linux Archives - MYstIC G

25 April 20145 January 2015

Howto install OpenVPN 2 on CentOS 6

These are my notes on howto install OpenVPN 2 on CentOS 6, more specifically OpenVPN 2.3.2 on CentOS 6.5. My notes build on the DigitalOcean community guide and are accurate as of 25 April 2014. The guide was a helpful starting point but I’ve managed to shorten a couple of the steps and updated some to take into account directories having moved, etc.

To start off you need to be on the console of the server you wish to run OpenVPN on. I ran all of these commands as the root user, you may need to su or sudo as necessary.

rpm -Uvh http://dl.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
yum install openvpn -y
cp /usr/share/doc/openvpn-*/sample/sample-config-files/server.conf /etc/openvpn
nano-w /etc/openvpn/server.conf
1. Replace
  1. ;push “redirect-gateway def1 bypass-dhcp”
  2. push “redirect-gateway def1 bypass-dhcp”
2. Add
  1. push “dhcp-option DNS 8.8.8.8”
  2. push “dhcp-option DNS 8.8.4.4”
3. Replace
  1. ;user nobody
    ;group nobody
  2. user nobody
    group nobody
4. Replace
  1. dh dh1024.pem
  2. dh dh2048.pem
5. Save and exit nano
yum install easy-rsa -y
mkdir -p /etc/openvpn/easy-rsa/keys
cp -R /usr/share/easy-rsa/2.0/* /etc/openvpn/easy-rsa
nano-w /etc/openvpn/easy-rsa/vars
1. Replace values as necessary
  1. export KEY_COUNTRY=”US”
    export KEY_PROVINCE=”CA”
    export KEY_CITY=”SanFrancisco”
    export KEY_ORG=”Fort-Funston”
    export KEY_EMAIL=”me@myhost.mydomain”
    export KEY_OU=”MyOrganizationalUnit“
2. Save and exit nano
cd /etc/openvpn/easy-rsa
source ./vars
./clean-all
./build-ca
./build-key-server server
./build-dh
cd /etc/openvpn/easy-rsa/keys
cp dh2048.pem ca.crt server.crt server.key /etc/openvpn
cd /etc/openvpn/easy-rsa
./build-key client
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0-j MASQUERADE
1. if unsure of eth0 (network interface) use ifconfig to look it up first
service iptables save
nano-w /etc/sysctl.conf
1. Replace
  1. net.ipv4.ip_forward = 0
  2. net.ipv4.ip_forward = 1
2. Save and exit nano
service openvpn start
chkconfig openvpn on
Download the following files to your client
1. /etc/openvpn/easy-rsa/keys/ca.crt
2. /etc/openvpn/easy-rsa/keys/client.crt
3. /etc/openvpn/easy-rsa/keys/client.key
In same directory on client create client.ovpn
1. Insert replacing items in bold as necessary
  1. client
    dev tun
    proto udp
    remote X.X.X.X 1194
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    comp-lzo
    verb 3
    <ca>
    Contents of ca.crt
    </ca>
    <cert>
    Contents of client.crt
    </cert>
    <key>
    Contents of client.key
    </key>

Hope some of you find this useful, any issues please leave a comment.

8 September 20112 September 2015

Fix broken portage on RPS running OVH Release 2

It was always going to happen.

With my current web host (OVH) when setting up my server (RPS) I chose to run it using their custom version of gentoo Linux (OVH Release 2). They offer a number of choices but this seemed like the best pick because it was their release running on their hardware so I figured it would just get the job done.

That was all fine until I went and broke it. Well, when I say broke it, I didn’t break it exactly so much as stupidly try to update it so that it would be running the latest shiny version of things.

This was out not a sensible plan and the net upshot was that I broke the portage system. Impressively though gentoo didn’t fall over despite my ineptitude and kept serving up my websites (including this one) without issue. The only thing was, I had no idea how to put things right!

So, after much tinkering behind the scenes (with gentoo still managing to keep going despite me doing my best to knock lumps out of it and wreck it completely) I managed to get things back on a proper footing, i.e. a working Release 2 running the latest patches from OVH.

Here’s what I did to fix the mess I created which I’m sharing because I thought it might be useful to other people out there who have also “tinkered” with their RPS and struggle, as I did, to read all the technical support that’s mainly found in French on the OVH RPS forums.

Disclaimer: These commands worked for me but they might not work for you so if you decide to use them backup everything on your RPS first because I’m not responsible for any commands you issue to your server!

Firstly SSH into your RPS with root access. This will land you in the home directory.
Run the command: echo “2.10” > /etc/ovhrelease as this will fool the OVH updater into thinking you’re running an earlier version of Release 2.
Run: eselect profile list
Look at the list and find the number of the profile that matches: default-linux/x86/2007.0/desktop on my RPS it was 4.
Run: eselect profile set <> where <<NUMBER>> is the profile number you looked up at step 5, e.g. for me it was eselect profile set 4
Remove any pre-existing upgrade scripts with: rm -rf patch-2.*.sh to make sure that you get a clean update.
Restore and run the OVH patch-all scripts with: wget ftp://ftp.ovh.net/made-in-ovh/release/patch-all.sh -O patch-all.sh; sh patch-all.sh
Now, that should, ditch the broken portage tree and run every automatic update script since they released 2.10. I found that this upon reaching patch 2.19 it was necessary to change the profile again.
Run: eselect profile list again
Look at the list and find the number of the profile that matches: default/linux/x86/2008.0/desktop on my RPS it was 9.
Run: eselect profile set <<NUMBER>> where <<NUMBER>> is the profile number you looked up at step 5, e.g. for me it was eselect profile set 9
Run: sh patch-all.sh
This should finish the patches and bring you up to current which at the time of writing is 2.30.

Hopefully this will be of some use to those out there like me who just can’t help tinkering with things!