Stappen om EduVPN te activeren:

Transcriptie

1 EduVPN onder Ubuntu Helaas is de network manager van Ubuntu niet in staat met de ovpn file van eduvpn om te gaan. Ook is de standaard openvpn die Ubuntu uitlevert niet de laatste versie. Stappen om EduVPN te activeren: 1. Deïnstalleer de standaard openvpn van Ubuntu. (apt remove openvpn) 2. Installeer minimaal versie (op dit moment is de standaard, je hebt de epel repository nodig) (apt install openvpn2.4.7) 3. Ga met een browser naar ru.eduvpn.nl en login met je Yubikey 4. kies RU ISC Admnistrators als profile en geef een naam op bij name, klik download Bestandsnaam: Linux Handleiding Pag. 1 van 5

2 5. Kopieer deze ovpn naar een plek waar jij je key wilt bewaren. Deze key is geldig voor 12 uur en je moet elke dag een nieuwe key downloaden. Met behulp van de connection information kun je zien dat de tunnel werkt Bestandsnaam: Linux Handleiding Pag. 2 van 5

3 output openvpn: Tue Jun 11 11:57: OpenVPN x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb Tue Jun 11 11:57: library versions: OpenSSL 1.0.2g 1 Mar 2016, LZO 2.08 Tue Jun 11 11:57: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Tue Jun 11 11:57: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Tue Jun 11 11:57: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key Tue Jun 11 11:57: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication Tue Jun 11 11:57: TCP/UDP: Preserving recently used remote address: [AF_INET] :1233 Tue Jun 11 11:57: Socket Buffers: R=[ >212992] S=[ >212992] Tue Jun 11 11:57: UDP link local: (not bound) Tue Jun 11 11:57: UDP link remote: [AF_INET] :1233 Tue Jun 11 11:57: TLS: Initial packet from [AF_INET] :1233, sid=054faffb 154c4564 Tue Jun 11 11:57: VERIFY OK: depth=1, CN=VPN CA Tue Jun 11 11:57: VERIFY KU OK Tue Jun 11 11:57: Validating certificate extended key usage Tue Jun 11 11:57: Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Tue Jun 11 11:57: VERIFY EKU OK Tue Jun 11 11:57: VERIFY OK: depth=0, CN= administrators Tue Jun 11 11:57: Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA- AES256-GCM-SHA384, 3072 bit RSA Tue Jun 11 11:57: [ administrators] Peer Connection Initiated with [AF_INET] :1233 Tue Jun 11 11:57: SENT CONTROL [ administrators]: 'PUSH_REQUEST' (status=1) Bestandsnaam: Linux Handleiding Pag. 3 van 5

4 Tue Jun 11 11:57: PUSH: Received control message: 'PUSH_REPLY,block-outsidedns,dhcp-option DNS ,explicit-exit-notify 1,redirect-gateway def1 ipv6 block-local,tun-ipv6,route-gateway ,topology subnet,ping 10,ping-restart 60,ifconfig-ipv6 fd00:4242:4242:3333::2:102b/112 fd00:4242:4242:3333::2:1,ifconfig ,peer-id 2,cipher AES-256-GCM' Tue Jun 11 11:57: Options error: Unrecognized option or missing or extra parameter(s) in [PUSH-OPTIONS]:1: block-outside-dns (2.4.7) Tue Jun 11 11:57: OPTIONS IMPORT: timers and/or timeouts modified Tue Jun 11 11:57: OPTIONS IMPORT: explicit notify parm(s) modified Tue Jun 11 11:57: OPTIONS IMPORT: --ifconfig/up options modified Tue Jun 11 11:57: OPTIONS IMPORT: route options modified Tue Jun 11 11:57: OPTIONS IMPORT: route-related options modified Tue Jun 11 11:57: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Tue Jun 11 11:57: OPTIONS IMPORT: peer-id set Tue Jun 11 11:57: OPTIONS IMPORT: adjusting link_mtu to 1624 Tue Jun 11 11:57: OPTIONS IMPORT: data channel crypto options modified Tue Jun 11 11:57: Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Tue Jun 11 11:57: Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key Tue Jun 11 11:57: ROUTE_GATEWAY / IFACE=eth0 HWADDR=fc:3f:db:f9:89:51 Tue Jun 11 11:57: ROUTE: bypass_host_route[0]= Tue Jun 11 11:57: GDG6: remote_host_ipv6=n/a Tue Jun 11 11:57: ROUTE6: default_gateway=undef Tue Jun 11 11:57: TUN/TAP device tun0 opened Tue Jun 11 11:57: TUN/TAP TX queue length set to 100 Tue Jun 11 11:57: /sbin/ip link set dev tun0 up mtu 1500 Tue Jun 11 11:57: /sbin/ip addr add dev tun /26 broadcast Tue Jun 11 11:57: /sbin/ip -6 addr add fd00:4242:4242:3333::2:102b/112 dev tun0 Bestandsnaam: Linux Handleiding Pag. 4 van 5

5 Tue Jun 11 11:57: /sbin/ip route add /32 via Tue Jun 11 11:57: /sbin/ip route add /32 dev eth0 Tue Jun 11 11:57: /sbin/ip route add /1 via Tue Jun 11 11:57: /sbin/ip route add /1 via Tue Jun 11 11:57: /sbin/ip route add /25 via Tue Jun 11 11:57: /sbin/ip route add /25 via Tue Jun 11 11:57: add_route_ipv6(::/3 -> fd00:4242:4242:3333::2:1 metric -1) dev tun0 Tue Jun 11 11:57: /sbin/ip -6 route add ::/3 dev tun0 Tue Jun 11 11:57: add_route_ipv6(2000::/4 -> fd00:4242:4242:3333::2:1 metric - 1) dev tun0 Tue Jun 11 11:57: /sbin/ip -6 route add 2000::/4 dev tun0 Tue Jun 11 11:57: add_route_ipv6(3000::/4 -> fd00:4242:4242:3333::2:1 metric - 1) dev tun0 Tue Jun 11 11:57: /sbin/ip -6 route add 3000::/4 dev tun0 Tue Jun 11 11:57: add_route_ipv6(fc00::/7 -> fd00:4242:4242:3333::2:1 metric -1) dev tun0 Tue Jun 11 11:57: /sbin/ip -6 route add fc00::/7 dev tun0 Tue Jun 11 11:57: WARNING: this configuration may cache passwords in memory - - use the auth-nocache option to prevent this Tue Jun 11 11:57: Initialization Sequence Completed Bestandsnaam: Linux Handleiding Pag. 5 van 5