Difference between revisions of "Building a tiered access OpenVPN gateway on OpenBSD"
m (→The Design: typo) |
(Updated with working scripts and configs :)) |
||
Line 1: | Line 1: | ||
== Introduction == | == Introduction == | ||
− | |||
− | |||
I recently needed to expand the scope of the [http://openvpn.net OpenVPN] gateway I administer to allow clients to have very limited access over it to a server on our network while still allowing certain employees more access. I did an initial quick and dirty config using client-config-directories but I wasn't satisfied with that from a maintenance point of view. This page will document my improved approach, using learn-address and client-connect scripts. | I recently needed to expand the scope of the [http://openvpn.net OpenVPN] gateway I administer to allow clients to have very limited access over it to a server on our network while still allowing certain employees more access. I did an initial quick and dirty config using client-config-directories but I wasn't satisfied with that from a maintenance point of view. This page will document my improved approach, using learn-address and client-connect scripts. | ||
Line 17: | Line 15: | ||
== The Scripts == | == The Scripts == | ||
− | === client- | + | === client-connect.sh === |
<pre> | <pre> | ||
#!/bin/sh | #!/bin/sh | ||
Line 30: | Line 28: | ||
Profiles=`grep -l "^${common_name}$" profiles/*` | Profiles=`grep -l "^${common_name}$" profiles/*` | ||
− | + | ||
if [ $? -ne 0 ]; then | if [ $? -ne 0 ]; then | ||
− | echo "No profile | + | echo "$0: No profile match for $3" |
exit 1 | exit 1 | ||
fi | fi | ||
Line 39: | Line 37: | ||
if [ $MatchCount -gt 1 ]; then | if [ $MatchCount -gt 1 ]; then | ||
− | echo "Multiple profiles matched, | + | echo "$0: Multiple profiles matched for $3, this is bad" |
exit 1 | exit 1 | ||
fi | fi | ||
Line 47: | Line 45: | ||
if [ -f $ProfileConfig ]; then | if [ -f $ProfileConfig ]; then | ||
+ | echo "$0: Client ${common_name} configured using the ${Profile} profile" | ||
cp $ProfileConfig $1 | cp $ProfileConfig $1 | ||
else | else | ||
− | echo "Config for profile $Profile not found" | + | echo "$0: Config for profile $Profile not found" |
exit 1 | exit 1 | ||
fi | fi | ||
</pre> | </pre> | ||
− | === | + | === client-disconnect.sh === |
+ | |||
+ | <pre> | ||
+ | #!/bin/sh | ||
+ | |||
+ | # This is an openvpn client-disconnect script that deletes client IP | ||
+ | # addresses from PF tables on client disconnect. | ||
+ | |||
+ | # everything is passed via environment variables. common_name and | ||
+ | # ifconfig_pool_remote_ip are all we care about in this script. | ||
+ | |||
+ | Profiles=`grep -l "^${common_name}$" profiles/*` | ||
+ | |||
+ | if [ $? -ne 0 ]; then | ||
+ | echo "$0: No profile matched for $3" | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | MatchCount=`echo $Profiles | awk '{ printf "%d", NF }'` | ||
+ | |||
+ | if [ $MatchCount -gt 1 ]; then | ||
+ | echo "$0: Multiple profiles matched for $3, this is bad" | ||
+ | exit 1 | ||
+ | fi | ||
+ | |||
+ | Profile=`echo $Profiles | awk -F / '{ print $NF }'` | ||
+ | Table="vpn${Profile}" | ||
+ | |||
+ | |||
+ | echo "$0: Deleting user ${common_name} at ${ifconfig_pool_remote_ip} from PF table ${Table}" | ||
+ | sudo pfctl -t ${Table} -T delete ${ifconfig_pool_remote_ip} > /dev/null | ||
+ | </pre> | ||
+ | |||
+ | === learn-address.sh === | ||
<pre> | <pre> | ||
Line 66: | Line 98: | ||
# $2 is IP/Subnet/MAC | # $2 is IP/Subnet/MAC | ||
# $3 is certificate's common name | # $3 is certificate's common name | ||
+ | |||
+ | if [ $1 == "delete" ]; then | ||
+ | Tables=`ls profiles/* | awk -F / '{ printf "vpn%s ", $NF }'` | ||
+ | echo "removing $2 from PF tables ${Tables}" | ||
+ | for Table in $Tables; do | ||
+ | sudo /sbin/pfctl -t ${Table} -T delete $2 | ||
+ | done | ||
+ | exit 0 | ||
+ | fi | ||
Profiles=`grep -l "^${3}$" profiles/*` | Profiles=`grep -l "^${3}$" profiles/*` | ||
if [ $? -ne 0 ]; then | if [ $? -ne 0 ]; then | ||
− | echo "No profile | + | echo "$0: No profile match for $3" |
exit 1 | exit 1 | ||
fi | fi | ||
Line 77: | Line 118: | ||
if [ $MatchCount -gt 1 ]; then | if [ $MatchCount -gt 1 ]; then | ||
− | echo "Multiple profiles matched, | + | echo "$0: Multiple profiles matched for $3, this is bad" |
exit 1 | exit 1 | ||
fi | fi | ||
Line 84: | Line 125: | ||
Table="vpn${Profile}" | Table="vpn${Profile}" | ||
− | if [ $1 != " | + | if [ $1 != "add" ]; then # if we're updating |
− | echo "pfctl -t ${Table} -T | + | echo "$0: Deleting user $3 at $2 from PF table ${Table}" |
+ | sudo /sbin/pfctl -t ${Table} -T delete $2 > /dev/null | ||
fi | fi | ||
− | + | # delete doesn't get this far | |
− | + | echo "$0: Adding user $3 at $2 to PF table ${Table}" | |
− | + | sudo /sbin/pfctl -t ${Table} -T add $2 > /dev/null | |
+ | </pre> | ||
+ | |||
+ | == Service Configuration == | ||
+ | |||
+ | === Sudoers === | ||
+ | You'll have to allow the user openvpn is running as (in my case _openvpn:_openvpn) to add/delete from the vpn PF tables. Here's how I did it: | ||
+ | |||
+ | <pre> | ||
+ | _openvpn ALL=(root) NOPASSWD: /sbin/pfctl -t vpn* -T add * | ||
+ | _openvpn ALL=(root) NOPASSWD: /sbin/pfctl -t vpn* -T delete * | ||
</pre> | </pre> | ||
+ | |||
+ | === OpenVPN === | ||
+ | You'll need a couple of config options turned on in your openvpn server conf: | ||
+ | |||
+ | <pre> | ||
+ | learn-address ./learn-address.sh | ||
+ | client-connect ./client-connect.sh | ||
+ | client-disconnect ./client-disconnect.sh | ||
+ | tmp-dir /tmp/openvpn | ||
+ | </tmp> | ||
+ | |||
+ | Also, I recommend you add <tt>explicit-exit-notify</tt> to your openvpn client configs, otherwise ip addresses can persist in the pf tables for a while after a client disconnects. | ||
+ | |||
+ | === PF === | ||
+ | Just set a "vpn<ProfileName>" for each profile you setup and add your firewall rules in pf.conf. |
Revision as of 19:44, 18 November 2008
Introduction
I recently needed to expand the scope of the OpenVPN gateway I administer to allow clients to have very limited access over it to a server on our network while still allowing certain employees more access. I did an initial quick and dirty config using client-config-directories but I wasn't satisfied with that from a maintenance point of view. This page will document my improved approach, using learn-address and client-connect scripts.
The Design
I wanted to add the concept of 'profiles' to OpenVPN to allow me to assign users access depending on their certificate's common name. I also wanted it to be scripted using only OpenBSD's shell commands so that no additional software with possible security holes or upgrade issues could interfere with the VPN's operation.
I have 2 configuration directories: profile and profileoptions. Profiles contains a set of files, each representing a profile. Each Profile file contains a list of common names, each on a new line, that delineates who is a member of that profile. A common name can only appear in one profile file at any one time, multiple matches are an error.
The other directory, profileoptions, contains the openvpn options for that profile. These can be any of the following openvpn config directives: push, push-reset, iroute, ifconfig-push and config. See the OpenVPN Man Page for further details.
In addition, the pf.conf file should have a table for each vpn profile. The tables should be named according to the format "vpn<ProfileName>" so client's connecting as an admin have their IP in the vpnadmin table.
The Scripts
client-connect.sh
#!/bin/sh # This is an openvpn client-connect script that pushes routes or other # openvpn client config stuff to a newly connected client depending on # their detected 'profile'. # $1 is tempfile # everything else is passed via environment variables. common_name is # all we care about in this script. Profiles=`grep -l "^${common_name}$" profiles/*` if [ $? -ne 0 ]; then echo "$0: No profile match for $3" exit 1 fi MatchCount=`echo $Profiles | awk '{ printf "%d", NF }'` if [ $MatchCount -gt 1 ]; then echo "$0: Multiple profiles matched for $3, this is bad" exit 1 fi Profile=`echo $Profiles | awk -F / '{ print $NF }'` ProfileConfig="profileoptions/${Profile}" if [ -f $ProfileConfig ]; then echo "$0: Client ${common_name} configured using the ${Profile} profile" cp $ProfileConfig $1 else echo "$0: Config for profile $Profile not found" exit 1 fi
client-disconnect.sh
#!/bin/sh # This is an openvpn client-disconnect script that deletes client IP # addresses from PF tables on client disconnect. # everything is passed via environment variables. common_name and # ifconfig_pool_remote_ip are all we care about in this script. Profiles=`grep -l "^${common_name}$" profiles/*` if [ $? -ne 0 ]; then echo "$0: No profile matched for $3" exit 1 fi MatchCount=`echo $Profiles | awk '{ printf "%d", NF }'` if [ $MatchCount -gt 1 ]; then echo "$0: Multiple profiles matched for $3, this is bad" exit 1 fi Profile=`echo $Profiles | awk -F / '{ print $NF }'` Table="vpn${Profile}" echo "$0: Deleting user ${common_name} at ${ifconfig_pool_remote_ip} from PF table ${Table}" sudo pfctl -t ${Table} -T delete ${ifconfig_pool_remote_ip} > /dev/null
learn-address.sh
#!/bin/sh # This is an openvpn learn-address script that modifies PF rules dynamically # and supports 'profiles' to allow you to manage client connections without # the headache of assigning static IPs. # $1 is add/update/delete # $2 is IP/Subnet/MAC # $3 is certificate's common name if [ $1 == "delete" ]; then Tables=`ls profiles/* | awk -F / '{ printf "vpn%s ", $NF }'` echo "removing $2 from PF tables ${Tables}" for Table in $Tables; do sudo /sbin/pfctl -t ${Table} -T delete $2 done exit 0 fi Profiles=`grep -l "^${3}$" profiles/*` if [ $? -ne 0 ]; then echo "$0: No profile match for $3" exit 1 fi MatchCount=`echo $Profiles | awk '{ printf "%d", NF }'` if [ $MatchCount -gt 1 ]; then echo "$0: Multiple profiles matched for $3, this is bad" exit 1 fi Profile=`echo $Profiles | awk -F / '{ print $NF }'` Table="vpn${Profile}" if [ $1 != "add" ]; then # if we're updating echo "$0: Deleting user $3 at $2 from PF table ${Table}" sudo /sbin/pfctl -t ${Table} -T delete $2 > /dev/null fi # delete doesn't get this far echo "$0: Adding user $3 at $2 to PF table ${Table}" sudo /sbin/pfctl -t ${Table} -T add $2 > /dev/null
Service Configuration
Sudoers
You'll have to allow the user openvpn is running as (in my case _openvpn:_openvpn) to add/delete from the vpn PF tables. Here's how I did it:
_openvpn ALL=(root) NOPASSWD: /sbin/pfctl -t vpn* -T add * _openvpn ALL=(root) NOPASSWD: /sbin/pfctl -t vpn* -T delete *
OpenVPN
You'll need a couple of config options turned on in your openvpn server conf:
learn-address ./learn-address.sh client-connect ./client-connect.sh client-disconnect ./client-disconnect.sh tmp-dir /tmp/openvpn </tmp> Also, I recommend you add explicit-exit-notify to your openvpn client configs, otherwise ip addresses can persist in the pf tables for a while after a client disconnects.PF
Just set a "vpn<ProfileName>" for each profile you setup and add your firewall rules in pf.conf.