Vyos OpenVPN (SSL TLS+User Auth) 本地PAM认证 SSLVPN服务器搭建

实现目标

搭建基于OpenVPN (SSL TLS + User Auth)的SSLVPN服务器，支持PAM本地用户认证登录，支持多用户登录。

1、安装环境

• Vyos 1.3 (debian 10.13)
• OpenVPN 2.5.1
• Easyrsa
• Python3( python-pam )

1.1、证书生成

OpenVPN 证书与配置
cp -r /usr/share/easy-rsa/ /config/my-easy-rsa-config
cd /config/my-easy-rsa-config
mv vars.example vars

echo -e 'set_var EASYRSA_DN      		"org"
set_var EASYRSA_REQ_COUNTRY     "CN"
set_var EASYRSA_REQ_PROVINCE    "GD"
set_var EASYRSA_REQ_CITY        "QY"
set_var EASYRSA_REQ_ORG 		"psales"
set_var EASYRSA_REQ_EMAIL       "sslvpn@psales.org"
set_var EASYRSA_REQ_OU          "sslvpn"
set_var EASYRSA_KEY_SIZE        2048' >> vars

# central 为服务器证书
# branch1 为客户端证书
./easyrsa init-pki

./easyrsa build-ca		                       #输入加密文本文本

./easyrsa gen-req central nopass

./easyrsa sign-req server central		   #输入加密文本文本

./easyrsa gen-dh

./easyrsa build-client-full branch1 nopass

// 把证书、密钥等导入到OpenVPN目录
sudo mkdir /config/auth/openvpn
sudo cp pki/ca.crt /config/auth/openvpn
sudo cp pki/dh.pem  /config/auth/openvpn
sudo cp pki/private/central.key /config/auth/openvpn
sudo cp pki/issued/central.crt  /config/auth/openvpn

// tls-auth 私钥
sudo openvpn --genkey tls-auth /config/auth/openvpn/ta.key

# 回到vyo用户目录
cd /home/vyos

1.2、用户认证脚本

# 给vyos添加 apt 软件源 安装python-pam 模块
sudo chmod 777 /etc/apt/sources.list
sudo echo -e'deb http://deb.debian.org/debian/ buster main
deb-src http://deb.debian.org/debian/ buster main

deb http://deb.debian.org/debian/ buster-updates main
deb-src ht