月: 2021年1月

前提

今回のサーバにはVPN接続を受け付けるNICと、実際に内部でアクセスするためのNICの2つが接続されています。そのため、他のブログなどで書かれているようなブリッジ接続は実施していません。

SoftEtherの導入

$ wget https://www.softether-download.com/files/softether/v4.34-9745-rtm-2020.04.05-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.34-9745-rtm-2020.04.05-linux-x64-64bit.tar.gz
$ tar zxvf softether-vpnserver-v4.34-9745-rtm-2020.04.05-linux-x64-64bit.tar.gz
$ cd vpnserver/
$ make
$ sudo cp -r vpnserver /usr/local/
$ sudo chown -R root:root /usr/local/vpnserver/

SoftEtherの自動起動設定

softetherをubuntu18.04にインストールするhttps://qiita.com/rimksky/items/e169f9af83ce472b4ce3
のページを参考にさせて頂きました。

$ vim /etc/systemd/system/vpnserver.service
 [Unit]
 Description=SoftEther VPN Server
 After=network.target auditd.service
 ConditionPathExists=!/usr/local/vpnserver/do_not_run

 [Service]
 Type=forking
 EnvironmentFile=-/usr/local/vpnserver
 ExecStart=/usr/local/vpnserver/vpnserver start
 ExecStop=/usr/local/vpnserver/vpnserver stop
 KillMode=process
 Restart=on-failure
 Hardening
 PrivateTmp=yes
 ProtectHome=yes
 ProtectSystem=full
 ReadOnlyDirectories=/
 ReadWriteDirectories=-/usr/local/vpnserver
 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_NICE CAP_SYS_ADMIN CAP_SETUID

 [Install]
 WantedBy=multi-user.target

$ sudo systemctl daemon-reload
$ sudo systemctl enable vpnserver.service
$ sudo systemctl start vpnserver.service

SoftEtherのVPNサービスのセットアップ

Windows機にSoftEtherの管理ツールを導入して、そこからGUIで設定しています。

初回ログイン時は管理者パスワードの設定を求められる以外は、後は初期セットアップウィザードで設定して回ればOK。

Let’s EncryptのCertbot導入

$ sudo apt install certbot

Certbotの設定

今回は簡単にHTTP 80番ポートが空いていたのでstandaloneモードでCertbot自身が一時的にHTTPアクセスを受け付けてホスト名を検証する方式で設定します。(80番ポートを他のApacheやNginx等が使っている場合は適合するプラグインを使ってください)

$ sudo certbot --standalone

imksoo@lainhv01:~$ sudo certbot certonly --standalone
 Saving debug log to /var/log/letsencrypt/letsencrypt.log
 Plugins selected: Authenticator standalone, Installer None
 Please enter in your domain name(s) (comma and/or space separated)  (Enter 'c'
 to cancel): hostname.example.com,vpn.example.com
 Obtaining a new certificate
 IMPORTANT NOTES:
 Congratulations! Your certificate and chain have been saved at:
 /etc/letsencrypt/live/hostname.example.com/fullchain.pem
 Your key file has been saved at:
 /etc/letsencrypt/live/hostname.example.com/privkey.pem
 Your cert will expire on 2021-04-08. To obtain a new or tweaked
 version of this certificate in the future, simply run certbot
 again. To non-interactively renew all of your certificates, run
 "certbot renew"
 If you like Certbot, please consider supporting our work by:
 Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 Donating to EFF:                    https://eff.org/donate-le 
 imksoo@lainhv01:~$

上記でサーバ証明書には複数のドメイン名を持たせるため、certbotコマンドの中でカンマ区切りで複数指定しています。

SoftEtherが利用するサーバ証明書の更新を定期的に実施する

UbuntuのCertbotが定期的にSSL証明書の更新をするやり方をパクりました。SystemdでTimer実行します。

$ vim /lib/systemd/system/renew_vpnserver.timer
 [Unit]
 Description=Renew VPN Server certificate file.
 [Timer]
 OnCalendar=--* 04,16:00:00
 RandomizedDelaySec=43200
 Persistent=true
 [Install]
 WantedBy=renew_vpnserver.target

$ vim /lib/systemd/system/renew_vpnserver.service
 [Unit]
 Description=Renew VPN Server certificate file.
 [Service]
 Type=oneshot
 ExecStart=/usr/local/vpnserver/vpncmd localhost:5555 /server /password:P@ssw0rd /CMD ServerCertSet /LOADCERT:/etc/letsencrypt/live/hostname.example.com/fullchain.pem /LOADKEY:/etc/letsencrypt/live/hostname.example.com/privkey.pem
 PrivateTmp=true

後はTimerとServiceを有効化して実行しておきます。

$ sudo systemctl daemon-reload
$ sudo systemctl enable renew_vpnserver.timer
$ sudo systemctl start renew_vpnserver.timer
$ sudo systemctl start renew_vpnserver.service

$ sudo systemctl status renew_vpnserver.service
 ● renew_vpnserver.service - Renew VPN Server certificate file.
      Loaded: loaded (/lib/systemd/system/renew_vpnserver.service; static; vendor preset: enabled)
      Active: inactive (dead) since Fri 2021-01-08 22:39:20 JST; 6s ago
 TriggeredBy: ● renew_vpnserver.timer
     Process: 695134 ExecStart=/usr/local/vpnserver/vpncmd localhost:5555 /server /password:P@ssw0rd /CMD ServerCertSet >
    Main PID: 695134 (code=exited, status=0/SUCCESS)
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: Version 4.34 Build 9745   (English)
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: Compiled 2020/04/05 23:39:56 by buildsan at crosswin
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: Copyright (c) SoftEther VPN Project. All Rights Reserved.
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: Connection has been established with VPN Server "localhost" (port 5555).
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: You have administrator privileges for the entire VPN Server.
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: VPN Server>ServerCertSet /LOADCERT:/etc/letsencrypt/live/hostname.example.com/fullc>
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: ServerCertSet command - Set SSL Certificate and Private Key of VPN Server
 Jan 08 22:39:20 lainhv01 vpncmd[695134]: The command completed successfully.
 Jan 08 22:39:20 lainhv01 systemd[1]: renew_vpnserver.service: Succeeded.
 Jan 08 22:39:20 lainhv01 systemd[1]: Finished Renew VPN Server certificate file..