s83/privacy-guides
1
0
Fork 0
mirror of https://github.com/sunknudsen/privacy-guides.git synced 2025-02-23 17:43:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Removed confusing step from strongSwan guide

Browse Source
This commit is contained in:
Sun Knudsen 2020-08-17 06:45:10 -04:00
parent 5d25329cd0
commit 8e272e930b
No known key found for this signature in database
GPG Key ID: 1FA767862BBD1305
1 changed files with 38 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
how-to-self-host-a-hardened-strongswan-ikev2-ipsec-vpn-server-for-ios-and-macos/README.md
View File

@ -78,30 +78,7 @@ If server uses public key authentication, run the following and type in passphra
ssh root@185.193.126.203 -i ~/.ssh/vpn-server ssh root@185.193.126.203 -i ~/.ssh/vpn-server
``` ```
### Step 3: add SSH public key to `authorized_keys` ### Step 3: create `vpn-server-admin` user
> This step is only required if server was configured without SSH public key.
On Mac, run:
```shell
echo "cat << \"EOF\" > ~/.ssh/authorized_keys
$(cat ~/.ssh/vpn-server.pub)
EOF"
```
On server, paste output from Mac command and press <kbd>enter</kbd>.
```shell
mkdir -p ~/.ssh
cat << "EOF" > ~/.ssh/authorized_keys
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCu4k9OcJlatGgUoo41m18Hekv+nSHq1w7qcuAuOZWLI8y5aYkLzyEgyp7EibB0rcmwiZfwx/RDb5zAvlr9KGsOWOYJ/gRIf4AwK1PdBPDo8jaa02J/H585NHV7T7XJ7Ycl/LeJh+oDXGs4OOspiFM/7NuleqCA0sSuJEnnuuTZsIDAlJwtWIJTM8lg4nWCQx2xAGkRyx4eNHE2vmlg+xHu3PbHg9kpSIaBWpx0WsysypyaB77+pkid6kYzxPXexoxFm4FnkoY7PZGb97wl4FwW1EK/yo9rnwbtEq5ny96JEHqeJdxeBGHYrsAoRro4jPWYXvdXZV2s27NYC6S3yHsJdaLfyfJXyTaygOyyaf39GcwqfJZpmVYwVyfZ2Go6ec9R/dFbKEA4Ue7aeCkDskSTiMuUZjYjfhezpa4Y0Jiy+lDZFVSv3tsBYu7Nxq0erZ2ygRJAXUMvvyFICJQGUhblRGXAOwYUt72CSUM0ZMsr84aOWsyzRwVQXzxETuDgnXk= vpn-server
EOF
```
On server, confirm output from `cat ~/.ssh/authorized_keys` matches output from `cat ~/.ssh/vpn-server.pub` on Mac.
### Step 4: create `vpn-server-admin` user
When asked for password, use output from `openssl rand -base64 24` (and store password in password manager). All other fields are optional, press <kbd>enter</kbd> to skip them and then press <kbd>Y</kbd>. When asked for password, use output from `openssl rand -base64 24` (and store password in password manager). All other fields are optional, press <kbd>enter</kbd> to skip them and then press <kbd>Y</kbd>.
@ -125,7 +102,7 @@ Enter the new value, or press ENTER for the default
Is the information correct? [Y/n] Y Is the information correct? [Y/n] Y
``` ```
### Step 5: copy root’s `authorized_keys` file to vpn-server-admin’s home folder ### Step 4: copy root’s `authorized_keys` file to vpn-server-admin’s home folder
```shell ```shell
mkdir /home/vpn-server-admin/.ssh mkdir /home/vpn-server-admin/.ssh
@ -133,7 +110,7 @@ cp /root/.ssh/authorized_keys /home/vpn-server-admin/.ssh/authorized_keys
chown -R vpn-server-admin:vpn-server-admin /home/vpn-server-admin/.ssh chown -R vpn-server-admin:vpn-server-admin /home/vpn-server-admin/.ssh
``` ```
### Step 6: set root password ### Step 5: set root password
When asked for password, use output from `openssl rand -base64 24` (and store password in password manager). When asked for password, use output from `openssl rand -base64 24` (and store password in password manager).
@ -141,13 +118,13 @@ When asked for password, use output from `openssl rand -base64 24` (and store pa
passwd passwd
``` ```
### Step 7: log out ### Step 6: log out
```shell ```shell
exit exit
``` ```
### Step 8: log in as `vpn-server-admin` ### Step 7: log in as `vpn-server-admin`
Replace `185.193.126.203` with IP of server. Replace `185.193.126.203` with IP of server.
@ -155,7 +132,7 @@ Replace `185.193.126.203` with IP of server.
ssh vpn-server-admin@185.193.126.203 -i .ssh/vpn-server ssh vpn-server-admin@185.193.126.203 -i .ssh/vpn-server
``` ```
### Step 9: switch to root ### Step 8: switch to root
When asked, enter root password. When asked, enter root password.
@ -163,7 +140,7 @@ When asked, enter root password.
su - su -
``` ```
### Step 10: update SSH config to disable root login and password authentication and restart SSH ### Step 9: update SSH config to disable root login and password authentication and restart SSH
```shell ```shell
sed -i -E 's/(#)?PermitRootLogin (prohibit-password|yes)/PermitRootLogin no/' /etc/ssh/sshd_config sed -i -E 's/(#)?PermitRootLogin (prohibit-password|yes)/PermitRootLogin no/' /etc/ssh/sshd_config
@ -171,7 +148,7 @@ sed -i -E 's/(#)?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh
systemctl restart ssh systemctl restart ssh
``` ```
### Step 11: update apt index files and upgrade packages ### Step 10: update apt index files and upgrade packages
#### Update apt index files #### Update apt index files
@ -185,7 +162,7 @@ apt update
apt upgrade -y apt upgrade -y
``` ```
### Step 12: install and configure Vim ### Step 11: install and configure Vim
#### Install Vim #### Install Vim
@ -212,7 +189,7 @@ syntax on
EOF EOF
``` ```
### Step 13: set timezone (the following is for Montreal time) ### Step 12: set timezone (the following is for Montreal time)
See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for available timezones. See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for available timezones.
@ -220,7 +197,7 @@ See https://en.wikipedia.org/wiki/List_of_tz_database_time_zones for available t
timedatectl set-timezone America/Montreal timedatectl set-timezone America/Montreal
``` ```
### Step 14: detect network interface and save to environment variables ### Step 13: detect network interface and save to environment variables
```console ```console
$ ip -4 route | grep "default" | awk '{print "STRONGSWAN_INTERFACE="$5}' | tee -a ~/.bashrc $ ip -4 route | grep "default" | awk '{print "STRONGSWAN_INTERFACE="$5}' | tee -a ~/.bashrc
@ -229,7 +206,7 @@ STRONGSWAN_INTERFACE=eth0
$ source ~/.bashrc $ source ~/.bashrc
``` ```
### Step 15: install cURL and Python, generate random IPv6 ULA and save to environment variables ### Step 14: install cURL and Python, generate random IPv6 ULA and save to environment variables
#### Install cURL and Python #### Install cURL and Python
@ -250,7 +227,7 @@ STRONGSWAN_IPV6_ULA=fdcb:f7a1:38ec::/64
$ source ~/.bashrc $ source ~/.bashrc
``` ```
### Step 16: install iptables-persistent ### Step 15: install iptables-persistent
When asked to save current IPv4 or IPv6 rules, answer `Yes`. When asked to save current IPv4 or IPv6 rules, answer `Yes`.
@ -258,7 +235,7 @@ When asked to save current IPv4 or IPv6 rules, answer `Yes`.
apt install -y iptables-persistent apt install -y iptables-persistent
``` ```
### Step 17: configure iptables ### Step 16: configure iptables
```shell ```shell
iptables -N SSH_BRUTE_FORCE_MITIGATION iptables -N SSH_BRUTE_FORCE_MITIGATION
@ -337,7 +314,7 @@ ip6tables -P INPUT DROP
ip6tables -P OUTPUT DROP ip6tables -P OUTPUT DROP
``` ```
### Step 18: log out and log in to confirm iptables didn’t block SSH ### Step 17: log out and log in to confirm iptables didn’t block SSH
#### Log out #### Log out
@ -362,14 +339,14 @@ When asked, enter root password.
su - su -
``` ```
### Step 19: make iptables rules persistent ### Step 18: make iptables rules persistent
```shell ```shell
iptables-save > /etc/iptables/rules.v4 iptables-save > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6 ip6tables-save > /etc/iptables/rules.v6
``` ```
### Step 20: add and enable dummy network interface ### Step 19: add and enable dummy network interface
If server is configured to use `/etc/network/interfaces`, run: If server is configured to use `/etc/network/interfaces`, run:
@ -402,7 +379,7 @@ EOF
systemctl restart systemd-networkd systemctl restart systemd-networkd
``` ```
### Step 21: install, configure and restart dnsmasq ### Step 20: install, configure and restart dnsmasq
#### Install dnsmasq #### Install dnsmasq
@ -428,7 +405,7 @@ EOF
systemctl restart dnsmasq systemctl restart dnsmasq
``` ```
### Step 22: install strongSwan ### Step 21: install strongSwan
If you are shown an "Old runlevel management superseded" warning, answer `Ok`. If you are shown an "Old runlevel management superseded" warning, answer `Ok`.
@ -436,7 +413,7 @@ If you are shown an "Old runlevel management superseded" warning, answer `Ok`.
apt install -y strongswan libcharon-extra-plugins apt install -y strongswan libcharon-extra-plugins
``` ```
### Step 23: configure strongSwan ### Step 22: configure strongSwan
#### Find server’s DNS nameserver(s) #### Find server’s DNS nameserver(s)
@ -609,7 +586,7 @@ sed -i 's/After=network-online.target/After=dnsmasq.service/' /lib/systemd/syste
systemctl daemon-reload systemctl daemon-reload
``` ```
### Step 24: create `strongswan-certs` folder ### Step 23: create `strongswan-certs` folder
> For security reasons, steps 24 to 28 are done on Mac vs server. > For security reasons, steps 24 to 28 are done on Mac vs server.
@ -618,7 +595,7 @@ mkdir ~/Desktop/strongswan-certs
cd ~/Desktop/strongswan-certs cd ~/Desktop/strongswan-certs
``` ```
### Step 25: create OpenSSL config file ### Step 24: create OpenSSL config file
#### Set client common name #### Set client common name
@ -663,7 +640,7 @@ extendedKeyUsage = serverAuth, 1.3.6.1.5.5.8.2.2
EOF EOF
``` ```
### Step 26: generate certificate authority cert ### Step 25: generate certificate authority cert
```console ```console
$ openssl genrsa -out ca.key 4096 $ openssl genrsa -out ca.key 4096
@ -675,7 +652,7 @@ e is 65537 (0x10001)
$ openssl req -x509 -new -nodes -config openssl.cnf -extensions ca -key ca.key -subj "/C=US/O=Self-hosted strongSwan VPN/CN=vpn-server.com" -days 3650 -out ca.crt $ openssl req -x509 -new -nodes -config openssl.cnf -extensions ca -key ca.key -subj "/C=US/O=Self-hosted strongSwan VPN/CN=vpn-server.com" -days 3650 -out ca.crt
``` ```
### Step 27: generate server cert ### Step 26: generate server cert
```console ```console
$ openssl genrsa -out server.key 4096 $ openssl genrsa -out server.key 4096
@ -692,7 +669,7 @@ subject=/C=US/O=Self-hosted strongSwan VPN/CN=vpn-server.com
Getting CA Private Key Getting CA Private Key
``` ```
### Step 28: generate client cert ### Step 27: generate client cert
When asked for export password, use output from `openssl rand -base64 24` (and store password in password manager). When asked for export password, use output from `openssl rand -base64 24` (and store password in password manager).
@ -715,29 +692,29 @@ Enter Export Password:
Verifying - Enter Export Password: Verifying - Enter Export Password:
``` ```
### Step 29: copy/paste the content of `ca.crt`, `server.key` and `server.crt` to server and make private key root-only. ### Step 28: copy/paste the content of `ca.crt`, `server.key` and `server.crt` to server and make private key root-only.
On Mac: run `cat ca.crt` On Mac: run `cat ca.crt`
On server: run `vi /etc/ipsec.d/cacerts/ca.crt`, press <kbd>i</kbd>, paste output from previous step in the window and press <kbd>shift+z+z</kbd> On server: run `vi /etc/ipsec.d/cacerts/ca.crt`, press <kbd>i</kbd>, paste output from previous step in window, press <kbd>esc</kbd> and press <kbd>shift+z+z</kbd>
On Mac: run `cat server.key` On Mac: run `cat server.key`
On server: run `vi /etc/ipsec.d/private/server.key`, press <kbd>i</kbd>, paste output from previous step in the window and press <kbd>shift+z+z</kbd> On server: run `vi /etc/ipsec.d/private/server.key`, press <kbd>i</kbd>, paste output from previous step in window, press <kbd>esc</kbd> and press <kbd>shift+z+z</kbd>
On Mac: run `cat server.crt` On Mac: run `cat server.crt`
On server: run `vi /etc/ipsec.d/certs/server.crt`, press <kbd>i</kbd>, paste output from previous step in the window and press <kbd>shift+z+z</kbd> On server: run `vi /etc/ipsec.d/certs/server.crt`, press <kbd>i</kbd>, paste output from previous step in window, press <kbd>esc</kbd> and press <kbd>shift+z+z</kbd>
On server: run `chmod -R 600 /etc/ipsec.d/private` On server: run `chmod -R 600 /etc/ipsec.d/private`
### Step 30: restart strongSwan ### Step 29: restart strongSwan
```shell ```shell
systemctl restart strongswan systemctl restart strongswan
``` ```
### Step 31: configure sysctl ### Step 30: configure sysctl
#### Backup and override `/etc/sysctl.conf` #### Backup and override `/etc/sysctl.conf`
@ -770,7 +747,7 @@ sed -i -E 's/#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/' /e
sysctl -p sysctl -p
``` ```
### Step 32: create VPN profile for iOS and macOS using [Apple Configurator 2](https://support.apple.com/apple-configurator) ### Step 31: create VPN profile for iOS and macOS using [Apple Configurator 2](https://support.apple.com/apple-configurator)
> When configuring strongSwan using certs and dnsmasq, two devices cannot use the same provisioning profile simultaneously. > When configuring strongSwan using certs and dnsmasq, two devices cannot use the same provisioning profile simultaneously.
@ -792,7 +769,7 @@ The "Child SA Params" are the same as "IKE SA Params".
Finally, click "File", then "Save", and save file as "john.mobileconfig". Finally, click "File", then "Save", and save file as "john.mobileconfig".
### Step 33: add VPN profile to iPhone using Apple Configurator 2 ### Step 32: add VPN profile to iPhone using Apple Configurator 2
Unlock iPhone, connect it to Mac using USB cable and open Apple Configurator 2. Unlock iPhone, connect it to Mac using USB cable and open Apple Configurator 2.
@ -802,22 +779,22 @@ Select "john.mobileconfig" and follow instructions.
On iPhone, open "Settings", then "Profile Downloaded" and tap "Install" On iPhone, open "Settings", then "Profile Downloaded" and tap "Install"
### Step 34: add VPN profile to Mac ### Step 33: add VPN profile to Mac
This step is super simple, simply double-click "john.mobileconfig" and follow instructions. This step is super simple, simply double-click "john.mobileconfig" and follow instructions.
### Step 35: connect to VPN on iPhone or Mac ### Step 34: connect to VPN on iPhone or Mac
On iPhone, open "Settings", then enable "VPN". On iPhone, open "Settings", then enable "VPN".
On Mac, open "System Preferences", click "Network", then "Self-hosted strongSwan VPN" and finally "Connect" and enable "Show VPN status in menu bar". On Mac, open "System Preferences", click "Network", then "Self-hosted strongSwan VPN" and finally "Connect" and enable "Show VPN status in menu bar".
### Step 36: test for leaks ### Step 35: test for leaks
Open Firefox and go to https://ipleak.net/. Open Firefox and go to https://ipleak.net/.
Make sure listed IPv4, IPv6 (if server is dual stack) and DNS servers do not match the ones supplied by client ISP. Make sure listed IPv4, IPv6 (if server is dual stack) and DNS servers do not match the ones supplied by client ISP.
### Step 37: create additionnal provisioning profiles ### Step 36: create additional provisioning profiles
Repeat steps [25](#step-25-create-openssl-config-file), [28](#step-28-generate-client-cert) and [32](#step-32-create-vpn-profile-for-ios-and-macos-using). Repeat steps [24](#step-24-create-openssl-config-file), [27](#step-27-generate-client-cert) and [31](#step-31-create-vpn-profile-for-ios-and-macos-using).