=90204 ifconfig_nowarn = DISABLED
Sat Nov 15 18:55:03 2008 us=91041 shaper = 0
Sat Nov 15 18:55:03 2008 us=91799 tun_mtu = 1500
Sat Nov 15 18:55:03 2008 us=92494 tun_mtu_defined = ENABLED
Sat Nov 15 18:55:03 2008 us=93193 link_mtu = 1500
Sat Nov 15 18:55:03 2008 us=93887 link_mtu_defined = DISABLED
Sat Nov 15 18:55:03 2008 us=94587 tun_mtu_extra = 0
Sat Nov 15 18:55:03 2008 us=95535 tun_mtu_extra_defined = DISABLED
Sat Nov 15 18:55:03 2008 us=96226 fragment = 0
Sat Nov 15 18:55:03 2008 us=96917 mtu_discover_type = -1
Sat Nov 15 18:55:03 2008 us=97432 mtu_test = 0
Sat Nov 15 18:55:03 2008 us=97944 mlock = DISABLED
Sat Nov 15 18:55:03 2008 us=98458 keepalive_ping = 0
Sat Nov 15 18:55:03 2008 us=98613 keepalive_timeout = 0
Sat Nov 15 18:55:03 2008 us=98719 inactivity_timeout = 0
Sat Nov 15 18:55:03 2008 us=98822 ping_send_timeout = 0
Sat Nov 15 18:55:03 2008 us=98924 ping_rec_timeout = 0
Sat Nov 15 18:55:03 2008 us=99027 ping_rec_timeout_action = 0
Sat Nov 15 18:55:03 2008 us=99128 ping_timer_remote = DISABLED
Sat Nov 15 18:55:03 2008 us=99295 remap_sigusr1 = 0
Sat Nov 15 18:55:03 2008 us=99401 explicit_exit_notification = 0
Sat Nov 15 18:55:03 2008 us=99502 persist_tun = DISABLED
Sat Nov 15 18:55:03 2008 us=99604 persist_local_ip = DISABLED
Sat Nov 15 18:55:03 2008 us=99705 persist_remote_ip = DISABLED
Sat Nov 15 18:55:03 2008 us=99806 persist_key = DISABLED
Sat Nov 15 18:55:03 2008 us=99910 mssfix = 1450
Sat Nov 15 18:55:03 2008 us=100010 passtos = DISABLED
Sat Nov 15 18:55:03 2008 us=100116 resolve_retry_seconds = 1000000000
Sat Nov 15 18:55:03 2008 us=100220 connect_retry_seconds = 5
Sat Nov 15 18:55:03 2008 us=100322 username = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=100425 groupname = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=100708 chroot_dir = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=100831 cd_dir = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=100937 writepid = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=101038 up_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=101141 down_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=101243 down_pre = DISABLED
Sat Nov 15 18:55:03 2008 us=101344 up_restart = DISABLED
Sat Nov 15 18:55:03 2008 us=101447 up_delay = DISABLED
Sat Nov 15 18:55:03 2008 us=101548 daemon = DISABLED
Sat Nov 15 18:55:03 2008 us=101650 inetd = 0
Sat Nov 15 18:55:03 2008 us=101750 log = DISABLED
Sat Nov 15 18:55:03 2008 us=101852 suppress_timestamps = DISABLED
Sat Nov 15 18:55:03 2008 us=101955 nice = 0
Sat Nov 15 18:55:03 2008 us=102056 verbosity = 5
Sat Nov 15 18:55:03 2008 us=102158 mute = 0
Sat Nov 15 18:55:03 2008 us=102258 gremlin = 0
Sat Nov 15 18:55:03 2008 us=102358 status_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=102462 status_file_version = 1
Sat Nov 15 18:55:03 2008 us=102566 status_file_update_freq = 60
Sat Nov 15 18:55:03 2008 us=102667 occ = ENABLED
Sat Nov 15 18:55:03 2008 us=102769 rcvbuf = 65536
Sat Nov 15 18:55:03 2008 us=102871 sndbuf = 65536
Sat Nov 15 18:55:03 2008 us=102973 socks_proxy_server = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=103078 socks_proxy_port = 0
Sat Nov 15 18:55:03 2008 us=103234 socks_proxy_retry = DISABLED
Sat Nov 15 18:55:03 2008 us=103346 fast_io = DISABLED
Sat Nov 15 18:55:03 2008 us=103448 comp_lzo = ENABLED
Sat Nov 15 18:55:03 2008 us=103551 comp_lzo_adaptive = ENABLED
Sat Nov 15 18:55:03 2008 us=103654 route_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=103758 route_default_gateway = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=103860 route_noexec = DISABLED
Sat Nov 15 18:55:03 2008 us=103964 route_delay = 0
Sat Nov 15 18:55:03 2008 us=104066 route_delay_window = 30
Sat Nov 15 18:55:03 2008 us=104167 route_delay_defined = DISABLED
Sat Nov 15 18:55:03 2008 us=104271 management_addr = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=104376 management_port = 0
Sat Nov 15 18:55:03 2008 us=104477 management_user_pass = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=104582 management_log_history_cache = 250
Sat Nov 15 18:55:03 2008 us=104687 management_echo_buffer_size = 100
Sat Nov 15 18:55:03 2008 us=104789 management_query_passwords = DISABLED
Sat Nov 15 18:55:03 2008 us=104892 management_hold = DISABLED
Sat Nov 15 18:55:03 2008 us=104996 shared_secret_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=105101 key_direction = 0
Sat Nov 15 18:55:03 2008 us=105207 ciphername_defined = ENABLED
Sat Nov 15 18:55:03 2008 us=105313 ciphername = 'BF-CBC'
Sat Nov 15 18:55:03 2008 us=105418 authname_defined = ENABLED
Sat Nov 15 18:55:03 2008 us=105522 authname = 'SHA1'
Sat Nov 15 18:55:03 2008 us=105628 keysize = 0
Sat Nov 15 18:55:03 2008 us=105730 engine = DISABLED
Sat Nov 15 18:55:03 2008 us=109467 replay = ENABLED
Sat Nov 15 18:55:03 2008 us=109904 mute_replay_warnings = DISABLED
Sat Nov 15 18:55:03 2008 us=110259 replay_window = 64
Sat Nov 15 18:55:03 2008 us=111754 replay_time = 15
Sat Nov 15 18:55:03 2008 us=112450 packet_id_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=113148 use_iv = ENABLED
Sat Nov 15 18:55:03 2008 us=113838 test_crypto = DISABLED
Sat Nov 15 18:55:03 2008 us=114529 tls_server = DISABLED
Sat Nov 15 18:55:03 2008 us=115306 tls_client = ENABLED
Sat Nov 15 18:55:03 2008 us=115980 key_method = 2
Sat Nov 15 18:55:03 2008 us=116674 ca_file = 'bts.eme-cacert.pem'
Sat Nov 15 18:55:03 2008 us=117377 dh_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=118067 cert_file = 'cyclope.maison.mrs.pem'
Sat Nov 15 18:55:03 2008 us=118769 priv_key_file = 'cyclope.maison.mrs-key.pem'
Sat Nov 15 18:55:03 2008 us=119534 pkcs12_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=120226 cipher_list = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=120918 tls_verify = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=121610 tls_remote = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=121769 crl_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=122060 ns_cert_type = 0
Sat Nov 15 18:55:03 2008 us=122174 tls_timeout = 2
Sat Nov 15 18:55:03 2008 us=122281 renegotiate_bytes = 0
Sat Nov 15 18:55:03 2008 us=122389 renegotiate_packets = 0
Sat Nov 15 18:55:03 2008 us=122496 renegotiate_seconds = 3600
Sat Nov 15 18:55:03 2008 us=122604 handshake_window = 60
Sat Nov 15 18:55:03 2008 us=122709 transition_window = 3600
Sat Nov 15 18:55:03 2008 us=122813 single_session = DISABLED
Sat Nov 15 18:55:03 2008 us=122918 tls_exit = DISABLED
Sat Nov 15 18:55:03 2008 us=123024 tls_auth_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=123350 server_network = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=123480 server_netmask = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=123599 server_bridge_ip = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=123716 server_bridge_netmask = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=123835 server_bridge_pool_start = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=123954 server_bridge_pool_end = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=124061 ifconfig_pool_defined = DISABLED
Sat Nov 15 18:55:03 2008 us=124180 ifconfig_pool_start = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=124299 ifconfig_pool_end = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=124455 ifconfig_pool_netmask = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=124574 ifconfig_pool_persist_filename = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=124683 ifconfig_pool_persist_refresh_freq = 600
Sat Nov 15 18:55:03 2008 us=124790 ifconfig_pool_linear = DISABLED
Sat Nov 15 18:55:03 2008 us=124897 n_bcast_buf = 256
Sat Nov 15 18:55:03 2008 us=125005 tcp_queue_limit = 64
Sat Nov 15 18:55:03 2008 us=125109 real_hash_size = 256
Sat Nov 15 18:55:03 2008 us=125214 virtual_hash_size = 256
Sat Nov 15 18:55:03 2008 us=125321 client_connect_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=125429 learn_address_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=125536 client_disconnect_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=125642 client_config_dir = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=125747 ccd_exclusive = DISABLED
Sat Nov 15 18:55:03 2008 us=125851 tmp_dir = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=125955 push_ifconfig_defined = DISABLED
Sat Nov 15 18:55:03 2008 us=126075 push_ifconfig_local = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=126193 push_ifconfig_remote_netmask = 0.0.0.0
Sat Nov 15 18:55:03 2008 us=126299 enable_c2c = DISABLED
Sat Nov 15 18:55:03 2008 us=126403 duplicate_cn = DISABLED
Sat Nov 15 18:55:03 2008 us=126509 cf_max = 0
Sat Nov 15 18:55:03 2008 us=126612 cf_per = 0
Sat Nov 15 18:55:03 2008 us=126718 max_clients = 1024
Sat Nov 15 18:55:03 2008 us=126826 max_routes_per_client = 256
Sat Nov 15 18:55:03 2008 us=126931 client_cert_not_required = DISABLED
Sat Nov 15 18:55:03 2008 us=127037 username_as_common_name = DISABLED
Sat Nov 15 18:55:03 2008 us=127144 auth_user_pass_verify_script = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=127317 auth_user_pass_verify_script_via_file = DISABLED
Sat Nov 15 18:55:03 2008 us=127426 client = DISABLED
Sat Nov 15 18:55:03 2008 us=127529 pull = DISABLED
Sat Nov 15 18:55:03 2008 us=127633 auth_user_pass_file = '[UNDEF]'
Sat Nov 15 18:55:03 2008 us=127747 OpenVPN 2.0.9 i486-pc-linux-gnu [SSL] [LZO] [EPOLL] built on Sep 20 2007
Sat Nov 15 18:55:03 2008 us=128224 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sat Nov 15 18:55:03 2008 us=193832 LZO compression initialized
Sat Nov 15 18:55:03 2008 us=215986 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Nov 15 18:55:03 2008 us=274091 TUN/TAP device tun1 opened
Sat Nov 15 18:55:03 2008 us=275033 TUN/TAP TX queue length set to 100
Sat Nov 15 18:55:03 2008 us=275779 ifconfig tun1 192.168.25.2 pointopoint 192.168.25.1 mtu 1500
Sat Nov 15 18:55:03 2008 us=467561 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Nov 15 18:55:03 2008 us=468607 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,ifconfig 192.168.25.1 192.168.25.2,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Nov 15 18:55:03 2008 us=469420 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,ifconfig 192.168.25.2 192.168.25.1,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Nov 15 18:55:03 2008 us=470311 Local Options hash (VER=V4): 'b7094d11'
Sat Nov 15 18:55:03 2008 us=471125 Expected Remote Options hash (VER=V4): '40c5ad26'
Sat Nov 15 18:55:03 2008 us=472024 Socket Buffers: R=[110592->131072] S=[110592->131072]
Sat Nov 15 18:55:03 2008 us=472741 UDPv4 link local (bound): [undef]:8147
Sat Nov 15 18:55:03 2008 us=473457 UDPv4 link remote: 82.127.57.95:8147
WRSat Nov 15 18:55:03 2008 us=566989 TLS: Initial packet from 82.127.57.95:8147, sid=fa310697 a7811164
WWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSat Nov 15 18:55:04 2008 us=947948 VERIFY OK: depth=1, /C=FR/ST=Bouches_du_Rhone/L=Marseille/O=EME/OU=EME/CN=rootCA.bts.eme/emailAddress=sysop@bts.eme
Sat Nov 15 18:55:04 2008 us=963876 VERIFY OK: depth=0, /C=FR/ST=Bouches_du_Rhone/L=Marseille/O=EME/OU=EME/CN=aaron.bts.eme/emailAddress=sysop@bts.eme
WRWRWRWRWRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWWWWRRRRWRWRSat Nov 15 18:55:07 2008 us=57442 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 15 18:55:07 2008 us=58073 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 15 18:55:07 2008 us=59658 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 15 18:55:07 2008 us=60217 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WSat Nov 15 18:55:07 2008 us=62054 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sat Nov 15 18:55:07 2008 us=62827 [aaron.bts.eme] Peer Connection Initiated with 82.127.57.95:8147
Sat Nov 15 18:55:08 2008 us=235349 Initialization Sequence Completed
Sitôt que le client se connecte au serveur, il obtient le certificat de ''aaron'' et vérifie qu'il est bien signé par la CA. Il doit se passer aussi des choses sur ''aaron'' concernant l'identité de ''cyclope'' :
RSat Nov 15 18:55:11 2008 us=189661 TLS: Initial packet from 82.229.41.132:8147, sid=66df4f24 9bbda6c9
WRRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRSat Nov 15 18:55:14 2008 us=507464 VERIFY OK: depth=1, /C=FR/ST=Bouches_du_Rhone/L=Marseille/O=EME/OU=EME/CN=rootCA.bts.eme/emailAddress=sysop@bts.eme
Sat Nov 15 18:55:14 2008 us=517805 VERIFY OK: depth=0, /C=FR/ST=Bouches_du_Rhone/L=Marseille/O=EME/OU=EME/CN=cyclope.maison.mrs/emailAddress=sysop@maison.mrs
WRWRWRWRWRWRWRWRWRWRWRSat Nov 15 18:55:14 2008 us=697312 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 15 18:55:14 2008 us=697683 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 15 18:55:14 2008 us=698267 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 15 18:55:14 2008 us=698533 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
WWWRRRSat Nov 15 18:55:14 2008 us=775185 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sat Nov 15 18:55:14 2008 us=775576 [cyclope.maison.mrs] Peer Connection Initiated with 80.8.135.67:8147
Sat Nov 15 18:55:15 2008 us=812670 Initialization Sequence Completed
Effectivement il y a bien authentification mutuelle des deux bouts du tunnel.
===== Conclusion presque finale =====
Nous disposons désormais d'un tunnel chiffré, où chaque extrémité sait authentifier l'autre bout. En réalité, il ne fait que vérifier que le certificat présenté par l'autre bout est bien signé par la CA connue (directive ''--ca'').
Avant de mettre en production, il serait peut-être bon de durcir encore un peu plus ce tunnel, si c'est possible.