前提
今回のサーバにはVPN接続を受け付けるNICと、実際に内部でアクセスするためのNICの2つが接続されています。そのため、他のブログなどで書かれているようなブリッジ接続は実施していません。
SoftEtherの導入
$ wget https://www.softether-download.com/files/softether/v4.34-9745-rtm-2020.04.05-tree/Linux/SoftEther_VPN_Server/64bit_-_Intel_x64_or_AMD64/softether-vpnserver-v4.34-9745-rtm-2020.04.05-linux-x64-64bit.tar.gz
$ tar zxvf softether-vpnserver-v4.34-9745-rtm-2020.04.05-linux-x64-64bit.tar.gz
$ cd vpnserver/
$ make
$ sudo cp -r vpnserver /usr/local/
$ sudo chown -R root:root /usr/local/vpnserver/
SoftEtherの自動起動設定
softetherをubuntu18.04にインストールするhttps://qiita.com/rimksky/items/e169f9af83ce472b4ce3
のページを参考にさせて頂きました。
$ vim /etc/systemd/system/vpnserver.service
[Unit]
Description=SoftEther VPN Server
After=network.target auditd.service
ConditionPathExists=!/usr/local/vpnserver/do_not_run
[Service]
Type=forking
EnvironmentFile=-/usr/local/vpnserver
ExecStart=/usr/local/vpnserver/vpnserver start
ExecStop=/usr/local/vpnserver/vpnserver stop
KillMode=process
Restart=on-failure
Hardening
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
ReadOnlyDirectories=/
ReadWriteDirectories=-/usr/local/vpnserver
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_NICE CAP_SYS_ADMIN CAP_SETUID
[Install]
WantedBy=multi-user.target
$ sudo systemctl daemon-reload
$ sudo systemctl enable vpnserver.service
$ sudo systemctl start vpnserver.service
SoftEtherのVPNサービスのセットアップ
Windows機にSoftEtherの管理ツールを導入して、そこからGUIで設定しています。
初回ログイン時は管理者パスワードの設定を求められる以外は、後は初期セットアップウィザードで設定して回ればOK。
Let’s EncryptのCertbot導入
$ sudo apt install certbot
Certbotの設定
今回は簡単にHTTP 80番ポートが空いていたのでstandaloneモードでCertbot自身が一時的にHTTPアクセスを受け付けてホスト名を検証する方式で設定します。(80番ポートを他のApacheやNginx等が使っている場合は適合するプラグインを使ってください)
$ sudo certbot --standalone
imksoo@lainhv01:~$ sudo certbot certonly --standalone
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator standalone, Installer None
Please enter in your domain name(s) (comma and/or space separated) (Enter 'c'
to cancel): hostname.example.com,vpn.example.com
Obtaining a new certificate
IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/hostname.example.com/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/hostname.example.com/privkey.pem
Your cert will expire on 2021-04-08. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
"certbot renew"
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
imksoo@lainhv01:~$
上記でサーバ証明書には複数のドメイン名を持たせるため、certbotコマンドの中でカンマ区切りで複数指定しています。
SoftEtherが利用するサーバ証明書の更新を定期的に実施する
UbuntuのCertbotが定期的にSSL証明書の更新をするやり方をパクりました。SystemdでTimer実行します。
$ vim /lib/systemd/system/renew_vpnserver.timer
[Unit]
Description=Renew VPN Server certificate file.
[Timer]
OnCalendar=--* 04,16:00:00
RandomizedDelaySec=43200
Persistent=true
[Install]
WantedBy=renew_vpnserver.target
$ vim /lib/systemd/system/renew_vpnserver.service
[Unit]
Description=Renew VPN Server certificate file.
[Service]
Type=oneshot
ExecStart=/usr/local/vpnserver/vpncmd localhost:5555 /server /password:P@ssw0rd /CMD ServerCertSet /LOADCERT:/etc/letsencrypt/live/hostname.example.com/fullchain.pem /LOADKEY:/etc/letsencrypt/live/hostname.example.com/privkey.pem
PrivateTmp=true
後はTimerとServiceを有効化して実行しておきます。
$ sudo systemctl daemon-reload
$ sudo systemctl enable renew_vpnserver.timer
$ sudo systemctl start renew_vpnserver.timer
$ sudo systemctl start renew_vpnserver.service
$ sudo systemctl status renew_vpnserver.service
● renew_vpnserver.service - Renew VPN Server certificate file.
Loaded: loaded (/lib/systemd/system/renew_vpnserver.service; static; vendor preset: enabled)
Active: inactive (dead) since Fri 2021-01-08 22:39:20 JST; 6s ago
TriggeredBy: ● renew_vpnserver.timer
Process: 695134 ExecStart=/usr/local/vpnserver/vpncmd localhost:5555 /server /password:P@ssw0rd /CMD ServerCertSet >
Main PID: 695134 (code=exited, status=0/SUCCESS)
Jan 08 22:39:20 lainhv01 vpncmd[695134]: Version 4.34 Build 9745 (English)
Jan 08 22:39:20 lainhv01 vpncmd[695134]: Compiled 2020/04/05 23:39:56 by buildsan at crosswin
Jan 08 22:39:20 lainhv01 vpncmd[695134]: Copyright (c) SoftEther VPN Project. All Rights Reserved.
Jan 08 22:39:20 lainhv01 vpncmd[695134]: Connection has been established with VPN Server "localhost" (port 5555).
Jan 08 22:39:20 lainhv01 vpncmd[695134]: You have administrator privileges for the entire VPN Server.
Jan 08 22:39:20 lainhv01 vpncmd[695134]: VPN Server>ServerCertSet /LOADCERT:/etc/letsencrypt/live/hostname.example.com/fullc>
Jan 08 22:39:20 lainhv01 vpncmd[695134]: ServerCertSet command - Set SSL Certificate and Private Key of VPN Server
Jan 08 22:39:20 lainhv01 vpncmd[695134]: The command completed successfully.
Jan 08 22:39:20 lainhv01 systemd[1]: renew_vpnserver.service: Succeeded.
Jan 08 22:39:20 lainhv01 systemd[1]: Finished Renew VPN Server certificate file..
